Trivy reports HIGH and CRITICAL CVEs. A simple in-range lockfile refresh does not fix them. PR #598 fixes the clean direct ones. It bumps @opentelemetry/sdk-node to 0.217, axios to 1.18.1, next to 15.5.22, and protobufjs (7.x) to 7.6.5. PR #598 ignores the rest until 2026-09-05. Fix the rest before that date.
Priority 1 — Python ML stack (docling)
This stack shares one blocker: the torch and GCP/CUDA validation.
transformers 4.57.6 has an RCE (CVE-2026-4372, CVE-2026-5241). The fix needs version 5.x. This is a major bump. First check if our docling path loads remote-code models. It probably does not. Then bump.pillow 12.2.0 has 10 HIGH CVEs. The fix is 12.3.0. This is a minor bump. The docling and torch chain pins it.torch 2.5.1+cu121 has an ignored CVE (CVE-2025-32434). This is the root of the block. Bump to 2.6 or later. This unblocks pillow and transformers together.
Do these three as one validated torch, docling, and CUDA update.
Priority 2 — base node image
The image bundles a vulnerable npm. This pulls tar (CVE-2026-59873, CRITICAL, gzip-bomb DoS), brace-expansion, picomatch, and sigstore. These packages run at build time only. They are not part of the API attack surface. The clean fix is to bump the base node image, not to ignore a CRITICAL for a long time.
Priority 3 — transitive npm dependencies
Repo policy bans npm overrides. So these wait for their parent packages to release a fix:
@grpc/grpc-js@opentelemetry/propagator-jaeger (2.7.1, fix 2.9.0)protobufjs 8.0.1 (CVE-2026-44289/44290/44291/44293, fix 8.0.2). @opentelemetry/otlp-transformer pins it exactly. It serializes our telemetry only. No attacker-controlled decoding.form-data, multer, postcss, sharp, ws, and transitive undici 6.x.
Re-check all of these on the next dependency sweep.
All items above are ignored in .trivyignore.yaml with expiry 2026-09-05.
Trivy reports HIGH and CRITICAL CVEs. A simple in-range lockfile refresh does not fix them. PR #598 fixes the clean direct ones. It bumps
@opentelemetry/sdk-nodeto 0.217,axiosto 1.18.1,nextto 15.5.22, andprotobufjs(7.x) to 7.6.5. PR #598 ignores the rest until 2026-09-05. Fix the rest before that date.Priority 1 — Python ML stack (docling)
This stack shares one blocker: the torch and GCP/CUDA validation.
transformers4.57.6 has an RCE (CVE-2026-4372, CVE-2026-5241). The fix needs version 5.x. This is a major bump. First check if our docling path loads remote-code models. It probably does not. Then bump.pillow12.2.0 has 10 HIGH CVEs. The fix is 12.3.0. This is a minor bump. The docling and torch chain pins it.torch2.5.1+cu121 has an ignored CVE (CVE-2025-32434). This is the root of the block. Bump to 2.6 or later. This unblocks pillow and transformers together.Do these three as one validated torch, docling, and CUDA update.
Priority 2 — base node image
The image bundles a vulnerable npm. This pulls
tar(CVE-2026-59873, CRITICAL, gzip-bomb DoS),brace-expansion,picomatch, andsigstore. These packages run at build time only. They are not part of the API attack surface. The clean fix is to bump the base node image, not to ignore a CRITICAL for a long time.Priority 3 — transitive npm dependencies
Repo policy bans npm
overrides. So these wait for their parent packages to release a fix:@grpc/grpc-js@opentelemetry/propagator-jaeger(2.7.1, fix 2.9.0)protobufjs8.0.1 (CVE-2026-44289/44290/44291/44293, fix 8.0.2).@opentelemetry/otlp-transformerpins it exactly. It serializes our telemetry only. No attacker-controlled decoding.form-data,multer,postcss,sharp,ws, and transitiveundici6.x.Re-check all of these on the next dependency sweep.
All items above are ignored in
.trivyignore.yamlwith expiry 2026-09-05.