murdoc/ha-cli
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases 38 Packages 1 Wiki Activity Actions

chore(docker): update aquasec/trivy docker tag to v0.72.0 #162

Merged
murdoc merged 1 commit from renovate-aquasec-trivy-0-x into main 2026-07-20 17:05:24 +00:00
Conversation 0 Commits 1 Files changed 1 +1 -1
murdoc commented 2026-07-20 17:05:18 +00:00
Owner
Copy link

This PR contains the following updates:

Package Type Update Change OpenSSF
aquasec/trivy (source) container minor 0.70.0 → 0.72.0 OpenSSF Scorecard

Release Notes

aquasecurity/trivy (aquasec/trivy)

v0.72.0

Compare Source

⚠ BREAKING CHANGES
  • migrate docker config to dockers_v2 (#​10783)
Features
  • bottlerocket: add vulnerability matching for Bottlerocket OS (#​10893) (246ee3c)
  • dotnet: detect bundled runtime in self-contained deployments (#​10786) (bd78842)
  • java: detect JAR licenses from packaged LICENSE files (#​10856) (b8a1ccd)
  • java: detect JAR licenses from the embedded pom.xml (#​10851) (0a166c3)
  • misconf: Adds CloudFront standard logging v2 support to AVD-AWS-0010 (#​10848) (a848925)
  • secret: add OpenAI secret detection rules (#​10798) (65e5128)
  • secret: support new stateless format for GitHub App installation tokens (#​10826) (e68f3d2)
Bug Fixes
  • correct format verbs in diagnostic messages (#​10805) (859a933)
  • forward ospkg detector options through ospkg.NewScanner (#​10811) (28d44d3)
  • image: deterministic OS package deduplication for images with embedded SBOMs (#​10777) (888911b)
  • image: lookup origin layer for custom resources in merged layers (#​10788) (dccb128)
  • misconf: support github_repository_vulnerability_alerts resource (#​10680) (abb5174)
  • nodejs: parse project dependencies from multi-document pnpm-lock.yaml (#​10861) (a10291b)
  • server: propagate package repository class in client/server mode (#​10874) (a2777ae)
  • spdx: guard against nil root component in SPDX marshaler (#​10771) (c0654e1)
  • surface the original analysis error instead of context cancellation (#​10793) (3054b3b)
  • terraform: avoid data race on global getter.Getters in remote module resolver (#​10843) (0aff3fd)
  • use random suffix for process temp directory instead of PID (#​10431) (c8d1d0d)
  • vex: load VEX documents from within the repository directory (#​10820) (1f56a34)
  • vuln: fall back to UNKNOWN severity when vulnerability details are missing (#​10795) (dfd53cf)
Continuous Integration

v0.71.2

Compare Source

Changelog

v0.71.1

Compare Source

Changelog

  • 164b383 release: v0.71.1 [release/v0.71] (#​10818)
  • a72d9a4 fix(oci): validate artifact filename
  • 3dd9847 fix: forward ospkg detector options through ospkg.NewScanner [backport: release/v0.71] (#​10825)
  • a62cbe4 fix(vex): load VEX documents from within the repository directory [backport: release/v0.71] (#​10821)
  • 43d1d26 fix: surface the original analysis error instead of context cancellation [backport: release/v0.71] (#​10812)
  • ac7696c ci: expect GitHub App bot as backport PR author [backport: release/v0.71] (#​10815)

v0.71.0

Compare Source

Features
Bug Fixes
  • cloudformation: propagate AWS::EC2::Instance MetadataOptions (#​10731) (ac2f3d7)
  • image: correctly reconstruct RUN instructions built without BuildKit (#​10714) (519eac9)
  • java: surface 429 from a remote Maven repository as a fatal error when scanning pom.xml files (#​10693) (f8fdb93)
  • misconf: fix rendering of nested values in terraform plan lists (#​10746) (9c1cf65)
  • misconf: make identifiers in ignore rules case-insensitive (#​10375) (a75a468)
  • misconf: prevent path traversal in Terraform filesystem functions (#​10664) (9d91b88)
  • misconf: reject nil plays during playbook parsing (#​10273) (0bc5c6d)
  • misconf: skip null cty values in AsMapValue to prevent panic (#​10723) (f080e1e)
  • misconf: skip resources with no after changes (#​10352) (f099dc4)
  • nodejs: handle legacy license formats in npm lockfile parser (#​10684) (451fd99)
  • nodejs: silently skip subdirectory package.json files with invalid names (#​10609) (0e4dc66)
  • overwrite OS packages PURLs after overwrite OS (#​10298) (39a28ed)
  • pull instead of clone when test repo already exists (#​10636) (3a2f7fb)
  • report: don't produce trailing comma in gitlab.tpl links array (#​10728) (69e78e2)
  • secret: correctly skip secret-scanner config file from scanning (#​10666) (fc1e46f)

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • "after 3am and before 6pm"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | OpenSSF | |---|---|---|---|---| | [aquasec/trivy](https://www.aquasec.com/products/trivy/) ([source](https://github.com/aquasecurity/trivy)) | container | minor | `0.70.0` → `0.72.0` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/aquasecurity/trivy/badge)](https://securityscorecards.dev/viewer/?uri=github.com/aquasecurity/trivy) | --- ### Release Notes <details> <summary>aquasecurity/trivy (aquasec/trivy)</summary> ### [`v0.72.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0720-2026-06-30) [Compare Source](https://github.com/aquasecurity/trivy/compare/v0.71.2...v0.72.0) ##### ⚠ BREAKING CHANGES - migrate docker config to dockers\_v2 ([#&#8203;10783](https://github.com/aquasecurity/trivy/issues/10783)) ##### Features - **bottlerocket:** add vulnerability matching for Bottlerocket OS ([#&#8203;10893](https://github.com/aquasecurity/trivy/issues/10893)) ([246ee3c](https://github.com/aquasecurity/trivy/commit/246ee3ca56b666e3c6e6462bf7c0ecd6f059341a)) - **dotnet:** detect bundled runtime in self-contained deployments ([#&#8203;10786](https://github.com/aquasecurity/trivy/issues/10786)) ([bd78842](https://github.com/aquasecurity/trivy/commit/bd788423970f08ea64ad7bc7638dd16bc7e9e43b)) - **java:** detect JAR licenses from packaged LICENSE files ([#&#8203;10856](https://github.com/aquasecurity/trivy/issues/10856)) ([b8a1ccd](https://github.com/aquasecurity/trivy/commit/b8a1ccd68a6e06e101de618dbc97b564d902e2f2)) - **java:** detect JAR licenses from the embedded pom.xml ([#&#8203;10851](https://github.com/aquasecurity/trivy/issues/10851)) ([0a166c3](https://github.com/aquasecurity/trivy/commit/0a166c3fd42e941f37f524cc3905ad3f07062438)) - **misconf:** Adds CloudFront standard logging v2 support to AVD-AWS-0010 ([#&#8203;10848](https://github.com/aquasecurity/trivy/issues/10848)) ([a848925](https://github.com/aquasecurity/trivy/commit/a848925c613a3308524cbbcff98fa258c89fe3e3)) - **secret:** add OpenAI secret detection rules ([#&#8203;10798](https://github.com/aquasecurity/trivy/issues/10798)) ([65e5128](https://github.com/aquasecurity/trivy/commit/65e51285de53aa1cfb430cde59001c244fc5f0fd)) - **secret:** support new stateless format for GitHub App installation tokens ([#&#8203;10826](https://github.com/aquasecurity/trivy/issues/10826)) ([e68f3d2](https://github.com/aquasecurity/trivy/commit/e68f3d2d3476b59c57de2ef2c2806edb001147ee)) ##### Bug Fixes - correct format verbs in diagnostic messages ([#&#8203;10805](https://github.com/aquasecurity/trivy/issues/10805)) ([859a933](https://github.com/aquasecurity/trivy/commit/859a933cd05e6cb0e06d80e47a6e96f96d337567)) - forward ospkg detector options through ospkg.NewScanner ([#&#8203;10811](https://github.com/aquasecurity/trivy/issues/10811)) ([28d44d3](https://github.com/aquasecurity/trivy/commit/28d44d3af5e7c6ba56edbfd53e178fa613fbd94b)) - **image:** deterministic OS package deduplication for images with embedded SBOMs ([#&#8203;10777](https://github.com/aquasecurity/trivy/issues/10777)) ([888911b](https://github.com/aquasecurity/trivy/commit/888911bcd3d0fdcd0cccbb2d45b9cb4cc267d926)) - **image:** lookup origin layer for custom resources in merged layers ([#&#8203;10788](https://github.com/aquasecurity/trivy/issues/10788)) ([dccb128](https://github.com/aquasecurity/trivy/commit/dccb12835679d01930574ecb53be7686cee607fb)) - **misconf:** support github\_repository\_vulnerability\_alerts resource ([#&#8203;10680](https://github.com/aquasecurity/trivy/issues/10680)) ([abb5174](https://github.com/aquasecurity/trivy/commit/abb5174b7e6932ffcee88ccd35c5c8cf7c55df12)) - **nodejs:** parse project dependencies from multi-document pnpm-lock.yaml ([#&#8203;10861](https://github.com/aquasecurity/trivy/issues/10861)) ([a10291b](https://github.com/aquasecurity/trivy/commit/a10291be6f44a512977e887180faab3f3dd240c5)) - **server:** propagate package repository class in client/server mode ([#&#8203;10874](https://github.com/aquasecurity/trivy/issues/10874)) ([a2777ae](https://github.com/aquasecurity/trivy/commit/a2777aed340e4bb11c6cea6d7cf5d4bf137587ec)) - **spdx:** guard against nil root component in SPDX marshaler ([#&#8203;10771](https://github.com/aquasecurity/trivy/issues/10771)) ([c0654e1](https://github.com/aquasecurity/trivy/commit/c0654e17eb27a222bada78e22384c86039430d94)) - surface the original analysis error instead of context cancellation ([#&#8203;10793](https://github.com/aquasecurity/trivy/issues/10793)) ([3054b3b](https://github.com/aquasecurity/trivy/commit/3054b3b953a59d536d5e13ab7210501dbfc55a40)) - **terraform:** avoid data race on global getter.Getters in remote module resolver ([#&#8203;10843](https://github.com/aquasecurity/trivy/issues/10843)) ([0aff3fd](https://github.com/aquasecurity/trivy/commit/0aff3fdf3b8924fe6b9ee69b05276db37a68d0d8)) - use random suffix for process temp directory instead of PID ([#&#8203;10431](https://github.com/aquasecurity/trivy/issues/10431)) ([c8d1d0d](https://github.com/aquasecurity/trivy/commit/c8d1d0d113b0bd3a058f566ede786b18ff94f75e)) - **vex:** load VEX documents from within the repository directory ([#&#8203;10820](https://github.com/aquasecurity/trivy/issues/10820)) ([1f56a34](https://github.com/aquasecurity/trivy/commit/1f56a3450a4e0a7d42c273b4acfeec1f584979ab)) - **vuln:** fall back to UNKNOWN severity when vulnerability details are missing ([#&#8203;10795](https://github.com/aquasecurity/trivy/issues/10795)) ([dfd53cf](https://github.com/aquasecurity/trivy/commit/dfd53cfcb6888d8af57bec63d6c33f648ba87380)) ##### Continuous Integration - migrate docker config to dockers\_v2 ([#&#8203;10783](https://github.com/aquasecurity/trivy/issues/10783)) ([848d135](https://github.com/aquasecurity/trivy/commit/848d13595fea770c2f6488957cd0771654eb2659)) ### [`v0.71.2`](https://github.com/aquasecurity/trivy/releases/tag/v0.71.2) [Compare Source](https://github.com/aquasecurity/trivy/compare/v0.71.1...v0.71.2) #### Changelog - [`055a5c8`](https://github.com/aquasecurity/trivy/commit/055a5c8a53bfd61f7a8e276a5b2f0c3fc1673420) release: v0.71.2 \[release/v0.71] ([#&#8203;10871](https://github.com/aquasecurity/trivy/issues/10871)) - [`875328a`](https://github.com/aquasecurity/trivy/commit/875328a4138f26e8559cfee80adaef82b6693076) fix(deps): bump alpine to 3.24.1 \[backport: release/v0.71] ([#&#8203;10870](https://github.com/aquasecurity/trivy/issues/10870)) - [`998f7b3`](https://github.com/aquasecurity/trivy/commit/998f7b3c3f3c9de2132bc4358970eeafbd797fba) chore(deps): bump the common group with 4 updates \[backport: release/v0.71] ([#&#8203;10867](https://github.com/aquasecurity/trivy/issues/10867)) ### [`v0.71.1`](https://github.com/aquasecurity/trivy/releases/tag/v0.71.1) [Compare Source](https://github.com/aquasecurity/trivy/compare/v0.71.0...v0.71.1) #### Changelog - [`164b383`](https://github.com/aquasecurity/trivy/commit/164b383121351c2d49c5d354c2245719d972752b) release: v0.71.1 \[release/v0.71] ([#&#8203;10818](https://github.com/aquasecurity/trivy/issues/10818)) - [`a72d9a4`](https://github.com/aquasecurity/trivy/commit/a72d9a4d997c25fbb6534e231b4e206c9b202b31) fix(oci): validate artifact filename - [`3dd9847`](https://github.com/aquasecurity/trivy/commit/3dd98471dfbbc4a95edd5cd866468d3a8c87fd17) fix: forward ospkg detector options through ospkg.NewScanner \[backport: release/v0.71] ([#&#8203;10825](https://github.com/aquasecurity/trivy/issues/10825)) - [`a62cbe4`](https://github.com/aquasecurity/trivy/commit/a62cbe40a240d3a3f568401b8a5f86e14114e371) fix(vex): load VEX documents from within the repository directory \[backport: release/v0.71] ([#&#8203;10821](https://github.com/aquasecurity/trivy/issues/10821)) - [`43d1d26`](https://github.com/aquasecurity/trivy/commit/43d1d2628725e913db110b89419f0bebd36f58a8) fix: surface the original analysis error instead of context cancellation \[backport: release/v0.71] ([#&#8203;10812](https://github.com/aquasecurity/trivy/issues/10812)) - [`ac7696c`](https://github.com/aquasecurity/trivy/commit/ac7696c7b50d633183ce2ff44898d4b5c6eae565) ci: expect GitHub App bot as backport PR author \[backport: release/v0.71] ([#&#8203;10815](https://github.com/aquasecurity/trivy/issues/10815)) ### [`v0.71.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0710-2026-06-01) [Compare Source](https://github.com/aquasecurity/trivy/compare/v0.70.0...v0.71.0) ##### Features - add WithDriver and WithProvider options to ospkg detector ([#&#8203;10740](https://github.com/aquasecurity/trivy/issues/10740)) ([f8a6ddb](https://github.com/aquasecurity/trivy/commit/f8a6ddb45e5d041ac209f3d3732afcdcafb61ef6)) - **java:** support \<mirrors> from settings.xml ([#&#8203;10692](https://github.com/aquasecurity/trivy/issues/10692)) ([c080ce3](https://github.com/aquasecurity/trivy/commit/c080ce34639b6f22c990f59a3b4f9dd19385d129)) - **sbom:** support for CycloneDX 1.7 ([#&#8203;10715](https://github.com/aquasecurity/trivy/issues/10715)) ([04f739e](https://github.com/aquasecurity/trivy/commit/04f739e5244db8bd157eb4a2a2fe2caa8dbfa61f)) - **seal:** add vendor support for language file detection. ([#&#8203;10297](https://github.com/aquasecurity/trivy/issues/10297)) ([b08bf6a](https://github.com/aquasecurity/trivy/commit/b08bf6a0a59785ff72900a4a6873f25a9d7b2921)) - **secret:** add a way to customize skipped folders, files and exts ([#&#8203;10550](https://github.com/aquasecurity/trivy/issues/10550)) ([e4325b1](https://github.com/aquasecurity/trivy/commit/e4325b18246dc90d2d18bf7e032fe47db89108e5)) - **secret:** add Azure secret detection rules ([#&#8203;10562](https://github.com/aquasecurity/trivy/issues/10562)) ([69dcd18](https://github.com/aquasecurity/trivy/commit/69dcd18eff5c810948738644d9a2df79a470f0e0)) - **secret:** add Maven rules to detect passwords and passphrases in settings.xml and settings-security.xml files ([#&#8203;10704](https://github.com/aquasecurity/trivy/issues/10704)) ([9ad901d](https://github.com/aquasecurity/trivy/commit/9ad901d510ff1013878818f55a899091efd6e46f)) - **spdx:** add SHA-512 hash algorithm support to SPDX serializer ([#&#8203;10719](https://github.com/aquasecurity/trivy/issues/10719)) ([f2a1237](https://github.com/aquasecurity/trivy/commit/f2a12375772a93ab9bd6f754c33378f1c0356a76)) - **ubuntu:** detect Ubuntu 26.04 LTS ([#&#8203;10592](https://github.com/aquasecurity/trivy/issues/10592)) ([a61feac](https://github.com/aquasecurity/trivy/commit/a61feac3c558ba9d9f7bee58fb5862d3a1d56fd9)) ##### Bug Fixes - **cloudformation:** propagate AWS::EC2::Instance MetadataOptions ([#&#8203;10731](https://github.com/aquasecurity/trivy/issues/10731)) ([ac2f3d7](https://github.com/aquasecurity/trivy/commit/ac2f3d79770b6ae65241fec1a7656e0faa069e84)) - **image:** correctly reconstruct RUN instructions built without BuildKit ([#&#8203;10714](https://github.com/aquasecurity/trivy/issues/10714)) ([519eac9](https://github.com/aquasecurity/trivy/commit/519eac97accaa4068a4f81ce94cbdb74a91a7b7f)) - **java:** surface 429 from a remote Maven repository as a fatal error when scanning pom.xml files ([#&#8203;10693](https://github.com/aquasecurity/trivy/issues/10693)) ([f8fdb93](https://github.com/aquasecurity/trivy/commit/f8fdb932dd8ef6586bebc467a3ee3b098d040a51)) - **misconf:** fix rendering of nested values in terraform plan lists ([#&#8203;10746](https://github.com/aquasecurity/trivy/issues/10746)) ([9c1cf65](https://github.com/aquasecurity/trivy/commit/9c1cf658d461b2bc73ac10317947ab6ce8b2e51e)) - **misconf:** make identifiers in ignore rules case-insensitive ([#&#8203;10375](https://github.com/aquasecurity/trivy/issues/10375)) ([a75a468](https://github.com/aquasecurity/trivy/commit/a75a468facbff12c81da00742709c88c0a4ad29d)) - **misconf:** prevent path traversal in Terraform filesystem functions ([#&#8203;10664](https://github.com/aquasecurity/trivy/issues/10664)) ([9d91b88](https://github.com/aquasecurity/trivy/commit/9d91b888cf63023e9c09b64259a4c1cea8dfe993)) - **misconf:** reject nil plays during playbook parsing ([#&#8203;10273](https://github.com/aquasecurity/trivy/issues/10273)) ([0bc5c6d](https://github.com/aquasecurity/trivy/commit/0bc5c6dfa453aa8866ec7fd27044b2603d77cbcc)) - **misconf:** skip null cty values in AsMapValue to prevent panic ([#&#8203;10723](https://github.com/aquasecurity/trivy/issues/10723)) ([f080e1e](https://github.com/aquasecurity/trivy/commit/f080e1ec0986833aa95b94c92bb84f14e1889f9d)) - **misconf:** skip resources with no after changes ([#&#8203;10352](https://github.com/aquasecurity/trivy/issues/10352)) ([f099dc4](https://github.com/aquasecurity/trivy/commit/f099dc431dd836adbd4c2ed8d7ed0764b9c86b8c)) - **nodejs:** handle legacy license formats in npm lockfile parser ([#&#8203;10684](https://github.com/aquasecurity/trivy/issues/10684)) ([451fd99](https://github.com/aquasecurity/trivy/commit/451fd996c0c29459ab8574ab5b8ab85518495a59)) - **nodejs:** silently skip subdirectory package.json files with invalid names ([#&#8203;10609](https://github.com/aquasecurity/trivy/issues/10609)) ([0e4dc66](https://github.com/aquasecurity/trivy/commit/0e4dc6686658c4d29c084bedb7b3a925ab85482c)) - overwrite OS packages PURLs after overwrite OS ([#&#8203;10298](https://github.com/aquasecurity/trivy/issues/10298)) ([39a28ed](https://github.com/aquasecurity/trivy/commit/39a28edd7f70f63dd4b48dc6838a16c42d36c8dc)) - pull instead of clone when test repo already exists ([#&#8203;10636](https://github.com/aquasecurity/trivy/issues/10636)) ([3a2f7fb](https://github.com/aquasecurity/trivy/commit/3a2f7fb2636189a1f703a509125ee34d5c0b9eaa)) - **report:** don't produce trailing comma in gitlab.tpl links array ([#&#8203;10728](https://github.com/aquasecurity/trivy/issues/10728)) ([69e78e2](https://github.com/aquasecurity/trivy/commit/69e78e21598898ca57fe31449570d6979e811009)) - **secret:** correctly skip secret-scanner config file from scanning ([#&#8203;10666](https://github.com/aquasecurity/trivy/issues/10666)) ([fc1e46f](https://github.com/aquasecurity/trivy/commit/fc1e46fb0214d32f5b91581ff221a3309ebaa94a)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - "after 3am and before 6pm" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjQuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI2NC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkb2NrZXIiLCJtaW5vciIsInJlbm92YXRlIl19-->
chore(docker): update aquasec/trivy docker tag to v0.72.0
All checks were successful
renovate/stability-days Updates have met minimum release age requirement
Details
pre-commit-check / pre-commit (pull_request) Successful in 5s
Details
CI Pipeline / build (pull_request) Successful in 40s
Details
CI / build (pull_request) Successful in 6s
Details
CI Pipeline / trivy_scan (pull_request) Successful in 36s
Details
b438d47f48
murdoc scheduled this pull request to auto merge when all checks succeed 2026-07-20 17:05:18 +00:00
murdoc merged commit e71d59a889 into main 2026-07-20 17:05:24 +00:00
murdoc deleted branch renovate-aquasec-trivy-0-x 2026-07-20 17:05:24 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
murdoc/ha-cli!162
No description provided.