fix(security): clear Trivy findings for gh and oasdiff

Newly published advisories fail the Trivy gate: kin-openapi CRITICAL in oasdiff
(fixed by bumping to 1.26.0, which vendors kin-openapi 0.144.0) and a grpc HIGH
in gh, argo, grype and syft, whose latest releases all still vendor grpc < 1.82.1.

Author: miragecentury

.trivyignore

@@ -86,6 +86,11 @@ CVE-2026-44973 exp:2026-08-19
 CVE-2026-45022 exp:2026-08-19
 CVE-2026-46680 exp:2026-08-19
 #
+# gRPC-Go xDS RBAC / HTTP2 advisory in grpc bundled by gh, argo, grype and syft.
+# Their latest releases still vendor grpc < 1.82.1, and none of these CLIs run an
+# xDS server. Drop once upstream rebuilds against the fixed grpc.
+GHSA-hrxh-6v49-42gf exp:2026-08-19
+#
 # Go stdlib / x/crypto / x/net / containerd — base image and pinned CLIs without fixed releases yet.
 CVE-2026-25681 exp:2026-08-19
 CVE-2026-27136 exp:2026-08-19

Containerfile

@@ -165,7 +165,7 @@ RUN npm install --prefix /tmp/openapi-tools --omit=dev --no-package-lock \
     && rm -rf /root/.npm
 
 # Install oasdiff (OpenAPI diff and breaking-change detection)
-ARG OASDIFF_VERSION=1.23.0
+ARG OASDIFF_VERSION=1.26.0
 RUN curl -sSL -o /tmp/oasdiff.tgz \
       "https://github.com/Tufin/oasdiff/releases/download/v${OASDIFF_VERSION}/oasdiff_${OASDIFF_VERSION}_linux_amd64.tar.gz" \
     && tar -xzf /tmp/oasdiff.tgz -C /tmp oasdiff \

manifest.yaml

@@ -22,7 +22,7 @@ build:
     - SPECTRAL_CLI_VERSION=6.16.1
     - PORTMAN_VERSION=1.35.0
     - NEWMAN_VERSION=6.2.2
-    - OASDIFF_VERSION=1.23.0
+    - OASDIFF_VERSION=1.26.0
     - RUST_VERSION=1.97.1
     - ZIG_VERSION=0.14.0
     - CARGO_LAMBDA_VERSION=1.9.1