# Known, accepted findings. Revisit before ignoreUntil or when upstream publishes a fix.

# github.com/docker/docker 28.5.2: no fixed version published yet. Test-only
# transitive dependency (golang-migrate -> dktest, used by DB tests); no
# non-test package imports it and govulncheck reports it as not reachable.
[[IgnoredVulns]]
id = "GO-2026-4883"
ignoreUntil = 2026-12-31
reason = "docker/docker has no fix; test-only transitive dep, not reachable"

[[IgnoredVulns]]
id = "GHSA-pxq6-2prw-chj9"
ignoreUntil = 2026-12-31
reason = "alias of GO-2026-4883; test-only, not reachable"

[[IgnoredVulns]]
id = "GO-2026-4887"
ignoreUntil = 2026-12-31
reason = "docker/docker has no fix; test-only transitive dep, not reachable"