Skip to content

Bump github.com/aquasecurity/trivy from 0.58.2 to 0.61.1 in /hack/tools#251

Closed
dependabot[bot] wants to merge 2 commits intomainfrom
dependabot/go_modules/hack/tools/github.com/aquasecurity/trivy-0.61.1
Closed

Bump github.com/aquasecurity/trivy from 0.58.2 to 0.61.1 in /hack/tools#251
dependabot[bot] wants to merge 2 commits intomainfrom
dependabot/go_modules/hack/tools/github.com/aquasecurity/trivy-0.61.1

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Apr 28, 2025

Bumps github.com/aquasecurity/trivy from 0.58.2 to 0.61.1.

Release notes

Sourced from github.com/aquasecurity/trivy's releases.

v0.61.1

Changelog

  • 7d3b4ffdd6b22ae80215f3a04421606b1f78de6a release: v0.61.1 [release/v0.61] (#8704)
  • 80d120fa0f96695e09eb97f43fb7413e5c773e50 fix(k8s): skip passed misconfigs for the summary report [backport: release/v0.61] (#8748)
  • 9d6290b31977b1bd4ab47349cd26498bc3b079c3 fix(k8s): correct compare artifact versions [backport: release/v0.61] (#8699)
  • 3799ebbb5a9bc78041492d1f191fb94ce1aa389b test: use aquasecurity repository for test images [backport: release/v0.61] (#8698)

v0.61.0

⚡Release highlights and summary⚡

👉 https://github.com/aquasecurity/trivy/discussions/8639

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0610-2025-03-28

v0.60.0

⚡Release highlights and summary⚡

👉 https://github.com/aquasecurity/trivy/discussions/8495

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0600-2025-03-05

v0.59.1

Changelog

  • 9aabfd2a91e7278384bce7ccc6841a1d2851feb0 release: v0.59.1 [release/v0.59] (#8334)
  • 412c690924d4414ef6d8a5f37b293969bc245d32 fix(misconf): do not log scanners when misconfig scanning is disabled [backport: release/v0.59] (#8349)
  • 98f9ba295a55da34914b849c73b2d003d57d238a chore(deps): bump Go to v1.23.5 [backport: release/v0.59] (#8343)
  • 1741fddbe07d166dffbfb9b6f768940e52d08487 fix(python): add poetry v2 support [backport: release/v0.59] (#8335)
  • 3fd8e2785b2b838327a80cdc8b489583c3664944 fix(sbom): preserve OS packages from multiple SBOMs [backport: release/v0.59] (#8333)

v0.59.0

⚡Release highlights and summary⚡

👉 https://github.com/aquasecurity/trivy/discussions/8312

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0590-2025-01-30

Changelog

Sourced from github.com/aquasecurity/trivy's changelog.

0.61.1 (2025-04-17)

Bug Fixes

  • k8s: correct compare artifact versions [backport: release/v0.61] (#8699) (9d6290b)
  • k8s: skip passed misconfigs for the summary report [backport: release/v0.61] (#8748) (80d120f)

0.61.0 (2025-03-28)

Features

  • fs: optimize scanning performance by direct file access for known paths (#8525) (8bf6caf)
  • k8s: add support for controllers (#8614) (1bf0117)
  • misconf: adapt aws_default_security_group (#8538) (b57eccb)
  • misconf: adapt aws_opensearch_domain (#8550) (9913465)
  • misconf: adapt AWS::DynamoDB::Table (#8529) (8112cdf)
  • misconf: adapt AWS::EC2::VPC (#8534) (0d9865f)
  • misconf: Add support for aws_ami (#8499) (573502e)
  • replace TinyGo with standard Go for WebAssembly modules (#8496) (529957e)

Bug Fixes

  • debian: don't include empty licenses for dpkgs (#8623) (346f5b3)
  • fs: check postAnalyzers for StaticPaths (#8543) (c228307)
  • k8s: show report for --report all (#8613) (dbb6f28)
  • misconf: add ephemeral block type to config schema (#8513) (41512f8)
  • misconf: Check values wholly prior to evalution (#8604) (ad58cf4)
  • misconf: do not skip loading documents from subdirectories (#8526) (de7eb13)
  • misconf: do not use cty.NilVal for non-nil values (#8567) (400a79c)
  • misconf: identify the chart file exactly by name (#8590) (ba77dbe)
  • misconf: Improve logging for unsupported checks (#8634) (5b7704d)
  • misconf: set default values for AWS::EKS::Cluster.ResourcesVpcConfig (#8548) (1f05b45)
  • misconf: skip Azure CreateUiDefinition (#8503) (c7814f1)
  • spdx: save text licenses into otherLicenses without normalize (#8502) (e5072f1)
  • use --file-patterns flag for all post analyzers (#7365) (8b88238)

Performance Improvements

  • misconf: parse input for Rego once (#8483) (0e5e909)
  • misconf: retrieve check metadata from annotations once (#8478) (7b96351)

0.60.0 (2025-03-05)

Features

... (truncated)

Commits
  • 7d3b4ff release: v0.61.1 [release/v0.61] (#8704)
  • 80d120f fix(k8s): skip passed misconfigs for the summary report [backport: release/v0...
  • 9d6290b fix(k8s): correct compare artifact versions [backport: release/v0.61] (#8699)
  • 3799ebb test: use aquasecurity repository for test images [backport: release/v0.61]...
  • 7f41822 release: v0.61.0 [main] (#8507)
  • 5b7704d fix(misconf): Improve logging for unsupported checks (#8634)
  • 1bf0117 feat(k8s): add support for controllers (#8614)
  • 346f5b3 fix(debian): don't include empty licenses for dpkgs (#8623)
  • ad58cf4 fix(misconf): Check values wholly prior to evalution (#8604)
  • c76764e chore(deps): Bump trivy-checks (#8619)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Prajyot-Parab and others added 2 commits April 25, 2025 09:10
Signed-off-by: Prajyot Parab <Prajyot.Parab2@ibm.com>
Bumps [github.com/aquasecurity/trivy](https://github.com/aquasecurity/trivy) from 0.58.2 to 0.61.1.
- [Release notes](https://github.com/aquasecurity/trivy/releases)
- [Changelog](https://github.com/aquasecurity/trivy/blob/v0.61.1/CHANGELOG.md)
- [Commits](aquasecurity/trivy@v0.58.2...v0.61.1)

---
updated-dependencies:
- dependency-name: github.com/aquasecurity/trivy
  dependency-version: 0.61.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Apr 28, 2025

Labels

The following labels could not be found: ok-to-test. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github May 1, 2025

Looks like github.com/aquasecurity/trivy is no longer a dependency, so this is no longer needed.

@dependabot dependabot bot closed this May 1, 2025
@dependabot dependabot bot deleted the dependabot/go_modules/hack/tools/github.com/aquasecurity/trivy-0.61.1 branch May 1, 2025 03:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant