aquasecurity/trivy v0.76.2

on GitHub

🔐 Security update 🛡️

Trivy v0.76.2 bundles several security fixes:

• Official container images are rebuilt on Alpine 3.24.3, which fixes musl/musl-utils (CVE-2026-107891), and the build picks up fixed libcurl (24 CVEs, including HIGH CVE-2026-92392) and brotli-libs (CVE-2026-111497) from the v3.24 package repository.
• golang.org/x/net is bumped to v0.62.0, fixing two vulnerabilities in golang.org/x/net/html: CVE-2026-78661 (quadratic complexity when coalescing text nodes) and CVE-2026-97045 (missing ancestor namespace check when rendering raw text).
• github.com/go-jose/go-jose/v4 is bumped to v4.1.6, fixing GHSA-mgcc-cww5-fp2q.

We recommend upgrading to v0.76.2 and redeploying container images to apply these updates.

Changelog

• 3f6334d release: v0.76.2 [release/v0.76] (#11552)
• 1cabe83 fix(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 [backport: release/v0.76] (#11554)
• be08de4 chore(deps): bump the common group across 1 directory with 14 updates [backport: release/v0.76] (#11555)
• a8537d3 fix(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 [backport: release/v0.76] (#11553)
• ae26b88 fix(deps): bump alpine to 3.24.3 in container images [backport: release/v0.76] (#11551)