Skip to content
TrustMyStack, home

trivy

v0.76.2
aquasecurity/trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Version of aquasecurity/trivy you run

CompareView on GitHub
Maintenance
Active152 commits in 3 months · bus factor 3
License
Apache-2.0Permissive · OSI-approved
Security
5 advisories1 critical, 1 high, 3 medium · Scorecard 6.4/10
Supported versions
No scheduleendoflife.date does not track this project

39.4k stars · 885 forks · 315 open issues · last release 10 days ago · data checked 4 hours ago

OverviewTourReleasesDocker imagesSecurityLogos

Breaking changes

What to check before upgrading, taken from the notes of the last 30 releases.

  • v0.23.0Jan 31, 2022
    • 22054626 BREAKING: remove root command (#1579)
    • 8da20c8c BREAKING: migrate the sarif template to Go code (#1437)
    • e65274e0 BREAKING: Trivy DB from GHCR (#1539)
  • v0.22.0Dec 24, 2021
    • 76249bdc BREAKING: disable JAR detection in fs/repo scanning (#1512)

Release history

All releases on GitHub
Atom feed/feed/aquasecurity/trivy
BadgeLatest version of aquasecurity/trivy[![version](/badge/aquasecurity/trivy)](/p/aquasecurity/trivy)

🔐 Security update 🛡️

Trivy v0.76.2 bundles several security fixes:

  • Official container images are rebuilt on Alpine 3.24.3, which fixes musl/musl-utils (CVE-2026-107891), and the build picks up fixed libcurl (24 CVEs, including HIGH CVE-2026-92392) and brotli-libs (CVE-2026-111497) from the v3.24 package repository.
  • golang.org/x/net is bumped to v0.62.0, fixing two vulnerabilities in golang.org/x/net/html: CVE-2026-78661 (quadratic complexity when coalescing text nodes) and CVE-2026-97045 (missing ancestor namespace check when rendering raw text).
  • github.com/go-jose/go-jose/v4 is bumped to v4.1.6, fixing GHSA-mgcc-cww5-fp2q.

We recommend upgrading to v0.76.2 and redeploying container images to apply these updates.

Changelog

  • 3f6334d223b52188324af3b9923b4249cd206652 release: v0.76.2 [release/v0.76] (#11552)
  • 1cabe83c11ffed6e984ab46be8886e1e01516ead fix(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 [backport: release/v0.76] (#11554)
  • be08de47d0d76fca7e992c0f47fbcf7853f8a713 chore(deps): bump the common group across 1 directory with 14 updates [backport: release/v0.76] (#11555)
  • a8537d389cbd0fa215eddfddc27150fc7bc82a6c fix(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 [backport: release/v0.76] (#11553)
  • ae26b88c3b3c380808e767dfb63f9b8dcd5f64fd fix(deps): bump alpine to 3.24.3 in container images [backport: release/v0.76] (#11551)

Full release notesCompare with previous