Update to 0.66.0 (bsc#1248937, CVE-2025-58058)

_service

@@ -2,7 +2,7 @@
   <service name="tar_scm" mode="manual">
     <param name="url">https://github.com/aquasecurity/trivy</param>
     <param name="scm">git</param>
-    <param name="revision">v0.65.0</param>
+    <param name="revision">v0.66.0</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="versionrewrite-pattern">v(.*)</param>
     <param name="changesgenerate">enable</param>

_servicedata

@@ -1,4 +1,4 @@
 <servicedata>
 <service name="tar_scm">
                 <param name="url">https://github.com/aquasecurity/trivy</param>
-              <param name="changesrevision">b2b15459bac0efef73531c73b45e80d40ddd0fec</param></service></servicedata>
+              <param name="changesrevision">7bcb181268893fdd69ef4582588c040bb1036c33</param></service></servicedata>

trivy.changes

@@ -1,3 +1,56 @@
+-------------------------------------------------------------------
+Thu Sep 04 13:44:57 UTC 2025 - Dirk Müller <dmueller@suse.com>
+
+- Update to version 0.66.0 (bsc#1248937, CVE-2025-58058):
+  * release: v0.66.0 [main] (#9289)
+  * chore(deps): bump the aws group with 7 updates (#9419)
+  * refactor(secret): clarify secret scanner messages (#9409)
+  * fix(cyclonedx): handle multiple license types (#9378)
+  * fix(repo): sanitize git repo URL before inserting into report metadata (#9391)
+  * test: add HTTP basic authentication to git test server (#9407)
+  * fix(sbom): add support for `file` component type of `CycloneDX` (#9372)
+  * fix(misconf): ensure module source is known (#9404)
+  * ci: migrate GitHub Actions from version tags to SHA pinning (#9405)
+  * fix: create temp file under composite fs dir (#9387)
+  * chore(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#9403)
+  * refactor: switch to stable azcontainerregistry SDK package (#9319)
+  * chore(deps): bump the common group with 7 updates (#9382)
+  * refactor(misconf): migrate from custom Azure JSON parser (#9222)
+  * fix(repo): preserve RepoMetadata on FS cache hit (#9389)
+  * refactor(misconf): use atomic.Int32 (#9385)
+  * chore(deps): bump the aws group with 6 updates (#9383)
+  * docs: Fix broken link to "Built-in Checks" (#9375)
+  * fix(plugin): don't remove plugins when updating index.yaml file (#9358)
+  * fix: persistent flag option typo (#9374)
+  * chore(deps): bump the common group across 1 directory with 26 updates (#9347)
+  * fix(image): use standardized HTTP client for ECR authentication (#9322)
+  * refactor: export `systemFileFiltering` Post Handler (#9359)
+  * docs: update links to Semaphore pages (#9352)
+  * fix(conda): memory leak by adding closure method for `package.json` file (#9349)
+  * feat: add timeout handling for cache database operations (#9307)
+  * fix(misconf): use correct field log_bucket instead of target_bucket in gcp bucket (#9296)
+  * fix(misconf): ensure ignore rules respect subdirectory chart paths (#9324)
+  * chore(deps): bump alpine from 3.21.4 to 3.22.1 (#9301)
+  * feat(terraform): use .terraform cache for remote modules in plan scanning (#9277)
+  * chore: fix some function names in comment (#9314)
+  * chore(deps): bump the aws group with 7 updates (#9311)
+  * docs: add explanation for how to use non-system certificates (#9081)
+  * chore(deps): bump the github-actions group across 1 directory with 2 updates (#8962)
+  * fix(misconf): preserve original paths of remote submodules from .terraform (#9294)
+  * refactor(terraform): make Scan method of Terraform plan scanner private (#9272)
+  * fix: suppress debug log for context cancellation errors (#9298)
+  * feat(secret): implement streaming secret scanner with byte offset tracking (#9264)
+  * fix(python): impove package name normalization  (#9290)
+  * feat(misconf): added audit config attribute (#9249)
+  * refactor(misconf): decouple input fs and track extracted files with fs references (#9281)
+  * test(misconf): remove BenchmarkCalculate using outdated check metadata (#9291)
+  * refactor: simplify Detect function signature (#9280)
+  * ci(helm): bump Trivy version to 0.65.0 for Trivy Helm Chart 0.17.0 (#9288)
+  * fix(fs): avoid shadowing errors in file.glob (#9286)
+  * test(misconf): move terraform scan tests to integration tests (#9271)
+  * test(misconf): drop gcp iam test covered by another case (#9285)
+  * chore(deps): bump to alpine from `3.21.3` to `3.21.4` (#9283)
+
 -------------------------------------------------------------------
 Fri Aug 15 09:16:06 UTC 2025 - Dirk Müller <dmueller@suse.com>
 
@@ -83,7 +136,8 @@ Wed Jul  9 15:48:08 UTC 2025 - Dirk Müller <dmueller@suse.com>
 -------------------------------------------------------------------
 Wed Jul 09 15:17:39 UTC 2025 - Dirk Müller <dmueller@suse.com>
 
-- Update to version 0.64.1 (bsc#1243633, CVE-2025-47291):
+- Update to version 0.64.1 (bsc#1243633, CVE-2025-47291,
+                           (bsc#1246730, CVE-2025-46569):
   * release: v0.64.1 [release/v0.64] (#9122)
   * fix(misconf): skip rewriting expr if attr is nil [backport: release/v0.64] (#9127)
   * fix(cli): Add more non-sensitive flags to telemetry [backport: release/v0.64] (#9124)

trivy.spec

@@ -17,7 +17,7 @@
 
 
 Name:           trivy
-Version:        0.65.0
+Version:        0.66.0
 Release:        0
 Summary:        A Simple and Comprehensive Vulnerability Scanner for Containers
 License:        Apache-2.0