search

project-copacetic / copacetic

🧵 CLI tool for directly patching container images using reports from vulnerability scanners
https://project-copacetic.github.io/copacetic/
Apache License 2.0
843 stars 57 forks source link

chore: bump github.com/aquasecurity/trivy from 0.51.4 to 0.52.0 #647

Closed dependabot[bot] closed 3 weeks ago

dependabot[bot] commented 1 month ago

Bumps github.com/aquasecurity/trivy from 0.51.4 to 0.52.0.

Release notes

Sourced from github.com/aquasecurity/trivy's releases.

v0.52.0

⚡Release highlights and summary⚡

👉 https://github.com/aquasecurity/trivy/discussions/6838

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0520-2024-06-03

Changelog

Sourced from github.com/aquasecurity/trivy's changelog.

0.52.0 (2024-06-03)

Features

  • Add Julia language analyzer support (#5635) (fecafb1)
  • add support for plugin index (#6674) (26faf8f)
  • misconf: Add support for deprecating a check (#6664) (88702cf)
  • misconf: add Terraform 'removed' block to schema (#6640) (b7a0a13)
  • misconf: register builtin Rego funcs from trivy-checks (#6616) (7c22ee3)
  • misconf: resolve tf module from OpenTofu compatible registry (#6743) (ac74520)
  • misconf: support for VPC resources for inbound/outbound rules (#6779) (349caf9)
  • misconf: support symlinks inside of Helm archives (#6621) (4eae37c)
  • nodejs: add v9 pnpm lock file support (#6617) (1e08648)
  • plugin: specify plugin version (#6683) (d6dc567)
  • python: add license support for requirement.txt files (#6782) (29615be)
  • python: add line number support for requirement.txt files (#6729) (2bc54ad)
  • report: Include licenses and secrets filtered by rego to ModifiedFindings (#6483) (fa3cf99)
  • vex: improve relationship support in CSAF VEX (#6735) (a447f6b)
  • vex: support non-root components for products in OpenVEX (#6728) (9515695)

Bug Fixes

  • clean up golangci lint configuration (#6797) (62de6f3)
  • cli: always output fatal errors to stderr (#6827) (c2b9132)
  • close APKINDEX archive file (#6672) (5caf437)
  • close settings.xml (#6768) (9c3e895)
  • close testfile (#6830) (aa0c413)
  • conda: add support pip deps for environment.yml files (#6675) (150a773)
  • go: add only non-empty root modules for gobinaries (#6710) (c96f2a5)
  • go: include only .version|.ver (no prefixes) ldflags for gobinaries (#6705) (afb4f9d)
  • Golang version parsing from binaries w/GOEXPERIMENT (#6696) (696f2ae)
  • include packages unless it is not needed (#6765) (56dbe1f)
  • misconf: don't shift ignore rule related to code (#6708) (39a746c)
  • misconf: skip Rego errors with a nil location (#6638) (a2c522d)
  • misconf: skip Rego errors with a nil location (#6666) (a126e10)
  • node-collector high and critical cves (#6707) (ff32deb)
  • plugin: initialize logger (#6836) (728e77a)
  • python: add package name and version validation for requirements.txt files. (#6804) (ea3a124)
  • report: hide empty tables if all vulns has been filtered (#6352) (3d388d8)
  • sbom: fix panic for convert mode when scanning json file derived from sbom file (#6808) (f92ea09)
  • use of specified context to obtain cluster name (#6645) (39ebed4)

Performance Improvements

Commits
  • c24dfba release: v0.52.0 [main] (#6809)
  • 728e77a fix(plugin): initialize logger (#6836)
  • 83fc6e7 chore(deps): bump alpine from 3.19.1 to 3.20.0 in the docker group (#6835)
  • c2b9132 fix(cli): always output fatal errors to stderr (#6827)
  • aa0c413 fix: close testfile (#6830)
  • 1c49ae9 docs(julia): add scanner table (#6826)
  • 29615be feat(python): add license support for requirement.txt files (#6782)
  • 2f05418 docs: add more workarounds for out-of-disk (#6821)
  • 5b0bc58 chore: improve error message for image not found (#6822)
  • f92ea09 fix(sbom): fix panic for convert mode when scanning json file derived from ...
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot] commented 3 weeks ago

Superseded by #655.