{"id":"CVE-2025-53547","aliases":["ALPINE-CVE-2025-53547","AZL-64877","BIT-helm-2025-53547","EUVD-2025-20751","GHSA-557j-xg8c-q2mm","GO-2025-3802","SUSE-SU-2025:20516-1","SUSE-SU-2025:20595-1","SUSE-SU-2025:4190-1","openSUSE-SU-2025:15331-1","openSUSE-SU-2025:15336-1","openSUSE-SU-2025:15338-1","openSUSE-SU-2025:15341-1","openSUSE-SU-2025:15405-1","openSUSE-SU-2025:15406-1","openSUSE-SU-2025:15779-1","openSUSE-SU-2025:20117-1","openSUSE-SU-2026:20798-1"],"status":"published","title":"Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution","description":"Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.","severity":{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00494,"percentile":0.4273,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2025-07-08T21:39:59Z","modified":"2026-11-03T06:32:52Z","exploits":[{"source":"pocgithub","id":"DVKunion/CVE-2025-53547-POC","title":"DVKunion/CVE-2025-53547-POC","date":"2025-07-09","url":"https://github.com/DVKunion/CVE-2025-53547-POC"}],"fixes":[{"ecosystem":"Go","package":"helm.sh/helm/v3","fixed_in":["3.18.4","3.17.4"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.22","package":"helm","fixed_in":["3.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"helm","fixed_in":["3.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"helm","fixed_in":["3.18.4-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"helm","fixed_in":["3.14.2-7"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"helm","fixed_in":["3.18.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"helm","fixed_in":["3.18.4-slfo.1.1_1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"helm","fixed_in":["3.18.4-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cmctl","fixed_in":["2.3.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"k9s","fixed_in":["0.50.7-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"trivy","fixed_in":["0.64.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"kubeshark-cli","fixed_in":["52.8.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"helm.sh/helm/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.18.0-rc.1"},{"fixed":"3.18.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"helm.sh/helm/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.17.4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.18.0"},{"fixed":"3.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.18.0"},{"fixed":"3.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.18.0"},{"fixed":"3.18.4-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.2-7"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"helm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.18.4"}]}]},{"source":"osv","ecosystem":"Go","package":"helm.sh/helm/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"3.18.0-rc.1"},{"fixed":"3.18.4"}]}]},{"source":"osv","ecosystem":"Go","package":"helm.sh/helm/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.17.4"}]}]},{"source":"osv","ecosystem":"Go","package":"helm.sh/helm/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.18.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.4-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.4-slfo.1.1_1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-150000.1.57.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.4-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cmctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"k9s","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.50.7-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.64.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250730T213748-1.1"}]}],"bundled":56},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kubeshark-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.8.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.2-1.1"}]}],"bundled":20}],"products":[{"vendor":"helm","product":"helm"}],"references":[{"url":"https://github.com/helm/helm/security/advisories/GHSA-557j-xg8c-q2mm","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web"]},{"url":"https://github.com/helm/helm/commit/4b8e61093d8f579f1165cdc6bd4b43fa5455f571","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://news.ycombinator.com/item?id=44506696","tags":["Issue Tracking","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53547","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-557j-xg8c-q2mm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-53547","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53547.json","tags":["advisory"]},{"url":"https://github.com/helm/helm","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520516-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1241802","tags":["report"]},{"url":"https://bugzilla.suse.com/1246152","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53547","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520595-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254190-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1251442","tags":["report"]},{"url":"https://bugzilla.suse.com/1251649","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-51471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://bugzilla.suse.com/1227010","tags":["report"]},{"url":"https://bugzilla.suse.com/1232948","tags":["report"]},{"url":"https://bugzilla.suse.com/1234512","tags":["report"]},{"url":"https://bugzilla.suse.com/1235265","tags":["report"]},{"url":"https://bugzilla.suse.com/1237618","tags":["report"]},{"url":"https://bugzilla.suse.com/1239225","tags":["report"]},{"url":"https://bugzilla.suse.com/1239385","tags":["report"]},{"url":"https://bugzilla.suse.com/1240466","tags":["report"]},{"url":"https://bugzilla.suse.com/1241724","tags":["report"]},{"url":"https://bugzilla.suse.com/1243633","tags":["report"]},{"url":"https://bugzilla.suse.com/1246151","tags":["report"]},{"url":"https://bugzilla.suse.com/1246730","tags":["report"]},{"url":"https://bugzilla.suse.com/1248897","tags":["report"]},{"url":"https://bugzilla.suse.com/1248937","tags":["report"]},{"url":"https://bugzilla.suse.com/1250625","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://bugzilla.suse.com/1251363","tags":["report"]},{"url":"https://bugzilla.suse.com/1251547","tags":["report"]},{"url":"https://bugzilla.suse.com/1253512","tags":["report"]},{"url":"https://bugzilla.suse.com/1253786","tags":["report"]},{"url":"https://bugzilla.suse.com/1253977","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-53547","title":"Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution","description":"Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.","status":"published","published":"2025-07-08T21:39:59.075Z","modified":"2026-02-26T17:51:02.113Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:32:48.853452Z"}],"euvd":[{"id":"EUVD-2025-20751","description":"Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.","status":"published","published":"2025-07-08T21:39:59Z","modified":"2026-02-26T17:51:02Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:18.619892Z"}],"ghsa":[{"id":"GHSA-557j-xg8c-q2mm","title":"Helm vulnerable to Code Injection through malicious chart.yaml content","description":"A Helm contributor discovered that a specially crafted `Chart.yaml` file along with a specially linked `Chart.lock` file can lead to local code execution when dependencies are updated.\n\n### Impact\n\nFields in a `Chart.yaml` file, that are carried over to a `Chart.lock` file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a `bash.rc` file or shell script). If the `Chart.lock` file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking.\n\nThis affects when dependencies are updated. When using the `helm` command this happens when `helm dependency update` is run. `helm dependency build` can write a lock file when one does not exist but this vector requires one to already exist. This affects the Helm SDK when the downloader `Manager` performs an update.\n\n### Patches\n\nThis issue has been resolved in Helm v3.18.4\n\n### Workarounds\n\nEnsure the `Chart.lock` file in a chart is not a symlink prior to updating dependencies.\n\n### For more information\n\nHelm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.\n\n### Credits\n\nDisclosed by Jakub Ciolek at AlphaSense.","status":"published","published":"2025-07-08T23:20:54Z","modified":"2025-07-16T21:10:16Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:38:50.834587Z"}],"nvd":[{"id":"CVE-2025-53547","description":"Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.","status":"published","published":"2025-07-08T22:15:27.897Z","modified":"2026-06-17T09:38:25.54Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:11:17.727956Z"}],"osv":[{"id":"ALPINE-CVE-2025-53547","description":"Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.","status":"published","published":"2025-07-08T22:15:27.897Z","modified":"2026-11-03T06:32:52.021120855Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"CVE-2025-53547","title":"Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution","description":"Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.","status":"published","published":"2025-07-08T21:39:59.075Z","modified":"2026-10-28T02:31:14.394890995Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:50.45326Z"},{"id":"GHSA-557j-xg8c-q2mm","title":"Helm vulnerable to Code Injection through malicious chart.yaml content","description":"A Helm contributor discovered that a specially crafted `Chart.yaml` file along with a specially linked `Chart.lock` file can lead to local code execution when dependencies are updated.\n\n### Impact\n\nFields in a `Chart.yaml` file, that are carried over to a `Chart.lock` file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a `bash.rc` file or shell script). If the `Chart.lock` file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking.\n\nThis affects when dependencies are updated. When using the `helm` command this happens when `helm dependency update` is run. `helm dependency build` can write a lock file when one does not exist but this vector requires one to already exist. This affects the Helm SDK when the downloader `Manager` performs an update.\n\n### Patches\n\nThis issue has been resolved in Helm v3.18.4\n\n### Workarounds\n\nEnsure the `Chart.lock` file in a chart is not a symlink prior to updating dependencies.\n\n### For more information\n\nHelm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.\n\n### Credits\n\nDisclosed by Jakub Ciolek at AlphaSense.","status":"published","published":"2025-07-08T23:20:54Z","modified":"2026-09-10T03:50:25.790911761Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"AZL-64877","title":"CVE-2025-53547 affecting package helm for versions less than 3.14.2-7","description":"Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.","status":"published","published":"2025-07-08T22:15:27Z","modified":"2026-04-21T04:32:35.089853Z","updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"BIT-helm-2025-53547","title":"Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution","description":"Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.","status":"published","published":"2025-07-10T05:43:09.073Z","modified":"2026-09-08T08:48:23.109638581Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2025-3802","title":"Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm","description":"Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm","status":"published","published":"2025-07-21T15:05:07Z","modified":"2026-02-04T04:11:16.982399Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15331-1","title":"helm-3.18.4-1.1 on GA media","description":"These are all security issues fixed in the helm-3.18.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-09T00:00:00Z","modified":"2026-03-23T04:53:39.399918Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15336-1","title":"cmctl-2.3.0-1.1 on GA media","description":"These are all security issues fixed in the cmctl-2.3.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-11T00:00:00Z","modified":"2026-02-04T03:00:27.700142Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15338-1","title":"k9s-0.50.7-2.1 on GA media","description":"These are all security issues fixed in the k9s-0.50.7-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-11T00:00:00Z","modified":"2026-02-04T02:36:46.850058Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15341-1","title":"trivy-0.64.1-1.1 on GA media","description":"These are all security issues fixed in the trivy-0.64.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-11T00:00:00Z","modified":"2026-02-04T02:43:34.991104Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15405-1","title":"govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-04T00:00:00Z","modified":"2026-03-23T04:53:44.42671Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15406-1","title":"kubeshark-cli-52.8.0-1.1 on GA media","description":"These are all security issues fixed in the kubeshark-cli-52.8.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-04T00:00:00Z","modified":"2026-03-23T04:53:44.37855Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15779-1","title":"helm3-3.19.2-1.1 on GA media","description":"These are all security issues fixed in the helm3-3.19.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-28T00:00:00Z","modified":"2026-02-04T03:10:43.123465Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2025:20117-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\nChanges in trivy:\n\nUpdate to version 0.67.2 (bsc#1250625, CVE-2025-11065, bsc#1248897, CVE-2025-58058):\n\n  * fix: Use `fetch-level: 1` to check out trivy-repo in the release workflow [backport: release/v0.67] (#9638)\n  * fix: restore compatibility for google.protobuf.Value [backport: release/v0.67] (#9631)\n  * fix: using SrcVersion instead of Version for echo detector [backport: release/v0.67] (#9629)\n  * fix: add `buildInfo` for `BlobInfo` in `rpc` package [backport: release/v0.67] (#9615)\n  * fix(vex): don't use reused BOM [backport: release/v0.67] (#9612)\n  * fix(vex): don't  suppress vulns for packages with infinity loop (#9465)\n  * fix(aws): use `BuildableClient` insead of `xhttp.Client` (#9436)\n  * refactor(misconf): replace github.com/liamg/memoryfs with internal mapfs and testing/fstest (#9282)\n  * docs: clarify inline ignore limitations for resource-less checks (#9537)\n  * fix(k8s): disable parallel traversal with fs cache for k8s images (#9534)\n  * fix(misconf): handle tofu files in module detection (#9486)\n  * feat(seal): add seal support (#9370)\n  * docs: fix modules path and update code example (#9539)\n  * fix: close file descriptors and pipes on error paths (#9536)\n  * feat: add documentation URL for database lock errors (#9531)\n  * fix(db): Dowload database when missing but metadata still exists (#9393)\n  * feat(cloudformation): support default values and list results in Fn::FindInMap (#9515)\n  * fix(misconf): unmark cty values before access (#9495)\n  * feat(cli): change --list-all-pkgs default to true (#9510)\n  * fix(nodejs): parse workspaces as objects for package-lock.json files (#9518)\n  * refactor(fs): use underlyingPath to determine virtual files more reliably (#9302)\n  * refactor: remove google/wire dependency and implement manual DI (#9509)\n  * chore(deps): bump the aws group with 6 updates (#9481)\n  * chore(deps): bump the common group across 1 directory with 24 updates (#9507)\n  * fix(misconf): wrap legacy ENV values in quotes to preserve spaces (#9497)\n  * docs: move info about `detection priority` into coverage section (#9469)\n  * feat(sbom): added support for CoreOS (#9448)\n  * fix(misconf): strip build metadata suffixes from image history (#9498)\n  * feat(cyclonedx): preserve SBOM structure when scanning SBOM files with vulnerability updates (#9439)\n  * docs: Fix typo in terraform docs (#9492)\n  * feat(redhat): add os-release detection for RHEL-based images (#9458)\n  * ci(deps): add 3-day cooldown period for Dependabot updates (#9475)\n  * refactor: migrate from go-json-experiment to encoding/json/v2 (#9422)\n  * fix(vuln): compare `nuget` package names in lower case (#9456)\n  * chore: Update release flow to include chocolatey (#9460)\n  * docs: document eol supportability (#9434)\n  * docs(report): add nuanses about secret/license scanner in summary table (#9442)\n  * ci: use environment variables in GitHub Actions for improved security (#9433)\n  * chore: bump Go to 1.24.7 (#9435)\n  * fix(nodejs): use snapshot string as `Package.ID` for pnpm packages (#9330)\n  * ci(helm): bump Trivy version to 0.66.0 for Trivy Helm Chart 0.18.0 (#9425)\n\nUpdate to version 0.66.0 (bsc#1248937, CVE-2025-58058):\n\n  * chore(deps): bump the aws group with 7 updates (#9419)\n  * refactor(secret): clarify secret scanner messages (#9409)\n  * fix(cyclonedx): handle multiple license types (#9378)\n  * fix(repo): sanitize git repo URL before inserting into report metadata (#9391)\n  * test: add HTTP basic authentication to git test server (#9407)\n  * fix(sbom): add support for `file` component type of `CycloneDX` (#9372)\n  * fix(misconf): ensure module source is known (#9404)\n  * ci: migrate GitHub Actions from version tags to SHA pinning (#9405)\n  * fix: create temp file under composite fs dir (#9387)\n  * chore(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#9403)\n  * refactor: switch to stable azcontainerregistry SDK package (#9319)\n  * chore(deps): bump the common group with 7 updates (#9382)\n  * refactor(misconf): migrate from custom Azure JSON parser (#9222)\n  * fix(repo): preserve RepoMetadata on FS cache hit (#9389)\n  * refactor(misconf): use atomic.Int32 (#9385)\n  * chore(deps): bump the aws group with 6 updates (#9383)\n  * docs: Fix broken link to \"Built-in Checks\" (#9375)\n  * fix(plugin): don't remove plugins when updating index.yaml file (#9358)\n  * fix: persistent flag option typo (#9374)\n  * chore(deps): bump the common group across 1 directory with 26 updates (#9347)\n  * fix(image): use standardized HTTP client for ECR authentication (#9322)\n  * refactor: export `systemFileFiltering` Post Handler (#9359)\n  * docs: update links to Semaphore pages (#9352)\n  * fix(conda): memory leak by adding closure method for `package.json` file (#9349)\n  * feat: add timeout handling for cache database operations (#9307)\n  * fix(misconf): use correct field log_bucket instead of target_bucket in gcp bucket (#9296)\n  * fix(misconf): ensure ignore rules respect subdirectory chart paths (#9324)\n  * chore(deps): bump alpine from 3.21.4 to 3.22.1 (#9301)\n  * feat(terraform): use .terraform cache for remote modules in plan scanning (#9277)\n  * chore: fix some function names in comment (#9314)\n  * chore(deps): bump the aws group with 7 updates (#9311)\n  * docs: add explanation for how to use non-system certificates (#9081)\n  * chore(deps): bump the github-actions group across 1 directory with 2 updates (#8962)\n  * fix(misconf): preserve original paths of remote submodules from .terraform (#9294)\n  * refactor(terraform): make Scan method of Terraform plan scanner private (#9272)\n  * fix: suppress debug log for context cancellation errors (#9298)\n  * feat(secret): implement streaming secret scanner with byte offset tracking (#9264)\n  * fix(python): impove package name normalization  (#9290)\n  * feat(misconf): added audit config attribute (#9249)\n  * refactor(misconf): decouple input fs and track extracted files with fs references (#9281)\n  * test(misconf): remove BenchmarkCalculate using outdated check metadata (#9291)\n  * refactor: simplify Detect function signature (#9280)\n  * ci(helm): bump Trivy version to 0.65.0 for Trivy Helm Chart 0.17.0 (#9288)\n  * fix(fs): avoid shadowing errors in file.glob (#9286)\n  * test(misconf): move terraform scan tests to integration tests (#9271)\n  * test(misconf): drop gcp iam test covered by another case (#9285)\n  * chore(deps): bump to alpine from `3.21.3` to `3.21.4` (#9283)\n\nUpdate to version 0.65.0:\n\n  * fix(cli): ensure correct command is picked by telemetry (#9260)\n  * feat(flag): add schema validation for `--server` flag (#9270)\n  * chore(deps): bump github.com/docker/docker from 28.3.2+incompatible to 28.3.3+incompatible (#9274)\n  * ci: skip undefined labels in discussion triage action (#9175)\n  * feat(repo): add git repository metadata to reports (#9252)\n  * fix(license): handle WITH operator for `LaxSplitLicenses` (#9232)\n  * chore: add modernize tool integration for code modernization (#9251)\n  * fix(secret): add UTF-8 validation in secret scanner to prevent protobuf marshalling errors (#9253)\n  * chore: implement process-safe temp file cleanup (#9241)\n  * fix: prevent graceful shutdown message on normal exit (#9244)\n  * fix(misconf): correctly parse empty port ranges in google_compute_firewall (#9237)\n  * feat: add graceful shutdown with signal handling (#9242)\n  * chore: update template URL for brew formula (#9221)\n  * test: add end-to-end testing framework with image scan and proxy tests (#9231)\n  * refactor(db): use `Getter` interface with `GetParams` for trivy-db sources (#9239)\n  * ci: specify repository for `gh cache delete` in canary worklfow (#9240)\n  * ci: remove invalid `--confirm` flag from `gh cache delete` command in canary builds (#9236)\n  * fix(misconf): fix log bucket in schema (#9235)\n  * chore(deps): bump the common group across 1 directory with 24 updates (#9228)\n  * ci: move runner.os context from job-level env to step-level in canary workflow (#9233)\n  * chore(deps): bump up Trivy-kubernetes to v0.9.1 (#9214)\n  * feat(misconf): added logging and versioning to the gcp storage bucket (#9226)\n  * fix(server): add HTTP transport setup to server mode (#9217)\n  * chore: update the rpm download Update (#9202)\n  * feat(alma): add AlmaLinux 10 support (#9207)\n  * fix(nodejs): don't use prerelease logic for compare npm constraints  (#9208)\n  * fix(rootio): fix severity selection (#9181)\n  * fix(sbom): merge in-graph and out-of-graph OS packages in scan results (#9194)\n  * fix(cli): panic: attempt to get os.Args[1] when len(os.Args) \u003c 2 (#9206)\n  * fix(misconf): correctly adapt azure storage account (#9138)\n  * feat(misconf): add private ip google access attribute to subnetwork (#9199)\n  * feat(report): add CVSS vectors in sarif report (#9157)\n  * fix(terraform): `for_each` on a map returns a resource for every key (#9156)\n  * fix: supporting .egg-info/METADATA in python.Packaging analyzer (#9151)\n  * chore: migrate protoc setup from Docker to buf CLI (#9184)\n  * ci: delete cache after artifacts upload in canary workflow (#9177)\n  * refactor: remove aws flag helper message (#9080)\n  * ci: use gh pr view to get PR number for forked repositories in auto-ready workflow (#9183)\n  * ci: add auto-ready-for-review workflow (#9179)\n  * feat(image): add Docker context resolution (#9166)\n  * ci: optimize golangci-lint performance with cache-based strategy (#9173)\n  * feat: add HTTP request/response tracing support (#9125)\n  * fix(aws): update amazon linux 2 EOL date (#9176)\n  * chore: Update release workflow to trigger version updates (#9162)\n  * chore(deps): bump helm.sh/helm/v3 from 3.18.3 to 3.18.4 (#9164)\n  * fix: also check `filepath` when removing duplicate packages (#9142)\n  * chore: add debug log to show image source location (#9163)\n  * docs: add section on customizing default check data (#9114)\n  * chore(deps): bump the common group across 1 directory with 9 updates (#9153)\n  * docs: partners page content updates (#9149)\n  * chore(license): add missed spdx exceptions: (#9147)\n  * docs: trivy partners page updates (#9133)\n  * fix: migrate from `*.list` to `*.md5sums` files for `dpkg` (#9131)\n  * ci(helm): bump Trivy version to 0.64.1 for Trivy Helm Chart 0.16.1 (#9135)\n  * feat(sbom): add SHA-512 hash support for CycloneDX SBOM (#9126)\n  * fix(misconf): skip rewriting expr if attr is nil (#9113)\n  * fix(license): add missed `GFDL-NIV-1.1` and `GFDL-NIV-1.2` into Trivy mapping (#9116)\n  * fix(cli): Add more non-sensitive flags to telemetry (#9110)\n  * fix(alma): parse epochs from rpmqa file (#9101)\n  * fix(rootio): check full version to detect `root.io` packages (#9117)\n  * chore: drop FreeBSD 32-bit support (#9102)\n  * fix(sbom): use correct field for licenses in CycloneDX reports (#9057)\n  * fix(secret): fix line numbers for multiple-line secrets (#9104)\n  * feat(license): observe pkg types option in license scanner (#9091)\n  * ci(helm): bump Trivy version to 0.64.0 for Trivy Helm Chart 0.16.0 (#9107)\n- (CVE-2025-53547, bsc#1246151)\n\n- Update to version 0.64.1 (bsc#1243633, CVE-2025-47291,\n                           (bsc#1246730, CVE-2025-46569):\n\n  * fix(misconf): skip rewriting expr if attr is nil [backport: release/v0.64] (#9127)\n  * fix(cli): Add more non-sensitive flags to telemetry [backport: release/v0.64] (#9124)\n  * fix(rootio): check full version to detect `root.io` packages [backport: release/v0.64] (#9120)\n  * fix(alma): parse epochs from rpmqa file [backport: release/v0.64] (#9119)\n  * docs(python): fix type with METADATA file name (#9090)\n  * feat: reject unsupported artifact types in remote image retrieval (#9052)\n  * chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 (#9088)\n  * refactor(misconf): rewrite Rego module filtering using functional filters (#9061)\n  * feat(terraform): add partial evaluation for policy templates (#8967)\n  * feat(vuln): add Root.io support for container image scanning (#9073)\n  * feat(sbom): add manufacturer field to CycloneDX tools metadata (#9019)\n  * fix(cli): add some values to the telemetry call (#9056)\n  * feat(ubuntu): add end of life date for Ubuntu 25.04 (#9077)\n  * refactor: centralize HTTP transport configuration (#9058)\n  * test: include integration tests in linting and fix all issues (#9060)\n  * chore(deps): bump the common group across 1 directory with 26 updates (#9063)\n  * feat(java): dereference all maven settings.xml env placeholders (#9024)\n  * fix(misconf): reduce log noise on incompatible check (#9029)\n  * fix(misconf): .Config.User always takes precedence over USER in .History (#9050)\n  * chore(deps): update Docker to v28.2.2 and fix compatibility issues (#9037)\n  * docs(misconf): simplify misconfiguration docs (#9030)\n  * fix(misconf): move disabled checks filtering after analyzer scan (#9002)\n  * docs: add PR review policy for maintainers (#9032)\n  * fix(sbom): remove unnecessary OS detection check in SBOM decoding (#9034)\n  * test: improve and extend tests for iac/adapters/arm (#9028)\n  * chore: bump up Go version to 1.24.4 (#9031)\n  * feat(cli): add version constraints to annoucements (#9023)\n  * fix(misconf): correct Azure value-to-time conversion in AsTimeValue (#9015)\n  * feat(ubuntu): add eol date for 20.04-ESM (#8981)\n  * fix(report): don't panic when report contains vulns, but doesn't contain packages for `table` format (#8549)\n  * fix(nodejs): correctly parse `packages` array of `bun.lock` file (#8998)\n  * refactor: use strings.SplitSeq instead of strings.Split in for-loop (#8983)\n  * docs: change --disable-metrics to --disable-telemetry in example (#8999) (#9003)\n  * feat(misconf): add OpenTofu file extension support (#8747)\n  * refactor(misconf): set Trivy version by default in Rego scanner (#9001)\n  * docs: fix assets with versioning (#8996)\n  * docs: add partners page (#8988)\n  * chore(alpine): add EOL date for Alpine 3.22 (#8992)\n  * fix: don't show corrupted trivy-db warning for first run (#8991)\n  * Update installation.md (#8979)\n  * feat(misconf): normalize CreatedBy for buildah and legacy docker builder (#8953)\n  * chore(k8s): update comments with deprecated command format (#8964)\n  * chore: fix errors and typos in docs (#8963)\n  * fix: Add missing version check flags (#8951)\n  * feat(redhat): Add EOL date for RHEL 10. (#8910)\n  * fix: Correctly check for semver versions for trivy version check (#8948)\n  * refactor(server): change custom advisory and vulnerability data types fr… (#8923)\n  * ci(helm): bump Trivy version to 0.63.0 for Trivy Helm Chart 0.15.0 (#8946)\n  * fix(misconf): use argument value in WithIncludeDeprecatedChecks (#8942)\n  * chore(deps): Bump trivy-checks (#8934)\n  * fix(julia): add `Relationship` field support (#8939)\n  * feat(minimos): Add support for MinimOS (#8792)\n  * feat(alpine): add maintainer field extraction for APK packages (#8930)\n  * feat(echo): Add Echo Support (#8833)\n  * fix(redhat): Also try to find buildinfo in root layer (layer 0) (#8924)\n  * fix(wolfi): support new APK database location (#8937)\n  * feat(k8s): get components from namespaced resources (#8918)\n  * refactor(cloudformation): remove unused ScanFile method from Scanner (#8927)\n  * refactor(terraform): remove result sorting from scanner (#8928)\n  * feat(misconf): Add support for `Minimum Trivy Version` (#8880)\n  * docs: improve skipping files documentation (#8749)\n  * feat(cli): Add available version checking (#8553)\n  * feat(nodejs): add a bun.lock analyzer (#8897)\n  * feat: terraform parser option to set current working directory (#8909)\n  * perf(secret): only match secrets of meaningful length, allow example strings to not be matched (#8602)\n  * feat(misconf): export raw Terraform data to Rego (#8741)\n  * refactor(terraform): simplify AllReferences method signature in Attribute (#8906)\n  * fix: check post-analyzers for StaticPaths (#8904)\n  * feat: add Bottlerocket OS package analyzer (#8653)\n  * feat(license): improve work text licenses with custom classification (#8888)\n  * chore(deps): bump github.com/containerd/containerd/v2 from 2.1.0 to 2.1.1 (#8901)\n  * chore(deps): bump the common group across 1 directory with 9 updates (#8887)\n  * refactor(license): simplify compound license scanning (#8896)\n  * feat(license): Support compound licenses (licenses using SPDX operators) (#8816)\n  * fix(k8s): use in-memory cache backend during misconfig scanning (#8873)\n  * feat(nodejs): add bun.lock parser (#8851)\n  * feat(license): improve work with custom classification of licenses from config file (#8861)\n  * fix(cli): disable `--skip-dir` and `--skip-files` flags for `sbom` command (#8886)\n  * fix: julia parser panicing (#8883)\n  * refactor(db): change logic to detect wrong DB (#8864)\n  * fix(cli): don't use allow values for `--compliance` flag (#8881)\n  * docs(misconf): Reorganize misconfiguration scan pages (#8206)\n  * fix(server): add missed Relationship field for `rpc` (#8872)\n  * feat: add JSONC support for comments and trailing commas (#8862)\n  * fix(vex): use `lo.IsNil` to check `VEX` from OCI artifact (#8858)\n  * feat(go): support license scanning in both GOPATH and vendor (#8843)\n  * fix(redhat): save contentSets for OS packages in fs/vm modes (#8820)\n  * fix: filter all files when processing files installed from package managers (#8842)\n  * feat(misconf): add misconfiguration location to junit template (#8793)\n  * docs(vuln): remove OSV for Python from data sources (#8841)\n  * chore: add an issue template for maintainers (#8838)\n  * chore: enable staticcheck (#8815)\n  * ci(helm): bump Trivy version to 0.62.1 for Trivy Helm Chart 0.14.1 (#8836)\n  * feat(license): scan vendor directory for license for go.mod files (#8689)\n  * docs(java):  Update info about dev deps in gradle lock (#8830)\n  * chore(deps): bump golang.org/x/sync from 0.13.0 to 0.14.0 in the common group (#8822)\n  * fix(java): exclude dev dependencies in gradle lockfile (#8803)\n  * fix: octalLiteral from go-critic (#8811)\n  * fix(redhat): trim invalid suffix from content_sets in manifest parsing (#8818)\n  * chore(deps): bump the common group across 1 directory with 10 updates (#8817)\n  * fix: use-any from revive (#8810)\n  * fix: more revive rules (#8814)\n  * docs: change in java.md: fix the Trity -to-\u003e Trivy typo (#8813)\n  * fix(misconf): check if for-each is known when expanding dyn block (#8808)\n  * ci(helm): bump Trivy version to 0.62.0 for Trivy Helm Chart 0.14.0 (#8802)\n\n- Update to version 0.62.1 (bsc#1239225, CVE-2025-22868,\n                            bsc#1241724, CVE-2025-22872):\n\n  * chore(deps): bump the common group across 1 directory with 10 updates [backport: release/v0.62] (#8831)\n  * fix(misconf): check if for-each is known when expanding dyn block [backport: release/v0.62] (#8826)\n  * fix(redhat): trim invalid suffix from content_sets in manifest parsing [backport: release/v0.62] (#8824)\n  * feat(nodejs): add root and workspace for `yarn` packages (#8535)\n  * fix: unused-parameter rule from revive (#8794)\n  * chore(deps): Update trivy-checks (#8798)\n  * fix: early-return, indent-error-flow and superfluous-else rules from revive  (#8796)\n  * fix(k8s): remove using `last-applied-configuration` (#8791)\n  * refactor(misconf): remove unused methods from providers (#8781)\n  * refactor(misconf): remove unused methods from iac types (#8782)\n  * fix(misconf): filter null nodes when parsing json manifest (#8785)\n  * fix: testifylint last issues (#8768)\n  * fix(misconf): perform operations on attribute safely (#8774)\n  * refactor(ubuntu): update time handling for fixing time (#8780)\n  * chore(deps): bump golangci-lint to v2.1.2 (#8766)\n  * feat(image): save layers metadata into report (#8394)\n  * feat(misconf): convert AWS managed policy to document (#8757)\n  * chore(deps): bump the docker group across 1 directory with 3 updates (#8762)\n  * ci(helm): bump Trivy version to 0.61.1 for Trivy Helm Chart 0.13.1 (#8753)\n  * ci(helm): create a helm branch for patches from main (#8673)\n  * fix(terraform): hcl object expressions to return references (#8271)\n  * chore(terraform): option to pass in instanced logger  (#8738)\n  * ci: use `Skitionek/notify-microsoft-teams` instead of `aquasecurity` fork (#8740)\n  * chore(terraform): remove os.OpenPath call from terraform file functions (#8737)\n  * chore(deps): bump the common group across 1 directory with 23 updates (#8733)\n  * feat(rust): add root and workspace relationships/package for `cargo` lock files (#8676)\n  * refactor(misconf): remove module outputs from parser.EvaluateAll (#8587)\n  * fix(misconf): populate context correctly for module instances (#8656)\n  * fix(misconf): check if metadata is not nil (#8647)\n  * refactor(misconf): switch to x/json  (#8719)\n  * fix(report): clean buffer after flushing (#8725)\n  * ci: improve PR title validation workflow (#8720)\n  * refactor(flag): improve flag system architecture and extensibility (#8718)\n  * fix(terraform): `evaluateStep` to correctly set `EvalContext` for multiple instances of blocks (#8555)\n  * refactor: migrate from `github.com/aquasecurity/jfather` to `github.com/go-json-experiment/json` (#8591)\n  * feat(misconf): support auto_provisioning_defaults in google_container_cluster (#8705)\n  * ci: use `github.event.pull_request.user.login` for release PR check workflow (#8702)\n  * refactor: add hook interface for extended functionality (#8585)\n  * fix(misconf): add missing variable as unknown (#8683)\n  * docs: Update maintainer docs (#8674)\n  * ci(vuln): reduce github action script injection attack risk (#8610)\n  * fix(secret): ignore .dist-info directories during secret scanning (#8646)\n  * fix(server): fix redis key when trying to delete blob (#8649)\n  * chore(deps): bump the testcontainers group with 2 updates (#8650)\n  * test: use `aquasecurity` repository for test images (#8677)\n  * chore(deps): bump the aws group across 1 directory with 5 updates (#8652)\n  * fix(k8s): skip passed misconfigs for the summary report (#8684)\n  * fix(k8s): correct compare artifact versions (#8682)\n  * chore: update Docker lib (#8681)\n  * refactor(misconf): remove unused terraform attribute methods (#8657)\n  * feat(misconf): add option to pass Rego scanner to IaC scanner (#8369)\n  * chore: typo fix to replace `rego` with `repo` on the RepoFlagGroup options error output (#8643)\n  * docs: Add info about helm charts release (#8640)\n  * ci(helm): bump Trivy version to 0.61.0 for Trivy Helm Chart 0.13.0 (#8638)\n\nUpdate to version 0.61.1 (bsc#1239385, CVE-2025-22869, bsc#1240466, CVE-2025-30204):\n\n  * fix(k8s): skip passed misconfigs for the summary report [backport: release/v0.61] (#8748)\n  * fix(k8s): correct compare artifact versions [backport: release/v0.61] (#8699)\n  * test: use `aquasecurity` repository for test images [backport: release/v0.61] (#8698)\n  * fix(misconf): Improve logging for unsupported checks (#8634)\n  * feat(k8s): add support for controllers (#8614)\n  * fix(debian): don't include empty licenses for `dpkgs` (#8623)\n  * fix(misconf): Check values wholly prior to evalution (#8604)\n  * chore(deps): Bump trivy-checks (#8619)\n  * fix(k8s): show report for `--report all` (#8613)\n  * chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 (#8597)\n  * refactor: rename scanner to service (#8584)\n  * fix(misconf): do not skip loading documents from subdirectories (#8526)\n  * refactor(misconf): get a block or attribute without calling HasChild (#8586)\n  * fix(misconf): identify the chart file exactly by name (#8590)\n  * test: use table-driven tests in Helm scanner tests (#8592)\n  * refactor(misconf): Simplify misconfig checks bundle parsing (#8533)\n  * chore(deps): bump the common group across 1 directory with 10 updates (#8566)\n  * fix(misconf): do not use cty.NilVal for non-nil values (#8567)\n  * docs(cli): improve flag value display format (#8560)\n  * fix(misconf): set default values for AWS::EKS::Cluster.ResourcesVpcConfig (#8548)\n  * docs: remove slack (#8565)\n  * fix: use `--file-patterns` flag for all post analyzers (#7365)\n  * docs(python): Mention pip-compile (#8484)\n  * feat(misconf): adapt aws_opensearch_domain (#8550)\n  * feat(misconf): adapt AWS::EC2::VPC (#8534)\n  * docs: fix a broken link (#8546)\n  * fix(fs): check postAnalyzers for StaticPaths (#8543)\n  * refactor(misconf): remove unused methods for ec2.Instance (#8536)\n  * feat(misconf): adapt aws_default_security_group (#8538)\n  * feat(fs): optimize scanning performance by direct file access for known paths (#8525)\n  * feat(misconf): adapt AWS::DynamoDB::Table (#8529)\n  * style: Fix MD syntax in self-hosting.md (#8523)\n  * perf(misconf): retrieve check metadata from annotations once (#8478)\n  * feat(misconf): Add support for aws_ami (#8499)\n  * fix(misconf): skip Azure CreateUiDefinition (#8503)\n  * refactor(misconf): use OPA v1 (#8518)\n  * fix(misconf): add ephemeral block type to config schema (#8513)\n  * perf(misconf): parse input for Rego once (#8483)\n  * feat: replace TinyGo with standard Go for WebAssembly modules (#8496)\n  * chore: replace deprecated tenv linter with usetesting (#8504)\n  * fix(spdx): save text licenses into `otherLicenses` without normalize (#8502)\n  * chore(deps): bump the common group across 1 directory with 13 updates (#8491)\n  * chore: use go.mod for managing Go tools (#8493)\n  * ci(helm): bump Trivy version to 0.60.0 for Trivy Helm Chart 0.12.0 (#8494)\n  * fix(sbom): improve logic for binding direct dependency to parent component (#8489)\n  * chore(deps): remove missed replace of `trivy-db` (#8492)\n  * chore(deps): bump alpine from 3.21.0 to 3.21.3 in the docker group across 1 directory (#8490)\n  * chore(deps): update Go to 1.24 and switch to go-version-file (#8388)\n  * docs: add abbreviation list (#8453)\n  * chore(terraform): assign *terraform.Module 'parent' field (#8444)\n  * feat: add report summary table (#8177)\n  * chore(deps): bump the github-actions group with 3 updates (#8473)\n  * refactor(vex): improve SBOM reference handling with project standards (#8457)\n  * ci: update GitHub Actions cache to v4 (#8475)\n  * feat: add `--vuln-severity-source` flag (#8269)\n  * fix(os): add mapping OS aliases (#8466)\n  * chore(deps): bump the aws group across 1 directory with 7 updates (#8468)\n  * chore(deps): Bump trivy-checks to v1.7.1 (#8467)\n  * refactor(report): write tables after rendering all results (#8357)\n  * docs: update VEX documentation index page (#8458)\n  * fix(db): fix case when 2 trivy-db were copied at the same time (#8452)\n  * feat(misconf): render causes for Terraform (#8360)\n  * fix(misconf): fix incorrect k8s locations due to JSON to YAML conversion (#8073)\n  * feat(cyclonedx): Add initial support for loading external VEX files from SBOM references (#8254)\n  * chore(deps): update go-rustaudit location (#8450)\n  * fix: update all documentation links (#8045)\n  * chore(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 (#8443)\n  * chore(deps): bump the common group with 6 updates (#8411)\n  * fix(k8s): add missed option `PkgRelationships` (#8442)\n  * fix(sbom): add SBOM file's filePath as Application FilePath if we can't detect its path (#8346)\n  * feat(go): fix parsing main module version for go \u003e= 1.24 (#8433)\n  * refactor(misconf): make Rego scanner independent of config type (#7517)\n  * fix(image): disable AVD-DS-0007 for history scanning (#8366)\n  * fix(server): secrets inspectation for the config analyzer in client server mode (#8418)\n  * chore: remove mockery (#8417)\n  * test(server): replace mock driver with memory cache in server tests (#8416)\n  * test: replace mock with memory cache and fix non-deterministic tests (#8410)\n  * test: replace mock with memory cache in scanner tests (#8413)\n  * test: use memory cache (#8403)\n  * fix(spdx): init `pkgFilePaths` map for all formats (#8380)\n  * chore(deps): bump the common group across 1 directory with 11 updates (#8381)\n  * docs: correct Ruby documentation (#8402)\n  * chore: bump `mockery` to update v2.52.2 version and rebuild mock files (#8390)\n  * fix: don't use `scope` for `trivy registry login` command (#8393)\n  * fix(go): merge nested flags into string for ldflags for Go binaries (#8368)\n  * chore(terraform): export module path on terraform modules (#8374)\n  * fix(terraform): apply parser options to submodule parsing (#8377)\n  * docs: Fix typos in documentation (#8361)\n  * docs: fix navigate links (#8336)\n  * ci(helm): bump Trivy version to 0.59.1 for Trivy Helm Chart 0.11.1 (#8354)\n  * ci(spdx): add `aqua-installer` step to fix `mage` error (#8353)\n  * chore: remove debug prints (#8347)\n  * fix(misconf): do not log scanners when misconfig scanning is disabled (#8345)\n  * fix(report): remove html escaping for `shortDescription` and `fullDescription` fields for sarif reports (#8344)\n  * chore(deps): bump Go to `v1.23.5` (#8341)\n  * fix(python): add `poetry` v2 support (#8323)\n  * chore(deps): bump the github-actions group across 1 directory with 4 updates (#8331)\n  * fix(misconf): ecs include enhanced for container insights (#8326)\n  * fix(sbom): preserve OS packages from multiple SBOMs (#8325)\n  * ci(helm): bump Trivy version to 0.59.0 for Trivy Helm Chart 0.11.0 (#8311)\n  *  (bsc#1237618, CVE-2025-27144)\n\nUpdate to version 0.59.1:\n\n  * fix(misconf): do not log scanners when misconfig scanning is disabled [backport: release/v0.59] (#8349)\n  * chore(deps): bump Go to `v1.23.5` [backport: release/v0.59] (#8343)\n  * fix(python): add `poetry` v2 support [backport: release/v0.59] (#8335)\n  * fix(sbom): preserve OS packages from multiple SBOMs [backport: release/v0.59] (#8333)\n\nUpdate to version 0.59.0:\n\n  * feat(image): return error early if total size of layers exceeds limit (#8294)\n  * chore(deps): Bump trivy-checks (#8310)\n  * chore(terraform): add accessors to underlying raw hcl values (#8306)\n  * fix: improve conversion of image config to Dockerfile (#8308)\n  * docs: replace short codes with Unicode emojis (#8296)\n  * feat(k8s): improve artifact selections for specific namespaces (#8248)\n  * chore: update code owners (#8303)\n  * fix(misconf): handle heredocs in dockerfile instructions (#8284)\n  * fix: de-duplicate same `dpkg` packages with different filePaths from different layers (#8298)\n  * chore(deps): bump the aws group with 7 updates (#8299)\n  * chore(deps): bump the common group with 12 updates (#8301)\n  * chore: enable int-conversion from perfsprint (#8194)\n  * feat(fs): use git commit hash as cache key for clean repositories (#8278)\n  * fix(spdx): use the `hasExtractedLicensingInfos` field for licenses that are not listed in the SPDX (#8077)\n  * chore: use require.ErrorContains when possible (#8291)\n  * feat(image): prevent scanning oversized container images (#8178)\n  * chore(deps): use aqua forks for `github.com/liamg/jfather` and `github.com/liamg/iamgo` (#8289)\n  * fix(fs): fix cache key generation to use UUID (#8275)\n  * fix(misconf): correctly handle all YAML tags in K8S templates (#8259)\n  * feat: add support for registry mirrors (#8244)\n  * chore(deps): bump the common group across 1 directory with 29 updates (#8261)\n  * refactor(license): improve license expression normalization (#8257)\n  * feat(misconf): support for ignoring by inline comments for Dockerfile (#8115)\n  * feat: add a examples field to check metadata (#8068)\n  * chore(deps): bump alpine from 3.20.0 to 3.21.0 in the docker group across 1 directory (#8196)\n  * ci: add workflow to restrict direct PRs to release branches (#8240)\n  * fix(suse): SUSE - update OSType constants and references for compatility (#8236)\n  * ci: fix path to main dir for canary builds (#8231)\n  * chore(secret): add reported issues related to secrets in junit template (#8193)\n  * refactor: use trivy-checks/pkg/specs package (#8226)\n  * ci(helm): bump Trivy version to 0.58.1 for Trivy Helm Chart 0.10.0 (#8170)\n  * fix(misconf): allow null values only for tf variables (#8112)\n  * feat(misconf): support for ignoring by inline comments for Helm (#8138)\n  * fix(redhat): check `usr/share/buildinfo/` dir to detect content sets (#8222)\n  * chore(alpine): add EOL date for Alpine 3.21 (#8221)\n  * fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field (#8207)\n  * fix(misconf): disable git terminal prompt on tf module load (#8026)\n  * chore: remove aws iam related scripts (#8179)\n  * docs: Updated JSON schema version 2 in the trivy documentation (#8188)\n  * refactor(python): use once + debug for `License acquired from METADATA...` logs (#8175)\n  * refactor: use slices package instead of custom function (#8172)\n  * chore(deps): bump the common group with 6 updates (#8162)\n  * feat(python): add support for uv dev and optional dependencies (#8134)\n  * feat(python): add support for poetry dev dependencies (#8152)\n  * fix(sbom): attach nested packages to Application (#8144)\n  * docs(vex): use debian minor version in examples (#8166)\n  * refactor: add generic Set implementation (#8149)\n  * chore(deps): bump the aws group across 1 directory with 6 updates (#8163)\n  * fix(python): skip dev group's deps for poetry (#8106)\n  * fix(sbom): use root package for `unknown` dependencies (if exists) (#8104)\n  * chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` (#8140)\n  * chore(vex): suppress CVE-2024-45338 (#8137)\n  * feat(python): add support for uv (#8080)\n  * chore(deps): bump the docker group across 1 directory with 3 updates (#8127)\n  * chore(deps): bump the common group across 1 directory with 14 updates (#8126)\n  * chore: bump go to 1.23.4 (#8123)\n  * test: set dummy value for NUGET_PACKAGES (#8107)\n  * chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` (#8105)\n  * chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 (#8103)\n  * fix: wasm module test (#8099)\n  * fix: CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass (#8088)\n  * chore(vex): suppress CVE-2024-45337 (#8101)\n  * fix(license): always trim leading and trailing spaces for licenses (#8095)\n  * fix(sbom): scan results of SBOMs generated from container images are missing layers (#7635)\n  * fix(redhat): correct rewriting of recommendations for the same vulnerability (#8063)\n  * fix: enable err-error and errorf rules from perfsprint linter (#7859)\n  * chore(deps): bump the aws group across 1 directory with 6 updates (#8074)\n  * perf: avoid heap allocation in applier findPackage (#7883)\n  * fix: Updated twitter icon (#7772)\n  * docs(k8s): add a note about multi-container pods (#7815)\n  * feat: add `--distro` flag to manually specify OS distribution for vulnerability scanning (#8070)\n  * fix(oracle): add architectures support for advisories (#4809)\n  * fix: handle `BLOW_UNKNOWN` error to download DBs (#8060)\n  * feat(misconf): generate placeholders for random provider resources (#8051)\n  * fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type (#8052)\n  * fix(flag): skip hidden flags for `--generate-default-config` command (#8046)\n  * fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props (#8050)\n  * feat(nodejs): respect peer dependencies for dependency tree (#7989)\n  * ci(helm): bump Trivy version to 0.58.0 for Trivy Helm Chart 0.10.0 (#8038)\n  * fix: respect GITHUB_TOKEN to download artifacts from GHCR (#7580)\n  * chore(deps): bump github.com/moby/buildkit from 0.17.2 to 0.18.0 in the docker group (#8029)\n  * fix(misconf): use log instead of fmt for logging (#8033)\n  * docs: add commercial content (#8030)\n\n- Update to version 0.58.2 (\n      bsc#1234512, CVE-2024-45337,\n      bsc#1235265, CVE-2024-45338,\n      bsc#1232948, CVE-2024-51744):\n\n  * fix(misconf): allow null values only for tf variables [backport: release/v0.58] (#8238)\n  * fix(suse): SUSE - update OSType constants and references for compatility [backport: release/v0.58] (#8237)\n  * fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field [backport: release/v0.58] (#8215)\n  * fix(sbom): attach nested packages to Application [backport: release/v0.58] (#8168)\n  * fix(python): skip dev group's deps for poetry [backport: release/v0.58] (#8158)\n  * fix(sbom): use root package for `unknown` dependencies (if exists) [backport: release/v0.58] (#8156)\n  * chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` [backport: release/v0.58] (#8142)\n  * chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` [backport: release/v0.58] (#8136)\n  * fix(redhat): correct rewriting of recommendations for the same vulnerability [backport: release/v0.58] (#8135)\n  * fix(oracle): add architectures support for advisories [backport: release/v0.58] (#8125)\n  * fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type [backport: release/v0.58] (#8124)\n  * chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 [backport: release/v0.58] (#8122)\n  * fix: handle `BLOW_UNKNOWN` error to download DBs [backport: release/v0.58] (#8121)\n  * fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props [backport: release/v0.58] (#8119)\n  * fix(misconf): wrap AWS EnvVar to iac types (#7407)\n  * chore(deps): Upgrade trivy-checks (#8018)\n  * refactor(misconf): Remove unused options (#7896)\n  * docs: add terminology page to explain Trivy concepts (#7996)\n  * feat: add `workspaceRelationship` (#7889)\n  * refactor(sbom): simplify relationship generation (#7985)\n  * chore: remove Go checks (#7907)\n  * docs: improve databases documentation (#7732)\n  * refactor: remove support for custom Terraform checks (#7901)\n  * docs: fix dead links (#7998)\n  * docs: drop AWS account scanning (#7997)\n  * fix(aws): change CPU and Memory type of ContainerDefinition to a string (#7995)\n  * fix(cli): Handle empty ignore files more gracefully (#7962)\n  * fix(misconf): load full Terraform module (#7925)\n  * fix(misconf): properly resolve local Terraform cache (#7983)\n  * refactor(k8s): add v prefix for Go packages (#7839)\n  * test: replace Go checks with Rego (#7867)\n  * feat(misconf): log causes of HCL file parsing errors (#7634)\n  * chore(deps): bump the aws group across 1 directory with 7 updates (#7991)\n  * chore(deps): bump github.com/moby/buildkit from 0.17.0 to 0.17.2 in the docker group across 1 directory (#7990)\n  * chore(deps): update csaf module dependency from csaf-poc to gocsaf (#7992)\n  * chore: downgrade the failed block expand message to debug (#7964)\n  * fix(misconf): do not erase variable type for child modules (#7941)\n  * feat(go): construct dependencies of `go.mod` main module in the parser (#7977)\n  * feat(go): construct dependencies in the parser (#7973)\n  * feat: add cvss v4 score and vector in scan response (#7968)\n  * docs: add `overview` page for `others` (#7972)\n  * fix(sbom): Fixes for Programming Language Vulnerabilities and SBOM Package Maintainer Details (#7871)\n  * feat(suse): Align SUSE/OpenSUSE OS Identifiers (#7965)\n  * chore(deps): bump the common group with 4 updates (#7949)\n  * feat(oracle): add `flavors` support (#7858)\n  * fix(misconf): Update trivy-checks default repo to `mirror.gcr.io` (#7953)\n  * chore(deps): Bump up trivy-checks to v1.3.0 (#7959)\n  * fix(k8s): check all results for vulnerabilities (#7946)\n  * ci(helm): bump Trivy version to 0.57.1 for Trivy Helm Chart 0.9.0 (#7945)\n  * feat(secret): Add built-in secrets rules for Private Packagist (#7826)\n  * docs: Fix broken links (#7900)\n  * docs: fix mistakes/typos (#7942)\n  * feat: Update registry fallbacks (#7679)\n  * fix(alpine): add `UID` for removed packages (#7887)\n  * chore(deps): bump the aws group with 6 updates (#7902)\n  * chore(deps): bump the common group with 6 updates (#7904)\n  * fix(debian): infinite loop (#7928)\n  * fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files (#7912)\n  * docs: add note about temporary podman socket (#7921)\n  * docs: combine trivy.dev into trivy docs (#7884)\n  * test: change branch in spdx schema link to check in integration tests (#7935)\n  * docs: add Headlamp to the Trivy Ecosystem page (#7916)\n  * fix(report): handle `git@github.com` schema for misconfigs in `sarif` report (#7898)\n  * chore(k8s): enhance k8s scan log (#6997)\n  * fix(terraform): set null value as fallback for missing variables (#7669)\n  * fix(misconf): handle null properties in CloudFormation templates (#7813)\n  * fix(fs): add missing defered Cleanup() call to post analyzer fs (#7882)\n  * chore(deps): bump the common group across 1 directory with 20 updates (#7876)\n  * chore: bump containerd to v2.0.0 (#7875)\n  * fix: Improve version comparisons when build identifiers are present (#7873)\n  * feat(k8s): add default commands for unknown platform (#7863)\n  * chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#7868)\n  * refactor(secret): optimize performance by moving ToLower operation outside loop (#7862)\n  * test: save `containerd` image into archive and use in tests (#7816)\n  * chore(deps): bump the github-actions group across 1 directory with 2 updates (#7854)\n  * chore: bump golangci-lint to v1.61.0 (#7853)\n\nUpdate to version 0.57.1:\n\n  * feat: Update registry fallbacks [backport: release/v0.57] (#7944)\n  * fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files [backport: release/v0.57] (#7939)\n  * test: change branch in spdx schema link to check in integration tests [backport: release/v0.57] (#7940)\n  * release: v0.57.0 [main] (#7710)\n  * chore: lint `errors.Join` (#7845)\n  * feat(db): append errors (#7843)\n  * docs(java): add info about supported scopes (#7842)\n  * docs: add example of creating whitelist of checks (#7821)\n  * chore(deps): Bump trivy-checks (#7819)\n  * fix(go): Do not trim v prefix from versions in Go Mod Analyzer (#7733)\n  * fix(k8s): skip resources without misconfigs (#7797)\n  * fix(sbom):  use `Annotation` instead of `AttributionTexts` for `SPDX` formats (#7811)\n  * fix(cli): add config name to skip-policy-update alias (#7820)\n  * fix(helm): properly handle multiple archived dependencies (#7782)\n  * refactor(misconf): Deprecate `EXCEPTIONS` for misconfiguration scanning (#7776)\n  * fix(k8s)!: support k8s multi container (#7444)\n  * fix(k8s): support kubernetes v1.31 (#7810)\n  * docs: add Windows install instructions (#7800)\n  * ci(helm): auto public Helm chart after PR merged (#7526)\n  * feat: add end of life date for Ubuntu 24.10 (#7787)\n  * feat(report): update gitlab template to populate operating_system value (#7735)\n  * feat(misconf): Show misconfig ID in output (#7762)\n  * feat(misconf): export unresolvable field of IaC types to Rego (#7765)\n  * refactor(k8s): scan config files as a folder (#7690)\n  * fix(license): fix license normalization for Universal Permissive License (#7766)\n  * fix: enable usestdlibvars linter (#7770)\n  * fix(misconf): properly expand dynamic blocks (#7612)\n  * feat(cyclonedx): add file checksums to `CycloneDX` reports (#7507)\n  * fix(misconf): fix for Azure Storage Account network acls adaptation (#7602)\n  * refactor(misconf): simplify k8s scanner (#7717)\n  * feat(parser): ignore white space in pom.xml files (#7747)\n  * test: use forked images (#7755)\n  * fix(java): correctly inherit `version` and `scope` from upper/root `depManagement` and `dependencies` into parents (#7541)\n  * fix(misconf): check if property is not nil before conversion (#7578)\n  * fix(misconf): change default ACL of digitalocean_spaces_bucket to private (#7577)\n  * feat(misconf): ssl_mode support for GCP SQL DB instance (#7564)\n  * test: define constants for test images (#7739)\n  * docs: add note about disabled DS016 check (#7724)\n  * feat(misconf): public network support for Azure Storage Account (#7601)\n  * feat(cli): rename `trivy auth` to `trivy registry` (#7727)\n  * docs: apt-transport-https is a transitional package (#7678)\n  * refactor(misconf): introduce generic scanner (#7515)\n  * fix(cli): `clean --all` deletes only relevant dirs (#7704)\n  * feat(cli): add `trivy auth` (#7664)\n  * fix(sbom): add options for DBs in private registries (#7660)\n  * docs(report): fix reporting doc format (#7671)\n  * fix(repo): `git clone` output to Stderr (#7561)\n  * fix(redhat): include arch in PURL qualifiers (#7654)\n  * fix(report): Fix invalid URI in SARIF report (#7645)\n  * docs(report): Improve SARIF reporting doc (#7655)\n  * fix(db): fix javadb downloading error handling (#7642)\n  * feat(cli): error out when ignore file cannot be found (#7624)\n\nUpdate to version 0.56.2:\n\n  * fix(redhat): include arch in PURL qualifiers [backport: release/v0.56] (#7702)\n  * fix(sbom): add options for DBs in private registries [backport: release/v0.56] (#7691)\n\n- Update to version 0.51.1 (bsc#1227010, CVE-2024-3817):\n","status":"withdrawn","published":"2025-11-27T12:27:44Z","modified":"2026-06-24T14:04:22.238238822Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20798-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\nUpdate to version 0.68.2:\n\nSecurity fixes:\n\n - CVE-2024-3817: hashicorp/go-getter: argument injection when fetching remote default git branches (bsc#1227010).\n - CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (bsc#1234512).\n - CVE-2024-45338: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content (bsc#1235265).\n - CVE-2024-51744: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (bsc#1232948).\n - CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250625).\n - CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239225).\n - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239385).\n - CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241724).\n - CVE-2025-27144: gopkg.in/go-jose/go-jose.v2: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237618).\n - CVE-2025-30204: github.com/golang-jwt/jwt/v4,github.com/golang-jwt/jwt/v5: jwt-go allows excessive memory allocation during header parsing (bsc#1240466).\n - CVE-2025-46569: github.com/open-policy-agent/opa: HTTP request path can be crafted to inject Rego code into a constructed query when a virtual document is requested through the Data API (bsc#1246730).\n - CVE-2025-47291: github.com/containerd/containerd/v2: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. (bsc#1243633).\n - CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251363).\n - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253512).\n - CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253977).\n - CVE-2025-53547: helm.sh/helm/v3: Helm Chart Code Execution (bsc#1246151).\n - CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248937, bsc#1248897).\n - CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253786).\n - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially crafted input (bsc#1251547).\n\nOther fixes:\n\n - Update installation.md (#8979)\n - chore(alpine): add EOL date for Alpine 3.21 (#8221)\n - chore(alpine): add EOL date for Alpine 3.22 (#8992)\n - chore(cli): Remove Trivy Cloud (#9847)\n - chore(deps): Bump trivy-checks (#7819)\n - chore(deps): Bump trivy-checks (#8310)\n - chore(deps): Bump trivy-checks (#8619)\n - chore(deps): Bump trivy-checks (#8934)\n - chore(deps): Bump trivy-checks to v1.7.1 (#8467)\n - chore(deps): Bump up trivy-checks to v1.3.0 (#7959)\n - chore(deps): Switch to go-viper/mapstructure (#9579)\n - chore(deps): Update trivy-checks (#8798)\n - chore(deps): Upgrade trivy-checks (#8018)\n - chore(deps): bump Go to `v1.23.5` (#8341)\n - chore(deps): bump Go to `v1.23.5` [backport: release/v0.59] (#8343)\n - chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` (#8105)\n - chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` [backport: release/v0.58] (#8136)\n - chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` (#8140)\n - chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` [backport: release/v0.58] (#8142)\n - chore(deps): bump alpine from 3.20.0 to 3.21.0 in the docker group across 1 directory (#8196)\n - chore(deps): bump alpine from 3.21.0 to 3.21.3 in the docker group across 1 directory (#8490)\n - chore(deps): bump alpine from 3.21.4 to 3.22.1 (#9301)\n - chore(deps): bump github.com/containerd/containerd from 1.7.28 to 1.7.29 (#9764)\n - chore(deps): bump github.com/containerd/containerd/v2 from 2.1.0 to 2.1.1 (#8901)\n - chore(deps): bump github.com/containerd/containerd/v2 from 2.1.4 to 2.1.5 (#9763)\n - chore(deps): bump github.com/docker/docker from 28.3.2+incompatible to 28.3.3+incompatible (#9274)\n - chore(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 (#8443)\n - chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 (#9088)\n - chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#7868)\n - chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 (#8597)\n - chore(deps): bump github.com/moby/buildkit from 0.17.0 to 0.17.2 in the docker group across 1 directory (#7990)\n - chore(deps): bump github.com/moby/buildkit from 0.17.2 to 0.18.0 in the docker group (#8029)\n - chore(deps): bump github.com/opencontainers/selinux from 1.12.0 to 1.13.0 (#9778)\n - chore(deps): bump github.com/quic-go/quic-go from 0.52.0 to 0.54.1 (#9694)\n - chore(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#9403)\n - chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 (#8103)\n - chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 [backport: release/v0.58] (#8122)\n - chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#9827)\n - chore(deps): bump golang.org/x/sync from 0.13.0 to 0.14.0 in the common group (#8822)\n - chore(deps): bump golangci-lint to v2.1.2 (#8766)\n - chore(deps): bump helm.sh/helm/v3 from 3.18.3 to 3.18.4 (#9164)\n - chore(deps): bump the aws group across 1 directory with 5 updates (#8652)\n - chore(deps): bump the aws group across 1 directory with 6 updates (#8074)\n - chore(deps): bump the aws group across 1 directory with 6 updates (#8163)\n - chore(deps): bump the aws group across 1 directory with 7 updates (#7991)\n - chore(deps): bump the aws group across 1 directory with 7 updates (#8468)\n - chore(deps): bump the aws group with 6 updates (#7902)\n - chore(deps): bump the aws group with 6 updates (#9383)\n - chore(deps): bump the aws group with 6 updates (#9481)\n - chore(deps): bump the aws group with 6 updates (#9547)\n - chore(deps): bump the aws group with 7 updates (#8299)\n - chore(deps): bump the aws group with 7 updates (#9311)\n - chore(deps): bump the aws group with 7 updates (#9419)\n - chore(deps): bump the aws group with 7 updates (#9691)\n - chore(deps): bump the common group across 1 directory with 10 updates (#8566)\n - chore(deps): bump the common group across 1 directory with 10 updates (#8817)\n - chore(deps): bump the common group across 1 directory with 10 updates [backport: release/v0.62] (#8831)\n - chore(deps): bump the common group across 1 directory with 11 updates (#8381)\n - chore(deps): bump the common group across 1 directory with 13 updates (#8491)\n - chore(deps): bump the common group across 1 directory with 14 updates (#8126)\n - chore(deps): bump the common group across 1 directory with 20 updates (#7876)\n - chore(deps): bump the common group across 1 directory with 20 updates (#9840)\n - chore(deps): bump the common group across 1 directory with 23 updates (#8733)\n - chore(deps): bump the common group across 1 directory with 24 updates (#9228)\n - chore(deps): bump the common group across 1 directory with 24 updates (#9507)\n - chore(deps): bump the common group across 1 directory with 26 updates (#9063)\n - chore(deps): bump the common group across 1 directory with 26 updates (#9347)\n - chore(deps): bump the common group across 1 directory with 29 updates (#8261)\n - chore(deps): bump the common group across 1 directory with 7 updates (#9590)\n - chore(deps): bump the common group across 1 directory with 9 updates (#8887)\n - chore(deps): bump the common group across 1 directory with 9 updates (#9153)\n - chore(deps): bump the common group with 12 updates (#8301)\n - chore(deps): bump the common group with 4 updates (#7949)\n - chore(deps): bump the common group with 6 updates (#7904)\n - chore(deps): bump the common group with 6 updates (#8162)\n - chore(deps): bump the common group with 6 updates (#8411)\n - chore(deps): bump the common group with 7 updates (#9382)\n - chore(deps): bump the docker group across 1 directory with 3 updates (#8127)\n - chore(deps): bump the docker group across 1 directory with 3 updates (#8762)\n - chore(deps): bump the docker group with 3 updates (#9545)\n - chore(deps): bump the docker group with 3 updates (#9776)\n - chore(deps): bump the github-actions group across 1 directory with 2 updates (#7854)\n - chore(deps): bump the github-actions group across 1 directory with 2 updates (#8962)\n - chore(deps): bump the github-actions group across 1 directory with 4 updates (#8331)\n - chore(deps): bump the github-actions group across 1 directory with 9 updates (#9563)\n - chore(deps): bump the github-actions group with 3 updates (#8473)\n - chore(deps): bump the github-actions group with 4 updates (#9739)\n - chore(deps): bump the testcontainers group with 2 updates (#8650)\n - chore(deps): bump the testcontainers group with 2 updates (#9506)\n - chore(deps): bump to alpine from `3.21.3` to `3.21.4` (#9283)\n - chore(deps): bump up Trivy-kubernetes to v0.9.1 (#9214)\n - chore(deps): remove missed replace of `trivy-db` (#8492)\n - chore(deps): update Docker to v28.2.2 and fix compatibility issues (#9037)\n - chore(deps): update Go to 1.24 and switch to go-version-file (#8388)\n - chore(deps): update csaf module dependency from csaf-poc to gocsaf (#7992)\n - chore(deps): update go-rustaudit location (#8450)\n - chore(deps): update to module-compatible docker-credential-gcr/v2 (#9591)\n - chore(deps): use aqua forks for `github.com/liamg/jfather` and `github.com/liamg/iamgo` (#8289)\n - chore(k8s): enhance k8s scan log (#6997)\n - chore(k8s): update comments with deprecated command format (#8964)\n - chore(license): add missed spdx exceptions: (#9147)\n - chore(secret): add reported issues related to secrets in junit template (#8193)\n - chore(terraform): add accessors to underlying raw hcl values (#8306)\n - chore(terraform): assign *terraform.Module 'parent' field (#8444)\n - chore(terraform): export module path on terraform modules (#8374)\n - chore(terraform): option to pass in instanced logger  (#8738)\n - chore(terraform): remove os.OpenPath call from terraform file functions (#8737)\n - chore(vex): suppress CVE-2024-45337 (#8101)\n - chore(vex): suppress CVE-2024-45338 (#8137)\n - chore: Update release flow to include chocolatey (#9460)\n - chore: Update release workflow to trigger version updates (#9162)\n - chore: add an issue template for maintainers (#8838)\n - chore: add context to the cache interface (#9565)\n - chore: add debug log to show image source location (#9163)\n - chore: add modernize tool integration for code modernization (#9251)\n - chore: bump Go to 1.24.7 (#9435)\n - chore: bump `mockery` to update v2.52.2 version and rebuild mock files (#8390)\n - chore: bump containerd to v2.0.0 (#7875)\n - chore: bump go to 1.23.4 (#8123)\n - chore: bump golangci-lint to v1.61.0 (#7853)\n - chore: bump up Go version to 1.24.4 (#9031)\n - chore: downgrade the failed block expand message to debug (#7964)\n - chore: drop FreeBSD 32-bit support (#9102)\n - chore: enable int-conversion from perfsprint (#8194)\n - chore: enable staticcheck (#8815)\n - chore: fix errors and typos in docs (#8963)\n - chore: fix some function names in comment (#9314)\n - chore: implement process-safe temp file cleanup (#9241)\n - chore: lint `errors.Join` (#7845)\n - chore: migrate protoc setup from Docker to buf CLI (#9184)\n - chore: remove Go checks (#7907)\n - chore: remove aws iam related scripts (#8179)\n - chore: remove debug prints (#8347)\n - chore: remove mockery (#8417)\n - chore: replace deprecated tenv linter with usetesting (#8504)\n - chore: trigger the trivy-www workflow (#9737)\n - chore: typo fix to replace `rego` with `repo` on the RepoFlagGroup options error output (#8643)\n - chore: update Docker lib (#8681)\n - chore: update code owners (#8303)\n - chore: update template URL for brew formula (#9221)\n - chore: update the rpm download Update (#9202)\n - chore: use go.mod for managing Go tools (#8493)\n - chore: use require.ErrorContains when possible (#8291)\n - ci(deps): add 3-day cooldown period for Dependabot updates (#9475)\n - ci(helm): auto public Helm chart after PR merged (#7526)\n - ci(helm): bump Trivy version to 0.57.1 for Trivy Helm Chart 0.9.0 (#7945)\n - ci(helm): bump Trivy version to 0.58.0 for Trivy Helm Chart 0.10.0 (#8038)\n - ci(helm): bump Trivy version to 0.58.1 for Trivy Helm Chart 0.10.0 (#8170)\n - ci(helm): bump Trivy version to 0.59.0 for Trivy Helm Chart 0.11.0 (#8311)\n - ci(helm): bump Trivy version to 0.59.1 for Trivy Helm Chart 0.11.1 (#8354)\n - ci(helm): bump Trivy version to 0.60.0 for Trivy Helm Chart 0.12.0 (#8494)\n - ci(helm): bump Trivy version to 0.61.0 for Trivy Helm Chart 0.13.0 (#8638)\n - ci(helm): bump Trivy version to 0.61.1 for Trivy Helm Chart 0.13.1 (#8753)\n - ci(helm): bump Trivy version to 0.62.0 for Trivy Helm Chart 0.14.0 (#8802)\n - ci(helm): bump Trivy version to 0.62.1 for Trivy Helm Chart 0.14.1 (#8836)\n - ci(helm): bump Trivy version to 0.63.0 for Trivy Helm Chart 0.15.0 (#8946)\n - ci(helm): bump Trivy version to 0.64.0 for Trivy Helm Chart 0.16.0 (#9107)\n - ci(helm): bump Trivy version to 0.64.1 for Trivy Helm Chart 0.16.1 (#9135)\n - ci(helm): bump Trivy version to 0.65.0 for Trivy Helm Chart 0.17.0 (#9288)\n - ci(helm): bump Trivy version to 0.66.0 for Trivy Helm Chart 0.18.0 (#9425)\n - ci(helm): bump Trivy version to 0.67.0 for Trivy Helm Chart 0.19.0 (#9554)\n - ci(helm): bump Trivy version to 0.67.2 for Trivy Helm Chart 0.19.1 (#9641)\n - ci(helm): create a helm branch for patches from main (#8673)\n - ci(spdx): add `aqua-installer` step to fix `mage` error (#8353)\n - ci(vuln): reduce github action script injection attack risk (#8610)\n - ci: add API diff workflow (#9600)\n - ci: add auto-ready-for-review workflow (#9179)\n - ci: add workflow to restrict direct PRs to release branches (#8240)\n - ci: delete cache after artifacts upload in canary workflow (#9177)\n - ci: enable `check-latest` for `setup-go` [backport: release/v0.68] (#9946)\n - ci: fix path to main dir for canary builds (#8231)\n - ci: get base_sha using base.ref (#9704)\n - ci: improve PR title validation workflow (#8720)\n - ci: migrate GitHub Actions from version tags to SHA pinning (#9405)\n - ci: move runner.os context from job-level env to step-level in canary workflow (#9233)\n - ci: optimize golangci-lint performance with cache-based strategy (#9173)\n - ci: remove invalid `--confirm` flag from `gh cache delete` command in canary builds (#9236)\n - ci: remove unused preinstalled software/images for build tests to free up disk space. (#9814)\n - ci: skip undefined labels in discussion triage action (#9175)\n - ci: specify repository for `gh cache delete` in canary worklfow (#9240)\n - ci: update GitHub Actions cache to v4 (#8475)\n - ci: use `Skitionek/notify-microsoft-teams` instead of `aquasecurity` fork (#8740)\n - ci: use `github.event.pull_request.user.login` for release PR check workflow (#8702)\n - ci: use environment variables in GitHub Actions for improved security (#9433)\n - ci: use gh pr view to get PR number for forked repositories in auto-ready workflow (#9183)\n - ci: use merge commit for apidiff to avoid false positives (#9622)\n - ci: use pull_request_target for apidiff workflow to support fork PRs (#9605)\n - docs(cli): improve flag value display format (#8560)\n - docs(java):  Update info about dev deps in gradle lock (#8830)\n - docs(java): add info about supported scopes (#7842)\n - docs(k8s): add a note about multi-container pods (#7815)\n - docs(misconf): Remove duplicate sections (#9819)\n - docs(misconf): Reorganize misconfiguration scan pages (#8206)\n - docs(misconf): simplify misconfiguration docs (#9030)\n - docs(python): Mention pip-compile (#8484)\n - docs(python): fix type with METADATA file name (#9090)\n - docs(report): Improve SARIF reporting doc (#7655)\n - docs(report): add nuanses about secret/license scanner in summary table (#9442)\n - docs(report): fix reporting doc format (#7671)\n - docs(server): fix info about scanning licenses on the client side. (#9805)\n - docs(vex): use debian minor version in examples (#8166)\n - docs(vuln): remove OSV for Python from data sources (#8841)\n - docs: Add info about helm charts release (#8640)\n - docs: Fix broken link to \"Built-in Checks\" (#9375)\n - docs: Fix broken links (#7900)\n - docs: Fix typo in terraform docs (#9492)\n - docs: Fix typos and linguistic errors in documentation / hacktoberfest (#9586)\n - docs: Fix typos in documentation (#8361)\n - docs: Update maintainer docs (#8674)\n - docs: Updated JSON schema version 2 in the trivy documentation (#8188)\n - docs: add Headlamp to the Trivy Ecosystem page (#7916)\n - docs: add PR review policy for maintainers (#9032)\n - docs: add Windows install instructions (#7800)\n - docs: add `overview` page for `others` (#7972)\n - docs: add abbreviation list (#8453)\n - docs: add commercial content (#8030)\n - docs: add example of creating whitelist of checks (#7821)\n - docs: add explanation for how to use non-system certificates (#9081)\n - docs: add info about `java-db` subdir (#9706)\n - docs: add info that `SSL_CERT_FILE` works on `Unix systems other than macOS` only (#9772)\n - docs: add note about disabled DS016 check (#7724)\n - docs: add note about temporary podman socket (#7921)\n - docs: add partners page (#8988)\n - docs: add section on customizing default check data (#9114)\n - docs: add terminology page to explain Trivy concepts (#7996)\n - docs: add vulnerability database contribution guide (#9667)\n - docs: apt-transport-https is a transitional package (#7678)\n - docs: bump pygments from 2.18.0 to 2.19.2 (#9596)\n - docs: catch some missed docs -\u003e guide (#9850)\n - docs: change --disable-metrics to --disable-telemetry in example (#8999) (#9003)\n - docs: change SecObserve URLs in documentatio (#9771)\n - docs: change in java.md: fix the Trity -to-\u003e Trivy typo (#8813)\n - docs: clarify inline ignore limitations for resource-less checks (#9537)\n - docs: combine trivy.dev into trivy docs (#7884)\n - docs: correct Ruby documentation (#8402)\n - docs: document eol supportability (#9434)\n - docs: drop AWS account scanning (#7997)\n - docs: fix a broken link (#8546)\n - docs: fix assets with versioning (#8996)\n - docs: fix dead links (#7998)\n - docs: fix mistakes/typos (#7942)\n - docs: fix modules path and update code example (#9539)\n - docs: fix navigate links (#8336)\n - docs: improve databases documentation (#7732)\n - docs: improve documentation for scanning raw IaC configurations (#9571)\n - docs: improve skipping files documentation (#8749)\n - docs: move info about `detection priority` into coverage section (#9469)\n - docs: partners page content updates (#9149)\n - docs: remove slack (#8565)\n - docs: replace short codes with Unicode emojis (#8296)\n - docs: restructure docs for new hosting (#9799)\n - docs: trivy partners page updates (#9133)\n - docs: update VEX documentation index page (#8458)\n - docs: update links to Semaphore pages (#9352)\n - docs: update vulnerability reporting guidelines in SECURITY.md (#9395)\n - feat(alma): add AlmaLinux 10 support (#9207)\n - feat(alpine): add maintainer field extraction for APK packages (#8930)\n - feat(aws): Add support for dualstack ECR endpoints (#9862)\n - feat(cli): Add available version checking (#8553)\n - feat(cli): Add trivy cloud suppport (#9637)\n - feat(cli): add `trivy auth` (#7664)\n - feat(cli): add version constraints to annoucements (#9023)\n - feat(cli): change --list-all-pkgs default to true (#9510)\n - feat(cli): error out when ignore file cannot be found (#7624)\n - feat(cli): rename `trivy auth` to `trivy registry` (#7727)\n - feat(cloudformation): support default values and list results in Fn::FindInMap (#9515)\n - feat(cyclonedx): Add initial support for loading external VEX files from SBOM references (#8254)\n - feat(cyclonedx): add file checksums to `CycloneDX` reports (#7507)\n - feat(cyclonedx): preserve SBOM structure when scanning SBOM files with vulnerability updates (#9439)\n - feat(db): append errors (#7843)\n - feat(db): enable concurrent access to vulnerability database (#9750)\n - feat(dotnet): add dependency graph support for .deps.json files (#9726)\n - feat(echo): Add Echo Support (#8833)\n - feat(flag): add `--cacert` flag (#9781)\n - feat(flag): add schema validation for `--server` flag (#9270)\n - feat(fs): change artifact type to repository when git info is detected (#9613)\n - feat(fs): optimize scanning performance by direct file access for known paths (#8525)\n - feat(fs): use git commit hash as cache key for clean repositories (#8278)\n - feat(go): construct dependencies in the parser (#7973)\n - feat(go): construct dependencies of `go.mod` main module in the parser (#7977)\n - feat(go): fix parsing main module version for go \u003e= 1.24 (#8433)\n - feat(go): support license scanning in both GOPATH and vendor (#8843)\n - feat(image): add Docker context resolution (#9166)\n - feat(image): add RepoTags support for Docker archives (#9690)\n - feat(image): add Sigstore bundle SBOM support (#9516)\n - feat(image): pass global context to docker/podman image save func (#9733)\n - feat(image): prevent scanning oversized container images (#8178)\n - feat(image): return error early if total size of layers exceeds limit (#8294)\n - feat(image): save layers metadata into report (#8394)\n - feat(java): add support remote repositories from settings.xml files (#9708)\n - feat(java): dereference all maven settings.xml env placeholders (#9024)\n - feat(k8s): add default commands for unknown platform (#7863)\n - feat(k8s): add support for controllers (#8614)\n - feat(k8s): get components from namespaced resources (#8918)\n - feat(k8s): improve artifact selections for specific namespaces (#8248)\n - feat(license): Support compound licenses (licenses using SPDX operators) (#8816)\n - feat(license): improve work text licenses with custom classification (#8888)\n - feat(license): improve work with custom classification of licenses from config file (#8861)\n - feat(license): observe pkg types option in license scanner (#9091)\n - feat(license): scan vendor directory for license for go.mod files (#8689)\n - feat(license): use separate SPDX ids to ignore SPDX expressions (#9087)\n - feat(minimos): Add support for MinimOS (#8792)\n - feat(misconf): Add RoleAssignments attribute (#9396)\n - feat(misconf): Add support for `Minimum Trivy Version` (#8880)\n - feat(misconf): Add support for aws_ami (#8499)\n - feat(misconf): Add support for configurable Rego error limit (#9657)\n - feat(misconf): Show misconfig ID in output (#7762)\n - feat(misconf): Update AppService schema (#9792)\n - feat(misconf): Update Azure Compute schema (#9675)\n - feat(misconf): Update Azure Container Schema (#9673)\n - feat(misconf): Update Azure network schema for new checks (#9791)\n - feat(misconf): Update SecurityCenter schema (#9674)\n - feat(misconf): Update azure storage schema (#9728)\n - feat(misconf): adapt AWS::DynamoDB::Table (#8529)\n - feat(misconf): adapt AWS::EC2::VPC (#8534)\n - feat(misconf): adapt aws_default_security_group (#8538)\n - feat(misconf): adapt aws_opensearch_domain (#8550)\n - feat(misconf): add OpenTofu file extension support (#8747)\n - feat(misconf): add agentpools to azure container schema (#9714)\n - feat(misconf): add misconfiguration location to junit template (#8793)\n - feat(misconf): add option to pass Rego scanner to IaC scanner (#8369)\n - feat(misconf): add private ip google access attribute to subnetwork (#9199)\n - feat(misconf): added audit config attribute (#9249)\n - feat(misconf): added logging and versioning to the gcp storage bucket (#9226)\n - feat(misconf): convert AWS managed policy to document (#8757)\n - feat(misconf): export raw Terraform data to Rego (#8741)\n - feat(misconf): export unresolvable field of IaC types to Rego (#7765)\n - feat(misconf): generate placeholders for random provider resources (#8051)\n - feat(misconf): include map key in manifest snippet for diagnostics (#9681)\n - feat(misconf): log causes of HCL file parsing errors (#7634)\n - feat(misconf): normalize CreatedBy for buildah and legacy docker builder (#8953)\n - feat(misconf): public network support for Azure Storage Account (#7601)\n - feat(misconf): render causes for Terraform (#8360)\n - feat(misconf): ssl_mode support for GCP SQL DB instance (#7564)\n - feat(misconf): support auto_provisioning_defaults in google_container_cluster (#8705)\n - feat(misconf): support for ignoring by inline comments for Dockerfile (#8115)\n - feat(misconf): support for ignoring by inline comments for Helm (#8138)\n - feat(misconf): support https_traffic_only_enabled in Az storage account (#9784)\n - feat(nodejs): add a bun.lock analyzer (#8897)\n - feat(nodejs): add bun.lock parser (#8851)\n - feat(nodejs): add root and workspace for `yarn` packages (#8535)\n - feat(nodejs): respect peer dependencies for dependency tree (#7989)\n - feat(oracle): add `flavors` support (#7858)\n - feat(parser): ignore white space in pom.xml files (#7747)\n - feat(python): add support for poetry dev dependencies (#8152)\n - feat(python): add support for uv (#8080)\n - feat(python): add support for uv dev and optional dependencies (#8134)\n - feat(redhat): Add EOL date for RHEL 10. (#8910)\n - feat(redhat): add os-release detection for RHEL-based images (#9458)\n - feat(repo): add git repository metadata to reports (#9252)\n - feat(report): add CVSS vectors in sarif report (#9157)\n - feat(report): add fingerprint generation for vulnerabilities (#9794)\n - feat(report): add image reference to report metadata (#9729)\n - feat(report): switch ReportID from UUIDv4 to UUIDv7 (#9749)\n - feat(report): update gitlab template to populate operating_system value (#7735)\n - feat(rust): add root and workspace relationships/package for `cargo` lock files (#8676)\n - feat(sbom): add SHA-512 hash support for CycloneDX SBOM (#9126)\n - feat(sbom): add manufacturer field to CycloneDX tools metadata (#9019)\n - feat(sbom): add support for SPDX attestations (#9829)\n - feat(sbom): added support for CoreOS (#9448)\n - feat(sbom): use SPDX license IDs list to validate SPDX IDs  (#9569)\n - feat(seal): add seal support (#9370)\n - feat(secret): Add built-in secrets rules for Private Packagist (#7826)\n - feat(secret): implement streaming secret scanner with byte offset tracking (#9264)\n - feat(suse): Add new openSUSE, Micro and SLES releases end of life dates (#9788)\n - feat(suse): Align SUSE/OpenSUSE OS Identifiers (#7965)\n - feat(terraform): add partial evaluation for policy templates (#8967)\n - feat(terraform): use .terraform cache for remote modules in plan scanning (#9277)\n - feat(ubuntu): add end of life date for Ubuntu 25.04 (#9077)\n - feat(ubuntu): add eol date for 20.04-ESM (#8981)\n - feat(vuln): add Root.io support for container image scanning (#9073)\n - feat: Update registry fallbacks (#7679)\n - feat: Update registry fallbacks [backport: release/v0.57] (#7944)\n - feat: add ArtifactID field to uniquely identify scan targets (#9663)\n - feat: add Bottlerocket OS package analyzer (#8653)\n - feat: add HTTP request/response tracing support (#9125)\n - feat: add JSONC support for comments and trailing commas (#8862)\n - feat: add ReportID field to scan reports (#9670)\n - feat: add `--distro` flag to manually specify OS distribution for vulnerability scanning (#8070)\n - feat: add `--vuln-severity-source` flag (#8269)\n - feat: add `workspaceRelationship` (#7889)\n - feat: add a examples field to check metadata (#8068)\n - feat: add cvss v4 score and vector in scan response (#7968)\n - feat: add documentation URL for database lock errors (#9531)\n - feat: add end of life date for Ubuntu 24.10 (#7787)\n - feat: add graceful shutdown with signal handling (#9242)\n - feat: add report summary table (#8177)\n - feat: add support for registry mirrors (#8244)\n - feat: add timeout handling for cache database operations (#9307)\n - feat: allow ignoring findings by type in Rego (#9578)\n - feat: include registry and repository in artifact ID calculation (#9689)\n - feat: reject unsupported artifact types in remote image retrieval (#9052)\n - feat: replace TinyGo with standard Go for WebAssembly modules (#8496)\n - feat: terraform parser option to set current working directory (#8909)\n - fix(alma): parse epochs from rpmqa file (#9101)\n - fix(alma): parse epochs from rpmqa file [backport: release/v0.64] (#9119)\n - fix(alpine): add `UID` for removed packages (#7887)\n - fix(aws): change CPU and Memory type of ContainerDefinition to a string (#7995)\n - fix(aws): update amazon linux 2 EOL date (#9176)\n - fix(aws): use `BuildableClient` insead of `xhttp.Client` (#9436)\n - fix(cli): Add more non-sensitive flags to telemetry (#9110)\n - fix(cli): Add more non-sensitive flags to telemetry [backport: release/v0.64] (#9124)\n - fix(cli): Handle empty ignore files more gracefully (#7962)\n - fix(cli): `clean --all` deletes only relevant dirs (#7704)\n - fix(cli): add config name to skip-policy-update alias (#7820)\n - fix(cli): add some values to the telemetry call (#9056)\n - fix(cli): disable `--skip-dir` and `--skip-files` flags for `sbom` command (#8886)\n - fix(cli): don't use allow values for `--compliance` flag (#8881)\n - fix(cli): ensure correct command is picked by telemetry (#9260)\n - fix(cli): panic: attempt to get os.Args[1] when len(os.Args) \u003c 2 (#9206)\n - fix(conda): memory leak by adding closure method for `package.json` file (#9349)\n - fix(cyclonedx): handle multiple license types (#9378)\n - fix(db): Dowload database when missing but metadata still exists (#9393)\n - fix(db): fix case when 2 trivy-db were copied at the same time (#8452)\n - fix(db): fix javadb downloading error handling (#7642)\n - fix(debian): don't include empty licenses for `dpkgs` (#8623)\n - fix(debian): infinite loop (#7928)\n - fix(deps): bump alpine from `3.22.1` to `3.23.0` [backport: release/v0.68] (#9949)\n - fix(flag): remove viper.SetDefault to fix IsSet() for config-only flags (#9732)\n - fix(flag): skip hidden flags for `--generate-default-config` command (#8046)\n - fix(fs): add missing defered Cleanup() call to post analyzer fs (#7882)\n - fix(fs): avoid shadowing errors in file.glob (#9286)\n - fix(fs): check postAnalyzers for StaticPaths (#8543)\n - fix(fs): fix cache key generation to use UUID (#8275)\n - fix(go): Do not trim v prefix from versions in Go Mod Analyzer (#7733)\n - fix(go): merge nested flags into string for ldflags for Go binaries (#8368)\n - fix(helm): properly handle multiple archived dependencies (#7782)\n - fix(image): disable AVD-DS-0007 for history scanning (#8366)\n - fix(image): use standardized HTTP client for ECR authentication (#9322)\n - fix(java): correctly inherit `version` and `scope` from upper/root `depManagement` and `dependencies` into parents (#7541)\n - fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props (#8050)\n - fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props [backport: release/v0.58] (#8119)\n - fix(java): exclude dev dependencies in gradle lockfile (#8803)\n - fix(java): update order for resolving package fields from multiple demManagement (#9575)\n - fix(java): use `true` as default value for Repository Release|Snapshot Enabled in pom.xml and settings.xml files (#9751)\n - fix(julia): add `Relationship` field support (#8939)\n - fix(k8s)!: support k8s multi container (#7444)\n - fix(k8s): add missed option `PkgRelationships` (#8442)\n - fix(k8s): check all results for vulnerabilities (#7946)\n - fix(k8s): correct compare artifact versions (#8682)\n - fix(k8s): correct compare artifact versions [backport: release/v0.61] (#8699)\n - fix(k8s): disable parallel traversal with fs cache for k8s images (#9534)\n - fix(k8s): remove using `last-applied-configuration` (#8791)\n - fix(k8s): show report for `--report all` (#8613)\n - fix(k8s): skip passed misconfigs for the summary report (#8684)\n - fix(k8s): skip passed misconfigs for the summary report [backport: release/v0.61] (#8748)\n - fix(k8s): skip resources without misconfigs (#7797)\n - fix(k8s): support kubernetes v1.31 (#7810)\n - fix(k8s): use in-memory cache backend during misconfig scanning (#8873)\n - fix(license): add missed `GFDL-NIV-1.1` and `GFDL-NIV-1.2` into Trivy mapping (#9116)\n - fix(license): always trim leading and trailing spaces for licenses (#8095)\n - fix(license): don't normalize `unlicensed` licenses into `unlicense` (#9611)\n - fix(license): fix license normalization for Universal Permissive License (#7766)\n - fix(license): handle SPDX WITH exceptions as single license in category detection (#9380)\n - fix(license): handle WITH operator for `LaxSplitLicenses` (#9232)\n - fix(misconf): .Config.User always takes precedence over USER in .History (#9050)\n - fix(misconf): Check values wholly prior to evalution (#8604)\n - fix(misconf): Improve logging for unsupported checks (#8634)\n - fix(misconf): Update trivy-checks default repo to `mirror.gcr.io` (#7953)\n - fix(misconf): add ephemeral block type to config schema (#8513)\n - fix(misconf): add missing variable as unknown (#8683)\n - fix(misconf): allow null values only for tf variables (#8112)\n - fix(misconf): allow null values only for tf variables [backport: release/v0.58] (#8238)\n - fix(misconf): change default ACL of digitalocean_spaces_bucket to private (#7577)\n - fix(misconf): check if for-each is known when expanding dyn block (#8808)\n - fix(misconf): check if for-each is known when expanding dyn block [backport: release/v0.62] (#8826)\n - fix(misconf): check if metadata is not nil (#8647)\n - fix(misconf): check if property is not nil before conversion (#7578)\n - fix(misconf): correct Azure value-to-time conversion in AsTimeValue (#9015)\n - fix(misconf): correctly adapt azure storage account (#9138)\n - fix(misconf): correctly handle all YAML tags in K8S templates (#8259)\n - fix(misconf): correctly parse empty port ranges in google_compute_firewall (#9237)\n - fix(misconf): disable git terminal prompt on tf module load (#8026)\n - fix(misconf): do not erase variable type for child modules (#7941)\n - fix(misconf): do not log scanners when misconfig scanning is disabled (#8345)\n - fix(misconf): do not log scanners when misconfig scanning is disabled [backport: release/v0.59] (#8349)\n - fix(misconf): do not skip loading documents from subdirectories (#8526)\n - fix(misconf): do not use cty.NilVal for non-nil values (#8567)\n - fix(misconf): ecs include enhanced for container insights (#8326)\n - fix(misconf): ensure boolean metadata values are correctly interpreted (#9770)\n - fix(misconf): ensure ignore rules respect subdirectory chart paths (#9324)\n - fix(misconf): ensure module source is known (#9404)\n - fix(misconf): ensure value used as ignore marker is non-null and known (#9835)\n - fix(misconf): filter null nodes when parsing json manifest (#8785)\n - fix(misconf): fix for Azure Storage Account network acls adaptation (#7602)\n - fix(misconf): fix incorrect k8s locations due to JSON to YAML conversion (#8073)\n - fix(misconf): fix log bucket in schema (#9235)\n - fix(misconf): handle heredocs in dockerfile instructions (#8284)\n - fix(misconf): handle null properties in CloudFormation templates (#7813)\n - fix(misconf): handle tofu files in module detection (#9486)\n - fix(misconf): handle unsupported experimental flags in Dockerfile (#9769)\n - fix(misconf): identify the chart file exactly by name (#8590)\n - fix(misconf): load full Terraform module (#7925)\n - fix(misconf): map healthcheck start period flag to --start-period instead of --startPeriod (#9837)\n - fix(misconf): move disabled checks filtering after analyzer scan (#9002)\n - fix(misconf): perform operations on attribute safely (#8774)\n - fix(misconf): populate context correctly for module instances (#8656)\n - fix(misconf): preserve original paths of remote submodules from .terraform (#9294)\n - fix(misconf): properly expand dynamic blocks (#7612)\n - fix(misconf): properly resolve local Terraform cache (#7983)\n - fix(misconf): reduce log noise on incompatible check (#9029)\n - fix(misconf): set default values for AWS::EKS::Cluster.ResourcesVpcConfig (#8548)\n - fix(misconf): skip Azure CreateUiDefinition (#8503)\n - fix(misconf): skip rewriting expr if attr is nil (#9113)\n - fix(misconf): skip rewriting expr if attr is nil [backport: release/v0.64] (#9127)\n - fix(misconf): strip build metadata suffixes from image history (#9498)\n - fix(misconf): unmark cty values before access (#9495)\n - fix(misconf): use argument value in WithIncludeDeprecatedChecks (#8942)\n - fix(misconf): use correct field log_bucket instead of target_bucket in gcp bucket (#9296)\n - fix(misconf): use log instead of fmt for logging (#8033)\n - fix(misconf): wrap AWS EnvVar to iac types (#7407)\n - fix(misconf): wrap legacy ENV values in quotes to preserve spaces (#9497)\n - fix(nodejs): correctly parse `packages` array of `bun.lock` file (#8998)\n - fix(nodejs): don't use prerelease logic for compare npm constraints  (#9208)\n - fix(nodejs): fix npmjs parser.pkgNameFromPath() panic issue (#9688)\n - fix(nodejs): parse workspaces as objects for package-lock.json files (#9518)\n - fix(nodejs): use snapshot string as `Package.ID` for pnpm packages (#9330)\n - fix(nodejs): use the default ID format to match licenses in pnpm packages. (#9661)\n - fix(oracle): add architectures support for advisories (#4809)\n - fix(oracle): add architectures support for advisories [backport: release/v0.58] (#8125)\n - fix(os): Add photon 5.0 in supported OS (#9724)\n - fix(os): add mapping OS aliases (#8466)\n - fix(plugin): don't remove plugins when updating index.yaml file (#9358)\n - fix(python): add `poetry` v2 support (#8323)\n - fix(python): add `poetry` v2 support [backport: release/v0.59] (#8335)\n - fix(python): impove package name normalization  (#9290)\n - fix(python): skip dev group's deps for poetry (#8106)\n - fix(python): skip dev group's deps for poetry [backport: release/v0.58] (#8158)\n - fix(redhat): Also try to find buildinfo in root layer (layer 0) (#8924)\n - fix(redhat): check `usr/share/buildinfo/` dir to detect content sets (#8222)\n - fix(redhat): correct rewriting of recommendations for the same vulnerability (#8063)\n - fix(redhat): correct rewriting of recommendations for the same vulnerability [backport: release/v0.58] (#8135)\n - fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files (#7912)\n - fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files [backport: release/v0.57] (#7939)\n - fix(redhat): include arch in PURL qualifiers (#7654)\n - fix(redhat): include arch in PURL qualifiers [backport: release/v0.56] (#7702)\n - fix(redhat): save contentSets for OS packages in fs/vm modes (#8820)\n - fix(redhat): trim invalid suffix from content_sets in manifest parsing (#8818)\n - fix(redhat): trim invalid suffix from content_sets in manifest parsing [backport: release/v0.62] (#8824)\n - fix(repo): `git clone` output to Stderr (#7561)\n - fix(repo): preserve RepoMetadata on FS cache hit (#9389)\n - fix(repo): sanitize git repo URL before inserting into report metadata (#9391)\n - fix(report): Fix invalid URI in SARIF report (#7645)\n - fix(report): clean buffer after flushing (#8725)\n - fix(report): correct field order in SARIF license results (#9712)\n - fix(report): don't panic when report contains vulns, but doesn't contain packages for `table` format (#8549)\n - fix(report): handle `git@github.com` schema for misconfigs in `sarif` report (#7898)\n - fix(report): remove html escaping for `shortDescription` and `fullDescription` fields for sarif reports (#8344)\n - fix(rootio): check full version to detect `root.io` packages (#9117)\n - fix(rootio): check full version to detect `root.io` packages [backport: release/v0.64] (#9120)\n - fix(rootio): fix severity selection (#9181)\n - fix(sbom):  use `Annotation` instead of `AttributionTexts` for `SPDX` formats (#7811)\n - fix(sbom): Fixes for Programming Language Vulnerabilities and SBOM Package Maintainer Details (#7871)\n - fix(sbom): add SBOM file's filePath as Application FilePath if we can't detect its path (#8346)\n - fix(sbom): add `buildInfo` info as properties (#9683)\n - fix(sbom): add options for DBs in private registries (#7660)\n - fix(sbom): add options for DBs in private registries [backport: release/v0.56] (#7691)\n - fix(sbom): add support for `file` component type of `CycloneDX` (#9372)\n - fix(sbom): attach nested packages to Application (#8144)\n - fix(sbom): attach nested packages to Application [backport: release/v0.58] (#8168)\n - fix(sbom): don’t panic on SBOM format if scanned CycloneDX file has empty metadata (#9562)\n - fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type (#8052)\n - fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type [backport: release/v0.58] (#8124)\n - fix(sbom): improve logic for binding direct dependency to parent component (#8489)\n - fix(sbom): merge in-graph and out-of-graph OS packages in scan results (#9194)\n - fix(sbom): preserve OS packages from multiple SBOMs (#8325)\n - fix(sbom): preserve OS packages from multiple SBOMs [backport: release/v0.59] (#8333)\n - fix(sbom): remove unnecessary OS detection check in SBOM decoding (#9034)\n - fix(sbom): scan results of SBOMs generated from container images are missing layers (#7635)\n - fix(sbom): use correct field for licenses in CycloneDX reports (#9057)\n - fix(sbom): use root package for `unknown` dependencies (if exists) (#8104)\n - fix(sbom): use root package for `unknown` dependencies (if exists) [backport: release/v0.58] (#8156)\n - fix(secret): add UTF-8 validation in secret scanner to prevent protobuf marshalling errors (#9253)\n - fix(secret): fix line numbers for multiple-line secrets (#9104)\n - fix(secret): ignore .dist-info directories during secret scanning (#8646)\n - fix(server): add HTTP transport setup to server mode (#9217)\n - fix(server): add missed Relationship field for `rpc` (#8872)\n - fix(server): fix redis key when trying to delete blob (#8649)\n - fix(server): secrets inspectation for the config analyzer in client server mode (#8418)\n - fix(spdx): init `pkgFilePaths` map for all formats (#8380)\n - fix(spdx): save text licenses into `otherLicenses` without normalize (#8502)\n - fix(spdx): use the `hasExtractedLicensingInfos` field for licenses that are not listed in the SPDX (#8077)\n - fix(suse): SUSE - update OSType constants and references for compatility (#8236)\n - fix(suse): SUSE - update OSType constants and references for compatility [backport: release/v0.58] (#8237)\n - fix(terraform): `evaluateStep` to correctly set `EvalContext` for multiple instances of blocks (#8555)\n - fix(terraform): `for_each` on a map returns a resource for every key (#9156)\n - fix(terraform): apply parser options to submodule parsing (#8377)\n - fix(terraform): hcl object expressions to return references (#8271)\n - fix(terraform): set null value as fallback for missing variables (#7669)\n - fix(vex): don't  suppress vulns for packages with infinity loop (#9465)\n - fix(vex): don't use reused BOM (#9604)\n - fix(vex): don't use reused BOM [backport: release/v0.67] (#9612)\n - fix(vex): use `lo.IsNil` to check `VEX` from OCI artifact (#8858)\n - fix(vex): use a separate `visited` set for each DFS path (#9760)\n - fix(vuln): compare `nuget` package names in lower case (#9456)\n - fix(wolfi): support new APK database location (#8937)\n - fix: Add missing version check flags (#8951)\n - fix: CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass (#8088)\n - fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field (#8207)\n - fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field [backport: release/v0.58] (#8215)\n - fix: Correctly check for semver versions for trivy version check (#8948)\n - fix: Improve version comparisons when build identifiers are present (#7873)\n - fix: Trim the end-of-range suffix (#9618)\n - fix: Updated twitter icon (#7772)\n - fix: Use `fetch-level: 1` to check out trivy-repo in the release workflow (#9636)\n - fix: Use `fetch-level: 1` to check out trivy-repo in the release workflow [backport: release/v0.67] (#9638)\n - fix: add `buildInfo` for `BlobInfo` in `rpc` package (#9608)\n - fix: add `buildInfo` for `BlobInfo` in `rpc` package [backport: release/v0.67] (#9615)\n - fix: also check `filepath` when removing duplicate packages (#9142)\n - fix: check post-analyzers for StaticPaths (#8904)\n - fix: close all opened resources if an error occurs (#9665)\n - fix: close file descriptors and pipes on error paths (#9536)\n - fix: create temp file under composite fs dir (#9387)\n - fix: de-duplicate same `dpkg` packages with different filePaths from different layers (#8298)\n - fix: don't show corrupted trivy-db warning for first run (#8991)\n - fix: don't use `scope` for `trivy registry login` command (#8393)\n - fix: early-return, indent-error-flow and superfluous-else rules from revive  (#8796)\n - fix: enable err-error and errorf rules from perfsprint linter (#7859)\n - fix: enable usestdlibvars linter (#7770)\n - fix: filter all files when processing files installed from package managers (#8842)\n - fix: handle `BLOW_UNKNOWN` error to download DBs (#8060)\n - fix: handle `BLOW_UNKNOWN` error to download DBs [backport: release/v0.58] (#8121)\n - fix: improve conversion of image config to Dockerfile (#8308)\n - fix: julia parser panicing (#8883)\n - fix: migrate from `*.list` to `*.md5sums` files for `dpkg` (#9131)\n - fix: more revive rules (#8814)\n - fix: octalLiteral from go-critic (#8811)\n - fix: persistent flag option typo (#9374)\n - fix: prevent graceful shutdown message on normal exit (#9244)\n - fix: respect GITHUB_TOKEN to download artifacts from GHCR (#7580)\n - fix: restore compatibility for google.protobuf.Value (#9559)\n - fix: restore compatibility for google.protobuf.Value [backport: release/v0.67] (#9631)\n - fix: supporting .egg-info/METADATA in python.Packaging analyzer (#9151)\n - fix: suppress debug log for context cancellation errors (#9298)\n - fix: testifylint last issues (#8768)\n - fix: unused-parameter rule from revive (#8794)\n - fix: update all documentation links (#8045)\n - fix: update all documentation links (#9777)\n - fix: update cosing settings for GoReleaser after bumping cosing to v3 (#9863)\n - fix: use `--file-patterns` flag for all post analyzers (#7365)\n - fix: use context for analyzers (#9538)\n - fix: use-any from revive (#8810)\n - fix: using SrcVersion instead of Version for echo detector (#9552)\n - fix: using SrcVersion instead of Version for echo detector [backport: release/v0.67] (#9629)\n - fix: validate backport branch name (#9548)\n - fix: wasm module test (#8099)\n - perf(misconf): parse input for Rego once (#8483)\n - perf(misconf): retrieve check metadata from annotations once (#8478)\n - perf(secret): only match secrets of meaningful length, allow example strings to not be matched (#8602)\n - perf: avoid heap allocation in applier findPackage (#7883)\n - refactor(cli): Update the cloud config command (#9676)\n - refactor(cloudformation): remove unused ScanFile method from Scanner (#8927)\n - refactor(db): change logic to detect wrong DB (#8864)\n - refactor(db): use `Getter` interface with `GetParams` for trivy-db sources (#9239)\n - refactor(flag): improve flag system architecture and extensibility (#8718)\n - refactor(fs): use underlyingPath to determine virtual files more reliably (#9302)\n - refactor(k8s): add v prefix for Go packages (#7839)\n - refactor(k8s): scan config files as a folder (#7690)\n - refactor(license): improve license expression normalization (#8257)\n - refactor(license): simplify compound license scanning (#8896)\n - refactor(misconf): Deprecate `EXCEPTIONS` for misconfiguration scanning (#7776)\n - refactor(misconf): Remove unused options (#7896)\n - refactor(misconf): Simplify misconfig checks bundle parsing (#8533)\n - refactor(misconf): add ID to scan.Rule (#9573)\n - refactor(misconf): add ManifestFromYAML for unified manifest parsing (#9680)\n - refactor(misconf): decouple input fs and track extracted files with fs references (#9281)\n - refactor(misconf): get a block or attribute without calling HasChild (#8586)\n - refactor(misconf): introduce generic scanner (#7515)\n - refactor(misconf): make Rego scanner independent of config type (#7517)\n - refactor(misconf): mark AVDID fields as deprecated and use ID internally (#9576)\n - refactor(misconf): migrate from custom Azure JSON parser (#9222)\n - refactor(misconf): parse azure_policy_enabled to addonprofile.azurepolicy.enabled (#9851)\n - refactor(misconf): remove module outputs from parser.EvaluateAll (#8587)\n - refactor(misconf): remove unused methods for ec2.Instance (#8536)\n - refactor(misconf): remove unused methods from iac types (#8782)\n - refactor(misconf): remove unused methods from providers (#8781)\n - refactor(misconf): remove unused terraform attribute methods (#8657)\n - refactor(misconf): replace github.com/liamg/memoryfs with internal mapfs and testing/fstest (#9282)\n - refactor(misconf): rewrite Rego module filtering using functional filters (#9061)\n - refactor(misconf): set Trivy version by default in Rego scanner (#9001)\n - refactor(misconf): simplify k8s scanner (#7717)\n - refactor(misconf): switch to x/json  (#8719)\n - refactor(misconf): type-safe parser results in generic scanner (#9685)\n - refactor(misconf): use OPA v1 (#8518)\n - refactor(misconf): use atomic.Int32 (#9385)\n - refactor(python): use once + debug for `License acquired from METADATA...` logs (#8175)\n - refactor(report): write tables after rendering all results (#8357)\n - refactor(sbom): simplify relationship generation (#7985)\n - refactor(secret): clarify secret scanner messages (#9409)\n - refactor(secret): optimize performance by moving ToLower operation outside loop (#7862)\n - refactor(server): change custom advisory and vulnerability data types fr… (#8923)\n - refactor(terraform): make Scan method of Terraform plan scanner private (#9272)\n - refactor(terraform): remove result sorting from scanner (#8928)\n - refactor(terraform): simplify AllReferences method signature in Attribute (#8906)\n - refactor(ubuntu): update time handling for fixing time (#8780)\n - refactor(vex): improve SBOM reference handling with project standards (#8457)\n - refactor: add case-insensitive string set implementation (#9720)\n - refactor: add generic Set implementation (#8149)\n - refactor: add hook interface for extended functionality (#8585)\n - refactor: centralize HTTP transport configuration (#9058)\n - refactor: export `systemFileFiltering` Post Handler (#9359)\n - refactor: migrate from `github.com/aquasecurity/jfather` to `github.com/go-json-experiment/json` (#8591)\n - refactor: migrate from go-json-experiment to encoding/json/v2 (#9422)\n - refactor: move the aws config (#9617)\n - refactor: remove aws flag helper message (#9080)\n - refactor: remove google/wire dependency and implement manual DI (#9509)\n - refactor: remove support for custom Terraform checks (#7901)\n - refactor: rename scanner to service (#8584)\n - refactor: simplify Detect function signature (#9280)\n - refactor: switch to stable azcontainerregistry SDK package (#9319)\n - refactor: use slices package instead of custom function (#8172)\n - refactor: use strings.SplitSeq instead of strings.Split in for-loop (#8983)\n - refactor: use trivy-checks/pkg/specs package (#8226)\n - release: v0.56.2 [release/v0.56] (#7694)\n - release: v0.57.0 [main] (#7710)\n - release: v0.57.1 [release/v0.57] (#7943)\n - release: v0.58.0 [main] (#7874)\n - release: v0.58.1 [release/v0.58] (#8120)\n - release: v0.58.2 [release/v0.58] (#8216)\n - release: v0.59.0 [main] (#8041)\n - release: v0.59.1 [release/v0.59] (#8334)\n - release: v0.60.0 [main] (#8327)\n - release: v0.61.0 [main] (#8507)\n - release: v0.61.1 [release/v0.61] (#8704)\n - release: v0.62.0 [main] (#8669)\n - release: v0.62.1 [release/v0.62] (#8825)\n - release: v0.63.0 [main] (#8809)\n - release: v0.64.0 [main] (#8955)\n - release: v0.64.1 [release/v0.64] (#9122)\n - release: v0.65.0 [main] (#9108)\n - release: v0.66.0 [main] (#9289)\n - release: v0.67.0 [main] (#9432)\n - release: v0.67.1 [release/v0.67] (#9614)\n - release: v0.67.2 [release/v0.67] (#9639)\n - release: v0.68.0 [main] (#9549)\n - release: v0.68.1 [main] (#9867)\n - release: v0.68.2 [release/v0.68] (#9950)\n - style: Fix MD syntax in self-hosting.md (#8523)\n - test(go): refactor mod_test.go to use txtar format (#9775)\n - test(go): set `GOPATH` for tests (#9785)\n - test(helm): bump up Yamale dependency for Helm chart-testing-action (#9653)\n - test(k8s): update k8s integrtion test (#9725)\n - test(k8s): use a specific bundle for k8s misconfig scan (#9633)\n - test(misconf): drop gcp iam test covered by another case (#9285)\n - test(misconf): move terraform scan tests to integration tests (#9271)\n - test(misconf): remove BenchmarkCalculate using outdated check metadata (#9291)\n - test(server): replace mock driver with memory cache in server tests (#8416)\n - test: add HTTP basic authentication to git test server (#9407)\n - test: add end-to-end testing framework with image scan and proxy tests (#9231)\n - test: change branch in spdx schema link to check in integration tests (#7935)\n - test: change branch in spdx schema link to check in integration tests [backport: release/v0.57] (#7940)\n - test: define constants for test images (#7739)\n - test: improve and extend tests for iac/adapters/arm (#9028)\n - test: improve golden file management in integration tests (#9699)\n - test: include integration tests in linting and fix all issues (#9060)\n - test: replace Go checks with Rego (#7867)\n - test: replace mock with memory cache and fix non-deterministic tests (#8410)\n - test: replace mock with memory cache in scanner tests (#8413)\n - test: save `containerd` image into archive and use in tests (#7816)\n - test: set dummy value for NUGET_PACKAGES (#8107)\n - test: update golden files for TestRepository* integration tests (#9684)\n - test: use `aquasecurity` repository for test images (#8677)\n - test: use `aquasecurity` repository for test images [backport: release/v0.61] (#8698)\n - test: use forked images (#7755)\n - test: use memory cache (#8403)\n - test: use table-driven tests in Helm scanner tests (#8592)\n","status":"published","published":"2026-02-13T16:33:52Z","modified":"2026-05-29T18:24:10.235720339Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2025:20516-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\nUpdate to version 3.18.4 (bsc#1246152, CVE-2025-53547):\n\n  * Disabling linter due to unknown issue f20a4ad (Matt Farina)\n  * build(deps): bump the k8s-io group with 7 updates 563b094\n    (dependabot[bot])\n  * Updating link handling 00de613 (Matt Farina)\n\nUpdate to version 3.18.3:\n\n  * build(deps): bump golang.org/x/crypto from 0.38.0 to 0.39.0\n    6838ebc (dependabot[bot])\n  * fix: user username password for login 5b9e2f6 (Terry Howe)\n  * Update pkg/registry/transport.go 2782412 (Terry Howe)\n  * Update pkg/registry/transport.go e66cf6a (Terry Howe)\n  * fix: add debug logging to oci transport 191f05c (Terry Howe)\n\nUpdate to version 3.18.2:\n\n  * fix: legacy docker support broken for login 04cad46 (Terry\n    Howe)\n  * Handle an empty registry config file. bc9f8a2 (Matt Farina)\n\nUpdate to version 3.18.1:\n\n  * Notes:\n    - This release fixes regressions around template generation and\n      OCI registry interaction in 3.18.0\n    - There are at least 2 known regressions unaddressed in this\n      release. They are being worked on.\n      - Empty registry configuration files. When the file exists\n        but it is empty.\n      - Login to Docker Hub on some domains fails.\n  * Changelog\n    - fix(client): skipnode utilization for PreCopy\n    - fix(client): layers now returns manifest - remove duplicate\n      from descriptors\n    - fix(client): return nil on non-allowed media types\n    - Prevent fetching newReference again as we have in calling\n      method\n    - Prevent failure when resolving version tags in oras memory\n      store\n    - Update pkg/plugin/plugin.go\n    - Update pkg/plugin/plugin.go\n    - Wait for Helm v4 before raising when platformCommand and\n      Command are set\n    - Fix 3.18.0 regression: registry login with scheme\n    - Revert \"fix (helm) : toToml` renders int as float [ backport\n      to v3 ]\"\n\nUpdate to version 3.18.0 (bsc#1241802, CVE-2025-22872):\n\n  * Notable Changes:\n\n    - Add support for JSON Schema 2020\n    - Enabled cpu and memory profiling\n    - Add hook annotation to output hook logs to client on error\n\n  * Changelog:\n\n    - build(deps): bump the k8s-io group with 7 updates\n    - fix: govulncheck workflow\n    - bump version to v3.18.0\n    - fix:add proxy support when mTLS configured\n    - docs: Note about http fallback for OCI registries\n    - Bump net package to avoid CVE on dev-v3\n    - Bump toml\n    - backport #30677to dev3\n    - build(deps): bump github.com/rubenv/sql-migrate from 1.7.2 to\n      1.8.0\n    - Add install test for TakeOwnership flag\n    - Fix --take-ownership\n    - build(deps): bump github.com/rubenv/sql-migrate from 1.7.1 to\n      1.7.2\n    - build(deps): bump golang.org/x/crypto from 0.36.0 to 0.37.0\n    - build(deps): bump golang.org/x/term from 0.30.0 to 0.31.0\n    - Testing text bump\n    - Permit more Go version and not only 1.23.8\n    - Bumps github.com/distribution/distribution/v3 from 3.0.0-rc.3\n      to 3.0.0\n    - Unarchiving fix\n    - Fix typo\n    - Report as debug log, the time spent waiting for resources\n    - build(deps): bump github.com/containerd/containerd from\n      1.7.26 to 1.7.27\n    - Update pkg/registry/fallback.go\n    - automatic fallback to http\n    - chore(oci): upgrade to ORAS v2\n    - Updating to 0.37.0 for x/net\n    - build(deps): bump the k8s-io group with 7 updates\n    - build(deps): bump golang.org/x/crypto from 0.35.0 to 0.36.0\n    - build(deps): bump github.com/opencontainers/image-spec\n    - build(deps): bump github.com/containerd/containerd from\n      1.7.25 to 1.7.26\n    - build(deps): bump golang.org/x/crypto from 0.33.0 to 0.35.0\n    - Fix cherry-pick helm.sh/helm/v4 -\u003e helm.sh/helm/v3\n    - Refactor based on review comment\n    - Refactor based on review comment\n    - Add HookOutputFunc and generic yaml unmarshaller\n    - clarify fix error message\n    - fix err check\n    - remove comments about previous functionality\n    - add short circuit return\n    - Update based on review comments\n    - Update based on review comments\n    - Fix lint\n    - Tidy up imports\n    - Add hook annotations to output pod logs to client on success\n      and fail\n    - chore: use []error instead of []string\n    - Update cmd/helm/profiling.go\n    - chore: update profiling doc in CONTRIBUTING.md\n    - Update CONTRIBUTING guide\n    - Prefer environment variables to CLI flags\n    - Fix linter warning\n    - Move pprof paths to HELM_PPROF env variable\n    - Update CONTRIBUTING.md\n    - Update CONTRIBUTING.md\n    - Additional review fixes from PR\n    - feat: Add flags to enable CPU and memory profiling\n    - build(deps): bump github.com/distribution/distribution/v3\n    - build(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1\n    - Moving to SetOut and SetErr for Cobra\n    - build(deps): bump the k8s-io group with 7 updates\n    - build(deps): bump golang.org/x/crypto from 0.32.0 to 0.33.0\n    - build(deps): bump golang.org/x/term from 0.28.0 to 0.29.0\n    - build(deps): bump golang.org/x/text from 0.21.0 to 0.22.0\n    - build(deps): bump github.com/spf13/pflag from 1.0.5 to 1.0.6\n    - build(deps): bump github.com/cyphar/filepath-securejoin\n    - build(deps): bump github.com/evanphx/json-patch\n    - build(deps): bump the k8s-io group with 7 updates\n    - fix: check group for resource info match\n    - Bump github.com/cyphar/filepath-securejoin from 0.3.6 to\n      0.4.0\n    - add test for nullifying nested global value\n    - Ensuring the file paths are clean prior to passing to\n      securejoin\n    - Bump github.com/containerd/containerd from 1.7.24 to 1.7.25\n    - Bump golang.org/x/crypto from 0.31.0 to 0.32.0\n    - Bump golang.org/x/term from 0.27.0 to 0.28.0\n    - bump version to v3.17.0\n    - Bump github.com/moby/term from 0.5.0 to 0.5.2\n    - Add test case for removing an entire object\n    - Tests for bugfix: Override subcharts with null values #12879\n    - feat: Added multi-platform plugin hook support to v3\n    - This commit fixes the issue where the yaml.Unmarshaller\n      converts all int values into float64, this passes in option\n      to decoder, which enables conversion of int into .\n    - merge null child chart objects\n\nUpdate to version 3.17.3:\n\n  Helm v3.17.3 is a security (patch) release. Users are strongly\n  recommended to update to this release.\n\n  * Changelog\n    - Unarchiving fix e4da497 (Matt Farina)\n\n","status":"published","published":"2025-07-30T09:27:44Z","modified":"2026-03-23T04:48:58.101097Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20595-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\nUpdate to version 3.18.4 (bsc#1246152, CVE-2025-53547):\n\n  * Disabling linter due to unknown issue f20a4ad (Matt Farina)\n  * build(deps): bump the k8s-io group with 7 updates 563b094\n    (dependabot[bot])\n  * Updating link handling 00de613 (Matt Farina)\n\n","status":"published","published":"2025-08-14T10:15:33Z","modified":"2026-03-23T04:50:52.69331Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:4190-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\n- Update to version 3.19.1\n- CVE-2025-53547: Fixed local code execution in Helm Chart. (bsc#1246152)\n- CVE-2025-58190: Fixed excessive memory consumption by `html.ParseFragment` when processing specially crafted input. (bsc#1251649)\n- CVE-2025-47911: Fixed various algorithms with quadratic complexity when parsing HTML documents. (bsc#1251442)\n","status":"published","published":"2025-11-24T09:19:46Z","modified":"2026-03-23T04:51:28.636528Z","updated_at":"2026-11-02T15:54:00.344164Z"}]}}