String GITHUB_REPOSITORY = 'lambda-documents'
String ECR_ACCOUNT_ID = '086679231553'
List<String> AWS_REGIONS = ['us-east-1']
String SLACK_NOTIFICATIONS_CHANNEL = '#documents-public'
String SLACK_E2E_NOTIFY_CHANNEL = '#e2e-test-results'
String QA_ACCOUNT_ID = '437795906767'
String QA_DEPLOYMENT_ROLE = 'prod-jenkins-aws-pipeline-agent'
String PROD_ACCOUNT_ID = '437795906767'
String PROD_DEPLOYMENT_ROLE = 'prod-jenkins-aws-pipeline-agent'
String BUILD_ROLE = 'qa-lambda-documents-integration-test-role'
List<String> CROSS_LAMBDA_FUNCTIONS = [
    'load-from-s3',
    'calculate-payments',
    'generate-payments'
]
List<String> INTEGRATION_TESTS_FUNCTIONS = [
    'load-from-s3'
]

@groovy.transform.Field
List<String> functionsToBuild = null

Map<String, List<String>> VULNERABILITIES_TO_IGNORE_BY_FUNCTION = [
    'calculate-payments': [
        // TAP-2652: new base-image scanner findings surfaced in build #1386
        'CVE-2025-66418', // base image runtime copy: pkg:pypi/urllib3, fixed in 2.6.0
        'CVE-2025-66471', // base image runtime copy: pkg:pypi/urllib3, fixed in 2.6.0
        'CVE-2026-21441', // base image runtime copy: pkg:pypi/urllib3, fixed in 2.6.3
        'CVE-2026-44431', // base image runtime copy: pkg:pypi/urllib3@1.26.19, fixed in 2.7.0 (app pins 2.7.0)
        'CVE-2026-33811', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2026-33814', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2026-39820', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2026-39836', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2026-42499', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2022-49043', // aws-lambda-python:3.13 base image issue
        'CVE-2025-61729', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - HostnameError.Error() resource consumption
        'CVE-2025-49795', // aws-lambda-python:3.13 base image issue
        'CVE-2025-49794', // aws-lambda-python:3.13 base image issue
        'CVE-2025-22874', // aws-lambda-python:3.13 base image issue
        'CVE-2025-59375', // aws-lambda-python:3.13 base image issue
        'CVE-2025-61725', //pkg:generic/aws-lambda-rie?go_toolchain=1.22.7
        'CVE-2024-45490', // aws-lambda-python:3.13 base image issue
        'CVE-2021-43396', // aws-lambda-python:3.13 base image issue
        'CVE-2025-61723', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.24.6
        'CVE-2025-4802', // aws-lambda-python:3.13 base image issue
        'CVE-2025-5914', // aws-lambda-python:3.13 base image issue
        'CVE-2025-1390', // aws-lambda-python:3.13 base image issue
        'CVE-2023-52425', // aws-lambda-python:3.13 base image issue
        'CVE-2025-6020', // aws-lambda-python:3.13 base image issue
        'CVE-2025-1372', //pkg:rpm/amazon/elfutils-default-yama-scope@0.188-3.amzn2023.0.2
        'CVE-2025-49796', // aws-lambda-python:3.13 base image issue
        'CVE-2024-34459', // aws-lambda-python:3.13 base image issue
        'CVE-2025-22871', // aws-lambda-rie (pinned go_toolchain=1.22.7)
        'CVE-2025-24928', // aws-lambda-python:3.13 base image issue
        'CVE-2025-6052', // aws-lambda-python:3.13 base image issue
        'CVE-2025-32415', // aws-lambda-python:3.13 base image issue
        'CVE-2022-46908', // aws-lambda-python:3.13 base image issue
        'CVE-2025-6965', // aws-lambda-python:3.13 base image issue
        'CVE-2025-27113', // aws-lambda-python:3.13 base image issue
        'CVE-2025-58188', //pkg:generic/aws-lambda-rie?go_toolchain=1.22.7
        'CVE-2025-47907', // aws-lambda-rie: requires upgrade to fixed version 1.23.12 (currently unavailable/pinned)
        'CVE-2025-32414', // aws-lambda-python:3.13 base image issue
        'CVE-2024-56171', // aws-lambda-python:3.13 base image issue
        'CVE-2025-47912', // base image issue: pkg:generic/aws-lambda-rie
        'CVE-2024-33601', // aws-lambda-python:3.13 base image issue
        'CVE-2025-6021', // aws-lambda-python:3.13 base image issue
        'CVE-2025-1352', // fixed in 0:0.188-3.amzn2023.0.3
        'CVE-2025-9230', // aws-lambda-python:3.13 base image issue
        'CVE-2025-58187', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.24.6
        'CVE-2025-13601', // base image issue: pkg:rpm/amazon/glib2@2.74.7-689.amzn2023.0.2
        'CVE-2024-33602', // aws-lambda-python:3.13 base image issue
        'CVE-2025-8941', // aws-lambda-python base image issue: pkg:rpm/amazon/pam@1.5.1
        'CVE-2025-7425', // aws-lambda-python:3.13 base image issue
        'CVE-2024-33599', // aws-lambda-python:3.13 base image issue
        'CVE-2025-9086', // pkg:rpm/amazon/libcurl-minimal@8.5.0-1.amzn2023.0.4
        'CVE-2026-3805', // pkg:rpm/amazon/libcurl-minimal@8.5.0, fixed in 0:8.17.0-1.amzn2023.0.3
        'CVE-2025-14087', // pkg:rpm/amazon/glib2@2.74.7-689.amzn2023.0.2
        'CVE-2025-24528', // pkg:rpm/amazon/krb5-libs@1.21.3-1.amzn2023.0.1 - base image issue, fixed in 0:1.21.3-6.amzn2023.0.1
        'CVE-2025-61726', // pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - base image issue
        'CVE-2025-15467', //pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16
        'CVE-2025-13151', //pkg:rpm/amazon/libtasn1@4.19.0-1.amzn2023.0.4
        'CVE-2025-61731', //pkg:rpm/amazon/libcap@2.48-2.amzn2023.0.3
        'CVE-2025-68119', //pkg:rpm/amazon/libcap@2.48-2.amzn2023.0.3
        'CVE-2025-68973', //pkg:rpm/amazon/gnupg2-minimal@2.3.7-1.amzn2023.0.4
        'CVE-2025-68121', // pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - CRITICAL base image issue, fixed in 1.24.13
        'CVE-2025-15468', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2025-69419', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2025-69420', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2025-69421', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2026-22796', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2026-24882', // pkg:rpm/amazon/gnupg2-minimal@2.3.7-1.amzn2023.0.4 - base image issue, fixed in 0:2.3.7-1.amzn2023.0.7,
        'CVE-2026-25210', // pkg:rpm/amazon/expat@2.5.0-1.amzn2023.0.4?arch=x86_64&distro=2023&epoch=0&source=expat-2.5.0-1.amzn2023.0.4.src.rpm
        'CVE-2026-25679', // pkg:generic/aws-lambda-rie?go_toolchain=1.22.7
        'CVE-2026-2673', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16?arch=x86_64&distro=2023&epoch=1&source=openssl-3.0.8-1.amzn2023.0.16.src.rpm | 1:3.5.5-1.amzn2023.0.3
        'CVE-2026-32280',  // pkg:generic/aws-lambda-rie?go_toolchain=1.22.7
        'CVE-2026-27135', // pkg:rpm/amazon/libnghttp2@1.59.0-3.amzn2023.0.1 - base image issue
        'CVE-2026-28387', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-28388', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-28389', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-28390', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-31790', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-32281', // pkg:generic/aws-lambda-rie - base image issue
        'CVE-2026-32283', // pkg:generic/aws-lambda-rie - base image issue
        'CVE-2026-4046', // pkg:rpm/amazon/glibc-langpack-en@2.34-231.amzn2023.0.3 - base image issue
        'CVE-2026-42504', // pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - base image issue, fixed in 1.25.11
        'CVE-2026-7383', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-9076', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-34180', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-34181', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-34182', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-34183', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-42764', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-42768', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-45445', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-45447', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-48864', // pkg:rpm/amazon/libsolv@0.7.22-1.amzn2023.0.2 - base image issue, fixed in 0:0.7.22-1.amzn2023.0.4
        'CVE-2026-27145', // pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - base image issue, fixed in 1.25.11
        'GHSA-537c-gmf6-5ccf' // pkg:pypi/cryptography@46.0.7 - fixed in 48.0.1, but abacus-common-logic pins cryptography<47/<49 across its releases, blocking the upgrade
    ],
    'close-balance': [
        'CVE-2025-46328', // snowflake-sdk: fixed in 2.0.4, temporary exception until it can be upgraded
        'CVE-2025-64756', // lambda/nodejs:24 base image issue
        'CVE-2026-23745',  // lambda/nodejs:24 base image issue
        'CVE-2025-62718', // pkg:npm/axios@1.13.2 - base image issue
        'CVE-2025-69873', // pkg:npm/ajv@6.12.6 - base image issue
        'CVE-2026-2391', // pkg:npm/qs@6.14.1 - base image issue
        'CVE-2026-25128', // pkg:npm/fast-xml-parser@5.2.5 - base image issue
        'CVE-2026-25639', // pkg:npm/axios@1.13.2 - base image issue
        'CVE-2026-25896', // pkg:npm/fast-xml-parser@4.5.3 - base image issue
        'CVE-2026-26278', // pkg:npm/fast-xml-parser@4.5.3 - base image issue
        'CVE-2026-26996', // pkg:npm/minimatch@3.1.2 - base image issue
        'CVE-2026-27903', // pkg:npm/minimatch@10.2.2 - base image issue
        'CVE-2026-27904', // pkg:npm/minimatch@10.2.2 - base image issue
        'CVE-2026-27942', // pkg:npm/fast-xml-parser@4.5.3 - base image issue
        'CVE-2026-29063', // pkg:npm/immutable@3.7.6 - base image issue
        'CVE-2026-29786', // pkg:npm/tar@7.5.9 - base image issue
        'CVE-2026-31802', // pkg:npm/tar@7.5.9 - base image issue
        'CVE-2026-32141', // pkg:npm/flatted@3.3.3 - base image issue
        'CVE-2026-33036', // pkg:npm/fast-xml-parser@4.5.3 - base image issue
        'CVE-2026-33228', // pkg:npm/flatted@3.3.3 - base image issue
        'CVE-2026-33671', // pkg:npm/picomatch@4.0.3 - base image issue
        'CVE-2026-33750', // pkg:npm/brace-expansion@5.0.3 - base image issue
        'CVE-2026-33937', // pkg:npm/handlebars@4.7.8 - base image issue
        'CVE-2026-33938', // pkg:npm/handlebars@4.7.8 - base image issue
        'CVE-2026-33939', // pkg:npm/handlebars@4.7.8 - base image issue
        'CVE-2026-33940', // pkg:npm/handlebars@4.7.8 - base image issue
        'CVE-2026-33941', // pkg:npm/handlebars@4.7.8 - base image issue
        'CVE-2026-4046', // pkg:rpm/amazon/glibc-langpack-en@2.34-231.amzn2023.0.3 - base image issue
        'CVE-2026-4800', // pkg:npm/lodash@4.17.21 - base image issue
        'CVE-2025-13465' // pkg:npm/lodash@4.17.21 (fixed in 4.17.23)
    ],
    'evaluate-payment-eligibility': [
        'CVE-2025-64756', // lambda/nodejs:24 base image issue
        'CVE-2026-23745', // lambda/nodejs:24 base image issue
        'CVE-2026-26960', // pkg:npm/tar@7.5.7  - base imgae
        'CVE-2026-26996', // pkg:npm/minimatch@10.1.2 - base image
        'CVE-2026-27903', // pkg:npm/minimatch@10.1.2 - base image
        'CVE-2026-27904', // pkg:npm/minimatch@10.1.2 - base image
        'CVE-2026-29786', // pkg:npm/tar@7.5.7 - base image
        'CVE-2026-31802', // pkg:npm/tar@7.5.9 - base image
        'CVE-2025-62718', // pkg:npm/axios - base image issue
        'CVE-2026-4800', // pkg:npm/lodash - base image issue
        'CVE-2026-33671', // pkg:npm/picomatch - base image issue
        'CVE-2026-33750', // pkg:npm/brace-expansion - base image issue
        'CVE-2026-4046'  // pkg:rpm/amazon/glibc-langpack-en - base image issue
    ],
    'evaluate-tax-eligibility': [
        'CVE-2025-64756', // lambda/nodejs:24 base image issue
        'CVE-2026-23745', // lambda/nodejs:24 base image issue
        'CVE-2025-15467', // lambda/nodejs:24 base image issue
        'CVE-2025-13151', // lambda/nodejs:24 base image issue
        'CVE-2026-23950', // lambda/nodejs:24 base image issue
        'CVE-2026-24842', // lambda/nodejs:24 base image issue
        'CVE-2025-68121', // lambda/nodejs:24 base image issue
        'CVE-2026-25547', // lambda/nodejs:24 base image issue
        'CVE-2025-61726', // lambda/nodejs:24 base image issue
        'CVE-2025-61731', // lambda/nodejs:24 base image issue
        'CVE-2025-68119', // lambda/nodejs:24 base image issue
        'CVE-2026-25128', // lambda/nodejs:24 base image issue
        'CVE-2025-15468', // pkg:rpm/amazon/openssl-snapsafe-libs@3.2.2-1.amzn2023.0.4 - base image issue, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2025-69419', // pkg:rpm/amazon/openssl-snapsafe-libs@3.2.2-1.amzn2023.0.4 - base image issue, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2025-69420', // pkg:rpm/amazon/openssl-snapsafe-libs@3.2.2-1.amzn2023.0.4 - base image issue, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2025-69421', // pkg:rpm/amazon/openssl-snapsafe-libs@3.2.2-1.amzn2023.0.4 - base image issue, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2026-22796', // pkg:rpm/amazon/openssl-snapsafe-libs@3.2.2-1.amzn2023.0.4 - base image issue, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2026-24882', // pkg:rpm/amazon/gnupg2-minimal@2.3.7-1.amzn2023.0.6 - base image issue, fixed in 0:2.3.7-1.amzn2023.0.7
        'CVE-2026-26960', // pkg:npm/tar@7.5.7  - base imgae
        'CVE-2026-26996', // pkg:npm/minimatch@10.1.2 - base image
        'CVE-2026-27903', // pkg:npm/minimatch@10.1.2 - base image
        'CVE-2026-27904', // pkg:npm/minimatch@10.1.2 - base image
        'CVE-2026-29786', // pkg:npm/tar@7.5.7 - base image,
        'CVE-2026-31802', // pkg:npm/tar@7.5.9 - base image
        'CVE-2026-33671', // pkg:npm/picomatch@4.0.3 - base image issue (app tree uses 2.3.2)
        'CVE-2026-33750', // pkg:npm/brace-expansion@5.0.3 - base image issue (app tree uses 5.0.5)
        'CVE-2026-41907', // pkg:npm/uuid@9.0.1 - /var/runtime/@aws-sdk base image issue, fixed in 11.1.1
        'CVE-2026-45736', // pkg:npm/ws@8.20.0 - base image issue, fixed in 8.20.1
        // TAP-2652: base-image scanner findings surfaced in the post-merge master build (2026-06-16)
        'CVE-2026-45149', // pkg:npm/brace-expansion@5.0.3 - /var/lang npm base image issue, fixed in 5.0.6 (blocking)
        'CVE-2026-48864', // pkg:rpm/amazon/libsolv@0.7.22-1.amzn2023.0.3 - base image issue, fixed in 0:0.7.22-1.amzn2023.0.4 (blocking)
        'GHSA-96hv-2xvq-fx4p', // pkg:npm/ws@8.20.1 - /var/runtime/@aws-sdk base image issue, fixed in 8.21.0
        'CVE-2026-12143', // pkg:npm/form-data@4.0.5 - /var/runtime/@aws-sdk base image issue, fixed in 4.0.6
        'CVE-2026-44486', // pkg:npm/axios@1.15.2 - /var/runtime/@aws-sdk base image issue, fixed in 1.16.0
        'CVE-2026-44487', // pkg:npm/axios@1.15.2 - /var/runtime/@aws-sdk base image issue, fixed in 1.16.0
        'CVE-2026-44488', // pkg:npm/axios@1.15.2 - /var/runtime/@aws-sdk base image issue, fixed in 1.16.0
        'CVE-2026-44490', // pkg:npm/axios@1.15.2 - /var/runtime/@aws-sdk base image issue, fixed in 1.16.0
        'CVE-2026-44492', // pkg:npm/axios@1.15.2 - /var/runtime/@aws-sdk base image issue, fixed in 1.16.0
        'CVE-2026-44494', // pkg:npm/axios@1.15.2 - /var/runtime/@aws-sdk base image issue, fixed in 1.16.0
        'CVE-2026-44496',  // pkg:npm/axios@1.15.2 - /var/runtime/@aws-sdk base image issue, fixed in 1.16.0
        'CVE-2026-9076', // pkg:rpm/amazon/openssl-snapsafe-libs@3.5.5-1.amzn2023.0.4
        'CVE-2026-7383', // pkg:rpm/amazon/openssl-snapsafe-libs@3.5.5-1.amzn2023.0.4
        'CVE-2026-45447', // pkg:rpm/amazon/openssl-snapsafe-libs@3.5.5-1.amzn2023.0.4
        'CVE-2026-45445', // pkg:rpm/amazon/openssl-snapsafe-libs@3.5.5-1.amzn2023.0.4
        'CVE-2026-42768', // pkg:rpm/amazon/openssl-snapsafe-libs@3.5.5-1.amzn2023.0.4
        'CVE-2026-42764', // pkg:rpm/amazon/openssl-snapsafe-libs@3.5.5-1.amzn2023.0.4
        'CVE-2026-34183', // pkg:rpm/amazon/openssl-snapsafe-libs@3.5.5-1.amzn2023.0.4
        'CVE-2026-34181', // pkg:rpm/amazon/openssl-snapsafe-libs@3.5.5-1.amzn2023.0.4
        'CVE-2026-34180', // pkg:rpm/amazon/openssl-snapsafe-libs@3.5.5-1.amzn2023.0.4
        'CVE-2026-34182' // pkg:rpm/amazon/openssl-snapsafe-libs@3.5.5-1.amzn2023.0.4
    ],
    'generate-payments': [
        // TAP-2652: new base-image scanner finding surfaced in build #1386
        'CVE-2026-44431', // base image runtime copy: pkg:pypi/urllib3@1.26.19, fixed in 2.7.0 (app pins 2.7.0)
        'CVE-2022-46908', // aws-lambda-python:3.13 base image issue
        'CVE-2025-61723', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.24.6
        'CVE-2025-5914', // aws-lambda-python:3.13 base image issue
        'CVE-2025-7425', // aws-lambda-python:3.13 base image issue
        'CVE-2025-6021', // aws-lambda-python:3.13 base image issue
        'CVE-2024-33601', // aws-lambda-python:3.13 base image issue
        'CVE-2025-49796', // aws-lambda-python:3.13 base image issue
        'CVE-2025-22874', // aws-lambda-python:3.13 base image issue
        'CVE-2025-49795', // aws-lambda-python:3.13 base image issue
        'CVE-2025-47912', // base image issue: pkg:generic/aws-lambda-rie
        'CVE-2025-13601', // base image issue: pkg:rpm/amazon/glib2@2.74.7-689.amzn2023.0.2
        'CVE-2025-32415', // aws-lambda-python:3.13 base image issue
        'CVE-2024-34459', // aws-lambda-python:3.13 base image issue
        'CVE-2025-61725', //pkg:generic/aws-lambda-rie?go_toolchain=1.22.7
        'CVE-2025-47907', // aws-lambda-rie: requires upgrade to fixed version 1.23.12 (currently unavailable/pinned)
        'CVE-2025-6052', // aws-lambda-python:3.13 base image issue
        'CVE-2021-43396', // aws-lambda-python:3.13 base image issue
        'CVE-2025-22871', // aws-lambda-rie (pinned go_toolchain=1.22.7)
        'CVE-2025-27113', // aws-lambda-python:3.13 base image issue
        'CVE-2025-58187', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.24.6
        'CVE-2022-49043', // aws-lambda-python:3.13 base image issue
        'CVE-2025-61729', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - HostnameError.Error() resource consumption
        'CVE-2025-6965', // aws-lambda-python:3.13 base image issue
        'CVE-2025-49794', // aws-lambda-python:3.13 base image issue
        'CVE-2025-24928', // aws-lambda-python:3.13 base image issue
        'CVE-2025-66471', // urllib3@2.5.0: streaming API highly compressed data issue, fixed in 2.6.0
        'CVE-2024-33602', // aws-lambda-python:3.13 base image issue
        'CVE-2024-56171', // aws-lambda-python:3.13 base image issue
        'CVE-2024-33599', // aws-lambda-python:3.13 base image issue
        'CVE-2025-66418', // urllib3@2.5.0: unbounded decompression chain, fixed in 2.6.0
        'CVE-2025-4802', // aws-lambda-python:3.13 base image issue
        'CVE-2025-32414', // aws-lambda-python:3.13 base image issue
        'CVE-2025-9230', // aws-lambda-python:3.13 base image issue
        'CVE-2025-58188', //pkg:generic/aws-lambda-rie?go_toolchain=1.22.7
        'CVE-2025-1390', // aws-lambda-python:3.13 base image issue
        'CVE-2025-9086', // pkg:rpm/amazon/libcurl-minimal@8.5.0-1.amzn2023.0.4
        'CVE-2026-3805', // pkg:rpm/amazon/libcurl-minimal@8.5.0, fixed in 0:8.17.0-1.amzn2023.0.3
        'CVE-2025-14087', // pkg:rpm/amazon/glib2@2.74.7-689.amzn2023.0.2
        'CVE-2026-21441', //pkg:pypi/urllib3@2.5.0
        'CVE-2025-24528', // pkg:rpm/amazon/krb5-libs@1.21.3-1.amzn2023.0.1
        'CVE-2025-15467', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - CRITICAL base image issue, fixed in 1:3.2.2-1.amzn2023.0.4
        'CVE-2025-68121', // pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - CRITICAL base image issue, fixed in 1.24.13
        'CVE-2025-13151', // pkg:rpm/amazon/libtasn1@4.19.0-1.amzn2023.0.4 - base image issue, fixed in 0:4.19.0-1.amzn2023.0.6
        'CVE-2025-15468', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2025-61726', // pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - base image issue, fixed in 1.24.12
        'CVE-2025-68973', // pkg:rpm/amazon/gnupg2-minimal@2.3.7-1.amzn2023.0.4 - base image issue, fixed in 0:2.3.7-1.amzn2023.0.6
        'CVE-2025-69419', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2025-69420', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2025-69421', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2026-22796', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2026-24882', // pkg:rpm/amazon/gnupg2-minimal@2.3.7-1.amzn2023.0.4 - base image issue, fixed in 0:2.3.7-1.amzn2023.0.7
        'CVE-2026-25679', // pkg:generic/aws-lambda-rie - base image issue
        'CVE-2026-27135', // pkg:rpm/amazon/libnghttp2@1.59.0-3.amzn2023.0.1 - base image issue
        'CVE-2026-28387', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-28388', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-28389', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-28390', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-31790', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-32280', // pkg:generic/aws-lambda-rie - base image issue
        'CVE-2026-32281', // pkg:generic/aws-lambda-rie - base image issue
        'CVE-2026-32283', // pkg:generic/aws-lambda-rie - base image issue
        'CVE-2026-4046', // pkg:rpm/amazon/glibc-langpack-en@2.34-231.amzn2023.0.3 - base image issue
        'CVE-2026-33811', // pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - base image issue
        'CVE-2026-33814', // pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - base image issue
        'CVE-2026-39820', // pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - base image issue
        'CVE-2026-39836', // pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - base image issue
        'CVE-2026-42499', // pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - base image issue
        'CVE-2026-27145', // pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - base image issue
        'CVE-2026-34180', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-34181', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-34182', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - CRITICAL base image issue
        'CVE-2026-34183', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-42504', // pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - base image issue
        'CVE-2026-42764', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-42768', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-45445', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-45447', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-48864', // pkg:rpm/amazon/libsolv@0.7.22-1.amzn2023.0.2 - base image issue
        'CVE-2026-7383', // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
        'CVE-2026-9076' // pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8-1.amzn2023.0.16 - base image issue
    ],
    'knr-payments': [
        'CVE-2025-46328', // pkg:npm/snowflake-sdk@1.15.0 will be upgraded in a separate iteration
        'CVE-2025-64756' // pkg:npm/glob@10.4.5 in base image
    ],
    'knr-payments-approve': [
        'CVE-2025-64756' // pkg:npm/glob@10.4.5 in base image
    ],
    'knr-update-abacus-ledger': [
        'CVE-2025-64756', // pkg:npm/glob@10.4.5 in base image
        'CVE-2026-11822', // pkg:rpm/amazon/sqlite-libs@3.40.0-1.amzn2023.0.7 - base image issue, fixed in 0:3.40.0-1.amzn2023.0.8
        'CVE-2026-11824', // pkg:rpm/amazon/sqlite-libs@3.40.0-1.amzn2023.0.7 - base image issue, fixed in 0:3.40.0-1.amzn2023.0.8
        'CVE-2026-12143', // pkg:npm/form-data@4.0.5 - /var/runtime/@aws-sdk base image issue, fixed in 4.0.6
        'CVE-2026-12151', // pkg:npm/undici@6.26.0 - /var/lang/lib/node_modules/npm base image issue, fixed in 6.27.0
        'CVE-2026-6653', // pkg:rpm/amazon/libxml2@2.10.4-1.amzn2023.0.18 - base image issue, fixed in 0:2.10.4-1.amzn2023.0.19
        'ALAS2023-2026-1916' // pkg:rpm/amazon/libblkid@2.37.4-1.amzn2023.0.4 - base image issue, fixed in 0:2.37.4-1.amzn2023.0.5
    ],
    'load-from-s3': [
        // TAP-2652: new base-image scanner findings surfaced in build #1386
        'CVE-2025-66418', // base image runtime copy: pkg:pypi/urllib3, fixed in 2.6.0
        'CVE-2025-66471', // base image runtime copy: pkg:pypi/urllib3, fixed in 2.6.0
        'CVE-2026-21441', // base image runtime copy: pkg:pypi/urllib3, fixed in 2.6.3
        'CVE-2026-44431', // base image runtime copy: pkg:pypi/urllib3@1.26.19, fixed in 2.7.0 (app pins 2.7.0)
        'CVE-2026-33811', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2026-33814', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2026-39820', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2026-39836', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2026-42499', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2025-13601', // base image issue: pkg:rpm/amazon/glib2@2.74.7-689.amzn2023.0.2
        'CVE-2025-27113', // aws-lambda-python:3.13 base image issue
        'CVE-2025-61725', //pkg:generic/aws-lambda-rie?go_toolchain=1.22.7
        'CVE-2025-6052', // aws-lambda-python:3.13 base image issue
        'CVE-2025-4802', // aws-lambda-python:3.13 base image issue
        'CVE-2022-49043', // aws-lambda-python:3.13 base image issue
        'CVE-2025-47907', // aws-lambda-rie: requires upgrade to fixed version 1.23.12 (currently unavailable/pinned)
        'CVE-2025-9230', // aws-lambda-python:3.13 base image issue
        'CVE-2025-61729', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - HostnameError.Error() resource consumption
        'CVE-2024-34459', // aws-lambda-python:3.13 base image issue
        'CVE-2023-52425', // aws-lambda-python:3.13 base image issue
        'CVE-2025-6021', // aws-lambda-python:3.13 base image issue
        'CVE-2025-6965', // aws-lambda-python:3.13 base image issue
        'CVE-2025-32415', // aws-lambda-python:3.13 base image issue
        'CVE-2025-58187', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.24.6
        'CVE-2025-49795', // aws-lambda-python:3.13 base image issue
        'CVE-2025-8941', // aws-lambda-python base image issue: pkg:rpm/amazon/pam@1.5.1
        'CVE-2024-33601', // aws-lambda-python:3.13 base image issue
        'CVE-2024-33602', // aws-lambda-python:3.13 base image issue
        'CVE-2025-1390', // aws-lambda-python:3.13 base image issue
        'CVE-2024-33599', // aws-lambda-python:3.13 base image issue
        'CVE-2025-49796', // aws-lambda-python:3.13 base image issue
        'CVE-2025-22871', // aws-lambda-rie (pinned go_toolchain=1.22.7)
        'CVE-2025-1372', //pkg:rpm/amazon/elfutils-default-yama-scope@0.188-3.amzn2023.0.2
        'CVE-2025-47912', // base image issue: pkg:generic/aws-lambda-rie
        'CVE-2025-49794', // aws-lambda-python:3.13 base image issue
        'CVE-2025-61723', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.24.6
        'CVE-2025-22874', // aws-lambda-python:3.13 base image issue
        'CVE-2025-7425', // aws-lambda-python:3.13 base image issue
        'CVE-2025-24928', // aws-lambda-python:3.13 base image issue
        'CVE-2025-59375', // aws-lambda-python:3.13 base image issue
        'CVE-2021-43396', // aws-lambda-python:3.13 base image issue
        'CVE-2025-32414', // aws-lambda-python:3.13 base image issue
        'CVE-2025-5914', // aws-lambda-python:3.13 base image issue
        'CVE-2025-1352', // fixed in 0:0.188-3.amzn2023.0.3
        'CVE-2025-58188', //pkg:generic/aws-lambda-rie?go_toolchain=1.22.7
        'CVE-2025-6020', // aws-lambda-python:3.13 base image issue
        'CVE-2024-56171', // aws-lambda-python:3.13 base image issue
        'CVE-2024-45490', // aws-lambda-python:3.13 base image issue
        'CVE-2022-46908', // aws-lambda-python:3.13 base image issue
        'CVE-2025-14087', // pkg:rpm/amazon/glib2
        'CVE-2025-9086', // pkg:rpm/amazon/libcurl-minimal
        'CVE-2026-3805', // pkg:rpm/amazon/libcurl-minimal@8.5.0, fixed in 0:8.17.0-1.amzn2023.0.3
        'CVE-2025-15467', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 3.2.2-1.amzn2023.0.4
        'CVE-2025-68121', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.24.13
        'CVE-2025-13151', // base image issue: pkg:rpm/amazon/libtasn1@4.19.0, fixed in 4.19.0-1.amzn2023.0.6
        'CVE-2025-15468', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 3.2.2-1.amzn2023.0.5
        'CVE-2025-24528', // base image issue: pkg:rpm/amazon/krb5-libs@1.21.3, fixed in 1.21.3-6.amzn2023.0.1
        'CVE-2025-61726', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.24.12
        'CVE-2025-61731', // base image issue: pkg:rpm/amazon/libcap@2.48, fixed in 2.73-1.amzn2023.0.6
        'CVE-2025-68119', // base image issue: pkg:rpm/amazon/libcap@2.48, fixed in 2.73-1.amzn2023.0.6
        'CVE-2025-68973', // base image issue: pkg:rpm/amazon/gnupg2-minimal@2.3.7, fixed in 2.3.7-1.amzn2023.0.6
        'CVE-2025-69419', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 3.2.2-1.amzn2023.0.5
        'CVE-2025-69420', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 3.2.2-1.amzn2023.0.5
        'CVE-2025-69421', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 3.2.2-1.amzn2023.0.5
        'CVE-2026-22796', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 3.2.2-1.amzn2023.0.5
        'CVE-2026-24882', // base image issue: pkg:rpm/amazon/gnupg2-minimal@2.3.7, fixed in 2.3.7-1.amzn2023.0.7
        'CVE-2026-25210', // base image issue: pkg:rpm/amazon/expat@2.5.0, fixed in 0:2.6.3-1.amzn2023.0.4
        'CVE-2026-25679', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.8
        'CVE-2026-2673',  // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.3
        'CVE-2026-27135', // base image issue: pkg:rpm/amazon/libnghttp2@1.59.0, fixed in 0:1.59.0-3.amzn2023.0.2
        'CVE-2026-28387', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.4
        'CVE-2026-28388', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.4
        'CVE-2026-28389', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.4
        'CVE-2026-28390', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.4
        'CVE-2026-31790', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.4
        'CVE-2026-32280', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.9
        'CVE-2026-32281', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.9
        'CVE-2026-32283', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.9
        'CVE-2026-4046' // pkg:rpm/amazon/glibc-langpack-en@2.34-231.amzn2023.0.3 - base image issue
    ],
    'payoneer-program-move': [
        // TAP-2652: new base-image scanner findings surfaced in build #1386
        'CVE-2026-44431', // base image runtime copy: pkg:pypi/urllib3@1.26.19, fixed in 2.7.0 (app pins 2.7.0)
        'CVE-2026-33811', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2026-33814', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2026-39820', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2026-39836', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2026-42499', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2022-49043', // aws-lambda-python:3.13 base image issue
        'CVE-2025-61729', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - HostnameError.Error() resource consumption
        'CVE-2025-49795', // aws-lambda-python:3.13 base image issue
        'CVE-2025-66418', // urllib3@2.5.0: unbounded decompression chain, fixed in 2.6.0
        'CVE-2025-49794', // aws-lambda-python:3.13 base image issue
        'CVE-2025-22874', // aws-lambda-python:3.13 base image issue
        'CVE-2025-59375', // aws-lambda-python:3.13 base image issue
        'CVE-2025-61725', //pkg:generic/aws-lambda-rie?go_toolchain=1.22.7
        'CVE-2024-45490', // aws-lambda-python:3.13 base image issue
        'CVE-2021-43396', // aws-lambda-python:3.13 base image issue
        'CVE-2025-61723', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.24.6
        'CVE-2025-4802', // aws-lambda-python:3.13 base image issue
        'CVE-2025-5914', // aws-lambda-python:3.13 base image issue
        'CVE-2025-1390', // aws-lambda-python:3.13 base image issue
        'CVE-2023-52425', // aws-lambda-python:3.13 base image issue
        'CVE-2025-6020', // aws-lambda-python:3.13 base image issue
        'CVE-2025-1372', //pkg:rpm/amazon/elfutils-default-yama-scope@0.188-3.amzn2023.0.2
        'CVE-2025-49796', // aws-lambda-python:3.13 base image issue
        'CVE-2025-43859',
        'CVE-2024-34459', // aws-lambda-python:3.13 base image issue
        'CVE-2025-22871', // aws-lambda-rie (pinned go_toolchain=1.22.7)
        'CVE-2025-24928', // aws-lambda-python:3.13 base image issue
        'CVE-2025-6052', // aws-lambda-python:3.13 base image issue
        'CVE-2025-32415', // aws-lambda-python:3.13 base image issue
        'CVE-2025-66471', // urllib3@2.5.0: streaming API highly compressed data issue, fixed in 2.6.0
        'CVE-2022-46908', // aws-lambda-python:3.13 base image issue
        'CVE-2025-6965', // aws-lambda-python:3.13 base image issue
        'CVE-2025-27113', // aws-lambda-python:3.13 base image issue
        'CVE-2025-58188', //pkg:generic/aws-lambda-rie?go_toolchain=1.22.7
        'CVE-2025-47907', // aws-lambda-rie: requires upgrade to fixed version 1.23.12 (currently unavailable/pinned)
        'CVE-2025-32414', // aws-lambda-python:3.13 base image issue
        'CVE-2024-56171', // aws-lambda-python:3.13 base image issue
        'CVE-2025-47912', // base image issue: pkg:generic/aws-lambda-rie
        'CVE-2024-33601', // aws-lambda-python:3.13 base image issue
        'CVE-2025-6021', // aws-lambda-python:3.13 base image issue
        'CVE-2025-1352', // fixed in 0:0.188-3.amzn2023.0.3
        'CVE-2025-9230', // aws-lambda-python:3.13 base image issue
        'CVE-2025-58187', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.24.6
        'CVE-2025-13601', // base image issue: pkg:rpm/amazon/glib2@2.74.7-689.amzn2023.0.2
        'CVE-2025-0395', // aws-lambda-python:3.13 base image issue
        'CVE-2024-33602', // aws-lambda-python:3.13 base image issue
        'CVE-2025-8941', // aws-lambda-python base image issue: pkg:rpm/amazon/pam@1.5.1
        'CVE-2025-7425', // aws-lambda-python:3.13 base image issue
        'CVE-2024-33599', // aws-lambda-python:3.13 base image issue
        'CVE-2025-14087', // pkg:rpm/amazon/glib2
        'CVE-2025-9086', // pkg:rpm/amazon/libcurl-minimal
        'CVE-2026-3805', // pkg:rpm/amazon/libcurl-minimal@8.5.0, fixed in 0:8.17.0-1.amzn2023.0.3
        'CVE-2026-21441', // pkg:pypi/urllib3@2.5.0
        'CVE-2025-15467', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.2.2-1.amzn2023.0.4
        'CVE-2025-68121', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.24.13
        'CVE-2025-13151', // base image issue: pkg:rpm/amazon/libtasn1@4.19.0, fixed in 0:4.19.0-1.amzn2023.0.6
        'CVE-2025-15468', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2025-24528', // base image issue: pkg:rpm/amazon/krb5-libs@1.21.3, fixed in 0:1.21.3-6.amzn2023.0.1
        'CVE-2025-61726', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.24.12
        'CVE-2025-68973', // base image issue: pkg:rpm/amazon/gnupg2-minimal@2.3.7, fixed in 0:2.3.7-1.amzn2023.0.6
        'CVE-2025-69419', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2025-69420', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2025-69421', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2026-22796', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2026-24882', // base image issue: pkg:rpm/amazon/gnupg2-minimal@2.3.7, fixed in 0:2.3.7-1.amzn2023.0.7
        'CVE-2026-25210', // base image issue: pkg:rpm/amazon/expat@2.5.0, fixed in 0:2.6.3-1.amzn2023.0.4
        'CVE-2026-25679', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.8
        'CVE-2026-27142', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.8
        'CVE-2026-39892', // pkg:pypi/cryptography@46.0.5 - upgrade pending
        'CVE-2026-2673', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8
        'CVE-2026-27135', // base image issue: pkg:rpm/amazon/libnghttp2@1.59.0
        'CVE-2026-28387', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8
        'CVE-2026-28388', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8
        'CVE-2026-28389', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8
        'CVE-2026-28390', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8
        'CVE-2026-31790', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8
        'CVE-2026-32280', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7
        'CVE-2026-32281', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7
        'CVE-2026-32283', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7
        'CVE-2026-4046', // base image issue: pkg:rpm/amazon/glibc-gconv-extra@2.34
        // New base-image scanner findings surfaced by Trivy dockerScan on master (commit b8697195).
        // All are amazon/aws-lambda-python:3.13 base-image contents (OS RPMs, aws-lambda-rie binary,
        // /var/lang pip) - not reachable from the app's uv.lock, so suppressed here per the base-image policy.
        'CVE-2026-34182', // CRITICAL - base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.5
        'CVE-2026-34180', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.5
        'CVE-2026-34181', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.5
        'CVE-2026-34183', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.5
        'CVE-2026-42764', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.5
        'CVE-2026-42768', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.5
        'CVE-2026-45445', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.5
        'CVE-2026-45447', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.5
        'CVE-2026-7383', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.5
        'CVE-2026-9076', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.5
        'CVE-2026-11822', // base image issue: pkg:rpm/amazon/sqlite-libs@3.40.0, fixed in 0:3.40.0-1.amzn2023.0.8
        'CVE-2026-11824', // base image issue: pkg:rpm/amazon/sqlite-libs@3.40.0, fixed in 0:3.40.0-1.amzn2023.0.8
        'CVE-2026-27145', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.11
        'CVE-2026-42504', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.11
        'CVE-2026-40355', // base image issue: pkg:rpm/amazon/krb5-libs@1.21.3, fixed in 0:1.21.3-7.amzn2023.0.1
        'CVE-2026-40356', // base image issue: pkg:rpm/amazon/krb5-libs@1.21.3, fixed in 0:1.21.3-7.amzn2023.0.1
        'CVE-2026-48864', // base image issue: pkg:rpm/amazon/libsolv@0.7.22, fixed in 0:0.7.22-1.amzn2023.0.4
        'CVE-2026-6653', // base image issue: pkg:rpm/amazon/libxml2@2.10.4, fixed in 0:2.10.4-1.amzn2023.0.19
        'CVE-2026-8643', // base image issue: pkg:pypi/pip@24.2 (/var/lang base image runtime), fixed in 26.1.2
        'ALAS2023-2026-1916' // base image issue: pkg:rpm/amazon/libblkid@2.37.4 (util-linux), fixed in 0:2.37.4-1.amzn2023.0.5 - non-blocking (13d grace), suppressed preemptively
    ],
    'payoneer-webhooks': [
        'CVE-2026-12143', // pkg:npm/form-data@4.0.5 - /var/runtime/@aws-sdk base image issue, fixed in 4.0.6
        'CVE-2026-12151', // pkg:npm/undici@6.26.0 - /var/lang/lib/node_modules/npm base image issue
        'CVE-2026-41907', // pkg:npm/uuid@9.0.1 - /var/runtime/@aws-sdk base image issue, fixed in 11.1.1
        'CVE-2026-27903', // pkg:npm/minimatch@10.2.2 - base image issue
        'CVE-2026-27904', // pkg:npm/minimatch@10.2.2 - base image issue
        'CVE-2026-29786', // pkg:npm/tar@7.5.9 - base image issue
        'CVE-2026-31802', // pkg:npm/tar@7.5.9 - base image issue
        'CVE-2026-33671', // pkg:npm/picomatch@4.0.3 - base image issue
        'CVE-2026-33750' // pkg:npm/brace-expansion@5.0.3 - base image issue
    ],
    'payoneer-webhooks-payee': [
        // TAP-2652: new base-image scanner findings surfaced in build #1386
        'CVE-2026-21441', // base image runtime copy: pkg:pypi/urllib3, fixed in 2.6.3
        'CVE-2026-44431', // base image runtime copy: pkg:pypi/urllib3@1.26.19, fixed in 2.7.0 (app pins 2.7.0)
        'CVE-2026-33811', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2026-33814', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2026-39820', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2026-39836', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2026-42499', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.10
        'CVE-2024-33602', // aws-lambda-python:3.13 base image issue
        'CVE-2025-27113', // aws-lambda-python:3.13 base image issue
        'CVE-2025-6020', // aws-lambda-python:3.13 base image issue
        'CVE-2025-7425', // aws-lambda-python:3.13 base image issue
        'CVE-2024-56171', // aws-lambda-python:3.13 base image issue
        'CVE-2024-33599', // aws-lambda-python:3.13 base image issue
        'CVE-2025-49795', // aws-lambda-python:3.13 base image issue
        'CVE-2025-47907', // aws-lambda-rie: requires upgrade to fixed version 1.23.12 (currently unavailable/pinned)
        'CVE-2025-58187', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.24.6
        'CVE-2025-6052', // aws-lambda-python:3.13 base image issue
        'CVE-2022-49043', // aws-lambda-python:3.13 base image issue
        'CVE-2021-43396', // aws-lambda-python:3.13 base image issue
        'CVE-2025-66418', // urllib3@2.5.0: unbounded decompression chain, fixed in 2.6.0
        'CVE-2025-49796', // aws-lambda-python:3.13 base image issue
        'CVE-2023-52425', // aws-lambda-python:3.13 base image issue
        'CVE-2025-59375', // aws-lambda-python:3.13 base image issue
        'CVE-2025-0395', // aws-lambda-python:3.13 base image issue
        'CVE-2025-49794', // aws-lambda-python:3.13 base image issue
        'CVE-2025-1390', // aws-lambda-python:3.13 base image issue
        'CVE-2024-45490', // aws-lambda-python:3.13 base image issue
        'CVE-2025-9230', // aws-lambda-python:3.13 base image issue
        'CVE-2025-32415', // aws-lambda-python:3.13 base image issue
        'CVE-2025-47912', // base image issue: pkg:generic/aws-lambda-rie
        'CVE-2024-34459', // aws-lambda-python:3.13 base image issue
        'CVE-2024-33601', // aws-lambda-python:3.13 base image issue
        'CVE-2025-6965', // aws-lambda-python:3.13 base image issue
        'CVE-2025-24928', // aws-lambda-python:3.13 base image issue
        'CVE-2025-66471', // urllib3@2.5.0: streaming API highly compressed data issue, fixed in 2.6.0
        'CVE-2022-46908', // aws-lambda-python:3.13 base image issue
        'CVE-2025-1352', // fixed in 0:0.188-3.amzn2023.0.3
        'CVE-2025-32414', // aws-lambda-python:3.13 base image issue
        'CVE-2025-22871', // aws-lambda-rie (pinned go_toolchain=1.22.7)
        'CVE-2025-58188', //pkg:generic/aws-lambda-rie?go_toolchain=1.22.7
        'CVE-2025-61725', //pkg:generic/aws-lambda-rie?go_toolchain=1.22.7
        'CVE-2025-6021', // aws-lambda-python:3.13 base image issue
        'CVE-2025-8941', // aws-lambda-python base image issue: pkg:rpm/amazon/pam@1.5.1
        'CVE-2025-4802', // aws-lambda-python:3.13 base image issue
        'CVE-2025-5914', // aws-lambda-python:3.13 base image issue
        'CVE-2025-61729', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7 - HostnameError.Error() resource consumption
        'CVE-2025-13601', // base image issue: pkg:rpm/amazon/glib2@2.74.7-689.amzn2023.0.2
        'CVE-2025-22874', // aws-lambda-python:3.13 base image issue
        'CVE-2025-61723', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.24.6
        'CVE-2025-1372', //pkg:rpm/amazon/elfutils-default-yama-scope@0.188-3.amzn2023.0.2
        'CVE-2025-14087', // pkg:rpm/amazon/glib2
        'CVE-2025-9086', // pkg:rpm/amazon/libcurl-minimal
        'CVE-2026-3805', // pkg:rpm/amazon/libcurl-minimal@8.5.0, fixed in 0:8.17.0-1.amzn2023.0.3
        'CVE-2025-15467', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.2.2-1.amzn2023.0.4
        'CVE-2025-68121', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.24.13
        'CVE-2025-13151', // base image issue: pkg:rpm/amazon/libtasn1@4.19.0, fixed in 0:4.19.0-1.amzn2023.0.6
        'CVE-2025-15468', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2025-24528', // base image issue: pkg:rpm/amazon/krb5-libs@1.21.3, fixed in 0:1.21.3-6.amzn2023.0.1
        'CVE-2025-61726', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.24.12
        'CVE-2025-68973', // base image issue: pkg:rpm/amazon/gnupg2-minimal@2.3.7, fixed in 0:2.3.7-1.amzn2023.0.6
        'CVE-2025-69419', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2025-69420', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2025-69421', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2026-22796', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.2.2-1.amzn2023.0.5
        'CVE-2026-24882', // base image issue: pkg:rpm/amazon/gnupg2-minimal@2.3.7, fixed in 0:2.3.7-1.amzn2023.0.7
        'CVE-2026-25210', // base image issue: pkg:rpm/amazon/expat@2.5.0, fixed in 0:2.6.3-1.amzn2023.0.4
        'CVE-2026-25679', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.8
        'CVE-2026-2673', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.3
        'CVE-2026-32280', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.9
        'CVE-2026-27135', // base image issue: pkg:rpm/amazon/libnghttp2@1.59.0, fixed in 0:1.59.0-3.amzn2023.0.2
        'CVE-2026-28387', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.4
        'CVE-2026-28388', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.4
        'CVE-2026-28389', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.4
        'CVE-2026-28390', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.4
        'CVE-2026-31790', // base image issue: pkg:rpm/amazon/openssl-snapsafe-libs@3.0.8, fixed in 1:3.5.5-1.amzn2023.0.4
        'CVE-2026-32281', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.9
        'CVE-2026-32283', // base image issue: pkg:generic/aws-lambda-rie?go_toolchain=1.22.7, fixed in 1.25.9
        'CVE-2026-4046'  // base image issue: pkg:rpm/amazon/glibc-gconv-extra@2.34
    ],
    'post-to-subledger': [
        'CVE-2025-14087', // lambda/nodejs:24 base image issue
        'CVE-2025-61729', // lambda/nodejs:24 base image issue
        'CVE-2025-9086',   // lambda/nodejs:24 base image issue
        'CVE-2026-3805',   // lambda/nodejs:24 base image: pkg:rpm/amazon/libcurl-minimal@8.5.0, fixed in 0:8.17.0-1.amzn2023.0.3
        'CVE-2025-64756',  // pkg:npm/glob@10.4.5 somewhere in base image
        'CVE-2026-25547',   // pkg:npm/%40isaacs/brace-expansion@5.0.0 (fixed version 5.0.1)
        'CVE-2026-25896',   // pkg:npm/fast-xml-parser@4.5.3 (fixed version 4.5.4)
        'CVE-2025-69873',  // pkg:npm/ajv@6.12.6 (fixed version 6.14.0)
        'CVE-2026-23745',  // pkg:npm/tar@7.5.1 (fixed version 7.5.3)
        'CVE-2026-2391',   // pkg:npm/qs@6.14.1 (fixed version 6.14.2)
        'CVE-2026-23950',  // pkg:npm/tar@7.5.1 (fixed version 7.5.4)
        'CVE-2026-24001',  // pkg:npm/diff@8.0.2 (fixed version 8.0.3)
        'CVE-2026-24842',  // pkg:npm/tar@7.5.1 (fixed version 7.5.7)
        'CVE-2026-25128',  // pkg:npm/fast-xml-parser@5.2.5 (fixed version 5.3.4)
        'CVE-2026-25639',  // pkg:npm/axios@1.13.2 (fixed version 1.13.5)
        'CVE-2026-26278',  // pkg:npm/fast-xml-parser@4.5.3 (fixed version 4.5.4)
        'CVE-2026-26960',  // pkg:npm/tar@7.5.1 (fixed version 7.5.8)
        'CVE-2026-26996',  // pkg:npm/minimatch@9.0.5 (fixed version 9.0.6)
        'CVE-2025-62718', // pkg:npm/axios@1.13.2 - base image issue
        'CVE-2026-27903', // pkg:npm/minimatch@10.2.2 - base image issue
        'CVE-2026-27904', // pkg:npm/minimatch@10.2.2 - base image issue
        'CVE-2026-27942', // pkg:npm/fast-xml-parser@4.5.3 - base image issue
        'CVE-2026-29063', // pkg:npm/immutable@3.7.6 - base image issue
        'CVE-2026-29786', // pkg:npm/tar@7.5.9 - base image issue
        'CVE-2026-31802', // pkg:npm/tar@7.5.9 - base image issue
        'CVE-2026-32141', // pkg:npm/flatted@3.3.3 - base image issue
        'CVE-2026-33036', // pkg:npm/fast-xml-parser@4.5.3 - base image issue
        'CVE-2026-33228', // pkg:npm/flatted@3.3.3 - base image issue
        'CVE-2026-33671', // pkg:npm/picomatch@4.0.3 - base image issue
        'CVE-2026-33750', // pkg:npm/brace-expansion@5.0.3 - base image issue
        'CVE-2026-33937', // pkg:npm/handlebars@4.7.8 - base image issue
        'CVE-2026-33938', // pkg:npm/handlebars@4.7.8 - base image issue
        'CVE-2026-33939', // pkg:npm/handlebars@4.7.8 - base image issue
        'CVE-2026-33940', // pkg:npm/handlebars@4.7.8 - base image issue
        'CVE-2026-33941', // pkg:npm/handlebars@4.7.8 - base image issue
        'CVE-2026-4046', // pkg:rpm/amazon/glibc-langpack-en@2.34-231.amzn2023.0.3 - base image issue
        'CVE-2026-4800', // pkg:npm/lodash@4.17.21 - base image issue
        'CVE-2025-13465' // pkg:npm/lodash@4.17.21 (fixed in 4.17.23)
    ],
    'send-payments': [
        'CVE-2025-14087', // lambda/nodejs:24 base image issue
        'CVE-2025-61729', // lambda/nodejs:24 base image issue
        'CVE-2025-9086', // lambda/nodejs:24 base image issue
        'CVE-2026-3805', // lambda/nodejs:24 base image: pkg:rpm/amazon/libcurl-minimal@8.5.0, fixed in 0:8.17.0-1.amzn2023.0.3
        'CVE-2025-64756', // pkg:npm/glob@10.4.5
        'CVE-2026-25547', // pkg:npm/@isaacs/brace-expansion@5.0.0
        'CVE-2026-25896', // pkg:npm/fast-xml-parser@4.4.1
        'CVE-2025-69873', // pkg:npm/ajv@6.12.6
        'CVE-2026-23745', // pkg:npm/tar@7.5.1
        'CVE-2026-2391', // pkg:npm/qs@6.14.1
        'CVE-2026-23950', // pkg:npm/tar@7.5.1
        'CVE-2026-24001', // pkg:npm/diff@8.0.2
        'CVE-2026-24842', // pkg:npm/tar@7.5.1
        'CVE-2026-25128', // pkg:npm/fast-xml-parser@5.2.5
        'CVE-2026-25639', // pkg:npm/axios@1.13.2
        'CVE-2026-26278', // pkg:npm/fast-xml-parser@4.4.1 (fixed version 4.5.4)
        'CVE-2026-26960',  // pkg:npm/tar@7.5.1(fixed version 7.5.8)
        'CVE-2026-26996',  // pkg:npm/minimatch@9.0.5(fixed version 9.0.6)
        'CVE-2026-2673', // pkg:rpm/amazon/openssl-snapsafe-libs@3.2.2-1.amzn2023.0.5?arch=aarch64&distro=2023&epoch=1&source=openssl-3.2.2-1.amzn2023.0.5.src.rpm
        'CVE-2026-27903', // pkg:npm/minimatch@10.1.2 - base image
        'CVE-2026-27904', // pkg:npm/minimatch@10.1.2 - base image
        'CVE-2026-29786', // pkg:npm/tar@7.5.7 - base image
        'CVE-2026-31802', // pkg:npm/tar@7.5.9 - base image,
        'CVE-2025-62718',  // pkg:npm/axios@1.13.5 - base image
        'CVE-2026-33671',  // pkg:npm/picomatch@4.0.3
        'CVE-2026-33750',  // pkg:npm/brace-expansion@5.0.3 - base image
        'CVE-2026-4046', // pkg:rpm/amazon/glibc-langpack-en@2.34-231.amzn2023.0.3 - base image issue
        'CVE-2026-41907' // pkg:npm/uuid@9.0.1 - /var/runtime/@aws-sdk base image issue, fixed in 11.1.1
    ],
    'update-knr-vat-details': [
        'CVE-2025-46328', // snowflake-sdk: fixed in 2.0.4, temporary exception until it can be upgraded
        'CVE-2026-27903', // pkg:npm/minimatch@10.1.2 - base image
        'CVE-2026-27904', // pkg:npm/minimatch@10.1.2 - base image
        'CVE-2026-29786', // pkg:npm/tar@7.5.7 - base image
        'CVE-2026-31802', // pkg:npm/tar@7.5.9 - base image
        'CVE-2026-33750', // pkg:npm/brace-expansion@5.0.3 - /var/runtime/@aws-sdk base image issue
        'CVE-2026-41907', // pkg:npm/uuid@9.0.1 - /var/runtime/@aws-sdk base image issue
        'CVE-2026-48864', // pkg:rpm/amazon/libsolv@0.7.22-1.amzn2023.0.3 - base image issue, fixed in 0:0.7.22-1.amzn2023.0.4 (blocking)
        "CVE-2026-45149", // pkg:npm/brace-expansion@5.0.3 - /var/lang npm base image issue
        "CVE-2026-34182", // openssl-snapsafe-libs rpm in lambda base image
        "CVE-2026-34180", // openssl-snapsafe-libs rpm in lambda base image
        "CVE-2026-34181", // openssl-snapsafe-libs rpm in lambda base image
        "CVE-2026-34183", // openssl-snapsafe-libs rpm in lambda base image
        "CVE-2026-42764", // openssl-snapsafe-libs rpm in lambda base image
        "CVE-2026-42768", // openssl-snapsafe-libs rpm in lambda base image
        "CVE-2026-45445", // openssl-snapsafe-libs rpm in lambda base image
        "CVE-2026-45447", // openssl-snapsafe-libs rpm in lambda base image
        "CVE-2026-7383", // openssl-snapsafe-libs rpm in lambda base image
        "CVE-2026-9076", // openssl-snapsafe-libs rpm in lambda base image
        "CVE-2026-12143", // pkg:npm/form-data@4.0.5 - /var/runtime/@aws-sdk base image issue
        "CVE-2026-12151", // pkg:npm/undici@6.26.0 - /var/lang/lib/node_modules/npm base image issue
    ],
    'update-payee-info': [
        'CVE-2025-64756', // lambda/nodejs:24 base image issue
        'CVE-2025-62718', // pkg:npm/axios - base image issue
        'CVE-2026-25896', // pkg:npm/fast-xml-parser - base image issue
        'CVE-2026-29063', // pkg:npm/immutable - base image issue
        'CVE-2026-33228', // pkg:npm/flatted - base image issue
        'CVE-2026-33937', // pkg:npm/handlebars - base image issue
        'CVE-2026-4800', // pkg:npm/lodash - base image issue
        'CVE-2025-69873', // pkg:npm/ajv - base image issue
        'CVE-2026-2391', // pkg:npm/qs - base image issue
        'CVE-2026-24001', // pkg:npm/diff - base image issue
        'CVE-2026-25128', // pkg:npm/fast-xml-parser - base image issue
        'CVE-2026-25639', // pkg:npm/axios - base image issue
        'CVE-2026-26278', // pkg:npm/fast-xml-parser - base image issue
        'CVE-2026-26996', // pkg:npm/minimatch - base image issue
        'CVE-2026-27903', // pkg:npm/minimatch - base image issue
        'CVE-2026-27904', // pkg:npm/minimatch - base image issue
        'CVE-2026-27942', // pkg:npm/fast-xml-parser - base image issue
        'CVE-2026-29786', // pkg:npm/tar - base image issue
        'CVE-2026-31802', // pkg:npm/tar - base image issue
        'CVE-2026-32141', // pkg:npm/flatted - base image issue
        'CVE-2026-33036', // pkg:npm/fast-xml-parser - base image issue
        'CVE-2026-33671', // pkg:npm/picomatch - base image issue
        'CVE-2026-33750', // pkg:npm/brace-expansion - base image issue
        'CVE-2026-33938', // pkg:npm/handlebars - base image issue
        'CVE-2026-33939', // pkg:npm/handlebars - base image issue
        'CVE-2026-33940', // pkg:npm/handlebars - base image issue
        'CVE-2026-33941', // pkg:npm/handlebars - base image issue
        'CVE-2026-4046', // base image issue: pkg:rpm/amazon/glibc-langpack-en@2.34
        'CVE-2025-13465' // pkg:npm/lodash@4.17.21 (fixed in 4.17.23)
    ]
]

LAMBDA_ALIAS_MAP = [
    'calculate-payments': 'provisioned',
    'close-balance': 'provisioned',
    'generate-payments': 'provisioned',
    'knr-payments': 'provisioned',
    'knr-payments-approve': 'provisioned',
    'payoneer-program-move': 'provisioned',
    'payoneer-webhooks': 'provisioned',
    'post-to-subledger': 'provisioned',
    'send-payments': 'provisioned'
]

LAMBDA_JS_LIST = [
    'evaluate-payment-eligibility',
    'evaluate-tax-eligibility',
    'knr-payments',
    'knr-payments-approve',
    'knr-update-abacus-ledger',
    'payoneer-webhooks',
    'post-to-subledger',
    'send-payments',
    'update-knr-vat-details',
    'update-payee-info'
]

LAMBDA_JS_REDEPLOY_LIST = [
    'payoneer-webhooks'
]

def deploymentTargets = [
    'prod': [
        'accountId': '437795906767',
        'deploymentRole': 'prod-jenkins-aws-pipeline-agent'
    ],
    'uat_accounting': [
        'accountId': '989790945997',
        'deploymentRole': 'uat-jenkins-pipeline-deploy-role'
    ]
]

def functionDeploymentMap = [
    'calculate-payments': [
        'qa': ['prod'],
        'prod': ['prod'],
        'uat': ['uat_accounting']
    ],
    'close-balance': [
        'qa': ['prod'],
        'prod': ['prod'],
        'uat': ['uat_accounting']
    ],
    'generate-payments': [
        'qa': ['prod'],
        'prod': ['prod'],
        'uat': ['uat_accounting']
    ],
    'knr-payments': [
        'qa': ['prod'],
        'prod': ['prod'],
        'uat': ['uat_accounting']
    ],
    'knr-payments-approve': [
        'qa': ['prod'],
        'prod': ['prod']
    ],
    'payoneer-program-move': [
        'qa': ['prod'],
        'prod': ['prod'],
        'uat': ['uat_accounting']
    ],
    'payoneer-webhooks-payee': [
        'qa': ['prod'],
        'prod': ['prod'],
        'uat': ['uat_accounting']
    ],
    'payoneer-webhooks': [
        'qa': ['prod'],
        'prod': ['prod'],
        'uat': ['uat_accounting']
    ],
    'post-to-subledger': [
        'qa': ['prod'],
        'prod': ['prod'],
        'uat': ['uat_accounting']
    ],
    'send-payments': [
        'qa': ['prod'],
        'prod': ['prod'],
        'uat': ['uat_accounting']
    ],
    'evaluate-payment-eligibility': [
        'qa': ['prod'],
        'prod': ['prod'],
        'uat': ['uat_accounting']
    ],
    'evaluate-tax-eligibility': [
        'qa': ['prod'],
        'prod': ['prod'],
        'uat': ['uat_accounting']
    ],
    'knr-update-abacus-ledger': [
        'qa': ['prod'],
        'prod': ['prod']
    ],
    'load-from-s3': [
        'qa': ['prod'],
        'prod': ['prod'],
        'uat': ['uat_accounting']
    ],
    'update-knr-vat-details': [
        'qa': ['prod'],
        'prod': ['prod']
    ],
    'update-payee-info': [
        'qa': ['prod'],
        'prod': ['prod'],
        'uat': ['uat_accounting']
    ]
]

def payoutE2eTests = [
    'calculate-payments',
    'close-balance',
    'generate-payments',
    'knr-payments',
    'knr-payments-approve',
    'knr-update-abacus-ledger',
    'payoneer-webhooks',
    'post-to-subledger',
    'send-payments',
    'load-from-s3'
]

def payeeE2eTests = [
    'payoneer-program-move',
    'payoneer-webhooks-payee',
    'evaluate-payment-eligibility',
    'evaluate-tax-eligibility',
    'update-knr-vat-details',
    'update-payee-info',
    'payoneer-webhooks'
]


pipeline {
    agent none

    options {
        ansiColor('xterm')
        disableConcurrentBuilds()
        timestamps()
    }

    parameters {
        booleanParam(name: 'DEPLOY_TO_PROD', defaultValue: true, description: 'Whether or not to deploy to prod.')
        booleanParam(name: 'DEPLOY_UAT', defaultValue: true, description: 'Whether or not to deploy to UAT.')
        string(name: 'LAMBDA_FUNCTION_NAMES', defaultValue: '', description: 'Comma-separated list of Lambda function directory names to build and deploy')
        string(name: 'SHARED_LIBRARIES_VERSION', defaultValue: 'master', description: 'The version of the Jenkins shared libraries to use. Can be a branch, tag, Git revision or PR ref (e.g. pull/PR_NUMBER/merge).')
        booleanParam(name: 'RUN_CROSS_LAMBDA_TESTS', defaultValue: false, description: 'Whether or not to run across lambdas tests.')
        booleanParam(name: 'RUN_INTEGRATION_TESTS', defaultValue: false, description: 'Whether or not to run integration tests.')
    }

    triggers {
        issueCommentTrigger('.*retest this please.*')
        // cron(env.BRANCH_NAME == 'master' ? 'H */1 * * *' : '')
    }

    stages {
        stage('Load Shared Libraries') {
            steps {
                library "jenkins-global-libraries@${params.SHARED_LIBRARIES_VERSION}"
            }
        }

        stage('Compliance Checks') {
            steps {
                withModifiedFunctions(checkout: true) { functionName ->
                    echo "Running Compliance Checks for ${functionName}"
                    dir("lambda/${functionName}") {
                        complianceChecks()
                    }
                }
            }
        }

        stage('Build Test and Scan') {
            parallel {
                stage('Validate Software Catalog Definition') {
                    steps {
                        withModifiedFunctions(checkout: true) { functionName ->
                            echo "Validating Software Catalog Definition for ${functionName}"
                            datadogSoftwareCatalogValidate(servicePath: "lambda/${functionName}")
                        }
                    }
                }

                stage('Unit Tests and Style Checks') {
                    steps {
                        withModifiedFunctions(checkout: true, agentLabel: 'can_reach_orchard_aws_dev') { functionName ->
                            withCredentials([string(credentialsId: 'github_packages_token', variable: 'GITHUB_NPM_TOKEN'),]) {
                                script {
                                    echo "Running Unit Tests and Style Checks for ${functionName}"
                                    dir("lambda/${functionName}") {
                                        withEnv(["COMPOSE_PROJECT_NAME=${env.BUILD_TAG.toLowerCase()}-${functionName}"]) {
                                            try {
                                                sh "touch .env && docker compose run --rm --build lint-and-test"
                                            }
                                            finally {
                                                sh "docker compose down --remove-orphans || true"
                                            }
                                        }
                                    }
                                }
                            }
                        }
                    }
                }

                stage('Static Application Security Tests') {
                    steps {
                        withModifiedFunctions(checkout: true) { functionName ->
                            echo "Running Static App Security Tests for ${functionName}"
                            sastTests(projectDir: "lambda/${functionName}", v2: true)
                        }
                    }
                }

                stage('Sonar Scan and Analysis') {
                    agent any
                    when {
                        branch 'master'
                    }
                    steps {
                        withModifiedFunctions(checkout: true) { functionName ->
                            echo "Running Sonar scan for ${functionName}"
                            sonarScan project: "${GITHUB_REPOSITORY}-${functionName.replaceAll('_', '-')}",
                                language: LAMBDA_JS_LIST.contains(functionName) ? 'ts' : 'py',
                                projectBaseDir: "lambda/${functionName}"
                        }
                    }
                    post {
                        cleanup { cleanWs() }
                    }
                }

                stage('Create and Scan a Release') {
                    when {
                        anyOf {
                            branch 'master'
                            expression { env.GITHUB_COMMENT =~ 'build docker' }
                        }
                    }
                    steps {
                        withModifiedFunctions(checkout: true) { functionName ->
                            withCredentials([string(credentialsId: 'github_packages_token', variable: 'GITHUB_NPM_TOKEN')]) {
                                echo "Building for ${functionName}"
                                dockerToEcr awsRegions: AWS_REGIONS,
                                    ecrAccountId: ECR_ACCOUNT_ID,
                                    imageName: "${GITHUB_REPOSITORY}-${functionName.replaceAll('_', '-')}",
                                    imageTag: env.GIT_COMMIT,
                                    dockerBuildContext: "lambda/${functionName}",
                                    dockerBuildSecrets: [[id: 'GITHUB_NPM_TOKEN', env: 'GITHUB_NPM_TOKEN']],
                                    dockerBuildFile: "lambda/${functionName}/Dockerfile"
                            }
                            echo "Scanning Docker Images for ${functionName}"
                            dir("lambda/${functionName}") {
                                dockerScan awsRegion: AWS_REGIONS[0],
                                    ecrAccountId: ECR_ACCOUNT_ID,
                                    imageName: "${GITHUB_REPOSITORY}-${functionName.replaceAll('_', '-')}",
                                    imageTag: env.GIT_COMMIT,
                                    vulnerabilitiesToIgnore: VULNERABILITIES_TO_IGNORE_BY_FUNCTION[functionName] ?: []
                            }
                        }
                    }
                }
            }
        }

        stage('Deploy to QA') {
            when {
                branch 'master'
            }
            steps {
                script {
                    withModifiedFunctions { functionName ->
                        echo "Deploying to QA for ${functionName}"
                        dir("lambda/${functionName}") {
                            functionDeploymentMap[functionName]['qa'].each { account ->
                                lambdaDeploy environment: 'qa',
                                    awsRegions: AWS_REGIONS,
                                    imageTag: env.GIT_COMMIT,
                                    imageName: "${GITHUB_REPOSITORY}-${functionName.replaceAll('_', '-')}",
                                    ecrRegistryAccountId: ECR_ACCOUNT_ID,
                                    awsDeploymentTargetAccountId: deploymentTargets[account].accountId,
                                    awsDeploymentRoleName: deploymentTargets[account].deploymentRole,
                                    aliasName: LAMBDA_ALIAS_MAP.get(functionName),
                                    publishVersion: LAMBDA_ALIAS_MAP.get(functionName) as Boolean
                            }
                        }
                    }
                }
            }
        }

        stage('Integration Tests') {
            agent any
            when {
                anyOf {
                    branch 'master'
                    expression { params.RUN_INTEGRATION_TESTS }
                }
            }
            steps {
                script {
                    def functions = getFunctionsToBuild()
                    def integrationFunctions = functions.findAll { it in INTEGRATION_TESTS_FUNCTIONS }
                    if (integrationFunctions) {
                        withEcr {
                            withAWS(roleAccount: QA_ACCOUNT_ID, role: BUILD_ROLE, roleSessionName: env.BUILD_TAG, useNode: true) {
                                integrationFunctions.each { functionName ->
                                    echo "Running integration tests for ${functionName}"
                                    dir("tests") {
                                        try {
                                            sh "make docker_run_integration_tests function=${functionName}"
                                        } finally {
                                            sh "docker compose down"
                                        }
                                    }
                                }
                            }
                        }
                    } else {
                        echo "Skipping integration tests: not implemented for these functions"
                    }
                }
            }
            post {
                always {
                    script {
                        getFunctionsToBuild().each { functionName ->
                            echo "Publishing Integration Test Report for ${functionName}"
                            publishHTML([
                                reportName: "Integration Tests Report",
                                reportDir: 'tests/report',
                                reportFiles: "report_${functionName}.html",
                                keepAll: true,
                                alwaysLinkToLastBuild: false,
                                allowMissing: true
                            ])
                        }
                    }
                }
                failure {
                    echo "\nFOLLOW THIS LINK TO DOWNLOAD AND VIEW TEST REPORTS:"
                    echo "${env.JOB_URL}${env.BUILD_NUMBER}/Integration_20Tests_20Report/*zip*/Integration_20Tests_20Report.zip"
                    echo "------------------------------------\n\n"
                }
                regression {
                    slackNotify channel: SLACK_E2E_NOTIFY_CHANNEL,
                                stepName: 'Integration Tests: Lambda Documents'
                }
                fixed {
                    slackNotify channel: SLACK_E2E_NOTIFY_CHANNEL,
                                stepName: 'Integration Tests: Lambda Documents'
                }
                cleanup { cleanWs() }
            }
        }

        stage('Cross Lambda Tests') {
            agent any
            when {
                anyOf {
                    branch 'master'
                    expression { params.RUN_CROSS_LAMBDA_TESTS }
                }
            }
            steps {
                script {
                    def functions = getFunctionsToBuild()
                    if (functions && functions.any { it in CROSS_LAMBDA_FUNCTIONS }) {
                        withEcr {
                            withAWS(roleAccount: QA_ACCOUNT_ID, role: BUILD_ROLE, roleSessionName: env.BUILD_TAG, useNode: true) {
                                echo "Running cross lambda tests for functions: ${functions.join(', ')}"
                                dir("tests") {
                                    try {
                                        sh "make docker_run_cross_lambda_tests"
                                    }
                                    finally {
                                        sh "docker compose down"
                                    }
                                }
                            }
                        }
                    } else {
                        echo "Skipping cross-lambda tests: not needed for these functions"
                    }
                }
            }
            post{
                always {
                    script {
                        def functions = getFunctionsToBuild()
                        if (functions && functions.any { it in CROSS_LAMBDA_FUNCTIONS }) {
                            publishHTML([
                                reportName: 'Cross Lambda Tests Report',
                                reportDir: 'tests/report',
                                reportFiles: 'report_cross_lambda.html',
                                keepAll: true,
                                alwaysLinkToLastBuild: false,
                                allowMissing: true
                            ])
                        }
                    }
                }
                failure {
                    echo "\nFOLLOW THIS LINK TO DOWNLOAD AND VIEW TEST REPORTS:"
                    echo "${env.JOB_URL}${env.BUILD_NUMBER}/Cross_20Lambda_20Tests_20Report/*zip*/Cross_20Lambda_20Tests_20Report.zip"
                    echo "------------------------------------\n\n"
                }
                regression {
                    slackNotify channel: SLACK_E2E_NOTIFY_CHANNEL,
                                stepName: 'Cross Lambda Tests'
                }
                fixed {
                    slackNotify channel: SLACK_E2E_NOTIFY_CHANNEL,
                                stepName: 'Cross Lambda Tests'
                }
                cleanup { cleanWs() }
            }
        }

        stage('E2E Playwright Tests') {
            agent any
            when {
                branch 'master'
            }
            environment {
                ADDITIONAL_ENV_VARS = '[{"TRACE":"on"}]'
            }
            steps {
                lock(resource: 'e2e-tests-tap-queue') {
                    script {
                        playwrightTests tags: "@lambda_documents_payee",
                        reportSuffix: "banking-tax-details"
                    }
                }
            }
            post {
                cleanup { cleanWs() }
            }
        }

        stage('E2E Closing Balances Tests') {
            agent any
            when {
                branch 'master'
            }
            environment {
                ADDITIONAL_ENV_VARS = '[{"TRACE":"on"}]'
            }            
            steps {
                lock(resource: 'e2e-tests-documents') {
                    script {
                        def functions = getFunctionsToBuild();
                        def E2E_TEST_TAGS = [];

                        if (functions?.any { it in payoutE2eTests }) {
                            playwrightTests tags: "@lambda_documents_payout_all", reportSuffix: "closing-balances-results", runtimeEnvironment: 'ecs'
                            E2E_TEST_TAGS << "@lambda_documents_payout_all"
                        }
                        if (functions?.any { it in payeeE2eTests }) {
                              echo "Skipping payee E2E tests for functions: ${functions.findAll { it in payeeE2eTests }}"
                        }
                        // run everything, if there are no functions to build OR the function does not have a designated group
                        if (E2E_TEST_TAGS.isEmpty()) {
                            playwrightTests tags: "@lambda_documents_payout_all", reportSuffix: "closing-balances-results", runtimeEnvironment: 'ecs'
                        }
                    }
                }
            }
            post {
                cleanup { cleanWs() }
            }
        }

        stage('Deploy to UAT and PROD') {
            when {
                branch 'master'
            }
            parallel {
                stage('Deploy to UAT') {
                    when {
                        expression { params.DEPLOY_UAT }
                    }
                    steps {
                        script {
                            withModifiedFunctions { functionName ->
                                def uatTargets = functionDeploymentMap[functionName]?.get('uat')
                                if (!uatTargets) {
                                    echo "Skipping UAT deploy for ${functionName}: no UAT target configured"
                                    return
                                }
                                echo "Deploying to UAT for ${functionName}"
                                dir("lambda/${functionName}") {
                                    uatTargets.each { account ->
                                        lambdaDeploy environment: 'uat',
                                            awsRegions: AWS_REGIONS,
                                            imageTag: env.GIT_COMMIT,
                                            imageName: "${GITHUB_REPOSITORY}-${functionName.replaceAll('_', '-')}",
                                            ecrRegistryAccountId: ECR_ACCOUNT_ID,
                                            awsDeploymentTargetAccountId: deploymentTargets[account].accountId,
                                            awsDeploymentRoleName: deploymentTargets[account].deploymentRole,
                                            aliasName: LAMBDA_ALIAS_MAP.get(functionName),
                                            publishVersion: LAMBDA_ALIAS_MAP.get(functionName) as Boolean
                                    }
                                }
                            }
                        }
                    }
                }
                stage('Deploy to PROD') {
                    when {
                        expression { params.DEPLOY_TO_PROD }
                    }
                    steps {
                        script {
                            withModifiedFunctions(checkout: true) { functionName ->
                                echo "Deploying to PROD for ${functionName}"
                                dir("lambda/${functionName}") {
                                    functionDeploymentMap[functionName]['prod'].each { account ->
                                        lambdaDeploy environment: 'prod',
                                            awsRegions: AWS_REGIONS,
                                            imageTag: env.GIT_COMMIT,
                                            imageName: "${GITHUB_REPOSITORY}-${functionName.replaceAll('_', '-')}",
                                            ecrRegistryAccountId: ECR_ACCOUNT_ID,
                                            awsDeploymentTargetAccountId: deploymentTargets[account].accountId,
                                            awsDeploymentRoleName: deploymentTargets[account].deploymentRole,
                                            aliasName: LAMBDA_ALIAS_MAP.get(functionName),
                                            publishVersion: LAMBDA_ALIAS_MAP.get(functionName) as Boolean
                                    }
                                }
                                datadogSoftwareCatalogPublish(servicePath: "lambda/${functionName}")
                            }
                        }
                    }
                }
            }
        }
    }

    post {
        regression {
            script {
                if (env.BRANCH_NAME == 'master') {
                    slackNotify channel: SLACK_NOTIFICATIONS_CHANNEL
                }
            }
        }
        fixed {
            script {
                if (env.BRANCH_NAME == 'master') {
                    slackNotify channel: SLACK_NOTIFICATIONS_CHANNEL
                }
            }
        }
    }
}


def getFunctionsToBuild() {
    if (this.@functionsToBuild != null) {
        return this.@functionsToBuild
    }

    def lambdaFunctionName = params.LAMBDA_FUNCTION_NAME ?: null

    if (lambdaFunctionName) {
        this.@functionsToBuild = [lambdaFunctionName]
    } else {
        node {
            def scmVars = checkout scm

            def isCronTrigger = currentBuild.getBuildCauses().any { cause ->
                cause._class == 'hudson.triggers.TimerTrigger$TimerTriggerCause'
            }

            if (isCronTrigger && env.BRANCH_NAME == 'master') {
                this.@functionsToBuild = LAMBDA_JS_REDEPLOY_LIST
            } else {
                def lambdaDirectories = findFiles(glob: '**/Dockerfile', excludes: '**/example/Dockerfile, **/tests/**')
                this.@functionsToBuild = getModifiedFunctions branchName: scmVars.BRANCH_NAME,
                    previousSuccessfulCommit: scmVars.GIT_PREVIOUS_SUCCESSFUL_COMMIT,
                    lambdaDirectories: lambdaDirectories
            }
        }
    }

    if (this.@functionsToBuild) {
        currentBuild.description = this.@functionsToBuild.join('<br>')
    }
    return this.@functionsToBuild
}

def withModifiedFunctions(Map args = [:], Closure steps) {
    getMonorepoUtils().withModifiedProjects(args, steps)
}

def getMonorepoUtils() {
    return library("jenkins-global-libraries@${params.SHARED_LIBRARIES_VERSION}").com.sonymusic.MonorepoUtils.getInstance(
        steps: this,
        projectBasePath: 'lambda',
        projectsToBuild: params.LAMBDA_FUNCTION_NAMES ? params.LAMBDA_FUNCTION_NAMES.split(',') : null
    )
}