Make dependabot auto update docker files

.github/dependabot.yml

@@ -34,10 +34,7 @@ updates:
       development-dependencies:
         dependency-type: "development"
 
-
   - package-ecosystem: "docker"
-    directories:
-      - "Dockerfile"
-      - "Dockerfile-legacy"
+    directory: /
     schedule:
-      interval: weekly
+      interval: weekly

.trivyignore

@@ -7,16 +7,15 @@
 # to maintain our own fork of Frankenphp and keep it up to date with the latest security patches, which
 # is not sustainable for us.
 
-# This CVE is stupid and disputed.
-# The "vulnerability" is that php-jwt accepts short HMAC keys without validation.
-# This is not a library bug — key management is the caller's responsibility.
-# PHP's own hash_hmac() and openssl_sign() behave identically and have no CVEs for this.
-# NVD agrees — hence the Disputed tag and no score from NIST.
-CVE-2025-45769
-
-# Unfortunately, this CVE does not have a fix yet.
 # google.golang.org/grpc │ GHSA-hrxh-6v49-42gf │ HIGH     │ fixed  │ v1.81.1           │ 1.82.1        │ gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
 # Nasty nasty
 GHSA-hrxh-6v49-42gf
 
-GHSA-r277-6w6q-xmqw
+# github.com/getkin/kin-openapi │ GHSA-r277-6w6q-xmqw │ CRITICAL │ fixed  │ v0.140.0          │ 0.144.0       │ kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default │
+GHSA-r277-6w6q-xmqw
+
+# kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS
+CVE-2026-76905
+
+# kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding
+CVE-2026-77354

Dockerfile

@@ -56,7 +56,7 @@
 # ============================================================================
 # Stage 3: Production FrankenPHP Image
 # ============================================================================
-FROM dunglas/frankenphp:1.12.7-php8-trixie@sha256:ee14233b7866ae5e9838ec3afe07721837c0a74b534fb30d0a7f7b373dd2fd12
+FROM dunglas/frankenphp:1.12.7-php8-trixie@sha256:e2fb833fac0135f9a070647a8c70eb80ba282de4a035de56b6a3371cb555eca0
 
 ARG USER=appuser
 
@@ -121,7 +121,7 @@
 COPY --from=node --chown=www-data:www-data /app/public/embed ./public/embed
 
 # Ensure storage and bootstrap/cache are writable with minimal permissions
 RUN mkdir -p storage/framework/cache \
     storage/framework/sessions \
     storage/framework/views \
     storage/logs \

osv-scanner.toml

@@ -1,7 +1,4 @@
-[[IgnoredVulns]]
-id = "GHSA-67mh-4wv8-2f99"
-reason = "We do not use the esbuild dev server. We use the vite one: see https://github.com/vitejs/vite/pull/19389#issuecomment-2651836759"
-
 [[IgnoredVulns]]
 id = "GHSA-g7r4-m6w7-qqqr"
 reason = "We do not use the esbuild dev server."
+