From c942ce93286e05bc8676993b98066ecc97a48c97 Mon Sep 17 00:00:00 2001
From: Thore Cimbal <cfx@riot.8shield.net>
Date: Fri, 21 Aug 2026 12:00:00 +0000
Subject: [PATCH] cve: decide the one critical the new grafana brings with it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

12.4.9 is what runs now, and its single remaining critical sits in a bundled go
dependency that grafana has to update, not us. Recording it before the scanner
reaches that image, so the count does not go to one and stay there.

Worth noting why it was not in the earlier list: the old scanner did not know
CVE-2025-41115 in grafana 12.0.0 at all. Trivy 0.74.0 found it on the first
round, on an image we were already replacing — an outdated scanner is outdated
detection, which was the argument for bumping it, now with an example.
---
 monitoring/cve/entscheidungen.json | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/monitoring/cve/entscheidungen.json b/monitoring/cve/entscheidungen.json
index daaeac9..b2e7a01 100644
--- a/monitoring/cve/entscheidungen.json
+++ b/monitoring/cve/entscheidungen.json
@@ -104,6 +104,15 @@
         "GHSA-r277-6w6q-xmqw"
       ]
     },
+    {
+      "ziel": "grafana/grafana:12.4.9",
+      "art": "hingenommen",
+      "grund": "Die Fassung, auf die wir heute gehoben haben (7 CRITICAL -> 1). Der eine Rest ist GHSA-r277-6w6q-xmqw in github.com/getkin/kin-openapi v0.133.0, einer mitgelieferten Go-Abhaengigkeit - behoben in 0.144.0, aber Grafana muss sie ziehen, wir koennen es nicht. Der Major 13.2.0 wurde gemessen verworfen (HIGH 70 -> 162). Beim naechsten 12er-Patch nachsehen.",
+      "pruefen_am": "2026-09-21",
+      "cves": [
+        "GHSA-r277-6w6q-xmqw"
+      ]
+    },
     {
       "ziel": "oci.element.io/synapse:v1.158.0",
       "art": "hingenommen",