🔐 Security update 🛡️

Trivy v0.76.2 bundles several security fixes:

• Official container images are rebuilt on Alpine 3.24.3, which fixes musl/musl-utils (CVE-2026-107891), and the build picks up fixed libcurl (24 CVEs, including HIGH CVE-2026-92392) and brotli-libs (CVE-2026-111497) from the v3.24 package repository.
• golang.org/x/net is bumped to v0.62.0, fixing two vulnerabilities in golang.org/x/net/html: CVE-2026-78661 (quadratic complexity when coalescing text nodes) and CVE-2026-97045 (missing ancestor namespace check when rendering raw text).
• github.com/go-jose/go-jose/v4 is bumped to v4.1.6, fixing GHSA-mgcc-cww5-fp2q.

We recommend upgrading to v0.76.2 and redeploying container images to apply these updates.

Changelog

• 3f6334d release: v0.76.2 [release/v0.76] (#11552)
• 1cabe83 fix(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 [backport: release/v0.76] (#11554)
• be08de4 chore(deps): bump the common group across 1 directory with 14 updates [backport: release/v0.76] (#11555)
• a8537d3 fix(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 [backport: release/v0.76] (#11553)
• ae26b88 fix(deps): bump alpine to 3.24.3 in container images [backport: release/v0.76] (#11551)

🔐 Security update: eMudhra CA incident 🛡️

Trivy v0.76.1 includes mitigations for the eMudhra intermediate CA key compromise.

• Official binaries are built with Go 1.27.3, which includes the certificate distrust mitigation tracked as CVE-2026-111943.
• Official container images include an updated Alpine CA trust store that rejects the affected certificate chains.

We recommend upgrading to v0.76.1 and redeploying container images to apply these updates. If you build Trivy from source, use Go 1.27.3 or later and keep your runtime CA trust store up to date.

Changelog

• e713f67 release: v0.76.1 [release/v0.76] (#11445)
• 6647bd6 fix(deps): bump the aws group across 1 directory with 6 updates [backport: release/v0.76] (#11446)
• e0964c9 fix(deps): bump the docker group with 3 updates [backport: release/v0.76] (#11443)
• 992c360 fix(deps): bump the common group with 3 updates [backport: release/v0.76] (#11442)

⚡ Highlights ⚡

👉 https://github.com/aquasecurity/trivy/discussions/11409

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0760-2026-10-14

⚡ Highlights ⚡

👉 https://github.com/aquasecurity/trivy/discussions/11333

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0750-2026-10-01

⚡ Highlights ⚡

👉 https://github.com/aquasecurity/trivy/discussions/11096

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0740-2026-08-14

⚡ Highlights ⚡

👉 https://github.com/aquasecurity/trivy/discussions/11033

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0730-2026-08-03

⚡ Highlights ⚡

👉 https://github.com/aquasecurity/trivy/discussions/10907

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0720-2026-06-30

Changelog

• 055a5c8 release: v0.71.2 [release/v0.71] (#10871)
• 875328a fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870)
• 998f7b3 chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867)

Changelog

• 164b383 release: v0.71.1 [release/v0.71] (#10818)
• a72d9a4 fix(oci): validate artifact filename
• 3dd9847 fix: forward ospkg detector options through ospkg.NewScanner [backport: release/v0.71] (#10825)
• a62cbe4 fix(vex): load VEX documents from within the repository directory [backport: release/v0.71] (#10821)
• 43d1d26 fix: surface the original analysis error instead of context cancellation [backport: release/v0.71] (#10812)
• ac7696c ci: expect GitHub App bot as backport PR author [backport: release/v0.71] (#10815)

⚡ Highlights ⚡

👉 https://github.com/aquasecurity/trivy/discussions/10767

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0710-2026-06-01