Skip to content

chore(deps): bump github.com/aquasecurity/trivy from 0.70.0 to 0.71.2 in the trivy group across 1 directory#2573

Merged
shino merged 1 commit into
masterfrom
dependabot/go_modules/master/trivy-920bea3a09
Jul 3, 2026
Merged

chore(deps): bump github.com/aquasecurity/trivy from 0.70.0 to 0.71.2 in the trivy group across 1 directory#2573
shino merged 1 commit into
masterfrom
dependabot/go_modules/master/trivy-920bea3a09

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the trivy group with 1 update in the / directory: github.com/aquasecurity/trivy.

Updates github.com/aquasecurity/trivy from 0.70.0 to 0.71.2

Release notes

Sourced from github.com/aquasecurity/trivy's releases.

v0.71.2

Changelog

  • 055a5c8a53bfd61f7a8e276a5b2f0c3fc1673420 release: v0.71.2 [release/v0.71] (#10871)
  • 875328a4138f26e8559cfee80adaef82b6693076 fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870)
  • 998f7b3c3f3c9de2132bc4358970eeafbd797fba chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867)

v0.71.1

Changelog

  • 164b383121351c2d49c5d354c2245719d972752b release: v0.71.1 [release/v0.71] (#10818)
  • a72d9a4d997c25fbb6534e231b4e206c9b202b31 fix(oci): validate artifact filename
  • 3dd98471dfbbc4a95edd5cd866468d3a8c87fd17 fix: forward ospkg detector options through ospkg.NewScanner [backport: release/v0.71] (#10825)
  • a62cbe40a240d3a3f568401b8a5f86e14114e371 fix(vex): load VEX documents from within the repository directory [backport: release/v0.71] (#10821)
  • 43d1d2628725e913db110b89419f0bebd36f58a8 fix: surface the original analysis error instead of context cancellation [backport: release/v0.71] (#10812)
  • ac7696c7b50d633183ce2ff44898d4b5c6eae565 ci: expect GitHub App bot as backport PR author [backport: release/v0.71] (#10815)

v0.71.0

⚡ Highlights ⚡

👉 aquasecurity/trivy#10767

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0710-2026-06-01

Changelog

Sourced from github.com/aquasecurity/trivy's changelog.

0.71.2 (2026-06-19)

Bug Fixes

  • deps: bump alpine to 3.24.1 [backport: release/v0.71] (#10870) (875328a)

0.71.1 (2026-06-10)

Bug Fixes

  • forward ospkg detector options through ospkg.NewScanner [backport: release/v0.71] (#10825) (3dd9847)
  • oci: validate artifact filename (a72d9a4)
  • surface the original analysis error instead of context cancellation [backport: release/v0.71] (#10812) (43d1d26)
  • vex: load VEX documents from within the repository directory [backport: release/v0.71] (#10821) (a62cbe4)

0.71.0 (2026-06-01)

Features

  • add WithDriver and WithProvider options to ospkg detector (#10740) (f8a6ddb)
  • java: support <mirrors> from settings.xml (#10692) (c080ce3)
  • sbom: support for CycloneDX 1.7 (#10715) (04f739e)
  • seal: add vendor support for language file detection. (#10297) (b08bf6a)
  • secret: add a way to customize skipped folders, files and exts (#10550) (e4325b1)
  • secret: add Azure secret detection rules (#10562) (69dcd18)
  • secret: add Maven rules to detect passwords and passphrases in settings.xml and settings-security.xml files (#10704) (9ad901d)
  • spdx: add SHA-512 hash algorithm support to SPDX serializer (#10719) (f2a1237)
  • ubuntu: detect Ubuntu 26.04 LTS (#10592) (a61feac)

Bug Fixes

  • cloudformation: propagate AWS::EC2::Instance MetadataOptions (#10731) (ac2f3d7)
  • image: correctly reconstruct RUN instructions built without BuildKit (#10714) (519eac9)
  • java: surface 429 from a remote Maven repository as a fatal error when scanning pom.xml files (#10693) (f8fdb93)
  • misconf: fix rendering of nested values in terraform plan lists (#10746) (9c1cf65)
  • misconf: make identifiers in ignore rules case-insensitive (#10375) (a75a468)
  • misconf: prevent path traversal in Terraform filesystem functions (#10664) (9d91b88)
  • misconf: reject nil plays during playbook parsing (#10273) (0bc5c6d)
  • misconf: skip null cty values in AsMapValue to prevent panic (#10723) (f080e1e)
  • misconf: skip resources with no after changes (#10352) (f099dc4)
  • nodejs: handle legacy license formats in npm lockfile parser (#10684) (451fd99)
  • nodejs: silently skip subdirectory package.json files with invalid names (#10609) (0e4dc66)
  • overwrite OS packages PURLs after overwrite OS (#10298) (39a28ed)
  • pull instead of clone when test repo already exists (#10636) (3a2f7fb)
  • report: don't produce trailing comma in gitlab.tpl links array (#10728) (69e78e2)
  • secret: correctly skip secret-scanner config file from scanning (#10666) (fc1e46f)
Commits
  • 055a5c8 release: v0.71.2 [release/v0.71] (#10871)
  • 875328a fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870)
  • 998f7b3 chore(deps): bump the common group with 4 updates [backport: release/v0.71] (...
  • 164b383 release: v0.71.1 [release/v0.71] (#10818)
  • a72d9a4 fix(oci): validate artifact filename
  • 3dd9847 fix: forward ospkg detector options through ospkg.NewScanner [backport: relea...
  • a62cbe4 fix(vex): load VEX documents from within the repository directory [backport: ...
  • 43d1d26 fix: surface the original analysis error instead of context cancellation [bac...
  • ac7696c ci: expect GitHub App bot as backport PR author [backport: release/v0.71] (#1...
  • 9b49920 release: v0.71.0 [main] (#10638)
  • Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
github.com/aquasecurity/trivy [>= 0.50.2.a, < 0.50.3]
github.com/aquasecurity/trivy [< 0.51, > 0.50.1]

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jun 5, 2026
@dependabot dependabot Bot changed the title chore(deps): bump github.com/aquasecurity/trivy from 0.70.0 to 0.71.0 in the trivy group chore(deps): bump github.com/aquasecurity/trivy from 0.70.0 to 0.71.1 in the trivy group across 1 directory Jun 15, 2026
@dependabot dependabot Bot force-pushed the dependabot/go_modules/master/trivy-920bea3a09 branch 2 times, most recently from d3ae06a to 94b0d0f Compare June 19, 2026 00:03
@yasuaki-oba yasuaki-oba mentioned this pull request Jun 19, 2026
Open
@dependabot dependabot Bot changed the title chore(deps): bump github.com/aquasecurity/trivy from 0.70.0 to 0.71.1 in the trivy group across 1 directory chore(deps): bump github.com/aquasecurity/trivy from 0.70.0 to 0.71.2 in the trivy group across 1 directory Jun 24, 2026
@dependabot dependabot Bot force-pushed the dependabot/go_modules/master/trivy-920bea3a09 branch 6 times, most recently from aa629f9 to bd7ee5b Compare June 30, 2026 13:00
@dependabot dependabot Bot force-pushed the dependabot/go_modules/master/trivy-920bea3a09 branch 3 times, most recently from f2b085a to 810f617 Compare July 3, 2026 00:03
@shino

shino commented Jul 3, 2026

Copy link
Copy Markdown
Collaborator

@dependabot recreate

@dependabot
chore(deps): bump github.com/aquasecurity/trivy
3014cbe 
Bumps the trivy group with 1 update in the / directory: [github.com/aquasecurity/trivy](https://github.com/aquasecurity/trivy).


Updates `github.com/aquasecurity/trivy` from 0.70.0 to 0.71.2
- [Release notes](https://github.com/aquasecurity/trivy/releases)
- [Changelog](https://github.com/aquasecurity/trivy/blob/v0.71.2/CHANGELOG.md)
- [Commits](aquasecurity/trivy@v0.70.0...v0.71.2)

---
updated-dependencies:
- dependency-name: github.com/aquasecurity/trivy
  dependency-version: 0.71.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: trivy
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/go_modules/master/trivy-920bea3a09 branch from 810f617 to 3014cbe Compare July 3, 2026 02:34
@shino shino merged commit 0d41be0 into master Jul 3, 2026
8 checks passed
@shino shino deleted the dependabot/go_modules/master/trivy-920bea3a09 branch July 3, 2026 07:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@shino shino shino approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@shino