Skip to content

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Feb 20, 2023

Bumps github.com/aquasecurity/trivy from 0.30.3 to 0.37.3.

Release notes

Sourced from github.com/aquasecurity/trivy's releases.

v0.37.3

Changelog

  • 85d5d61b chore(helm): update Trivy from v0.36.1 to v0.37.2 (#3574)
  • 2c17260b chore(deps): bump github.com/spf13/viper from 1.14.0 to 1.15.0 (#3536)
  • c54f1aa8 chore(deps): bump golang/x/mod to v0.8.0 (#3606)
  • 625ea581 chore(deps): bump golang.org/x/crypto from 0.3.0 to 0.5.0 (#3529)
  • 623c7f94 chore(deps): bump helm.sh/helm/v3 from 3.10.3 to 3.11.1 (#3580)
  • d291c34f ci: quote pros in c++ for semantic pr (#3605)
  • 6cac6c91 fix(image): check proxy settings from env for remote images (#3604)

v0.37.2

💔Breaking Change💔

Java DB

Added breaking change to Trivy Java DB. Users who are using Trivy v0.37.0 or v0.37.1 for Java scanning need to remove the local cached Java DB with trivy image --reset and update Trivy to v0.37.2.

Changelog

  • 12b563b9 BREAKING: use normalized trivy-java-db (#3583)
  • 72a14c67 fix(image): add timeout for remote images (#3582)
  • 4c01d73f chore(deps): bump golang.org/x/mod from 0.6.0 to 0.7.0 (#3532)
  • 10dd5d1a chore(deps): bump golang.org/x/text from 0.5.0 to 0.6.0 (#3534)
  • 439c541f fix(misconf): handle dot files better (#3550)
  • 200e04a7 chore: bump Go to 1.19 (#3551)
  • a533ca87 chore(deps): bump alpine from 3.17.0 to 3.17.1 (#3522)
  • 4bccbe6e chore(deps): bump docker/build-push-action from 3 to 4 (#3523)
  • d0562085 chore(deps): bump actions/cache from 3.2.2 to 3.2.4 (#3524)
  • f5e65749 chore(deps): bump golangci/golangci-lint-action from 3.3.0 to 3.4.0 (#3525)
  • d3da459d chore(deps): bump aquaproj/aqua-installer from 1.2.0 to 2.0.2 (#3526)

v0.37.1

Changelog

  • 7f8868b7 fix(sbom): download the Java DB when generating SBOM (#3539)
  • 364379b7 fix: use cgo free sqlite driver (#3521)
  • 0205475f ci: fix path to dist folder (#3527)

v0.37.0

Changelog

  • e9d2af91 fix(image): close layers (#3517)
  • b1694240 refactor: db client changed (#3515)
  • 7bf1e192 feat(java): use trivy-java-db to get GAV (#3484)
  • 023e45b8 docs: add note about the limitation in Rekor (#3494)
  • 0fe62a93 docs: aggregate targets (#3503)
  • 0373e082 deps: updates wazero to 1.0.0-pre.8 (#3510)
  • a2e21f9b docs: add alma 9 and rocky 9 to supported os (#3513)
  • 7d778b75 chore(deps): bump defsec to v0.82.9 (#3512)
  • 9e9dbea7 chore: add missing target labels (#3504)
  • d99a7b82 docs: add java vulnerability page (#3429)
  • cb5af0b3 feat(image): add support for Docker CIS Benchmark (#3496)
  • 6eec9ac0 feat(image): secret scanning on container image config (#3495)

... (truncated)

Commits
  • 85d5d61 chore(helm): update Trivy from v0.36.1 to v0.37.2 (#3574)
  • 2c17260 chore(deps): bump github.com/spf13/viper from 1.14.0 to 1.15.0 (#3536)
  • c54f1aa chore(deps): bump golang/x/mod to v0.8.0 (#3606)
  • 625ea58 chore(deps): bump golang.org/x/crypto from 0.3.0 to 0.5.0 (#3529)
  • 623c7f9 chore(deps): bump helm.sh/helm/v3 from 3.10.3 to 3.11.1 (#3580)
  • d291c34 ci: quote pros in c++ for semantic pr (#3605)
  • 6cac6c9 fix(image): check proxy settings from env for remote images (#3604)
  • 12b563b BREAKING: use normalized trivy-java-db (#3583)
  • 72a14c6 fix(image): add timeout for remote images (#3582)
  • 4c01d73 chore(deps): bump golang.org/x/mod from 0.6.0 to 0.7.0 (#3532)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/aquasecurity/trivy](https://github.com/aquasecurity/trivy) from 0.30.3 to 0.37.3.
- [Release notes](https://github.com/aquasecurity/trivy/releases)
- [Changelog](https://github.com/aquasecurity/trivy/blob/main/goreleaser.yml)
- [Commits](aquasecurity/trivy@v0.30.3...v0.37.3)

---
updated-dependencies:
- dependency-name: github.com/aquasecurity/trivy
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Feb 20, 2023
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Mar 6, 2023

Superseded by #104.

@dependabot dependabot bot closed this Mar 6, 2023
@dependabot dependabot bot deleted the dependabot/go_modules/master/github.com/aquasecurity/trivy-0.37.3 branch March 6, 2023 08:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant