gtfs-scorecard/.trivyignore.yaml at main · ghzhost/gtfs-scorecard · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
vulnerabilities:
  # MobilityData 8.0.1 is still the latest official gtfs-validator release as
  # of 2026-08-16 (checked against the GitHub releases API). Its shaded CLI jar
  # carries these fixed transitive-library CVEs, but no patched upstream
  # artifact exists, and repackaging the jar ourselves would break the sha256
  # pin to the published release that both Dockerfiles verify. Every entry here
  # is about that one jar; vex.json records the code-path or archive-preflight
  # justification for each time-bounded exception. CI tests keep this list, the
  # VEX, and the validator pin synchronized.
  - id: CVE-2022-25647
    statement: "Gson deserialization path is not used for untrusted GTFS input; see vex.json."
    expired_at: 2026-10-08
  - id: CVE-2014-0114
    statement: "BeanUtils property binding is not invoked by the validator CLI; see vex.json."
    expired_at: 2026-10-08
  - id: CVE-2019-10086
    statement: "BeanUtils property binding is not invoked by the validator CLI; see vex.json."
    expired_at: 2026-10-08
  - id: CVE-2025-48734
    statement: "BeanUtils property binding is not invoked by the validator CLI; see vex.json."
    expired_at: 2026-10-08
  - id: CVE-2021-35515
    statement: "GTFS archive size, entry, and compression limits run before Java; see vex.json."
    expired_at: 2026-10-08
  - id: CVE-2021-35516
    statement: "GTFS archive size, entry, and compression limits run before Java; see vex.json."
    expired_at: 2026-10-08
  - id: CVE-2021-35517
    statement: "GTFS archive size, entry, and compression limits run before Java; see vex.json."
    expired_at: 2026-10-08
  - id: CVE-2021-36090
    statement: "GTFS archive size, entry, and compression limits run before Java; see vex.json."
    expired_at: 2026-10-08
  - id: CVE-2026-54399
    statement: "Validator is only ever given a local zip, so its Apache HTTP parser never loads; measured, see vex.json."
    expired_at: 2026-10-08
  - id: CVE-2026-54428
    statement: "Validator is only ever given a local zip, so its HTTP/2 HPACK decoder never loads; measured, see vex.json."
    expired_at: 2026-10-08