chore(deps): Update ghcr.io/aquasecurity/trivy Docker tag to v0.76.2 #169

2026-11-13T08:16:40Z

renovate-bot commented

2026-11-13 08:16:40 +00:00

This PR contains the following updates:

Package	Update	Change
ghcr.io/aquasecurity/trivy (source)	patch	`0.76.1` → `0.76.2`

Release Notes

aquasecurity/trivy (ghcr.io/aquasecurity/trivy)

`v0.76.2`

Compare Source

🔐 Security update 🛡️

Trivy v0.76.2 bundles several security fixes:

Official container images are rebuilt on Alpine 3.24.3, which fixes musl/musl-utils (CVE-2026-107891), and the build picks up fixed libcurl (24 CVEs, including HIGH CVE-2026-92392) and brotli-libs (CVE-2026-111497) from the v3.24 package repository.
golang.org/x/net is bumped to v0.62.0, fixing two vulnerabilities in golang.org/x/net/html: CVE-2026-78661 (quadratic complexity when coalescing text nodes) and CVE-2026-97045 (missing ancestor namespace check when rendering raw text).
github.com/go-jose/go-jose/v4 is bumped to v4.1.6, fixing GHSA-mgcc-cww5-fp2q.

We recommend upgrading to v0.76.2 and redeploying container images to apply these updates.

Changelog

3f6334d release: v0.76.2 [release/v0.76] (#11552)
1cabe83 fix(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 [backport: release/v0.76] (#11554)
be08de4 chore(deps): bump the common group across 1 directory with 14 updates [backport: release/v0.76] (#11555)
a8537d3 fix(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 [backport: release/v0.76] (#11553)
ae26b88 fix(deps): bump alpine to 3.24.3 in container images [backport: release/v0.76] (#11551)

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- "after 3am and before 6am"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/aquasecurity/trivy](https://www.aquasec.com/products/trivy/) ([source](https://github.com/aquasecurity/trivy)) | patch | `0.76.1` → `0.76.2` | --- ### Release Notes <details> <summary>aquasecurity/trivy (ghcr.io/aquasecurity/trivy)</summary> ### [`v0.76.2`](https://github.com/aquasecurity/trivy/releases/tag/v0.76.2) [Compare Source](https://github.com/aquasecurity/trivy/compare/v0.76.1...v0.76.2) #### 🔐 Security update 🛡️ Trivy v0.76.2 bundles several security fixes: - Official container images are rebuilt on Alpine 3.24.3, which fixes `musl`/`musl-utils` (CVE-2026-107891), and the build picks up fixed `libcurl` (24 CVEs, including HIGH CVE-2026-92392) and `brotli-libs` (CVE-2026-111497) from the `v3.24` package repository. - `golang.org/x/net` is bumped to v0.62.0, fixing two vulnerabilities in `golang.org/x/net/html`: CVE-2026-78661 (quadratic complexity when coalescing text nodes) and CVE-2026-97045 (missing ancestor namespace check when rendering raw text). - `github.com/go-jose/go-jose/v4` is bumped to v4.1.6, fixing [GHSA-mgcc-cww5-fp2q](https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q). We recommend upgrading to v0.76.2 and redeploying container images to apply these updates. #### Changelog - [`3f6334d`](https://github.com/aquasecurity/trivy/commit/3f6334d223b52188324af3b9923b4249cd206652) release: v0.76.2 \[release/v0.76] ([#11552](https://github.com/aquasecurity/trivy/issues/11552)) - [`1cabe83`](https://github.com/aquasecurity/trivy/commit/1cabe83c11ffed6e984ab46be8886e1e01516ead) fix(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 \[backport: release/v0.76] ([#11554](https://github.com/aquasecurity/trivy/issues/11554)) - [`be08de4`](https://github.com/aquasecurity/trivy/commit/be08de47d0d76fca7e992c0f47fbcf7853f8a713) chore(deps): bump the common group across 1 directory with 14 updates \[backport: release/v0.76] ([#11555](https://github.com/aquasecurity/trivy/issues/11555)) - [`a8537d3`](https://github.com/aquasecurity/trivy/commit/a8537d389cbd0fa215eddfddc27150fc7bc82a6c) fix(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 \[backport: release/v0.76] ([#11553](https://github.com/aquasecurity/trivy/issues/11553)) - [`ae26b88`](https://github.com/aquasecurity/trivy/commit/ae26b88c3b3c380808e767dfb63f9b8dcd5f64fd) fix(deps): bump alpine to 3.24.3 in container images \[backport: release/v0.76] ([#11551](https://github.com/aquasecurity/trivy/issues/11551)) </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - "after 3am and before 6am" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added the needs-review blast-radius dependencies automated-update labels 2026-11-13 08:16:40 +00:00

renovate-bot added 1 commit 2026-11-13 08:16:40 +00:00

chore(deps): Update ghcr.io/aquasecurity/trivy Docker tag to v0.76.2

renovate/stability-days Updates have not met minimum release age requirement

Details

gate / gate (pull_request) Successful in 48s

Details

gate / conformance (pull_request) Skipped

Details

120913b04e

jakman85 merged commit 8b51b02446 into main

2026-11-14 21:58:18 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Home-Network/home-network-k3s-impl#169