Merge branch 'main' into slice/131-container-supply-chain

Signed-off-by: Ayla Croft <aylacroft@proton.me>

Author: HackTuah

ci/headless/justifications.yaml

@@ -84,9 +84,10 @@ justifications:
 
   # openssl-libs: added by this image (the crypto NIF links libcrypto). Red Hat lists no fix for
   # either; `dnf upgrade` ran against the installroot at build time, so this is the newest build
-  # UBI's repositories carried.
+  # UBI's repositories carried. Re-pinned 2026-10-08 from 3.5.8-1 to Red Hat's 3.5.8-2 rebuild, which
+  # the scan still reports as not fixed for both.
   - finding: "CVE-2026-75804"
-    package: "openssl-libs-1:3.5.8-1.el9_8"
+    package: "openssl-libs-1:3.5.8-2.el9_8"
     packagePath: null
     severity: "high"
     scanSource: "grype"
@@ -97,7 +98,7 @@ justifications:
       application implements TLS in Erlang without libssl. Red Hat lists no fix; the build ran dnf
       upgrade, so this is the newest openssl-libs UBI carried.
   - finding: "CVE-2026-84782"
-    package: "openssl-libs-1:3.5.8-1.el9_8"
+    package: "openssl-libs-1:3.5.8-2.el9_8"
     packagePath: null
     severity: "high"
     scanSource: "grype"