{
  "GHSA-gv7w-rqvm-qjhr": {
    "reason": "esbuild integrity-check advisory; transitive dev-only via drizzle-kit/vitest/vite; not in the production runtime — esbuild never runs in the shipped image; patched in esbuild >=0.28.1, will resolve when drizzle-kit bumps the transitive pin",
    "reviewer": "luc",
    "expires": "2026-09-01"
  },
  "GHSA-88fw-hqm2-52qc": {
    "reason": "hono CORS-middleware advisory: reflects any Origin with credentials when cors() origin defaults to wildcard. NOT exploitable here — FamilySync never uses hono's cors() middleware (grep of apps/api/src is empty); the affected code path is unreachable. Newly-published advisory against the pinned hono 4.12.23 (CLAUDE.md). Re-evaluate when hono is bumped to the patched release.",
    "reviewer": "luc",
    "expires": "2026-09-01"
  }
}