From 7920819ea11b7b02a1adc936f58ce9affea5e17d Mon Sep 17 00:00:00 2001
From: Matt Collins <matt.collins@thetradedesk.com>
Date: Mon, 2 Nov 2026 04:20:49 +0000
Subject: [PATCH] UID2-7861: ignore libexpat by package instead of per CVE

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .trivyignore      | 36 ------------------------------------
 .trivyignore.rego | 12 ++++++++++++
 2 files changed, 12 insertions(+), 36 deletions(-)
 create mode 100644 .trivyignore.rego

diff --git a/.trivyignore b/.trivyignore
index 07e7ca35..0395219e 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -31,42 +31,6 @@ CVE-2026-42577 exp:2026-09-11
 # See: UID2-7662
 CVE-2026-40984 exp:2026-11-11
 
-# CVE-2026-66046 — libexpat (Alpine base-image OS library) (HIGH).
-# Not exploitable here: Dockerfile FROM eclipse-temurin:21-jre-alpine-3.23; pure-Java Vert.x
-# jar-with-dependencies. No loadLibrary/JNI/native XML refs in any src *.java; only XML on disk
-# is trusted conf/logback.xml. JVM parses XML via JAXP/Xerces, not native libexpat.
-# See: UID2-7800
-CVE-2026-66046 exp:2026-12-02
-
-# CVE-2026-76641 — libexpat (Alpine base-image native C library) (HIGH).
-# Not exploitable here: Dockerfile FROM eclipse-temurin@sha256:319339...(21-jre-alpine-3.23);
-# pure-Java Vert.x jar-with-dependencies, apk adds only libpng/libcrypto3/libssl3/musl/gnutls;
-# no libexpat added and no JNI/native XML path in any *.java
-# See: UID2-7801
-CVE-2026-76641 exp:2026-12-02
-
-# CVE-2026-76956 — libexpat (Alpine base-image OS library) (HIGH), DoS via hash flooding
-# attack with crafted XML.
-# Not exploitable here: this is a Java/Vert.x service that parses XML via JAXP/Xerces, not
-# libexpat; no JNI/native/subprocess path reaches it.
-# See: UID2-7849
-CVE-2026-76956 exp:2026-10-10
-
-# CVE-2026-76957 — libexpat (Alpine base-image OS library) (HIGH), memory corruption allowing
-# arbitrary code execution or DoS.
-# Not exploitable here: same reasoning as CVE-2026-76956 above.
-# See: UID2-7849
-CVE-2026-76957 exp:2026-10-10
-
-# CVE-2026-93990 — libexpat (Alpine base-image native C library) (HIGH). Not exploitable here.
-# See the ticket below for the assessment.
-# See: UID2-7962
-CVE-2026-93990 exp:2026-12-25
-
-# CVE-2026-77214 — libexpat (HIGH). Not vulnerable.
-# See: UID2-8106
-CVE-2026-77214 exp:2027-01-19
-
 # CVE-2026-102554 — guava (HIGH). Not vulnerable.
 # See: UID2-8213
 CVE-2026-102554
diff --git a/.trivyignore.rego b/.trivyignore.rego
new file mode 100644
index 00000000..e8c125e7
--- /dev/null
+++ b/.trivyignore.rego
@@ -0,0 +1,12 @@
+package trivy
+
+import rego.v1
+
+default ignore := false
+
+# libexpat is a native OS library in the base image that the JVM never loads.
+# Java XML parsing uses the JDK's pure-Java parsers.
+ignore if {
+	input.PkgName == "libexpat"
+	startswith(input.PkgIdentifier.PURL, "pkg:apk/")
+}