[joshiste]

runc v1.5.2 is built with go1.26.8. The CVE scan on main no longer reports these ten runc ignores, so they are removed: CVE-2026-25681, CVE-2026-27136, CVE-2026-33814, CVE-2026-33818, CVE-2026-39821, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862.

🤖 Generated with Claude Code

[claude]

Claude finished @joshiste's task in 10s —— View job

---

Review of PR #538

• Checked the diff against origin/main
• Checked the removed IDs against the PR description
• Checked the remaining .trivyignore.yml entries

No issues found.

• The diff removes exactly the ten IDs listed in the description: CVE-2026-25681, -27136, -33814, -33818, -39821, -56853, -56858, -56859, -56860 and -56862. All ten were scoped to usr/sbin/runc, so no other binary loses an ignore.
• The remaining entries (including the runc-scoped CVE-2026-46600) are untouched, and the YAML structure is intact.
• If any removed CVE still shows up in the scan, CI will fail. That makes the scan a safe check on this change.
• I did not run the scan myself.
• There were no earlier review threads from me to resolve.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud