From 13ce9436b39ea5677409303bfaa7b25c6d937cac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adri=C3=A1n=20Pe=C3=B1a?= Date: Mon, 17 Aug 2026 10:25:28 +0200 Subject: [PATCH] chore: update Trivy to 0.74.0 (#12466) --- .github/actions/trivy-scan/action.yml | 4 ++-- .trivyignore.yaml | 4 ---- Dockerfile | 7 ++++--- api/Dockerfile | 7 ++++--- api/changelog.d/api-trivy-0740-bump.security.md | 1 + prowler/changelog.d/trivy-0740-bump.security.md | 1 + 6 files changed, 12 insertions(+), 12 deletions(-) create mode 100644 api/changelog.d/api-trivy-0740-bump.security.md create mode 100644 prowler/changelog.d/trivy-0740-bump.security.md diff --git a/.github/actions/trivy-scan/action.yml b/.github/actions/trivy-scan/action.yml index 91bd64e962..4032da469b 100644 --- a/.github/actions/trivy-scan/action.yml +++ b/.github/actions/trivy-scan/action.yml @@ -64,7 +64,7 @@ runs: scanners: 'vuln' ignore-unfixed: 'true' # A finding with no available fix is not actionable, so it must not gate timeout: '5m' - version: 'v0.73.0' + version: 'v0.74.0' # Not trivyignores: that input drops the .yaml extension Trivy parses by. env: TRIVY_IGNOREFILE: '.trivyignore.yaml' @@ -81,7 +81,7 @@ runs: scanners: 'vuln' ignore-unfixed: 'true' # A finding with no available fix is not actionable, so it must not gate timeout: '5m' - version: 'v0.73.0' + version: 'v0.74.0' # Not trivyignores: that input drops the .yaml extension Trivy parses by. env: TRIVY_IGNOREFILE: '.trivyignore.yaml' diff --git a/.trivyignore.yaml b/.trivyignore.yaml index 3157018994..b78162ecc4 100644 --- a/.trivyignore.yaml +++ b/.trivyignore.yaml @@ -164,7 +164,3 @@ vulnerabilities: purls: - "pkg:golang/oras.land/oras-go/v2" expired_at: 2026-12-31 - - id: CVE-2026-39822 - purls: - - "pkg:golang/stdlib" - expired_at: 2026-12-31 diff --git a/Dockerfile b/Dockerfile index 8956851347..c07c6f29da 100644 --- a/Dockerfile +++ b/Dockerfile @@ -8,15 +8,15 @@ ENV POWERSHELL_VERSION=${POWERSHELL_VERSION} # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com) ENV POWERSHELL_TELEMETRY_OPTOUT=1 -ARG TRIVY_VERSION=0.73.0 +ARG TRIVY_VERSION=0.74.0 ENV TRIVY_VERSION=${TRIVY_VERSION} ARG ZIZMOR_VERSION=1.24.1 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION} # Pinned here, not fetched with the artefact: a compromised release ships its own checksum. -ARG TRIVY_SHA256_AMD64=2edd39da482bb4e9831962487b68f68e3928ec3137794757f54d00383d79547b -ARG TRIVY_SHA256_ARM64=13833d97e8a1a5367471c372a173180157f593bece570e20d5d925fef552f5dd +ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a +ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5 ARG POWERSHELL_SHA256_AMD64=492ff26bb958336bf61e597ce19e07648b4003bd2a08659e02f0e3e0446ebfe0 ARG POWERSHELL_SHA256_ARM64=2503b71da3e83635592b092df59a0aca4c3606b4d9b068217bb00be989cb0d56 ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03 @@ -26,6 +26,7 @@ ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed9 RUN apt-get update && apt-get install -y --no-install-recommends \ wget libicu76 libunwind8 libssl3 libcurl4 ca-certificates apt-transport-https gnupg \ build-essential pkg-config libzstd-dev zlib1g-dev \ + && apt-get install -y --no-install-recommends --only-upgrade util-linux \ && rm -rf /var/lib/apt/lists/* # Install PowerShell diff --git a/api/Dockerfile b/api/Dockerfile index 61ecf7725d..0f7e5883bb 100644 --- a/api/Dockerfile +++ b/api/Dockerfile @@ -7,15 +7,15 @@ ENV POWERSHELL_VERSION=${POWERSHELL_VERSION} # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com) ENV POWERSHELL_TELEMETRY_OPTOUT=1 -ARG TRIVY_VERSION=0.73.0 +ARG TRIVY_VERSION=0.74.0 ENV TRIVY_VERSION=${TRIVY_VERSION} ARG ZIZMOR_VERSION=1.24.1 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION} # Pinned here, not fetched with the artefact: a compromised release ships its own checksum. -ARG TRIVY_SHA256_AMD64=2edd39da482bb4e9831962487b68f68e3928ec3137794757f54d00383d79547b -ARG TRIVY_SHA256_ARM64=13833d97e8a1a5367471c372a173180157f593bece570e20d5d925fef552f5dd +ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a +ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5 ARG POWERSHELL_SHA256_AMD64=492ff26bb958336bf61e597ce19e07648b4003bd2a08659e02f0e3e0446ebfe0 ARG POWERSHELL_SHA256_ARM64=2503b71da3e83635592b092df59a0aca4c3606b4d9b068217bb00be989cb0d56 ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03 @@ -36,6 +36,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ libtool \ libxslt1-dev \ python3-dev \ + && apt-get install -y --no-install-recommends --only-upgrade util-linux \ && rm -rf /var/lib/apt/lists/* # Install PowerShell diff --git a/api/changelog.d/api-trivy-0740-bump.security.md b/api/changelog.d/api-trivy-0740-bump.security.md new file mode 100644 index 0000000000..3a7df41ed3 --- /dev/null +++ b/api/changelog.d/api-trivy-0740-bump.security.md @@ -0,0 +1 @@ +Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the API container image, patching Go standard library vulnerabilities and CVE-2026-53615 diff --git a/prowler/changelog.d/trivy-0740-bump.security.md b/prowler/changelog.d/trivy-0740-bump.security.md new file mode 100644 index 0000000000..2aaf6882f6 --- /dev/null +++ b/prowler/changelog.d/trivy-0740-bump.security.md @@ -0,0 +1 @@ +Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the SDK container image, patching Go standard library vulnerabilities and CVE-2026-53615