Skip to content

chore(deps): update dependency trivy to v0.75.0 - #340

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/trivy-0.x
Open

renovate[bot] wants to merge 1 commit into
masterfrom
renovate/trivy-0.x

Conversation

@renovate

@renovate renovate Bot commented Jun 5, 2026 •

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update New value References Sourcegraph
trivy minor 0.75.0 source code search for "trivy"

Test plan: CI should pass with updated dependencies. No review required: this is an automated dependency update PR.


Release Notes

aquasecurity/trivy (trivy)

v0.75.0

Compare Source

⚠ BREAKING CHANGES
  • report: remove getHostByName from templates (#​11206)
Features
Bug Fixes
  • avoid panics on malformed dependency files and version-less Amazon Linux release (#​10996) (ef28d95)
  • correct grammar and typos in user-facing error messages (#​11211) (a8c8409)
  • correct grammar and typos in user-facing error messages and CLI flags (#​11281) (5ba5be0)
  • crypto: read RSA private keys without validating their math (#​11319) (3683d7d)
  • go: honor go directive when merging go.sum (#​11169) (71190a6)
  • go: restore stdlib version parsing for vendor-patched Go toolchains (#​11119) (a851889)
  • license: report unparsable license names with UNKNOWN severity (#​11254) (7b598ab)
  • license: use canonical SPDX casing for license.id (#​11165) (89d3acf)
  • misconf: report correct line numbers in multi-document manifests (#​11207) (4eac9a0)
  • nodejs: support boolean resolved field in package-lock.json (#​11156) (a2474b8)
  • os: keep the fullest OS version when merging analyzer results (#​11039) (0afeae0)
  • purl: classify julia, bottlerocket and centos stream packages (#​11326) (3a1b311)
  • python: skip pip requirement lines with malformed extras brackets (#​11300) (7e71d21)
  • python: support uv workspace lockfiles (#​10553) (a072319)
  • report: remove getHostByName from templates (#​11206) (9b2b830)
  • repo: strip credentials from remote repository URL in artifact name (#​11213) (c961eeb)
  • sbom: skip null entries in SPDX file and package arrays (#​11101) (0aaaa71)
  • server: propagate package modularity label, build info and installed files (#​11188) (bf9f5b7)
  • set locations for JSON values sharing a line (#​11231) (e5b5a3a)
  • terraform: do not override --skip-files with --skip-dirs (#​11191) (1c8c54f)
  • vex: avoid panic on CSAF relationships without a sub-component (#​11067) (ae561f8)
Performance Improvements

v0.74.0

Compare Source

⚡ Highlights ⚡

👉 https://redirect.github.com/aquasecurity/trivy/discussions/11096

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0740-2026-08-14

v0.73.0

Compare Source

Features
Bug Fixes

v0.72.0

Compare Source

⚡ Highlights ⚡

👉 https://redirect.github.com/aquasecurity/trivy/discussions/10907

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0720-2026-06-30

v0.71.2

Compare Source

Changelog

v0.71.1

Compare Source

Changelog

  • 164b383 release: v0.71.1 [release/v0.71] (#​10818)
  • a72d9a4 fix(oci): validate artifact filename
  • 3dd9847 fix: forward ospkg detector options through ospkg.NewScanner [backport: release/v0.71] (#​10825)
  • a62cbe4 fix(vex): load VEX documents from within the repository directory [backport: release/v0.71] (#​10821)
  • 43d1d26 fix: surface the original analysis error instead of context cancellation [backport: release/v0.71] (#​10812)
  • ac7696c ci: expect GitHub App bot as backport PR author [backport: release/v0.71] (#​10815)

v0.71.0

Compare Source

⚡ Highlights ⚡

👉 https://redirect.github.com/aquasecurity/trivy/discussions/10767

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0710-2026-06-01

v0.70.0

Compare Source

⚡ Highlights ⚡

👉 https://redirect.github.com/aquasecurity/trivy/discussions/10546

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0700-2026-04-16

v0.69.3

Compare Source

Changelog

  • 6fb20c8 release: v0.69.3 [release/v0.69] (#​10293)
  • dabefec fix(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 [backport: release/v0.69] (#​10291)

v0.69.2

Compare Source

Changelog

  • cfa322e release: v0.69.2 [release/v0.69] (#​10266)
  • 86debce fix(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 [backport: release/v0.69] (#​10267)
  • cf3d4cd fix(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 [backport: release/v0.69] (#​10264)
  • 6dfd3b0 ci: remove apidiff workflow

v0.26.0

Compare Source

Changelog

v0.25.4

Compare Source

Changelog

v0.25.3

Compare Source

Changelog

  • d4e3df8 fix(downloadDB): add dbRepositoryFlag to repository and rootfs commands (#​1956)
  • 7e48cc1 fix(misconf): update BurntSushi/toml for fix runtime error (#​1948)
  • c9efa8c fix(misconf): Update fanal/defsec to resolve missing metadata issues (#​1947)
  • 52b7154 feat(jar): allow setting Maven Central URL using environment variable (#​1939)
  • 21f7a41 chore(chart): update Trivy version in HelmChart to 0.25.0 (#​1931)
  • ff2b3d1 chore(chart): remove version comments (#​1933)

v0.25.2

Compare Source

Changelog

v0.25.1

Compare Source

Changelog

v0.25.0

Compare Source

Changelog

v0.24.4

Compare Source

Changelog

  • 06659f1 fix(docker): Getting images without a tag (#​1852)
  • a91cc50 docs(gitlab-ci): Use environment variables TRIVY_CACHE_DIR and TRIVY_NO_PROGRESS (#​1801)

v0.24.3

Compare Source

Changelog

v0.24.2

Compare Source

Changelog

eebf9c8 fix(pom): keep an order of dependencies (#​1784)
971092b chore: bump up Go to 1.17 (#​1781)
2f2d822 chore(deps): bump actions/setup-python from 2 to 3 (#​1776)
a2afd6e chore(deps): bump golangci/golangci-lint-action from 2 to 3.1.0 (#​1777)

Docker images

  • docker pull aquasec/trivy:0.24.2
  • docker pull ghcr.io/aquasecurity/trivy:0.24.2
  • docker pull public.ecr.aws/aquasecurity/trivy:0.24.2

v0.24.1

Compare Source

Changelog

a423b99 fix(python): correct handling pip package names with a hyphen (#​1771)
a069ad7 doc(docker): fix command to run trivy with docker on linux (#​1761)
015055e feat(helm): Add support for custom labels (#​1767)
cbaa363 chore(helm): bump chart to trivy 0.24.0 (#​1762)
bec02f0 docs: remove erroneous command (#​1763)

Docker images

  • docker pull aquasec/trivy:0.24.1
  • docker pull ghcr.io/aquasecurity/trivy:0.24.1
  • docker pull public.ecr.aws/aquasecurity/trivy:0.24.1

v0.24.0

Compare Source

Changelog

d7f8b92 chore(deps): bump github.com/spf13/afero from 1.6.0 to 1.8.1 (#​1708)
59ea0d5 fix(option): warn list-all-pkgs only with the table format (#​1755)
c788676 feat(option): warn "--list-all-pkgs" with "--format table" (#​1632)
58ade46 feat(report): add support for CycloneDX (#​1081)
77cab6e chore(deps): update the defsec and tfsec versions (#​1747)
2ede15d fix(scanner): fix skip of language-specific files when scanning rootf… (#​1751)
d266c74 chore(deps): bump github.com/google/wire from 0.4.0 to 0.5.0 (#​1712)
4423396 feat(report): considering App.Writer when printing results (#​1722)
356ae30 chore(deps): replace satori version and skipping examples folder (#​1745)
477dc7d build: add s390x container images (#​1726)
89b8d7f feat(template) Add misconfigurations to junit report (#​1724)
219b71b chore(deps): bump github.com/twitchtv/twirp (#​1709)
aa6e1eb feat(client): configure TLS InsecureSkipVerify for server connection (#​1287)
de6c3cb fix(rpc): Supports RPC calls for new identifier CustomResource (#​1605)
b7d4d1e chore(deps): bump go.uber.org/zap from 1.20.0 to 1.21.0 (#​1705)
e6c029d chore(deps): bump github.com/caarlos0/env/v6 from 6.0.0 to 6.9.1 (#​1707)
ec6cb1a feat(helm): Parameterise ServiceAccount annotations (#​1677)
7dfc16c chore(deps): bump github.com/hashicorp/go-getter from 1.5.2 to 1.5.11 (#​1710)
42d8fd6 chore(deps): bump github.com/cheggaaa/pb/v3 from 3.0.3 to 3.0.8 (#​1704)
c3ef203 chore(deps): bump github.com/open-policy-agent/opa from 0.36.1 to 0.37.2 (#​1711)
274103e chore(dependabot): enable gomod monthly (#​1699)
e618d83 fix(gitlab tpl): escape double quote (#​1635)
3b0b2ed build: Make make protoc be consistent (#​1682)
5c8d098 feat(purl): add generate purl package utilities (#​1574)
11f4f81 refactor: move result structs under types (#​1696)
6db2092 feat(mariner): add support for CBL-Mariner 2.0 (#​1694)
8898bb0 docs(gitlab-ci): fix Script in GitLab CI Example #​1688
33d0833 chore: Upgrade helm chart version (#​1683)
13874d8 chore(mod): update Go dependencies (#​1681)
f26a06b docs: fix typos in markdown docs (#​1674)
e2821a4 docs: update documentation for image scanning of tar files to use a tag present on Docker Hub (#​1671)
ef8a1af fix(repo): --no-progress suppresses git output (#​1669)

Docker images

  • docker pull aquasec/trivy:0.24.0
  • docker pull ghcr.io/aquasecurity/trivy:0.24.0
  • docker pull public.ecr.aws/aquasecurity/trivy:0.24.0

v0.23.0

Compare Source

Changelog

449add2 docs: add ACR navigator (#​1651)
cb9afc8 fix: update example Rego files and docs (#​1628)
78b2b89 feat(option): show a link to GitHub Discussions for --light deprecation (#​1650)
52fd3c2 fix(sarif): fix the warning message (#​1647)
8d5882b refactor: migrate to prefixed buckets (#​1644)
84dd33f feat(mariner): add support for CBL-Mariner (#​1640)
9e903a1 docs: commercial use available (#​1641)
f4c746a feat: support azure acr (#​1611)
420f8ab feat(os-pkg): add data sources (#​1636)
d2827cb feat(redhat): support build info in RHEL (#​807)
ce703ce fix: change links in pull_request_template to static URLs (#​1634)
50bb938 feat(lang-pkg): add data sources (#​1625)
a31ddbe feat(detector): support custom detector (#​1615)
3a4e18a docs(contribution): change role who should resolve comments (#​1618)
8ba6836 docs: add PR template (#​1602)
f5c5573 feat(rocky): support Rocky Linux (#​1570)
eab2b42 Add the ability to set dockerhub credentials in the helm chart (#​1569)
cabd18d feat(cache): redis TLS support (#​1297)
02c3c36 feat(java): add support for PAR files (#​1599)
4f7b768 refactor(rust): move rust-advisory-db to OSV (#​1591)
d754cb8 feat: log ignored vulnerabilities on debug (#​1378)
a936e67 chore(mod): hcl2json deps update (#​1585)
af116d3 fix(rpm): do not ignore installed files via third-party rpm (#​1594)
b507360 feat(fs): allow scanning a single file (#​1578)
7fcbf44 refactor(python): drop Safety DB (#​1580)
478d279 feat: added insecure tls skip to scan git repo (#​1528)
33bd41b Supress git clone output (#​1590)
39a1008 fix(alma): skip modular package because MODULARITYLABEL is not set (#​1588)
37abd61 feat(photon os): added EOL dates check (#​1587)
78de33e docs: update supported os (#​1586)
2205462 BREAKING: remove root command (#​1579)
28ddcf1 docs: add Rust to Language-specific Packages Table (#​1577)
df134c7 docs: update int doc for gitlab ci (#​1575)
8da20c8 BREAKING: migrate the sarif template to Go code (#​1437)
714b5ca refactor: remove unused field (#​1567)
51e152b chore(deps): bump helm/chart-testing-action from 2.1.0 to 2.2.0 (#​1554)
884daff docs: gitlab integration (#​1381)
2a8336b feat(alma): support AlmaLinux (#​1238)
1e171af docs: added note about default template path when Trivy installed using rpm (#​1551)
e65274e BREAKING: Trivy DB from GHCR (#​1539)
db35450 feat(cli): Do not set default commands when a plugin is being run (#​1549)
24254d1 fix: add fingerprint field to codequality template (#​1541)
2ee0745 fix(image): correct handling of uncompressed layers (#​1544)
0aef82c chore: helm chart app version 0.22.0 (#​1535)
8b2a799 test(integration): use fixtures (#​1532)

Docker images

  • docker pull aquasec/trivy:0.23.0
  • docker pull ghcr.io/aquasecurity/trivy:0.23.0
  • docker pull public.ecr.aws/aquasecurity/trivy:0.23.0

v0.22.0

Compare Source

Changelog

42f795f fix(java/pom): ignore unsupported requirements (#​1514)
8f737cc feat(cli): warning for root command (#​1516)
76249bd BREAKING: disable JAR detection in fs/repo scanning (#​1512)
59957d4 feat(scan): support --offline-scan option (#​1511)
da8b72d fix: improve memory usage (#​1509)
b713ad0 feat(java): support pom.xml (#​1501)
56115e9 docs: fixing rust link to security advisory (#​1504)
7f859af Add missing IacMetdata (#​1505)
628a796 feat(jar): add file path (#​1498)
[82fba77](https://redir

❗ Important

✂ PR body was truncated to here.


Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the bot label Jun 5, 2026
@renovate
renovate Bot force-pushed the renovate/trivy-0.x branch from c2db6fd to e4d99e7 Compare June 21, 2026 03:37
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.71.0 chore(deps): update dependency trivy to v0.71.2 Jun 21, 2026
@renovate
renovate Bot force-pushed the renovate/trivy-0.x branch from e4d99e7 to 10d70ad Compare July 4, 2026 03:02
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.71.2 chore(deps): update dependency trivy to v0.72.0 Jul 4, 2026
@renovate
renovate Bot force-pushed the renovate/trivy-0.x branch from 10d70ad to 5670ab0 Compare August 6, 2026 03:40
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.72.0 chore(deps): update dependency trivy to v0.73.0 Aug 6, 2026
@renovate
renovate Bot force-pushed the renovate/trivy-0.x branch from 5670ab0 to 4ce26b5 Compare August 15, 2026 15:53
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.73.0 chore(deps): update dependency trivy to v0.74.0 Aug 15, 2026
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 chore(deps): update dependency trivy to v0.74.0 - autoclosed Sep 5, 2026
@renovate renovate Bot closed this Sep 5, 2026
@renovate
renovate Bot deleted the renovate/trivy-0.x branch September 5, 2026 11:06
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 - autoclosed chore(deps): update dependency trivy to v0.74.0 Sep 5, 2026
@renovate renovate Bot reopened this Sep 5, 2026
@renovate
renovate Bot force-pushed the renovate/trivy-0.x branch 2 times, most recently from 4ce26b5 to 8aa64b7 Compare September 5, 2026 14:53
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 chore(deps): update dependency trivy to v0.74.0 - autoclosed Sep 5, 2026
@renovate renovate Bot closed this Sep 5, 2026
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 - autoclosed chore(deps): update dependency trivy to v0.74.0 Sep 5, 2026
@renovate renovate Bot reopened this Sep 5, 2026
@renovate
renovate Bot force-pushed the renovate/trivy-0.x branch 2 times, most recently from 8aa64b7 to 8b83db3 Compare September 5, 2026 22:57
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 chore(deps): update dependency trivy to v0.74.0 - autoclosed Sep 8, 2026
@renovate renovate Bot closed this Sep 8, 2026
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 - autoclosed chore(deps): update dependency trivy to v0.74.0 Sep 8, 2026
@renovate renovate Bot reopened this Sep 8, 2026
@renovate
renovate Bot force-pushed the renovate/trivy-0.x branch 2 times, most recently from 8b83db3 to 25c1441 Compare September 8, 2026 23:29
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 chore(deps): update dependency trivy to v0.74.0 - autoclosed Sep 12, 2026
@renovate renovate Bot closed this Sep 12, 2026
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 - autoclosed chore(deps): update dependency trivy to v0.74.0 Sep 16, 2026
@renovate renovate Bot reopened this Sep 16, 2026
@renovate
renovate Bot force-pushed the renovate/trivy-0.x branch 2 times, most recently from 812d2ed to 1499223 Compare September 16, 2026 07:52
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 chore(deps): update dependency trivy to v0.74.0 - autoclosed Sep 20, 2026
@renovate renovate Bot closed this Sep 20, 2026
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 - autoclosed chore(deps): update dependency trivy to v0.74.0 Sep 20, 2026
@renovate renovate Bot reopened this Sep 20, 2026
@renovate
renovate Bot force-pushed the renovate/trivy-0.x branch from 1499223 to a1d331d Compare September 20, 2026 15:16
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 chore(deps): update dependency trivy to v0.74.0 - autoclosed Sep 20, 2026
@renovate renovate Bot closed this Sep 20, 2026
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 - autoclosed chore(deps): update dependency trivy to v0.74.0 Sep 21, 2026
@renovate renovate Bot reopened this Sep 21, 2026
@renovate
renovate Bot force-pushed the renovate/trivy-0.x branch 2 times, most recently from a1d331d to 59d5a5f Compare September 21, 2026 03:32
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 chore(deps): update dependency trivy to v0.74.0 - autoclosed Sep 25, 2026
@renovate renovate Bot closed this Sep 25, 2026
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 - autoclosed chore(deps): update dependency trivy to v0.74.0 Sep 25, 2026
@renovate renovate Bot reopened this Sep 25, 2026
@renovate
renovate Bot force-pushed the renovate/trivy-0.x branch 2 times, most recently from 59d5a5f to 1105428 Compare September 25, 2026 17:27
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 chore(deps): update dependency trivy to v0.74.0 - autoclosed Sep 29, 2026
@renovate renovate Bot closed this Sep 29, 2026
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 - autoclosed chore(deps): update dependency trivy to v0.74.0 Sep 29, 2026
@renovate renovate Bot reopened this Sep 29, 2026
@renovate
renovate Bot force-pushed the renovate/trivy-0.x branch 2 times, most recently from 1105428 to e4c0359 Compare September 29, 2026 16:47
@renovate
renovate Bot force-pushed the renovate/trivy-0.x branch from e4c0359 to 1594ec2 Compare October 1, 2026 16:37
@renovate renovate Bot changed the title chore(deps): update dependency trivy to v0.74.0 chore(deps): update dependency trivy to v0.75.0 Oct 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants