fix(hydra): scope PR to hydra image only

Author: shipperizer

oci/kratos/.trivyignore

@@ -0,0 +1,13 @@
+# Upstream CVEs
+
+# https://github.com/advisories/GHSA-crqm-pwhx-j97f  - Decoder.Decode 
+CVE-2024-34156
+
+# https://github.com/advisories/GHSA-6f52-wpx2-hvf2  - Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation.
+CVE-2025-22874 
+
+# https://github.com/advisories/GHSA-j3gx-2473-5fp8 - url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
+CVE-2026-25679
+
+# https://github.com/advisories/GHSA-x744-4wpc-v9h2 - Moby has AuthZ plugin bypass when provided oversized request bodies
+CVE-2026-34040

oci/kratos/image.yaml

@@ -1,26 +1,12 @@
-version: 2
-
+version: 1
 upload:
   - source: "canonical/kratos-rock"
-    commit: 054491506cf40c662c8b9f87b7e0bfac37c4a3fc
+    commit: 396bf3a71cb65f97cf853540117858d6859ef43b
     directory: .
     release:
       1.1.0-22.04:
         risks:
           - stable
           - candidate
           - edge
-        end-of-life: "2025-05-01T00:00:00Z"
-    ignored-vulnerabilities:
-      - CVE-2026-32286  # Denial of Service via malicious PostgreSQL server (jackc/pgproto3/v2). No upstream fix. https://github.com/advisories/GHSA-jqcq-xjh3-6g23
-      - CVE-2026-33818  # encoding/asn1: DoS via excessive recursion in Unmarshal (Go stdlib). Fixed in Go 1.26.6+. https://avd.aquasec.com/nvd/cve-2026-33818
-      - CVE-2026-33997  # moby/docker: Privilege validation bypass during plugin installation. Breaking API in v29+. https://avd.aquasec.com/nvd/cve-2026-33997
-      - CVE-2026-34040  # moby/docker: Authorization bypass vulnerability. Breaking API in v29+. https://avd.aquasec.com/nvd/cve-2026-34040
-      - CVE-2026-39821  # golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (Go stdlib). Fixed in Go 1.26.6+. https://avd.aquasec.com/nvd/cve-2026-39821
-      - CVE-2026-46600  # golang.org/x/net/dns/dnsmessage: DoS via invalid DNS record parsing (Go stdlib). Fixed in Go 1.26.6+. https://avd.aquasec.com/nvd/cve-2026-46600
-      - CVE-2026-56853  # net/http: Unencrypted HTTP/2 connections vulnerable to DoS (Go stdlib). Fixed in Go 1.26.6+. https://avd.aquasec.com/nvd/cve-2026-56853
-      - CVE-2026-56858  # html/template: Cross-Site Scripting via pathological input (Go stdlib). Fixed in Go 1.26.6+. https://avd.aquasec.com/nvd/cve-2026-56858
-      - CVE-2026-56859  # encoding/xml: DoS via XML decoding recursion depth issue (Go stdlib). Fixed in Go 1.26.6+. https://avd.aquasec.com/nvd/cve-2026-56859
-      - CVE-2026-56860  # net/url: DoS from quadratic complexity in path resolution (Go stdlib). Fixed in Go 1.26.6+. https://avd.aquasec.com/nvd/cve-2026-56860
-      - CVE-2026-56862  # crypto/tls: DoS via indefinite KeyUpdate messages (Go stdlib). Fixed in Go 1.26.6+. https://avd.aquasec.com/nvd/cve-2026-56862
-      - GO-2026-5932    # golang.org/x/crypto/openpgp: Package is unmaintained/deprecated. https://pkg.go.dev/vuln/GO-2026-5932
+        end-of-life: "2025-05-01T00:00:00Z"