[longieirl]

Summary

 .trivyignore
+# CVE-2025-47273: setuptools — path traversal in PackageIndex.
+# python:3.13-slim ships setuptools 70.3.0; the fix is 78.1.1. Trivy detects
+# the version registered in the base image's pip metadata layer rather than
+# the pip-upgraded one. PackageIndex is never called at runtime (PDF only).
+CVE-2025-47273
+
 # CVE-2026-33845: libgnutls30t64

Removed in PR #285 expecting python:3.13-slim to ship fixed setuptools. The production stage already runs pip install --upgrade "setuptools>=78.1.1", but Trivy detects the version registered in the base image pip metadata layer (not the upgraded one). release.yml Trivy gate blocks the Docker release.

Evidence

• Before: release.yml run 41644732836 failed — setuptools 70.3.0 / CVE-2025-47273 / HIGH / fixed: 78.1.1
• After: CVE suppressed in .trivyignore with rationale; release unblocked

Merge Danger

Door: two-way

Blast Radius: config — .trivyignore only. No code changes. Re-tag v0.1.10 after merge to re-trigger release.yml.