v0.28.1 — ingest leniency, Trivy 0.73.0, agent DB-metadata fix

Patch release: ingest robustness, recommended Trivy 0.73.0, and an agent-side Trivy DB metadata fix. No schema change, no migration — upgrade in place.

TICKET-023: Trivy DB metadata read after the scan, not before

Fixed

• The agent now reads trivy version --format json after the rootfs
  scan instead of before it, so the reported DB version/timestamps reflect
  the DB the scan actually used. Previously a host whose DB refreshed
  during the scan submitted fresh findings but reported the pre-scan DB
  state, showing a trivy-db stale pill that was already wrong. Agent-side
  only — server, schema and UI are unchanged.

Changed

• AGENT_VERSION / CURRENT_AGENT_VERSION bumped 0.10.0 → 0.11.0 so
  the fix reaches hosts via auto_update_self. Hosts pick it up on their
  next run; no backfill of existing servers.trivy_db_* rows.

TICKET-022: bump recommended Trivy to 0.73.0

Changed

• RECOMMENDED_TRIVY_VERSION raised from 0.71.0 to 0.73.0. Every host
  with a fathometer-managed Trivy binary picks up the new version on its
  next scheduled run via the existing auto_update_trivy mechanism —
  server-side only, no agent update needed. MIN_TRIVY_VERSION stays
  0.70.0; hosts on a system-package Trivy are unaffected.

TICKET-021 (ADR-0072): per-vulnerability ingest leniency

Fixed

• A single non-conforming vulnerability entry no longer discards the whole
  scan (#22,
  #23):
  Vulnerabilities is validated per entry, so a bad entry drops itself while
  the remaining findings ingest. Accepted identifiers now cover TEMP-*
  (Debian Security Tracker), DSA, DLA, RUSTSEC, GO and PYSEC next to
  CVE and GHSA; over-long Title/Description are trimmed instead of
  rejected. Server-side only — no agent update needed, previously failed scans
  are not backfilled.
• Bulk-acknowledge by identifier accepts the same identifier set, so non-CVE
  findings can be acknowledged in bulk.

Added

• Dropped entries are counted per scan and reported as vulns_dropped in the
  scan.ingested audit metadata, the scan-ingest job result and the log.

Full changelog: v0.28.0...v0.28.1

v0.28.0 — AlmaLinux 10 base image + Python 3.14

Highlights

Runtime base image: Debian → AlmaLinux 10-minimal, Python 3.13 → 3.14 (ADR-0069 / TICKET-020).

The migration cuts Trivy OS-package noise at the root: AlmaLinux ships authoritative OVAL/ALSA errata with backport-aware fix-state, instead of the Debian tracker's "affects package, no fix planned" entries that Trivy surfaces forever. First AlmaLinux scan vs. the Debian baseline: image OS findings 45 → 16 (all openssl-libs, every one with an ALSA fix available → cleared on a base refresh), filesystem findings 2 → 0.

Changed

• Base image python:3.13-slim-trixie → almalinux:10-minimal (builder on almalinux:10). Interpreter Python 3.14 (EL10 ships no 3.13). No libpq (psycopg[binary] bundles it), no curl; the container HEALTHCHECK uses a Python urllib probe. entrypoint.sh and the scratch-flatten final stage are kept; builder and runtime share /usr/bin/python3.14 so the venv needs no relocation.
• Python floor raised to 3.14 everywhere: requires-python>=3.14, ruff target-version=py314, mypy python_version=3.14, CI setup-python 3.14. ruff pinned to ==0.15.13 for deterministic format/lint.
• Agent scan hardening (ADR-0067): trivy rootfs / now excludes container-runtime data-roots (/var/lib/docker, containerd stores, /var/lib/containers) and passes an explicit --timeout; new FM_SCAN_SKIP_DIRS / FM_SCAN_TIMEOUT operator overrides. Fixes a silent 5-minute scan timeout on container hosts.
• Dependencies: cryptography 48.0.0 → 48.0.1 (GHSA-537c-gmf6-5ccf, HIGH), pydantic-settings 2.14.1 → 2.14.2 (GHSA-4xgf-cpjx-pc3j); uv.lock resynced with pyproject.
• Image-size DoD cap raised 200 → 256 MB (the AlmaLinux userland is larger than Debian-slim; the venv is the bulk).
• CI: BuildKit type=gha cache disabled on the self-hosted runner — on the Hetzner ARC runner the transatlantic cache import (~0.29 MB/s for the ~82 MB layer) was slower than a full cold build.
• .trivyignore: dropped the now-moot ~90-entry Debian-tracker list — AlmaLinux findings are fixable via errata, not suppressed.

Notes

• The 16 remaining openssl-libs image findings clear automatically once almalinux:10-minimal ships the openssl -4.el10_2 errata build (base refresh; no code change).
• Air-gap: mirror the almalinux:10 / almalinux:10-minimal base images into the internal registry (see docs/operations.md).

Full changelog: v0.27.1...v0.28.0