fix(api): bump Trivy to 0.70.0 in API image for CVE-2026-33186

- Patch gRPC-Go auth bypass (missing leading slash in HTTP/2 :path)
  also in the API container image, which bundles the same Trivy CLI
- Update SDK changelog entry to reflect both images are now covered

api/CHANGELOG.md

@@ -8,6 +8,10 @@ All notable changes to the **Prowler API** are documented in this file.
 
 - New `scan-reset-ephemeral-resources` post-scan task zeroes `failed_findings_count` for resources missing from the latest full-scope scan, keeping ephemeral resources from polluting the Resources page sort [(#10929)](https://github.com/prowler-cloud/prowler/pull/10929)
 
+### 🔐 Security
+
+- `trivy` binary in the API image from 0.69.2 to 0.70.0, patching CVE-2026-33186 (gRPC-Go authorization bypass via missing leading slash in HTTP/2 `:path`)
+
 ---
 
 ## [1.26.1] (Prowler v5.25.1)

api/Dockerfile

@@ -5,7 +5,7 @@ LABEL maintainer="https://github.com/prowler-cloud/api"
 ARG POWERSHELL_VERSION=7.5.0
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 
-ARG TRIVY_VERSION=0.69.2
+ARG TRIVY_VERSION=0.70.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}
 
 ARG ZIZMOR_VERSION=1.24.1

prowler/CHANGELOG.md

@@ -30,7 +30,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 - Parser-mismatch SSRF in image provider registry auth where crafted bearer-token realms and pagination links could force requests to internal addresses and leak credentials cross-origin [(#10945)](https://github.com/prowler-cloud/prowler/pull/10945)
 - `cryptography` from 46.0.6 to 46.0.7, patching CVE-2026-39892 (out-of-bounds read on non-contiguous buffers passed to `Hash.update()` and similar APIs)
-- `trivy` binary in the SDK image from 0.69.2 to 0.70.0, patching CVE-2026-33186 (gRPC-Go authorization bypass via missing leading slash in HTTP/2 `:path`)
+- `trivy` binary in the SDK and API images from 0.69.2 to 0.70.0, patching CVE-2026-33186 (gRPC-Go authorization bypass via missing leading slash in HTTP/2 `:path`)
 
 ---