chore(deps): update dependency aquasecurity/trivy to v0.72.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aquasecurity/trivy	uses-with	minor	v0.71.2 → v0.72.0

---

Release Notes

aquasecurity/trivy (aquasecurity/trivy)

v0.72.0

Compare Source

Changelog

• 8a32853 release: v0.72.0 [main] (#​10782)
• 4295ac0 test: close plugin manager in tests cleanup (#​10904)
• d4213d7 Merge commit from fork
• 246ee3c feat(bottlerocket): add vulnerability matching for Bottlerocket OS (#​10893)
• abb5174 fix(misconf): support github_repository_vulnerability_alerts resource (#​10680)
• b8a1ccd feat(java): detect JAR licenses from packaged LICENSE files (#​10856)
• a10291b fix(nodejs): parse project dependencies from multi-document pnpm-lock.yaml (#​10861)
• a2777ae fix(server): propagate package repository class in client/server mode (#​10874)
• 6e37acf chore(deps): bump github.com/containerd/containerd/v2 from 2.3.1 to 2.3.2 (#​10888)
• dfd53cf fix(vuln): fall back to UNKNOWN severity when vulnerability details are missing (#​10795)
• 0a166c3 feat(java): detect JAR licenses from the embedded pom.xml (#​10851)
• 7a69b8f chore(deps): Upgrade github.com/cenkalti/backoff to v6 (#​10863)
• 1df6ca3 ci(helm): bump Trivy version to 0.71.2 for Trivy Helm Chart 0.23.2 (#​10873)
• 49299df chore(deps): bump alpine to 3.24.1 (#​10868)
• 13de603 docs: fix article typo in plugin developer guide (#​10860)
• a848925 feat(misconf): Adds CloudFront standard logging v2 support to AVD-AWS-0010 (#​10848)
• c1ad0e0 docs: fix typos (#​10857)
• 0aff3fd fix(terraform): avoid data race on global getter.Getters in remote module resolver (#​10843)
• e68f3d2 feat(secret): support new stateless format for GitHub App installation tokens (#​10826)
• 859a933 fix: correct format verbs in diagnostic messages (#​10805)
• 47b7ba4 ci(helm): bump Trivy version to 0.71.1 for Trivy Helm Chart 0.23.1 (#​10845)
• 3960fac refactor: use ParseErrorsAllowlist instead of ParseErrorsWhitelist (#​10830)
• 469d4fb docs: fix repository scan heading typo (#​10828)
• 39e0b13 Merge commit from fork
• 28d44d3 fix: forward ospkg detector options through ospkg.NewScanner (#​10811)
• 5619ae1 chore(deps): bump github.com/bufbuild/buf to v1.70.0 (#​10801)
• 1f56a34 fix(vex): load VEX documents from within the repository directory (#​10820)
• 848d135 ci!: migrate docker config to dockers_v2 (#​10783)
• bd78842 feat(dotnet): detect bundled runtime in self-contained deployments (#​10786)
• 65e5128 feat(secret): add OpenAI secret detection rules (#​10798)
• c613b5d ci: expect GitHub App bot as backport PR author (#​10813)
• 3054b3b fix: surface the original analysis error instead of context cancellation (#​10793)
• 15bdd2c chore(deps): bump the github-actions group across 1 directory with 11 updates (#​10803)
• 576b093 chore(deps): bump the common group with 4 updates (#​10797)
• 92b4a05 chore(deps): bump the aws group with 4 updates (#​10796)
• c8d1d0d fix: use random suffix for process temp directory instead of PID (#​10431)
• 3851371 docs: update signature verification for deb and rpm packages (#​10784)
• dccb128 fix(image): lookup origin layer for custom resources in merged layers (#​10788)
• 9032dcb test: fix flaky containerd integration test (#​10760)
• f00ee41 ci: bump GoReleaser to v2.16.0 (#​10774)
• 48af854 docs: fix broken nixpkgs reference link in installation guide (#​10776)
• b3d7be5 test(java): force offline-scan for client/server integration tests (#​10721)
• 888911b fix(image): deterministic OS package deduplication for images with embedded SBOMs (#​10777)
• c0654e1 fix(spdx): guard against nil root component in SPDX marshaler (#​10771)
• 7ca5a6b ci(helm): bump Trivy version to 0.71.0 for Trivy Helm Chart 0.23.0 (#​10768)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

✅ Supply Chain Verification Results

✅ PASSED

📦 SBOM Summary

• Components: 1484

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	4
🟢 Low	3
Total	7

📎 Artifacts

• SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

---

_{Generated by Supply Chain Verification workflow • View Details}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!