docs(security): the settled exceptions that stay say why

CHANGELOG.md

@@ -96,6 +96,15 @@ what has already shipped, and for nothing else. See `RELEASING.md`.
 
 ### Changed
 
+- **`SECURITY-EXCEPTIONS.toml`: the settled entries that stay now say why.** Docker Scout and Snyk
+  stopped reporting the gcc-14 advisories (CVE-2026-102010 and CVE-2026-95619, and their Snyk ids)
+  on 2026-10-07 and 2026-10-08, so the gate lists them as settled. `patchradar debian` on 2026-10-15
+  still reports gcc-14 no-dsa in trixie at 14.2.0-19, with the fix only in sid, so the package is
+  still unfixed and only the reporting changed. The entries are kept, and each now records when the
+  scanner fell silent and what Debian said, as this file's CVE-2026-82560 entry already did.
+  Deleting a flaw that is demonstrably present because a scanner fell silent is the one direction
+  the file must not drift in.
+
 - **The NIS2 document describes the branch rules as they are since 2026-10-12.** The ruleset on
   main lost the owner's bypass and requires a pull request for every change, the version bump
   included; the document said the maintainer could bypass the rules, that no rule required a pull request and that release commits went straight to main. A test holds the new

SECURITY-EXCEPTIONS.toml

@@ -200,6 +200,14 @@ why = """
 CVE-2026-102010. Open in trixie for both gcc-12 (12.4.0-5) and gcc-14 (14.2.0-19), with no fixed version in any suite and no Debian bug recorded — checked with `patchradar debian CVE-2026-102010`, which is this repository's own command and the reason the distinction between "no fix" and "nobody asked" is available at all. So there is nothing to wait for and nothing to ask for: what moves a flaw in this state is evidence on the tracker page, https://security-tracker.debian.org/tracker/CVE-2026-102010.
 
 Nor is it removable. Snyk names the source package `gcc-14`, and what is installed is `libstdc++6`, the C++ runtime a long list of packages in the base image link against — unlike the full `perl`, which was removable and was removed.
+
+Since 2026-10-07T20:10:21Z Snyk Container has stopped reporting it, which is why \
+the gate lists this entry as settled. It is kept, and the reason is not how long \
+the silence has lasted: `patchradar debian CVE-2026-102010` on 2026-10-15 still \
+reports gcc-14 no-dsa in trixie at 14.2.0-19, with the fix only in sid \
+(14.4.0-3). The package named in `where` is still unfixed in trixie and only the \
+reporting changed. Deleting a flaw that is demonstrably present because a \
+scanner fell silent is the one direction this file must not drift in.
 """
 review_by = "2026-12-31"
 
@@ -238,6 +246,14 @@ https://security-tracker.debian.org/tracker/CVE-2026-102010.
 Two entries for one flaw is not duplication: the gate matches by id, and an id \
 with no entry fails the build whichever scanner emitted it. zlib has been in the \
 same position since September.
+
+Since 2026-10-07T20:11:08Z Docker Scout has stopped reporting it, which is why \
+the gate lists this entry as settled. It is kept, and the reason is not how long \
+the silence has lasted: `patchradar debian CVE-2026-102010` on 2026-10-15 still \
+reports gcc-14 no-dsa in trixie at 14.2.0-19, with the fix only in sid \
+(14.4.0-3). The package named in `where` is still unfixed in trixie and only the \
+reporting changed. Deleting a flaw that is demonstrably present because a \
+scanner fell silent is the one direction this file must not drift in.
 """
 review_by = "2026-12-31"
 
@@ -258,6 +274,14 @@ compiler and `libstdc++6`. Which of them is installed had been asserted and neve
 measured, so `tests/docker/inspect.sh` now prints the gcc and libstdc++ packages \
 and the next `docker-build-check` run answers it — a flaw in cc1 needs something \
 to compile, and nothing in this image compiles anything.
+
+Since 2026-10-08T15:15:52Z Snyk Container has stopped reporting it, which is why \
+the gate lists this entry as settled. It is kept, and the reason is not how long \
+the silence has lasted: `patchradar debian CVE-2026-95619` on 2026-10-15 still \
+reports gcc-14 no-dsa in trixie at 14.2.0-19, with the fix only in sid \
+(14.4.0-3). The package named in `where` is still unfixed in trixie and only the \
+reporting changed. Deleting a flaw that is demonstrably present because a \
+scanner fell silent is the one direction this file must not drift in.
 """
 review_by = "2026-12-31"
 
@@ -269,5 +293,13 @@ why = """
 The same flaw as SNYK-DEBIAN13-GCC14-20386241 above, under the other scanner's \
 id. The gate matches by id, so one flaw needs an entry per scanner — zlib and \
 CVE-2026-102010 are in the same position.
+
+Since 2026-10-08T15:15:00Z Docker Scout has stopped reporting it, which is why \
+the gate lists this entry as settled. It is kept, and the reason is not how long \
+the silence has lasted: `patchradar debian CVE-2026-95619` on 2026-10-15 still \
+reports gcc-14 no-dsa in trixie at 14.2.0-19, with the fix only in sid \
+(14.4.0-3). The package named in `where` is still unfixed in trixie and only the \
+reporting changed. Deleting a flaw that is demonstrably present because a \
+scanner fell silent is the one direction this file must not drift in.
 """
 review_by = "2026-12-31"