Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump Trivy to 0.50.1 #3768

Merged
merged 1 commit into from
Apr 17, 2024
Merged

Bump Trivy to 0.50.1 #3768

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .gitpod/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
FROM gitpod/workspace-postgres

RUN wget https://github.com/aquasecurity/trivy/releases/download/v0.44.1/trivy_0.44.1_Linux-64bit.deb \
&& sudo dpkg -i trivy_0.44.1_Linux-64bit.deb
RUN wget https://github.com/aquasecurity/trivy/releases/download/v0.50.1/trivy_0.50.1_Linux-64bit.deb \
&& sudo dpkg -i trivy_0.50.1_Linux-64bit.deb
RUN sudo wget https://github.com/operator-framework/operator-registry/releases/download/v1.27.0/linux-amd64-opm -O /usr/local/bin/opm \
&& sudo chmod +x /usr/local/bin/opm
RUN wget https://storage.googleapis.com/tensorflow/libtensorflow/libtensorflow-cpu-linux-x86_64-2.11.0.tar.gz \
Expand Down
4 changes: 2 additions & 2 deletions charts/artifact-hub/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v2
name: artifact-hub
description: Artifact Hub is a web-based application that enables finding, installing, and publishing Cloud Native packages.
type: application
version: 1.17.1-3
version: 1.17.1-4
appVersion: 1.17.0
kubeVersion: ">= 1.19.0-0"
home: https://artifacthub.io
Expand Down Expand Up @@ -88,7 +88,7 @@ annotations:
- name: scanner
image: artifacthub/scanner:v1.17.0
- name: trivy
image: aquasec/trivy:0.44.1
image: aquasec/trivy:0.50.1
artifacthub.io/links: |
- name: source
url: https://github.com/artifacthub/hub
Expand Down
2 changes: 1 addition & 1 deletion charts/artifact-hub/values.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1230,7 +1230,7 @@
"image": {
"title": "Trivy container image",
"type": "string",
"default": "aquasec/trivy:0.44.1"
"default": "aquasec/trivy:0.50.1"
},
"nodeSelector": {
"title": "Trivy pod node selector",
Expand Down
2 changes: 1 addition & 1 deletion cmd/scanner/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /scanner .
# Trivy installer
FROM alpine:3.19.1 AS trivy-installer
RUN apk --no-cache add curl
RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.44.1
RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.50.1

# Final stage
FROM alpine:3.19.1
Expand Down
2 changes: 1 addition & 1 deletion docs/security_report.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Images used by these kinds of packages can be listed using the `containersImages

## Application dependencies

Trivy also scans [applications dependencies](https://aquasecurity.github.io/trivy/v0.44/docs/scanner/vulnerability/language/) for vulnerabilities. To do that, it inspects the files that contain the applications dependencies and the versions used. Please see the [language-specific packages](https://aquasecurity.github.io/trivy/v0.44/docs/scanner/vulnerability/language/) section in the Trivy documentation (image column) for a full list of the applications dependencies supported.
Trivy also scans [applications dependencies](https://aquasecurity.github.io/trivy/v0.50/docs/scanner/vulnerability/#language-specific-packages) for vulnerabilities. To do that, it inspects the files that contain the applications dependencies and the versions used. Please see the [language-specific packages](https://aquasecurity.github.io/trivy/v0.50/docs/scanner/vulnerability/#language-specific-packages) section in the Trivy documentation (image column) for a full list of the applications dependencies supported.

If you want your application dependencies scanned, please make sure the relevant files are included in your final images. The security report will include a target for each of them.

Expand Down