fix(container): suppress Trivy HTTP/2 SETTINGS DoS CVE (#13028)

.grype.yaml

@@ -51,6 +51,65 @@ ignore:
     package:
       name: golang.org/x/crypto
       version: v0.55.0
+  # Go 1.27.1 and golang.org/x/net v0.59.0 in Trivy 0.75.0, the latest release. Fixed in
+  # Go 1.27.2 and x/net 0.60.0, which only Trivy main has. Almost every entry is an HTTP,
+  # HTTP/2 or TLS server path (or Windows-only), and Trivy runs here only as a client. The
+  # two client-side ones are a DoS from a hostile HTTP/2 peer (CVE-2026-78669) and an
+  # unframed CONNECT body sent through a proxy (CVE-2026-56866); Trivy's only peer is the
+  # TLS-authenticated database registry and it never sends CONNECT with a body. Pinned to
+  # the embedded versions. Remove with the Trivy exception by 2026-11-15.
+  - vulnerability: CVE-2026-56857
+    package:
+      name: stdlib
+      version: go1.27.1
+  - vulnerability: CVE-2026-56866
+    package:
+      name: stdlib
+      version: go1.27.1
+  - vulnerability: CVE-2026-78659
+    package:
+      name: stdlib
+      version: go1.27.1
+  - vulnerability: CVE-2026-78660
+    package:
+      name: stdlib
+      version: go1.27.1
+  - vulnerability: CVE-2026-78663
+    package:
+      name: stdlib
+      version: go1.27.1
+  - vulnerability: CVE-2026-78669
+    package:
+      name: stdlib
+      version: go1.27.1
+  - vulnerability: CVE-2026-94439
+    package:
+      name: stdlib
+      version: go1.27.1
+  - vulnerability: CVE-2026-94440
+    package:
+      name: stdlib
+      version: go1.27.1
+  - vulnerability: CVE-2026-97031
+    package:
+      name: stdlib
+      version: go1.27.1
+  - vulnerability: CVE-2026-78659
+    package:
+      name: golang.org/x/net
+      version: v0.59.0
+  - vulnerability: CVE-2026-78660
+    package:
+      name: golang.org/x/net
+      version: v0.59.0
+  - vulnerability: CVE-2026-78663
+    package:
+      name: golang.org/x/net
+      version: v0.59.0
+  - vulnerability: CVE-2026-78669
+    package:
+      name: golang.org/x/net
+      version: v0.59.0
   - vulnerability: CVE-2026-56852
     package:
       name: golang.org/x/text

.trivyignore.yaml

@@ -203,6 +203,18 @@ vulnerabilities:
       - "pkg:golang/stdlib@v1.27.1"
     expired_at: 2026-11-15
 
+  # CVE-2026-78669 is an HTTP/2 DoS in the same Trivy 0.75.0 binary (stdlib 1.27.1 and
+  # golang.org/x/net 0.59.0): a malicious peer burns CPU with many small SETTINGS frames.
+  # Unlike the two above it also hits clients, but Trivy's only HTTP/2 peer here is the
+  # TLS-authenticated registry serving the vulnerability database, and the worst case is
+  # a slow scan. Fixed in Go 1.27.2 and x/net 0.60.0, which Trivy main already pulls in
+  # but no release ships yet. Same retirement rule as above.
+  - id: CVE-2026-78669
+    purls:
+      - "pkg:golang/stdlib@v1.27.1"
+      - "pkg:golang/golang.org/x/net@v0.59.0"
+    expired_at: 2026-11-15
+
   - id: CVE-2026-56852
     purls:
       - "pkg:golang/golang.org/x/text"