# Known advisories without a fixed version, accepted for a limited time.
#
# Each entry says why it does not reach anything we ship, and expires: when it
# runs out, the check is red again and somebody looks whether a fix exists.
# An entry is never extended without reading the advisory again.

[[IgnoredVulns]]
id = "GHSA-g3hv-75wg-m249"
ignoreUntil = 2026-12-04T00:00:00Z
reason = "minimatch 3.x, fixed only in 11.0.1 and not backported. Pulled in by eslint 9, @eslint/eslintrc and eslint-plugin-import/jsx-a11y/react, which all still require ^3 (devDependencies, not in the standalone build or the image); the patterns they expand are our own lint config. The 10.x copy under typescript-eslint is overridden to ^11 in package.json."