Skip to content

chore(deps): bump github.com/aquasecurity/trivy from 0.59.1 to 0.63.0 #156

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jun 2, 2025

Bumps github.com/aquasecurity/trivy from 0.59.1 to 0.63.0.

Release notes

Sourced from github.com/aquasecurity/trivy's releases.

v0.63.0

👉 Trivy v.63.0 release notes (click here)

⬇️ Download Trivy

Full changelog

v0.62.1

Changelog

  • c75ed2156c8fa801d6998016f46f6b953e8a9556 release: v0.62.1 [release/v0.62] (#8825)
  • aafebeb53aecbc9ed1ea44f8601183b4c25c49e3 chore(deps): bump the common group across 1 directory with 10 updates [backport: release/v0.62] (#8831)
  • 99485cfea2de53570342901eac860afdaacce86f fix(misconf): check if for-each is known when expanding dyn block [backport: release/v0.62] (#8826)
  • b4fc9e8ca1ff77a2795ffa47d0fc53cecd0e1bbd fix(redhat): trim invalid suffix from content_sets in manifest parsing [backport: release/v0.62] (#8824)

v0.62.0

⚡Release highlights and summary⚡

👉 aquasecurity/trivy#8801

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0620-2025-04-30

v0.61.1

Changelog

  • 7d3b4ffdd6b22ae80215f3a04421606b1f78de6a release: v0.61.1 [release/v0.61] (#8704)
  • 80d120fa0f96695e09eb97f43fb7413e5c773e50 fix(k8s): skip passed misconfigs for the summary report [backport: release/v0.61] (#8748)
  • 9d6290b31977b1bd4ab47349cd26498bc3b079c3 fix(k8s): correct compare artifact versions [backport: release/v0.61] (#8699)
  • 3799ebbb5a9bc78041492d1f191fb94ce1aa389b test: use aquasecurity repository for test images [backport: release/v0.61] (#8698)

v0.61.0

⚡Release highlights and summary⚡

👉 aquasecurity/trivy#8639

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0610-2025-03-28

v0.60.0

⚡Release highlights and summary⚡

👉 aquasecurity/trivy#8495

Changelog

... (truncated)

Changelog

Sourced from github.com/aquasecurity/trivy's changelog.

0.63.0 (2025-05-29)

Features

  • add Bottlerocket OS package analyzer (#8653) (07ef63b)
  • add JSONC support for comments and trailing commas (#8862) (0b0e406)
  • alpine: add maintainer field extraction for APK packages (#8930) (104bbc1)
  • cli: Add available version checking (#8553) (5a0bf9e)
  • echo: Add Echo Support (#8833) (c7b8cc3)
  • go: support license scanning in both GOPATH and vendor (#8843) (26437be)
  • k8s: get components from namespaced resources (#8918) (4f1ab23)
  • license: improve work text licenses with custom classification (#8888) (ee52230)
  • license: improve work with custom classification of licenses from config file (#8861) (c321fdf)
  • license: scan vendor directory for license for go.mod files (#8689) (dd6a6e5)
  • license: Support compound licenses (licenses using SPDX operators) (#8816) (39f9ed1)
  • minimos: Add support for MinimOS (#8792) (c2dde33)
  • misconf: add misconfiguration location to junit template (#8793) (a516775)
  • misconf: Add support for Minimum Trivy Version (#8880) (3b2a397)
  • misconf: export raw Terraform data to Rego (#8741) (aaecc29)
  • nodejs: add a bun.lock analyzer (#8897) (7ca656d)
  • nodejs: add bun.lock parser (#8851) (1dcf816)
  • terraform parser option to set current working directory (#8909) (8939451)

Bug Fixes

  • check post-analyzers for StaticPaths (#8904) (93e6680)
  • cli: disable --skip-dir and --skip-files flags for sbom command (#8886) (69a5fa1)
  • cli: don't use allow values for --compliance flag (#8881) (35e8889)
  • filter all files when processing files installed from package managers (#8842) (6ebde88)
  • java: exclude dev dependencies in gradle lockfile (#8803) (8995838)
  • julia parser panicing (#8883) (be8c7b7)
  • julia: add Relationship field support (#8939) (22f040f)
  • k8s: use in-memory cache backend during misconfig scanning (#8873) (fe12771)
  • misconf: check if for-each is known when expanding dyn block (#8808) (5706603)
  • misconf: use argument value in WithIncludeDeprecatedChecks (#8942) (7e9a54c)
  • more revive rules (#8814) (3ab459e)
  • octalLiteral from go-critic (#8811) (a19e0aa)
  • redhat: Also try to find buildinfo in root layer (layer 0) (#8924) (906b037)
  • redhat: save contentSets for OS packages in fs/vm modes (#8820) (9256804)
  • redhat: trim invalid suffix from content_sets in manifest parsing (#8818) (fa1077b)
  • server: add missed Relationship field for rpc (#8872) (38f17c9)
  • use-any from revive (#8810) (883c63b)
  • vex: use lo.IsNil to check VEX from OCI artifact (#8858) (e97af98)
  • wolfi: support new APK database location (#8937) (b15d9a6)

Performance Improvements

... (truncated)

Commits
  • 69093d2 release: v0.63.0 [main] (#8809)
  • 7e9a54c fix(misconf): use argument value in WithIncludeDeprecatedChecks (#8942)
  • 78e3304 chore(deps): Bump trivy-checks (#8934)
  • 22f040f fix(julia): add Relationship field support (#8939)
  • c2dde33 feat(minimos): Add support for MinimOS (#8792)
  • 104bbc1 feat(alpine): add maintainer field extraction for APK packages (#8930)
  • c7b8cc3 feat(echo): Add Echo Support (#8833)
  • 906b037 fix(redhat): Also try to find buildinfo in root layer (layer 0) (#8924)
  • b15d9a6 fix(wolfi): support new APK database location (#8937)
  • 4f1ab23 feat(k8s): get components from namespaced resources (#8918)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jun 2, 2025
@dependabot dependabot bot requested a review from a team as a code owner June 2, 2025 11:27
@dependabot dependabot bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jun 2, 2025
github-actions[bot]
github-actions bot previously approved these changes Jun 2, 2025
@github-actions github-actions bot enabled auto-merge (squash) June 2, 2025 11:27
@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/aquasecurity/trivy-0.63.0 branch from 735a1c7 to 8c6ad57 Compare June 30, 2025 11:18
github-actions[bot]
github-actions bot previously approved these changes Jun 30, 2025
@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/aquasecurity/trivy-0.63.0 branch from 8c6ad57 to e6e3ef7 Compare June 30, 2025 12:17
github-actions[bot]
github-actions bot previously approved these changes Jun 30, 2025
Bumps [github.com/aquasecurity/trivy](https://github.com/aquasecurity/trivy) from 0.59.1 to 0.63.0.
- [Release notes](https://github.com/aquasecurity/trivy/releases)
- [Changelog](https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md)
- [Commits](aquasecurity/trivy@v0.59.1...v0.63.0)

---
updated-dependencies:
- dependency-name: github.com/aquasecurity/trivy
  dependency-version: 0.63.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot dismissed github-actions[bot]’s stale review June 30, 2025 12:54

The merge-base changed after approval.

@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/aquasecurity/trivy-0.63.0 branch from e6e3ef7 to cab9e3f Compare June 30, 2025 12:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file go Pull requests that update Go code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants