security: clear the two repo-wide P4 gates for staging (Trivy x/crypto + gitpython)

[jgruberf5]

Clears the two P4 security gates that have been red on every open PR (and would be red on staging if re-scanned) since the advisory/vuln DBs updated after staging last ran clean on 2026-08-24. Neither is caused by any PR's code; both are repo-wide.

1. P4 · Docker Build + Scan — Trivy CRITICAL

Adds one .trivyignore entry for CVE-2026-56854 (golang.org/x/crypto/ssh — authentication bypass via unenforced source-address restriction, CRITICAL), the sole CRITICAL blocking the gate. Embedded in the bundled helm binary (helm 3.20.0 → x/crypto v0.46.0).

• Why suppress, not bump helm: fixed in x/crypto 0.55.0; the only helm release carrying it is v3.22.0-rc.1 (prerelease). Latest stable v3.21.4 still ships v0.54.0. We don't pin a prerelease helm, so a bump can't clear the CRITICAL yet.
• Not exploitable here: the flaw is in the SSH server auth path (ssh.ServerConfig source-address enforcement); helm/kubectl/tofu/infracost never run an SSH server and no Forge container exposes one (Python SSH uses paramiko). Same class/rationale as the existing CVE-2024-45337 entry.
• Follows the file's established format (justification + exp:2026-11-30 + tracker). Real fix (bump to helm 3.22.0 stable + drop the entry) tracked in Bump Helm to 3.22.0 (x/crypto 0.55.0) and drop CVE-2026-56854 trivyignore #214.

2. P4 · Security Audit — pip-audit

Bumps gitpython 3.1.58 → 3.1.59 in backend/requirements.txt. pip-audit flags 3.1.58 for PYSEC-2026-3785/3786/3787/3788, all fixed in the 3.1.59 patch release — the sole finding failing make security-audit. (The npm prod HIGH+ and dev CRITICAL gates both already pass; only 4 moderate prod advisories remain, which the gate does not block on.)

Scope

Deliberately minimal and low-risk: one documented Trivy suppression + one patch-level dependency bump. No behavior change. Once merged, the open PRs rebased on staging inherit both fixes and go green on P4.

https://claude.ai/code/session_01UCsZXDxBsWV2s4kT47DwDW

[jgruberf5]

Self-review @ 33770785

Reviewed against the goal of clearing the two repo-wide P4 gates with the minimum, most-defensible change. Each finding was extracted from the actual CI scan/audit logs, not assumed.

Diff

• .trivyignore — one entry, CVE-2026-56854, in the file's established format (justification + exp:2026-11-30 + tracker #214).
• backend/requirements.txt — gitpython 3.1.58 → 3.1.59.
• frontend-v2/package.json + package-lock.json — js-yaml 4.3.1 → 4.3.2 (lock diff is js-yaml-only).

Docker Build + Scan (Trivy CRITICAL) — verified

• CVE-2026-56854 is the only CRITICAL blocking the gate (scan log: 6 rows, all this CVE — x/crypto/ssh, fixed 0.55.0). Everything else is HIGH, which the gate reports but does not block.
• A bare-CVE .trivyignore line covers both embedded copies the scan flagged (helm's v0.46.0 and a second binary's v0.31.0); matches how every other entry in the file is written.
• Non-exploitability is accurate, not boilerplate: the CVE is "authentication bypass due to unenforced source-address restriction" — the SSH server auth path (ssh.ServerConfig). helm/kubectl/tofu/infracost never run an SSH server; no Forge container exposes one (Python SSH is paramiko). Same class as the pre-existing CVE-2024-45337 entry.
• No stable helm fixes it yet: checked helm's go.mod at the tags — v3.21.4 (latest stable) ships x/crypto v0.54.0; only v3.22.0-rc.1 (prerelease) has 0.55.0. Suppression is the correct interim; the real bump is tracked in Bump Helm to 3.22.0 (x/crypto 0.55.0) and drop CVE-2026-56854 trivyignore #214 and the exp: date forces re-check.

Security Audit (pip-audit + npm) — verified

• pip: gitpython 3.1.58 → 3.1.59 clears PYSEC-2026-3785/3786/3787/3788 (all fixed in that patch release) — the sole pip finding.
• npm: js-yaml 4.3.1 → 4.3.2 clears GHSA-2883-xcg3-v3hh (HIGH, maxTotalMergeKeys DoS), the sole HIGH in npm audit --omit=dev --audit-level=high. 4.3.2 is inside the existing ^4.3.1 caret — a non-breaking patch. The remaining DOMPurify (transitive via monaco-editor) and react-router advisories are moderate and don't gate; leaving them avoids an unnecessary transitive churn in a security PR.

CI

This PR touches backend/requirements.txt and frontend-v2/, so its own run exercises the backend + frontend jobs and both P4 gates end-to-end — the strongest proof the fixes work. Result on 33770785: Docker Build + Scan ✅, Security Audit ✅, all P1–P3 green.

Scope / risk

Deliberately minimal: one documented Trivy suppression + two patch-level dependency bumps, no behavior change. Merging to staging lets the P4-red PRs (#135, #199, #200, #201, #203) go green on rebase. Holding for your go-ahead before merging to staging.

https://claude.ai/code/session_01UCsZXDxBsWV2s4kT47DwDW