Philipp/cve-differential
Public Access
1
0 Fork 0
generated from Philipp/template-git
Code Issues 1 Pull Requests 1 Actions Packages Releases 1 Activity

chore(deps): update dependency aquasecurity/trivy to v0.76.2 #22

Open
Renovate wants to merge 1 commits from renovate/aquasecurity-trivy-0.x into main
pull from: renovate/aquasecurity-trivy-0.x
merge into: Philipp:main
Conversation 1 Commits 1 Files Changed 1
+1 -1
Renovate commented 2026-10-14 16:31:15 +02:00
Collaborator
Copy link
Copy source

This PR contains the following updates:

Package Update Change
aquasecurity/trivy minor 0.75.0 → 0.76.2

Release Notes

aquasecurity/trivy

v0.76.2

Compare Source

🔐 Security update 🛡️

Trivy v0.76.2 bundles several security fixes:

  • Official container images are rebuilt on Alpine 3.24.3, which fixes musl/musl-utils (CVE-2026-107891), and the build picks up fixed libcurl (24 CVEs, including HIGH CVE-2026-92392) and brotli-libs (CVE-2026-111497) from the v3.24 package repository.
  • golang.org/x/net is bumped to v0.62.0, fixing two vulnerabilities in golang.org/x/net/html: CVE-2026-78661 (quadratic complexity when coalescing text nodes) and CVE-2026-97045 (missing ancestor namespace check when rendering raw text).
  • github.com/go-jose/go-jose/v4 is bumped to v4.1.6, fixing GHSA-mgcc-cww5-fp2q.

We recommend upgrading to v0.76.2 and redeploying container images to apply these updates.

Changelog

  • 3f6334d release: v0.76.2 [release/v0.76] (#​11552)
  • 1cabe83 fix(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 [backport: release/v0.76] (#​11554)
  • be08de4 chore(deps): bump the common group across 1 directory with 14 updates [backport: release/v0.76] (#​11555)
  • a8537d3 fix(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 [backport: release/v0.76] (#​11553)
  • ae26b88 fix(deps): bump alpine to 3.24.3 in container images [backport: release/v0.76] (#​11551)

v0.76.1

Compare Source

🔐 Security update: eMudhra CA incident 🛡️

Trivy v0.76.1 includes mitigations for the eMudhra intermediate CA key compromise.

  • Official binaries are built with Go 1.27.3, which includes the certificate distrust mitigation tracked as CVE-2026-111943.
  • Official container images include an updated Alpine CA trust store that rejects the affected certificate chains.

We recommend upgrading to v0.76.1 and redeploying container images to apply these updates. If you build Trivy from source, use Go 1.27.3 or later and keep your runtime CA trust store up to date.

Changelog

  • e713f67 release: v0.76.1 [release/v0.76] (#​11445)
  • 6647bd6 fix(deps): bump the aws group across 1 directory with 6 updates [backport: release/v0.76] (#​11446)
  • e0964c9 fix(deps): bump the docker group with 3 updates [backport: release/v0.76] (#​11443)
  • 992c360 fix(deps): bump the common group with 3 updates [backport: release/v0.76] (#​11442)

v0.76.0

Compare Source

⚡ Highlights ⚡

👉 https://github.com/aquasecurity/trivy/discussions/11409

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0760-2026-10-14

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [aquasecurity/trivy](https://github.com/aquasecurity/trivy) | minor | `0.75.0` → `0.76.2` | --- ### Release Notes <details> <summary>aquasecurity/trivy</summary> ### [`v0.76.2`](https://github.com/aquasecurity/trivy/releases/tag/v0.76.2) [Compare Source](https://github.com/aquasecurity/trivy/compare/v0.76.1...v0.76.2) #### 🔐 Security update 🛡️ Trivy v0.76.2 bundles several security fixes: - Official container images are rebuilt on Alpine 3.24.3, which fixes `musl`/`musl-utils` (CVE-2026-107891), and the build picks up fixed `libcurl` (24 CVEs, including HIGH CVE-2026-92392) and `brotli-libs` (CVE-2026-111497) from the `v3.24` package repository. - `golang.org/x/net` is bumped to v0.62.0, fixing two vulnerabilities in `golang.org/x/net/html`: CVE-2026-78661 (quadratic complexity when coalescing text nodes) and CVE-2026-97045 (missing ancestor namespace check when rendering raw text). - `github.com/go-jose/go-jose/v4` is bumped to v4.1.6, fixing [GHSA-mgcc-cww5-fp2q](https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q). We recommend upgrading to v0.76.2 and redeploying container images to apply these updates. #### Changelog - [`3f6334d`](https://github.com/aquasecurity/trivy/commit/3f6334d223b52188324af3b9923b4249cd206652) release: v0.76.2 \[release/v0.76] ([#&#8203;11552](https://github.com/aquasecurity/trivy/issues/11552)) - [`1cabe83`](https://github.com/aquasecurity/trivy/commit/1cabe83c11ffed6e984ab46be8886e1e01516ead) fix(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 \[backport: release/v0.76] ([#&#8203;11554](https://github.com/aquasecurity/trivy/issues/11554)) - [`be08de4`](https://github.com/aquasecurity/trivy/commit/be08de47d0d76fca7e992c0f47fbcf7853f8a713) chore(deps): bump the common group across 1 directory with 14 updates \[backport: release/v0.76] ([#&#8203;11555](https://github.com/aquasecurity/trivy/issues/11555)) - [`a8537d3`](https://github.com/aquasecurity/trivy/commit/a8537d389cbd0fa215eddfddc27150fc7bc82a6c) fix(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 \[backport: release/v0.76] ([#&#8203;11553](https://github.com/aquasecurity/trivy/issues/11553)) - [`ae26b88`](https://github.com/aquasecurity/trivy/commit/ae26b88c3b3c380808e767dfb63f9b8dcd5f64fd) fix(deps): bump alpine to 3.24.3 in container images \[backport: release/v0.76] ([#&#8203;11551](https://github.com/aquasecurity/trivy/issues/11551)) ### [`v0.76.1`](https://github.com/aquasecurity/trivy/releases/tag/v0.76.1) [Compare Source](https://github.com/aquasecurity/trivy/compare/v0.76.0...v0.76.1) #### 🔐 Security update: eMudhra CA incident 🛡️ Trivy v0.76.1 includes mitigations for the [eMudhra intermediate CA key compromise](https://blog.cloudflare.com/emudhra-certificate-compromise/). - Official binaries are built with Go 1.27.3, which includes the certificate distrust mitigation tracked as [CVE-2026-111943](https://go.dev/issue/82345). - Official container images include an updated Alpine CA trust store that rejects the affected certificate chains. We recommend upgrading to v0.76.1 and redeploying container images to apply these updates. If you build Trivy from source, use Go 1.27.3 or later and keep your runtime CA trust store up to date. #### Changelog - [`e713f67`](https://github.com/aquasecurity/trivy/commit/e713f67f7d54decdcd9b3132c9751833dcced698) release: v0.76.1 \[release/v0.76] ([#&#8203;11445](https://github.com/aquasecurity/trivy/issues/11445)) - [`6647bd6`](https://github.com/aquasecurity/trivy/commit/6647bd6ec5924087956285b773b8cae10508736e) fix(deps): bump the aws group across 1 directory with 6 updates \[backport: release/v0.76] ([#&#8203;11446](https://github.com/aquasecurity/trivy/issues/11446)) - [`e0964c9`](https://github.com/aquasecurity/trivy/commit/e0964c97819b1d6a45b7e0426803745f173fc550) fix(deps): bump the docker group with 3 updates \[backport: release/v0.76] ([#&#8203;11443](https://github.com/aquasecurity/trivy/issues/11443)) - [`992c360`](https://github.com/aquasecurity/trivy/commit/992c360c33d9f9627bb24c1fe3f20815110c88e5) fix(deps): bump the common group with 3 updates \[backport: release/v0.76] ([#&#8203;11442](https://github.com/aquasecurity/trivy/issues/11442)) ### [`v0.76.0`](https://github.com/aquasecurity/trivy/releases/tag/v0.76.0) [Compare Source](https://github.com/aquasecurity/trivy/compare/v0.75.0...v0.76.0) #### ⚡ Highlights ⚡ 👉 <https://github.com/aquasecurity/trivy/discussions/11409> #### Changelog <https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0760-2026-10-14> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNDkuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE5OC4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Renovate commented 2026-10-14 16:31:16 +02:00
Author
Collaborator
Copy link
Copy source

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: action.yaml
Command failed: curl -sfL https://github.com/aquasecurity/trivy/releases/download/vv0.76.2/trivy_v0.76.2_checksums.txt -o checksums.txt
### ⚠️ Artifact update problem Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens: - any of the package files in this branch needs updating, or - the branch becomes conflicted, or - you click the rebase/retry checkbox if found above, or - you rename this PR's title to start with "rebase!" to trigger it manually The artifact failure details are included below: ##### File name: action.yaml ``` Command failed: curl -sfL https://github.com/aquasecurity/trivy/releases/download/vv0.76.2/trivy_v0.76.2_checksums.txt -o checksums.txt ```
Renovate force-pushed renovate/aquasecurity-trivy-0.x from 96a762ef9d to 1666786617 2026-10-21 14:25:18 +02:00 Compare
Renovate changed title from chore(deps): update dependency aquasecurity/trivy to v0.76.0 to chore(deps): update dependency aquasecurity/trivy to v0.76.1 2026-10-21 14:25:20 +02:00
Renovate added 1 commit 2026-11-05 14:36:47 +01:00
chore(deps): update dependency aquasecurity/trivy to v0.76.2
CI Tests / JS Unit Tests (push) Skipped
CI Tests / cross-check-mixed-sbom (sbom=false) (push) Skipped
CI Tests / cross-check-mixed-sbom (sbom=true) (push) Skipped
CI Tests / without-inbuild-sbom (sbom=false) (push) Skipped
CI Tests / without-inbuild-sbom (sbom=true) (push) Skipped
CI Tests / with-inbuild-sbom (sbom=false) (push) Skipped
CI Tests / with-inbuild-sbom (sbom=true) (push) Skipped
renovate/artifacts Artifact file update failure
CI Tests / JS Unit Tests (pull_request) Successful in 2m50s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Failing after 1m20s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Failing after 1m23s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 4m23s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Failing after 1m27s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Failing after 1m32s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Failing after 1m36s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Failing after 20s
Details
e1fd47716e
Renovate force-pushed renovate/aquasecurity-trivy-0.x from 1666786617 to e1fd47716e 2026-11-05 14:36:47 +01:00 Compare
Renovate changed title from chore(deps): update dependency aquasecurity/trivy to v0.76.1 to chore(deps): update dependency aquasecurity/trivy to v0.76.2 2026-11-05 14:36:51 +01:00
Some required checks failed
CI Tests / JS Unit Tests (push) Skipped
Required
CI Tests / cross-check-mixed-sbom (sbom=false) (push) Skipped
Required
CI Tests / cross-check-mixed-sbom (sbom=true) (push) Skipped
Required
CI Tests / without-inbuild-sbom (sbom=false) (push) Skipped
Required
CI Tests / without-inbuild-sbom (sbom=true) (push) Skipped
Required
CI Tests / with-inbuild-sbom (sbom=false) (push) Skipped
Required
CI Tests / with-inbuild-sbom (sbom=true) (push) Skipped
Required
renovate/artifacts Artifact file update failure
CI Tests / JS Unit Tests (pull_request) Successful in 2m50s
Required
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Failing after 1m20s
Required
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Failing after 1m23s
Required
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 4m23s
Required
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Failing after 1m27s
Required
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Failing after 1m32s
Required
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Failing after 1m36s
Required
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Failing after 20s
Required
Details
Some required checks were not successful.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/aquasecurity-trivy-0.x:renovate/aquasecurity-trivy-0.x
git checkout renovate/aquasecurity-trivy-0.x
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
AutoReview (LLMReview) Renovate (Renovate Bot) runner (Act Runner) Philipp (Philipp Horstenkamp)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Philipp/cve-differential#22