From fd3a5b427d2a014d787210a2dcf7bdc7b2f1f97a Mon Sep 17 00:00:00 2001
From: Chingis S <chingis@chingis.io>
Date: Sun, 20 Sep 2026 09:05:57 +0400
Subject: [PATCH] Cover older Python versions in temporary tarfile exceptions

Add exact CVE-2026-82049 rules for Python 3.12.14, 3.11.16, and 3.10.21. All 18 remaining failed builds report this finding; Python 3.13 already passes. Track removal of all four version-specific rules in issue #12.
---
 .grype.yaml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.grype.yaml b/.grype.yaml
index 63417f9..d3cb027 100644
--- a/.grype.yaml
+++ b/.grype.yaml
@@ -7,7 +7,7 @@ ignore:
       name: python
       version: 3.10.21
       type: binary
-  # Temporary acceptance until the official Python 3.13 image includes the tarfile fix.
+  # Temporary acceptance until the official Python 3.10–3.13 images include the tarfile fix.
   # https://github.com/python/cpython/pull/157192
   # Remove after upgrading: https://github.com/wodby/python/issues/12
   - vulnerability: CVE-2026-82049
@@ -15,3 +15,18 @@ ignore:
       name: python
       version: 3.13.15
       type: binary
+  - vulnerability: CVE-2026-82049
+    package:
+      name: python
+      version: 3.12.14
+      type: binary
+  - vulnerability: CVE-2026-82049
+    package:
+      name: python
+      version: 3.11.16
+      type: binary
+  - vulnerability: CVE-2026-82049
+    package:
+      name: python
+      version: 3.10.21
+      type: binary