---
ignore:
  - CVE-2021-41098 # https://github.com/chatwoot/chatwoot/issues/3097 (update once azure blob storage is updated)
  - GHSA-57hq-95w6-v4fc # Devise confirmable race condition — patched locally in User model (remove once on Devise 5+)
  # Devise 5 is currently blocked by devise-secure_password/devise_token_auth/devise-two-factor.
  # Chatwoot does not enable Timeoutable, so the timeout redirect path is not reachable.
  - GHSA-jp94-3292-c3xv
  # Rails 7.1 has no patched release for the Active Storage proxy range
  # advisories. Chatwoot limits proxy range requests locally.
  - CVE-2026-33658
  # Rails 7.1 has no patched release for this Active Storage direct-upload
  # advisory. Chatwoot filters internal metadata keys locally.
  - CVE-2026-33173
  - CVE-2026-33174
  # Rails 7.1 has no patched release for these Rails advisories. These are not
  # reachable through Chatwoot's current usage patterns and should be removed
  # once we upgrade to Rails 7.2.3.1+.
  - CVE-2026-33168
  - CVE-2026-33169
  - CVE-2026-33170
  - CVE-2026-33176
  - CVE-2026-33195
  - CVE-2026-33202