fix(docker): waive the two Compose advisories the image cannot yet clear

The remaining data-manager scan findings are in the bundled Compose
binary, not in anything this repository builds: 5.5.0 is the newest
official release and both advisories postdate it. They join the eleven
waivers already covering that binary and the Docker CLI, scoped to the
same path and carrying the same expiry, so a newer upstream build has to
replace them rather than the waiver quietly outliving the problem.

The ssh advisory is recorded as critical, but it reaches only callers
that dial over SSH; the data-manager drives Compose against the
bind-mounted socket and sets no DOCKER_HOST.

Also drops the x/crypto pin added to the gtfsclean build a commit ago.
That binary embeds neither module — the findings were always in Compose —
so the pin bought nothing and pushed x/text past the version deliberately
pinned beside it.

Author: Medformatik

.trivyignore.yaml

@@ -50,3 +50,14 @@ vulnerabilities:
     paths: ["usr/local/lib/docker/cli-plugins/docker-compose"]
     expired_at: 2026-09-20
     statement: Awaiting an official Compose binary with golang.org/x/mod 0.40.0 or newer.
+  # The ssh advisory reaches only callers that dial over SSH. The data-manager
+  # drives Compose against the bind-mounted socket and never sets a DOCKER_HOST,
+  # so the vulnerable transport is not on any path this image takes.
+  - id: CVE-2026-56854
+    paths: ["usr/local/lib/docker/cli-plugins/docker-compose"]
+    expired_at: 2026-09-20
+    statement: Awaiting an official Compose binary with golang.org/x/crypto 0.55.0 or newer.
+  - id: CVE-2026-84304
+    paths: ["usr/local/lib/docker/cli-plugins/docker-compose"]
+    expired_at: 2026-09-20
+    statement: Awaiting an official Compose binary with google.golang.org/grpc 1.83.1 or newer.

services/data-manager/Dockerfile

@@ -24,7 +24,6 @@ WORKDIR /tmp/gtfsclean-build
 RUN GOPROXY=direct go mod init openmapx.local/gtfsclean-build && \
     GOPROXY=direct go get github.com/public-transport/gtfsclean@bb3ea74f66ef9bc07dc1bd038c3f653e10f0ade0 && \
     GOPROXY=direct go get golang.org/x/text@v0.39.0 && \
-    GOPROXY=direct go get golang.org/x/crypto@v0.55.0 && \
     GOPROXY=direct go build -trimpath -o /usr/local/bin/gtfsclean github.com/public-transport/gtfsclean
 
 FROM node:24-slim@sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d AS base