[SandObserver]

Summary

• Add a Security entry under [Unreleased] for CVE-2026-77214 and CVE-2026-102633 in expat. Alpine fixes both in expat 2.9.0-r0, which the image's apk upgrade step installs on a clean build.

Testing
All green. A no-cache image build installs libexpat 2.9.0-r0 and its Trivy scan reports 0 HIGH or CRITICAL findings.

Changelog

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.