🌱 Update Builder Image group #169

cluster-stack-bot · 2024-12-01T11:20:46Z

This PR contains the following updates:

Package	Type	Update	Change
docker.io/aquasec/trivy (source)	stage	minor	`0.51.3` -> `0.58.2`
docker.io/hadolint/hadolint	stage	digest	`7dba9a9` -> `3c206a4`
docker.io/library/alpine	stage	minor	`3.20.0` -> `3.21.2`
docker.io/library/golang	final	digest	`a8712f2` -> `c62751a`
golangci/golangci-lint		minor	`v1.58.2` -> `v1.63.4`

Release Notes

aquasecurity/trivy (docker.io/aquasec/trivy)

`v0.58.2`

Compare Source

Changelog

936f06a release: v0.58.2 [release/v0.58] (#8216)
f72d2bc fix(misconf): allow null values only for tf variables [backport: release/v0.58] (#8238)
2896367 fix(suse): SUSE - update OSType constants and references for compatility [backport: release/v0.58] (#8237)
b733ecc fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field [backport: release/v0.58] (#8215)

Features

add workspaceRelationship (#7889) (d622ca2)
add cvss v4 score and vector in scan response (#7968) (e0f2054)
go: construct dependencies in the parser (#7973) (bcdc0bb)
go: construct dependencies of go.mod main module in the parser (#7977) (5448ba2)
k8s: add default commands for unknown platform (#7863) (b1c7f55)
misconf: log causes of HCL file parsing errors (#7634) (e9a899a)
oracle: add flavors support (#7858) (b9b383e)
secret: Add built-in secrets rules for Private Packagist (#7826) (132d9df)
suse: Align SUSE/OpenSUSE OS Identifiers (#7965) (45d3b40)
Update registry fallbacks (#7679) (5ba9a83)

Bug Fixes

alpine: add UID for removed packages (#7887) (07915da)
aws: change CPU and Memory type of ContainerDefinition to a string (#7995) (aeeba70)
cli: Handle empty ignore files more gracefully (#7962) (4cfb2a9)
debian: infinite loop (#7928) (d982e6a)
fs: add missing defered Cleanup() call to post analyzer fs (#7882) (ab32297)
Improve version comparisons when build identifiers are present (#7873) (eda4d76)
k8s: check all results for vulnerabilities (#7946) (797b36f)
misconf: do not erase variable type for child modules (#7941) (de3b7ea)
misconf: handle null properties in CloudFormation templates (#7813) (99b2db3)
misconf: load full Terraform module (#7925) (fbc42a0)
misconf: properly resolve local Terraform cache (#7983) (fe3a897)
misconf: Update trivy-checks default repo to mirror.gcr.io (#7953) (9988147)
misconf: wrap AWS EnvVar to iac types (#7407) (54130dc)
redhat: don't return error if root/buildinfo/content_manifests/ contains files that are not contentSets files (#7912) (38775a5)
report: handle [email protected] schema for misconfigs in sarif report (#7898) (19aea4b)
sbom: Fixes for Programming Language Vulnerabilities and SBOM Package Maintainer Details (#7871) (461a68a)
terraform: set null value as fallback for missing variables (#7669) (611558e)

`v0.57.1`

Compare Source

⚡Release highlights and summary⚡

👉https://github.com/aquasecurity/trivy/discussions/7951

Changelog

https://github.com/aquasecurity/trivy/blob/release/v0.57/CHANGELOG.md#0571-2024-11-18

`v0.57.0`

Compare Source

⚠ BREAKING CHANGES

k8s: support k8s multi container (#7444)

Features

add end of life date for Ubuntu 24.10 (#7787) (ad3c09e)
cli: add trivy auth (#7664) (27117f8)
cli: error out when ignore file cannot be found (#7624) (cb0b3a9)
cli: rename trivy auth to trivy registry (#7727) (633a7ab)
cyclonedx: add file checksums to CycloneDX reports (#7507) (c225883)
db: append errors (#7843) (5e78b6c)
misconf: export unresolvable field of IaC types to Rego (#7765) (9514148)
misconf: public network support for Azure Storage Account (#7601) (ad91412)
misconf: Show misconfig ID in output (#7762) (f75c0d1)
misconf: ssl_mode support for GCP SQL DB instance (#7564) (2eaa17e)
parser: ignore white space in pom.xml files (#7747) (a7baa93)
report: update gitlab template to populate operating_system value (#7735) (c0d79fa)

Bug Fixes

cli: clean --all deletes only relevant dirs (#7704) (672e886)
cli: add config name to skip-policy-update alias (#7820) (b661d68)
db: fix javadb downloading error handling (#7642) (2c87f0c)
enable usestdlibvars linter (#7770) (57e24aa)
go: Do not trim v prefix from versions in Go Mod Analyzer (#7733) (e872ec0)
helm: properly handle multiple archived dependencies (#7782) (6fab88d)
java: correctly inherit version and scope from upper/root depManagement and dependencies into parents (#7541) (778df82)
k8s: skip resources without misconfigs (#7797) (7882776)
k8s: support k8s multi container (#7444) (c434775)
k8s: support kubernetes v1.31 (#7810) (7a4f4d8)
license: fix license normalization for Universal Permissive License (#7766) (f6acdf7)
misconf: change default ACL of digitalocean_spaces_bucket to private (#7577) (9da84f5)
misconf: check if property is not nil before conversion (#7578) (c8c14d3)
misconf: fix for Azure Storage Account network acls adaptation (#7602) (35fd018)
misconf: properly expand dynamic blocks (#7612) (8d5dbc9)
redhat: include arch in PURL qualifiers (#7654) (a585e95)
repo: git clone output to Stderr (#7561) (fdf203c)
report: Fix invalid URI in SARIF report (#7645) (015bb88)
sbom: add options for DBs in private registries (#7660) (1f2e91b)
sbom: use Annotation instead of AttributionTexts for SPDX formats (#7811) (f2bb9c6)

`v0.56.2`

Compare Source

Changelog

f2252c8 release: v0.56.2 [release/v0.56] (#7694)
f6700ec fix(redhat): include arch in PURL qualifiers [backport: release/v0.56] (#7702)
25d2540 fix(sbom): add options for DBs in private registries [backport: release/v0.56] (#7691)

`v0.56.1`

Compare Source

Changelog

95dbf11 release: v0.56.1 [release/v0.56] (#7648)
5dbdadf fix(db): fix javadb downloading error handling [backport: release/v0.56] (#7646)

`v0.56.0`

Compare Source

Features

java: add empty versions if pom.xml dependency versions can't be detected (#7520) (b836232)
license: improve license normalization (#7131) (6472e3c)
misconf: add ability to disable checks by ID (#7536) (ef0a27d)
misconf: Register checks only when needed (#7435) (f768d3a)
misconf: Support --skip-* for all included modules (#7579) (c0e8da3)
secret: enhance secret scanning for python binary files (#7223) (60725f8)
support multiple DB repositories for vulnerability and Java DB (#7605) (3562529)
support RPM archives (#7628) (69bf7e0)
suse: added SUSE Linux Enterprise Micro support (#7294) (efdb68d)

Bug Fixes

allow access to '..' in mapfs (#7575) (a8fbe46)
db: check DownloadedAt for trivy-java-db (#7592) (13ef3e7)
java: use dependencyManagement from root/child pom's for dependencies from parents (#7497) (5442949)
license: stop spliting a long license text (#7336) (4926da7)
misconf: Disable deprecated checks by default (#7632) (82e2adc)
misconf: disable DS016 check for image history analyzer (#7540) (de40df9)
misconf: escape all special sequences (#7558) (ea0cf03)
misconf: Fix logging typo (#7473) (56db43c)
misconf: Fixed scope for China Cloud (#7560) (37d549e)
misconf: not to warn about missing selectors of libraries (#7638) (fcaea74)
oracle: Update EOL date for Oracle 7 (#7480) (dd0a64a)
report: change a receiver of MarshalJSON (#7483) (927c6e0)
report: fix error with unmarshal of ExperimentalModifiedFindings (#7463) (7ff9aff)
sbom: export bom-ref when converting a package to a component (#7340) (5dd94eb)
sbom: parse type framework as library when unmarshalling CycloneDX files (#7527) (aeb7039)
secret: change grafana token regex to find them without unquoted (#7627) (3e1fa21)

Performance Improvements

misconf: use port ranges instead of enumeration (#7549) (1f9fc13)

Reverts

java: stop supporting of test scope for pom.xml files (#7488) (b0222fe)

`v0.55.2`

Compare Source

Changelog

928c7c0 release: v0.55.2 [release/v0.55] (#7523)
14a058f fix(java): use dependencyManagement from root/child pom's for dependencies from parents [backport: release/v0.55] (#7521)
990bc4e chore(deps): bump alpine from 3.20.0 to 3.20.3 [backport: release/v0.55] (#7516)

`v0.55.1`

Compare Source

⚡Release highlights and summary⚡

👉https://github.com/aquasecurity/trivy/discussions/7494

Changelog

https://github.com/aquasecurity/trivy/blob/release/v0.55/CHANGELOG.md#0551-2024-09-12

`v0.55.0`

Compare Source

⚠ BREAKING CHANGES

cli: delete deprecated SBOM flags (#7266)

Features

cli: delete deprecated SBOM flags (#7266) (7024572)
go: use toolchain as stdlib version for go.mod files (#7163) (2d80769)
java: add test scope support for pom.xml files (#7414) (2d97700)
misconf: Add support for using spec from on-disk bundle (#7179) (be86126)
misconf: ignore duplicate checks (#7317) (9ef05fc)
misconf: iterator argument support for dynamic blocks (#7236) (fe92072)
misconf: port and protocol support for EC2 networks (#7146) (98e136e)
misconf: scanning support for YAML and JSON (#7311) (efdbd8f)
misconf: support for ignore by nested attributes (#7205) (44e4686)
misconf: support for policy and bucket grants (#7284) (a817fae)
misconf: variable support for Terraform Plan (#7228) (db2c955)
python: use minimum version for pip packages (#7348) (e9b43f8)
report: export modified findings in JSON (#7383) (7aea79d)
sbom: set User-Agent header on requests to Rekor (#7396) (af1d257)
server: add internal --path-prefix flag for client/server mode (#7321) (24a4563)
server: Make Trivy Server Multiplexer Exported (#7389) (4c6e8ca)
vm: Support direct filesystem (#7058) (45b3f34)
vm: support the Ext2/Ext3 filesystems (#6983) (35c60f0)
vuln: Add --detection-priority flag for accuracy tuning (#7288) (fd8348d)

Bug Fixes

aws: handle ECR repositories in different regions (#6217) (feaef96)
flag: incorrect behavior for deprected flag --clear-cache (#7281) (2a0e529)
helm: explicitly define kind and apiVersion of volumeClaimTemplate element (#7362) (da4ebfa)
java: Return error when trying to find a remote pom to avoid segfault (#7275) (49d5270)
license: add license handling to JUnit template (#7409) (f80183c)
logger initialization before flags parsing (#7372) (c929290)
misconf: change default TLS values for the Azure storage account (#7345) (aadb090)
misconf: do not filter Terraform plan JSON by name (#7406) (9d7264a)
misconf: do not recreate filesystem map (#7416) (3a5d091)
misconf: do not register Rego libs in checks registry (#7420) (a5aa63e)
misconf: do not set default value for default_cache_behavior (#7234) (f0ed5e4)
misconf: fix infer type for null value (#7424) (0cac3ac)
misconf: init frameworks before updating them (#7376) (b65b32d)
misconf: load only submodule if it is specified in source (#7112) (a4180bd)
misconf: support deprecating for Go checks (#7377) (2a6c7ab)
misconf: use module to log when metadata retrieval fails (#7405) (0799770)
misconf: wrap Azure PortRange in iac types (#7357) (c5c62d5)
nodejs: check all importers to detect dev deps from pnpm-lock.yaml file (#7387) (fd9ed3a)
plugin: do not call GitHub content API for releases and tags (#7274) (b3ee6da)
report: escape Message field in asff.tpl template (#7401) (dd9733e)
safely check if the directory exists (#7353) (05a8297)
sbom: use NOASSERTION for licenses fields in SPDX formats (#7403) (c96dcdd)
secret: use .eyJ keyword for JWT secret (#7410) (bf64003)
secret: use only line with secret for long secret lines (#7412) (391448a)
terraform: add aws_region name to presets (#7184) (bb2e26a)

Performance Improvements

misconf: do not convert contents of a YAML file to string (#7292) (85dadf5)
misconf: optimize work with context (#6968) (2b6d8d9)
misconf: use json.Valid to check validity of JSON (#7308) (c766831)

`v0.54.1`

Compare Source

Changelog

854c61d release: v0.54.1 [release/v0.54] (#7282)
334a1c2 fix(flag): incorrect behavior for deprected flag --clear-cache [backport: release/v0.54] (#7285)
f61725c fix(java): Return error when trying to find a remote pom to avoid segfault [backport: release/v0.54] (#7283)
a7b7117 fix(plugin): do not call GitHub content API for releases and tags [backport: release/v0.54] (#7279)

`v0.54.0`

Compare Source

Features

add log.FilePath() function for logger (#7080) (1f5f348)
add openSUSE tumbleweed detection and scanning (#6965) (17b5dbf)
cli: rename --vuln-type flag to --pkg-types flag (#7104) (7cbdb0a)
mariner: Add support for Azure Linux (#7186) (5cbc452)
misconf: enabled China configuration for ACRs (#7156) (d1ec89d)
nodejs: add license parser to pnpm analyser (#7036) (03ac93d)
sbom: add image labels into SPDX and CycloneDX reports (#7257) (4a2f492)
sbom: add vulnerability support for SPDX formats (#7213) (efb1f69)
share build-in rules (#7207) (bff317c)
vex: retrieve VEX attestations from OCI registries (#7249) (c2fd2e0)
vex: VEX Repository support (#7206) (88ba460)
vuln: add --pkg-relationships (#7237) (5c37361)

Bug Fixes

Add dependencyManagement exclusions to the child exclusions (#6969) (dc68a66)
add missing platform and type to spec (#7149) (c8a7abd)
cli: error on missing config file (#7154) (7fa5e7d)
close file when failed to open gzip (#7164) (2a577a7)
dotnet: don't include non-runtime libraries into report for *.deps.json files (#7039) (5bc662b)
dotnet: show nuget package dir not found log only when checking nuget packages (#7194) (d76feba)
ignore nodes when listing permission is not allowed (#7107) (25f8143)
java: avoid panic if deps from pom in it dir are not found (#7245) (4e54a7e)
java: use go-mvn-version to remove Package duplicates (#7088) (a7a304d)
misconf: do not evaluate TF when a load error occurs (#7109) (f27c236)
nodejs: detect direct dependencies when using latest version for files yarn.lock + package.json (#7110) (54bb8bd)
report: hide empty table when all secrets/license/misconfigs are ignored (#7171) (c3036de)
secret: skip regular strings contain secret patterns (#7182) (174b1e3)
secret: trim excessively long lines (#7192) (92b13be)
secret: update length of hugging-face-access-token (#7216) (8c87194)
server: pass license categories to options (#7203) (9d52018)

Performance Improvements

debian: use bytes.Index in emptyLineSplit to cut allocation (#7065) (acbec05)

`v0.53.0`

Compare Source

⚠ BREAKING CHANGES

k8s: node-collector dynamic commands support (#6861)
add clean subcommand (#6993)
aws: Remove aws subcommand (#6995)

Features

add clean subcommand (#6993) (8d0ae1f)
Add local ImageID to SARIF metadata (#6522) (f144e91)
add memory cache backend (#7048) (55ccd06)
aws: Remove aws subcommand (#6995) (979e118)
conda: add licenses support for environment.yml files (#6953) (654217a)
dart: use first version of constraint for dependencies using SDK version (#6239) (042d6b0)
image: Set User-Agent header for Trivy container registry requests (#6868) (9b31697)
java: add support for maven-metadata.xml files for remote snapshot repositories. (#6950) (1f8fca1)
java: add support for sbt projects using sbt-dependency-lock (#6882) (f18d035)
k8s: node-collector dynamic commands support (#6861) (8d618e4)
misconf: add metadata to Cloud schema (#6831) (02d5404)
misconf: add support for AWS::EC2::SecurityGroupIngress/Egress (#6755) (55fa610)
misconf: API Gateway V1 support for CloudFormation (#6874) (8491469)
misconf: support of selectors for all providers for Rego (#6905) (bc3741a)
php: add installed.json file support (#4865) (edc556b)
plugin: add support for nested archives (#6845) (622c67b)
sbom: migrate to CycloneDX v1.6 (#6903) (09e50ce)

Bug Fixes

c: don't skip conan files from file-patterns and scan .conan2 cache dir (#6949) (38b35dd)
cli: show info message only when --scanners is available (#7032) (e9fc3e3)
cyclonedx: trim non-URL info for advisory.url (#6952) (417212e)
debian: take installed files from the origin layer (#6849) (089b953)
image: parse image.inspect.Created field only for non-empty values (#6948) (0af5730)
license: return license separation using separators ,, or, etc. (#6916) (52f7aa5)
misconf: fix caching of modules in subdirectories (#6814) (0bcfedb)
misconf: fix parsing of engine links and frameworks (#6937) (ec68c9a)
misconf: handle source prefix to ignore (#6945) (c3192f0)
misconf: parsing numbers without fraction as int (#6834) (8141a13)
nodejs: fix infinite loop when package link from package-lock.json file is broken (#6858) (cf5aa33)
nodejs: fix infinity loops for pnpm with cyclic imports (#6857) (7d083bc)
plugin: respect --insecure (#7022) (3d02a31)
purl: add missed os types (#6955) (2d85a00)
python: compare pkg names from poetry.lock and pyproject.toml in lowercase (#6852) (faa9d92)
sbom: don't overwrite srcEpoch when decoding SBOM files (#6866) (04af59c)
sbom: fix panic when scanning SBOM file without root component into SBOM format (#7051) (3d4ae8b)
sbom: take pkg name from purl for maven pkgs (#7008) (a76e328)
sbom: use purl for bitnami pkg names (#6982) (7eabb92)
sbom: use package UIDs for uniqueness (#7042) (14d71ba)
secret: Asymmetric Private Key shouldn't start with space (#6867) (bb26445)
suse: Add SLES 15.6 and Leap 15.6 (#6964) (5ee4e9d)
use embedded when command path not found (#7037) (137c916)

`v0.52.2`

Compare Source

Changelog

8709d4f release: v0.52.2 [release/v0.52] (#6896)
a4b8ad7 ci: use ubuntu-latest-m runner [backport: release/v0.52] (#6933)
2b711bc chore(deps): bump github.com/Azure/a

Configuration

📅 Schedule: Branch creation - "on the first day of the month" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

| datasource | package | from | to | | ----------- | ------------------------ | ------- | ------- | | docker | docker.io/aquasec/trivy | 0.51.3 | 0.58.2 | | docker | docker.io/library/alpine | 3.20.0 | 3.21.2 | | github-tags | golangci/golangci-lint | v1.58.2 | v1.63.4 |

cluster-stack-bot bot added type/minor type/patch update/container size/XS Denotes a PR that changes 0-20 lines, ignoring generated files. area/github Changes made in the github directory labels Dec 1, 2024

cluster-stack-bot bot force-pushed the renovate/csctl-builder-image branch 2 times, most recently from 74116ad to 69e1e9d Compare December 6, 2024 11:21

cluster-stack-bot bot force-pushed the renovate/csctl-builder-image branch from 69e1e9d to f50ffa9 Compare December 24, 2024 11:20

cluster-stack-bot bot force-pushed the renovate/csctl-builder-image branch 4 times, most recently from a83bc31 to 874b8f4 Compare January 7, 2025 11:20

cluster-stack-bot bot force-pushed the renovate/csctl-builder-image branch from 874b8f4 to 5ccf6f9 Compare January 9, 2025 11:20

cluster-stack-bot bot force-pushed the renovate/csctl-builder-image branch from 5ccf6f9 to eb27b84 Compare January 14, 2025 11:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🌱 Update Builder Image group #169

🌱 Update Builder Image group #169

cluster-stack-bot bot commented Dec 1, 2024 •

edited

Loading

🌱 Update Builder Image group #169

Are you sure you want to change the base?

🌱 Update Builder Image group #169

Conversation

cluster-stack-bot bot commented Dec 1, 2024 • edited Loading

Release Notes

Changelog

⚡Release highlights and summary⚡

Changelog

Features

Bug Fixes

⚡Release highlights and summary⚡

Changelog

⚠ BREAKING CHANGES

Features

Bug Fixes

Changelog

Changelog

Features

Bug Fixes

Performance Improvements

Reverts

Changelog

⚡Release highlights and summary⚡

Changelog

⚠ BREAKING CHANGES

Features

Bug Fixes

Performance Improvements

Changelog

Features

Bug Fixes

Performance Improvements

⚠ BREAKING CHANGES

Features

Bug Fixes

Changelog

Configuration

cluster-stack-bot bot commented Dec 1, 2024 •

edited

Loading