diff --git a/.trivy/npmplus.yaml b/.trivy/npmplus.yaml
index f870c5233c..0bba1bfa53 100644
--- a/.trivy/npmplus.yaml
+++ b/.trivy/npmplus.yaml
@@ -1,19 +1,19 @@
-# Packaging-tool exceptions; reviewed on 2026-10-02, all expire 2026-10-04.
-# Scanned with Trivy 0.74.0 on 2026-10-02: ghcr.io/mangyan1/npmplus@sha256:a23d3d57a509feb8a0e38f576bee1db14d30c048a55bb42ed8a364d2d3d95430
+# Packaging-tool exceptions; reviewed on 2026-10-04, all expire 2026-10-11.
+# Scanned with Trivy 0.74.0 on 2026-10-04: ghcr.io/mangyan1/npmplus@sha256:e9e90bc214ff757290e4b929f68ea12bc2afc724bb0efc7ae6abb9c08a601bff
 vulnerabilities:
   - id: CVE-2025-47273
-    expired_at: 2026-10-04
-    statement: "Rechecked 2026-10-02: setuptools metadata finding persists, but no installed setuptools distribution is listed by Python. Keep upstream-compatible Certbot runtime plugin support; reassess with the next pip image update."
+    expired_at: 2026-10-11
+    statement: "Rechecked 2026-10-04: setuptools 70.3.0 metadata finding persists, but no installed setuptools distribution is listed by Python; pip 26.2.1 is still the latest release. Keep upstream-compatible Certbot runtime plugin support; reassess with the next pip image update."
   - id: GHSA-6v7p-g79w-8964
-    expired_at: 2026-10-04
-    statement: "Rechecked 2026-10-02: pip 26.2.1 vendors msgpack 1.1.2; scanner lists 1.2.1 as fixed. Runtime Certbot plugin installation remains intentional; await a reviewed pip vendor update rather than modifying its bundled modules."
+    expired_at: 2026-10-11
+    statement: "Rechecked 2026-10-04: pip 26.2.1 vendors msgpack 1.1.2; scanner lists 1.2.1 as fixed; pip 26.2.1 is still the latest release. Runtime Certbot plugin installation remains intentional; await a reviewed pip vendor update rather than modifying its bundled modules."
   - id: CVE-2026-97687
     purls:
       - pkg:pypi/urllib3@2.7.0
-    expired_at: 2026-10-04
-    statement: "Reviewed 2026-10-02: latest stable pip 26.2.1 embeds urllib3 2.7.0 in its vendor bundle/SBOM; the separately installed Certbot urllib3 is pinned to patched 2.8.0 and pip check passes. Accept the remaining packaging-tool HTTPS-proxy TLS risk temporarily under the owner decision preserving runtime DNS-plugin installation; not universally unreachable. Await a fixed pip release, retain suppressed findings in artifacts, and reassess by expiry. Advisory: https://github.com/advisories/GHSA-8988-9cw3-xx77"
+    expired_at: 2026-10-11
+    statement: "Rechecked 2026-10-04: pip 26.2.1 is still the latest release and still embeds urllib3 2.7.0 in its vendor bundle/SBOM; the separately installed Certbot urllib3 remains pinned to patched 2.8.0 and pip check passes. Accept the remaining packaging-tool HTTPS-proxy TLS risk temporarily under the owner decision preserving runtime DNS-plugin installation; not universally unreachable. Await a fixed pip release, retain suppressed findings in artifacts, and reassess by expiry. Advisory: https://github.com/advisories/GHSA-8988-9cw3-xx77"
   - id: CVE-2026-97689
     purls:
       - pkg:pypi/urllib3@2.7.0
-    expired_at: 2026-10-04
-    statement: "Reviewed 2026-10-02: latest stable pip 26.2.1 embeds urllib3 2.7.0 in its vendor bundle/SBOM; installed Certbot urllib3 is patched at 2.8.0. Malicious chunked responses during pip downloads remain a packaging-tool availability risk, not a false positive. Keep runtime DNS-plugin installation per the owner decision, do not modify pip's bundled modules, retain suppressed findings in artifacts, and reassess by expiry. Advisory: https://github.com/advisories/GHSA-vxq7-64xx-v4gw"
+    expired_at: 2026-10-11
+    statement: "Rechecked 2026-10-04: pip 26.2.1 is still the latest release and still embeds urllib3 2.7.0; installed Certbot urllib3 is patched at 2.8.0. Malicious chunked responses during pip downloads remain a packaging-tool availability risk, not a false positive. Keep runtime DNS-plugin installation per the owner decision, do not modify pip's bundled modules, retain suppressed findings in artifacts, and reassess by expiry. Advisory: https://github.com/advisories/GHSA-vxq7-64xx-v4gw"
\ No newline at end of file