From 452197da171acbde473d797acdc913d66ad91071 Mon Sep 17 00:00:00 2001
From: Matt Collins <matt.collins@thetradedesk.com>
Date: Mon, 2 Nov 2026 05:10:42 +0000
Subject: [PATCH] UID2-8233, UID2-8234, UID2-8235, UID2-8236, UID2-8237,
 UID2-8238: ignore joi and node-forge in .trivyignore.rego

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .trivyignore.rego | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 create mode 100644 .trivyignore.rego

diff --git a/.trivyignore.rego b/.trivyignore.rego
new file mode 100644
index 000000000..76dbbdaa1
--- /dev/null
+++ b/.trivyignore.rego
@@ -0,0 +1,14 @@
+# Ignore all findings for these npm packages. Not vulnerable.
+# See: UID2-8233, UID2-8234, UID2-8235, UID2-8236, UID2-8237, UID2-8238
+package trivy
+
+import rego.v1
+
+default ignore := false
+
+ignored_packages := {"joi", "node-forge"}
+
+ignore if {
+	input.PkgName in ignored_packages
+	startswith(input.PkgIdentifier.PURL, "pkg:npm/")
+}