Pull request for security update for trivy

Update patchinfo incident numbers [skip actions]
Merging
2025-11-26 12:37:55 +00:00 · 2025-11-19 09:24:16 +00:00 · 2025-11-19 09:23:57 +00:00 · 2025-11-19 09:23:34 +00:00 · 2025-11-17 16:30:01 +00:00 · 2025-11-14 10:02:45 +00:00
36 changed files with 1270 additions and 12 deletions
--- a/.gitmodules
+++ b/.gitmodules
@@ -26106,3 +26106,31 @@
 	path = perl-MCP
 	url = ../../pool/perl-MCP
 	branch = leap-16.0
+[submodule "fprintd"]
+	path = fprintd
+	url = ../../pool/fprintd
+	branch = leap-16.0
+[submodule "python-acme"]
+	path = python-acme
+	url = ../../pool/python-acme
+	branch = leap-16.0
+[submodule "python-certbot"]
+	path = python-certbot
+	url = ../../pool/python-certbot
+	branch = leap-16.0
+[submodule "python-certbot-nginx"]
+	path = python-certbot-nginx
+	url = ../../pool/python-certbot-nginx
+	branch = leap-16.0
+[submodule "python-ConfigArgParse"]
+	path = python-ConfigArgParse
+	url = ../../pool/python-ConfigArgParse
+	branch = leap-16.0
+[submodule "python-josepy"]
+	path = python-josepy
+	url = ../../pool/python-josepy
+	branch = leap-16.0
+[submodule "python-pyRFC3339"]
+	path = python-pyRFC3339
+	url = ../../pool/python-pyRFC3339
+	branch = leap-16.0
--- a/0Backports/Backports.productcompose
+++ b/0Backports/Backports.productcompose
@@ -271,6 +271,12 @@ packagesets:
  - update-test-retracted
  - update-test-security
  - update-test-trivial
+  - xen
+  - xen-devel
+  - xen-libs
+  - xen-doc-html
+  - xen-tools
+  - xen-tools-domU
  - yum-utils

 # TODO: unneeded Leap package per architecture
--- a/2
+++ b/2
--- a/2
+++ b/2
--- a/2
+++ b/2
--- a/1
+++ b/1
--- a/2
+++ b/2
--- a/2
+++ b/2
--- a/2
+++ b/2
--- a/2
+++ b/2
--- a/2
+++ b/2
--- a/patchinfo.20251016111300220521.93181000773252/_patchinfo
+++ b/patchinfo.20251016111300220521.93181000773252/_patchinfo
@@ -0,0 +1,17 @@
+<patchinfo incident="packagehub-11">
+  <issue tracker="bnc" id="1250487">VUL-0: CVE-2025-59682: python-Django,python-Django4: Potential partial directory-traversal via archive.extract()</issue>
+  <issue tracker="cve" id="2025-59682">VUL-0: CVE-2025-59682: python-Django,python-Django4: Potential partial directory-traversal via archive.extract()</issue>
+  <issue tracker="cve" id="2025-59681"/>
+  <issue tracker="bnc" id="1250485">VUL-0: CVE-2025-59681: python-Django,python-Django4: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB</issue>
+  <packager>mcalabkova</packager>
+  <rating>important</rating>
+  <category>security</category>
+  <summary>Security update for python-Django</summary>
+  <description>This update for python-Django fixes the following issues:
+
+- CVE-2025-59681: Fixed a potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB (boo#1250485)
+- CVE-2025-59682: Fixed a potential partial directory-traversal via archive.extract() (boo#1250487)
+</description>
+  <package>python-Django</package>
+  <seperate_build_arch/>
+</patchinfo>
--- a/patchinfo.20251023150135882810.90520734224245/_patchinfo
+++ b/patchinfo.20251023150135882810.90520734224245/_patchinfo
@@ -0,0 +1,11 @@
+<patchinfo incident="packagehub-9">
+  <packager>dgarcia</packager>
+  <rating>moderate</rating>
+  <category>optional</category>
+  <summary>Optional update for fprintd</summary>
+  <description>
+This update ships fprintd 1.94.4 to openSUSE Leap 16.0 and SLES Package Hub 16.0
+</description>
+  <package>fprintd</package>
+  <seperate_build_arch/>
+</patchinfo>
--- a/patchinfo.20251025182237146698.93181000773252/_patchinfo
+++ b/patchinfo.20251025182237146698.93181000773252/_patchinfo
@@ -0,0 +1,129 @@
+<patchinfo incident="packagehub-13">
+  <packager>os-autoinst-obs-workflow</packager>
+  <rating>moderate</rating>
+  <category>recommended</category>
+  <summary>Recommended update for openQA, os-autoinst</summary>
+  <description>This update for openQA, os-autoinst fixes the following issues:
+
+Changes in openQA:
+
+- Update to version 5.1761296552.ae7c17aa:
+  * Add tests for file_security_policy
+  * Pass parameter $is_userfile to log_url
+  * Remove redirect and serve files as attachments if necessary
+  * Serve files uploaded by tests via asset domain
+  * Use direct link to subdomain for the test assets
+  * Revert "Don't redirect to asset domain via /needles/ID/(image|json) route"
+  * Revert "Don't redirect screenshots, thumbs and needles to files_domain"
+
+- Update to version 5.1761228068.a3a7f84d:
+  * Dependency cron 2025-10-23
+
+- Update to version 5.1761037330.ad78558e:
+  * Avoid needless check for number of clones
+  * Avoid creation of `git_clone` tasks for jobs with empty `DISTRI`
+
+- Update to version 5.1760515610.a802d1dd:
+  * Lower the prio of archiving jobs to avoid piling up finalize jobs
+  * Add signatures in Schema::Result::ApiKeys
+
+- Update to version 5.1760245411.e3aeaaec:
+  * Dependency cron 2025-10-12
+
+- Update to version 5.1760108577.fd2f2a48:
+  * Log unavailability due to high load only as warning
+  * Filter job stats of scheduled products also by arch and build
+  * Document how to disable image optimizations
+  * Make image optimization errors stop the job producing an incomplete job
+  * Improve wording in description about job stats API
+  * Run `optipng` for real and handle errors if it fails
+
+- Update to version 5.1759912962.689b31ed:
+  * Avoid failing `obs_rsync_run` jobs when restarting `openqa-gru.service`
+
+- Update to version 5.1759834744.06a7028a:
+  * parser: ktap: Return earlier if subtest result is SKIP
+  * parser: ktap: Fallback to subtest index if name is not available
+
+- Update to version 5.1759440640.bb989cab:
+  * Don't redirect to asset domain via /needles/ID/(image|json) route
+
+- Update to version 5.1759402042.49e912c3:
+  * Introduce array job settings
+  * Retry `obs_rsync_update_*` tasks if Gru service terminates
+
+- Update to version 5.1759329378.3b8e8685:
+  * Reduce the number of required checks for Mergify again
+  * Ensure a failing cache service is seen as such by the worker/scheduler
+
+- Update to version 5.1759248257.70b23b32:
+  * Increase number of successful checks in Mergify config again
+  * Disable Helm Chart CI checks temporarily
+  * Consider all jobs for cleanup, not just jobs that were executed
+  * Verify job deletion when dependent job present
+
+- Update to version 5.1759149505.49c40b0b:
+  * Use always the latest PostgreSQL image in Compose and documentation
+  * Update the PostgreSQL version in the contributing documentation
+  * Update PostgreSQL data path in Docker Compose file after updating to v18
+  * Specify PostgreSQL version in Docker Compose configuration explicitly
+  * mergify: Allow more time for dependabot update reaction
+  * Remove version property from docker-compose
+  * README: Fix openQA badge after switch to UEFI
+  * build(deps-dev): bump eslint from 9.35.0 to 9.36.0
+
+- Update to version 5.1758910696.7549bb98:
+  * Replace argument assignment with signatures on ObsRsync/Task
+  * Enable automatic dependabot updates again after improvements
+  * docs: Add instructions for a continuous dashboard setup
+  * Replace argument assignment with signatures Folders package
+  * Fully cover WebAPI::Plugin::ObsRsync::Controller::Folders
+  * script: Also use OPENQA_WEBUI_MODE for related services
+
+- Update to version 5.1758814503.03d923a4:
+  * Use Mojo::File in Worker for is_qemu_running
+  * Use Mojo::File in Worker for meminfo
+  * Document archiving of important jobs
+
+- Update to version 5.1758729450.b88c0b40:
+  * Reject jobs if worker is broken when receiving a new job
+
+- Update to version 5.1758711845.e5c02221:
+  * script: Allow to configure openQA mode
+  * t: run at least once Memorylimit register with max_rss_limit &gt; 0
+  * Replace argument assignation with signatures on MemoryLimit
+
+Changes in os-autoinst:
+
+- Update to version 5.1761036042.c43e4ab:
+  * Update perltidy
+  * Allow redirects in needle NeedleDownloader
+  * Don't overwrite firewall xml
+  * Add UEFI support for ipxe kernel boot
+  * os-autoinst-setup-multi-machine: Simplify determine_ethernet_interface
+
+- Update to version 5.1759328765.e7438f7:
+  * Allow redirects in needle NeedleDownloader
+  * Don't overwrite firewall xml
+  * Add UEFI support for ipxe kernel boot
+  * t: Use consistent Mojo::File in 08-autotest as well
+  * os-autoinst-setup-multi-machine: Simplify determine_ethernet_interface
+
+- Update to version 5.1759134946.e08d7c7:
+  * Add UEFI support for ipxe kernel boot
+  * t: Use consistent Mojo::File in 08-autotest as well
+  * os-autoinst-setup-multi-machine: Simplify determine_ethernet_interface
+  * os-autoinst-setup-multi-machine: Only call zypper when necessary
+  * os-autoinst-setup-multi-machine: Improve network interface check
+</description>
+  <package>openQA</package>
+  <package>openQA:openQA-devel-test</package>
+  <package>openQA:openQA-test</package>
+  <package>openQA:openQA-worker-test</package>
+  <package>openQA:openQA-client-test</package>
+  <package>os-autoinst</package>
+  <package>os-autoinst:os-autoinst-test</package>
+  <package>os-autoinst:os-autoinst-devel-test</package>
+  <package>os-autoinst:os-autoinst-openvswitch-test</package>
+  <seperate_build_arch/>
+</patchinfo>
--- a/patchinfo.20251025182836794674.93181000773252/_patchinfo
+++ b/patchinfo.20251025182836794674.93181000773252/_patchinfo
@@ -0,0 +1,28 @@
+<patchinfo incident="packagehub-18">
+  <packager>jsulig</packager>
+  <rating>moderate</rating>
+  <category>recommended</category>
+  <summary>Recommended update for amarok</summary>
+  <description>This update for amarok fixes the following issues:
+
+Changes in amarok:
+
+- Update to version 3.3.1
+  * Enable saving and loading script console items, autocompletion
+    in script console, and re-enable some more scripting functionality
+  * Convert the remaining main UI toolbuttons to use icons from theme
+  * Clear out remnants of the now-discontinued MusicDNS service
+  * Fix example permission grant command in database settings (kde#386004)
+  * Fix equalizer gains not updating when selecting some presets (kde#463908)
+  * Fix continuing playback after timecoded tracks (cue files etc, (kde#270003)
+  * Fix MusicBrainz search
+  * Properly start CD playback if Amarok is not already running (kde#503310)
+  * Also transmit embedded cover art through MPRIS (kde#357620)
+  * Don't show transcoding dialog after canceling download (kde#275840)
+  * Load network information earlier to avoid crashes on startup (kde#507497)
+  * Try to export as-compatible-as-possible playlist files (kde#507329)
+  * Fix some random crashes during playback
+
+</description>
+  <package>amarok</package>
+</patchinfo>
--- a/patchinfo.20251027101618101208.187004354831441/_patchinfo
+++ b/patchinfo.20251027101618101208.187004354831441/_patchinfo
@@ -0,0 +1,32 @@
+<patchinfo incident="packagehub-16">
+  <packager>miska</packager>
+  <rating>moderate</rating>
+  <category>recommended</category>
+  <summary>Recommended update for knot</summary>
+  <description>This update for knot fixes the following issues:
+
+Changes in knot:
+
+- disable quic in stable releases due to the missing libraries
+
+update to version 3.5.1, see
+
+  https://www.knot-dns.cz/2025-10-16-version-351.html
+
+update to version 3.5.0, see
+
+  https://www.knot-dns.cz/2025-09-18-version-350.html
+
+update to version 3.4.8, see
+
+  https://www.knot-dns.cz/2025-07-29-version-348.html
+
+Use the libngtcp2_crypto_gnutls-devel instead of libngtcp2-devel
+to account for the openssl and gnutls devel files split in ngtcp2.
+
+update to version 3.4.7, see
+
+  https://www.knot-dns.cz/2025-06-04-version-347.html
+</description>
+  <package>knot</package>
+</patchinfo>
--- a/patchinfo.20251027101939269288.187004354831441/_patchinfo
+++ b/patchinfo.20251027101939269288.187004354831441/_patchinfo
@@ -0,0 +1,48 @@
+<patchinfo incident="packagehub-10">
+  <issue tracker="cve" id="2025-10527">This vulnerability affects Firefox &lt; 143, Firefox ESR &lt; 140.3, Thunderbird &lt; 143, and Thunderbird &lt; 140.3.</issue>
+  <issue tracker="cve" id="2025-10536">This vulnerability affects Firefox &lt; 143, Firefox ESR &lt; 140.3, Thunderbird &lt; 143, and Thunderbird &lt; 140.3.</issue>
+  <issue tracker="cve" id="2025-10528">This vulnerability affects Firefox &lt; 143, Firefox ESR &lt; 140.3, Thunderbird &lt; 143, and Thunderbird &lt; 140.3.</issue>
+  <issue tracker="cve" id="2025-10537">Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox &lt; 143, Firefox ESR &lt; 140.3, Thunderbird &lt; 143, and Thunderbird &lt; 140.3.</issue>
+  <issue tracker="cve" id="2025-10529">This vulnerability affects Firefox &lt; 143, Firefox ESR &lt; 140.3, Thunderbird &lt; 143, and Thunderbird &lt; 140.3.</issue>
+  <issue tracker="cve" id="2025-10532">This vulnerability affects Firefox &lt; 143, Firefox ESR &lt; 140.3, Thunderbird &lt; 143, and Thunderbird &lt; 140.3.</issue>
+  <issue tracker="cve" id="2025-10533">This vulnerability affects Firefox &lt; 143, Firefox ESR &lt; 115.28, Firefox ESR &lt; 140.3, Thunderbird &lt; 143, and Thunderbird &lt; 140.3.</issue>
+  <issue tracker="bnc" id="1249391">VUL-0: MozillaFirefox / MozillaThunderbird: update to 143.0 and 140.3esr</issue>
+  <packager>Yoshio_Sato</packager>
+  <rating>important</rating>
+  <category>security</category>
+  <summary>Security update for MozillaThunderbird</summary>
+  <description>This update for MozillaThunderbird fixes the following issues:
+
+Changes in MozillaThunderbird:
+
+Mozilla Thunderbird 140.3.0 ESR:
+
+  * Right-clicking 'List-ID' -&gt; 'Unsubscribe' created double encoded
+    draft subject
+  * Thunderbird could crash on startup
+  * Thunderbird could crash when importing mail
+  * Opening Website header link in RSS feed incorrectly re-encoded
+    URL parameters
+  MFSA 2025-78 (bsc#1249391)
+  * CVE-2025-10527
+    Sandbox escape due to use-after-free in the Graphics:
+    Canvas2D component
+  * CVE-2025-10528
+    Sandbox escape due to undefined behavior, invalid pointer in
+    the Graphics: Canvas2D component
+  * CVE-2025-10529
+    Same-origin policy bypass in the Layout component
+  * CVE-2025-10532
+    Incorrect boundary conditions in the JavaScript: GC component
+  * CVE-2025-10533
+    Integer overflow in the SVG component
+  * CVE-2025-10536
+    Information disclosure in the Networking: Cache component
+  * CVE-2025-10537
+    Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
+    ESR 140.3, Firefox 143 and Thunderbird 143
+
+</description>
+  <package>MozillaThunderbird</package>
+  <seperate_build_arch/>
+</patchinfo>
--- a/patchinfo.20251027103924170417.187004354831441/_patchinfo
+++ b/patchinfo.20251027103924170417.187004354831441/_patchinfo
@@ -0,0 +1,27 @@
+<patchinfo incident="packagehub-17">
+  <issue tracker="cve" id="2025-59438">VUL-0: CVE-2025-59438: TRACKERBUG: mbedtls: padding oracle attack possible through timing of cipher error reporting</issue>
+  <packager>dheidler</packager>
+  <rating>moderate</rating>
+  <category>security</category>
+  <summary>Security update for micropython</summary>
+  <description>This update for micropython fixes the following issues:
+
+Changes in micropython:
+
+- Build with mbedtls-3.6.5 instead of bundled 3.6.2 to fix CVE-2025-59438
+
+Version 1.26.0:
+
+  * Added machine.I2CTarget for creating I2C target devices on multiple ports.
+  * New MCU support: STM32N6xx (800 MHz, ML accel) &amp; ESP32-C2 (WiFi + BLE).
+  * Major float accuracy boost (~28% → ~98%), constant folding in compiler.
+  * Optimized native/Viper emitters; reduced heap use for slices.
+  * Time functions standardized (1970–2099); new boards across ESP32, SAMD, STM32, Zephyr.
+  * ESP32: ESP-IDF 5.4.2, flash auto-detect, PCNT class, LAN8670 PHY.
+  * RP2: compressed errors, better lightsleep, hard IRQ timers.
+  * Zephyr v4.0.0: PWM, SoftI2C/SPI, BLE runtime services, boot.py/main.py support.
+  * mpremote adds fs tree, improved df, portable config paths.
+  * Updated lwIP, LittleFS, libhydrogen, stm32lib; expanded hardware/CI tests.
+</description>
+  <package>micropython</package>
+</patchinfo>
--- a/patchinfo.20251030080843825030.187004354831441/_patchinfo
+++ b/patchinfo.20251030080843825030.187004354831441/_patchinfo
@@ -0,0 +1,56 @@
+<patchinfo incident="packagehub-12">
+  <issue tracker="cve" id="2025-12441"/>
+  <issue tracker="cve" id="2025-12429"/>
+  <issue tracker="cve" id="2025-12431"/>
+  <issue tracker="cve" id="2025-12444"/>
+  <issue tracker="cve" id="2025-12428"/>
+  <issue tracker="cve" id="2025-12438"/>
+  <issue tracker="cve" id="2025-12435"/>
+  <issue tracker="cve" id="2025-12437"/>
+  <issue tracker="cve" id="2025-12443"/>
+  <issue tracker="cve" id="2025-12430"/>
+  <issue tracker="cve" id="2025-12440"/>
+  <issue tracker="cve" id="2025-12445"/>
+  <issue tracker="cve" id="2025-12446"/>
+  <issue tracker="cve" id="2025-12432"/>
+  <issue tracker="cve" id="2025-12436"/>
+  <issue tracker="cve" id="2025-12434"/>
+  <issue tracker="cve" id="2025-54874">VUL-0: CVE-2025-54874: TRACKERBUG: openjpeg: missing error check can lead to the use of an uninitialized pointer and cause an out-of-bounds heap</issue>
+  <issue tracker="cve" id="2025-12433"/>
+  <issue tracker="bnc" id="1252881">VUL-0: chromium: release 142.0.7444.59</issue>
+  <issue tracker="cve" id="2025-12439"/>
+  <issue tracker="cve" id="2025-12447"/>
+  <packager>AndreasStieger</packager>
+  <rating>important</rating>
+  <category>security</category>
+  <summary>Security update for chromium</summary>
+  <description>This update for chromium fixes the following issues:
+
+Chromium 142.0.7444.59, the stable channel promotion of 142.
+
+Security fixes (boo#1252881):
+
+  * CVE-2025-12428: Type Confusion in V8
+  * CVE-2025-12429: Inappropriate implementation in V8
+  * CVE-2025-12430: Object lifecycle issue in Media
+  * CVE-2025-12431: Inappropriate implementation in Extensions
+  * CVE-2025-12432: Race in V8
+  * CVE-2025-12433: Inappropriate implementation in V8
+  * CVE-2025-12434: Race in Storage
+  * CVE-2025-12435: Incorrect security UI in Omnibox
+  * CVE-2025-12436: Policy bypass in Extensions
+  * CVE-2025-12437: Use after free in PageInfo
+  * CVE-2025-12438: Use after free in Ozone
+  * CVE-2025-12439: Inappropriate implementation in App-Bound Encryption
+  * CVE-2025-12440: Inappropriate implementation in Autofill
+  * CVE-2025-12441: Out of bounds read in V8
+  * CVE-2025-12443: Out of bounds read in WebXR
+  * CVE-2025-12444: Incorrect security UI in Fullscreen UI
+  * CVE-2025-12445: Policy bypass in Extensions
+  * CVE-2025-12446: Incorrect security UI in SplitView
+  * CVE-2025-12447: Incorrect security UI in Omnibox
+
+</description>
+  <package>chromium</package>
+  <seperate_build_arch/>
+</patchinfo>
--- a/patchinfo.20251030134459405257.187004354831441/_patchinfo
+++ b/patchinfo.20251030134459405257.187004354831441/_patchinfo
@@ -0,0 +1,24 @@
+<patchinfo incident="packagehub-14">
+  <packager>adrianSuSE</packager>
+  <rating>moderate</rating>
+  <category>recommended</category>
+  <summary>Recommended update for product-composer</summary>
+  <description>This update for product-composer fixes the following issues:
+
+Update to version 0.6.16:
+
+  - merge updateinfo's with same id into one
+  - error out on updateinfo with same id, but non-mergable content
+
+Update to version 0.6.15:
+
+  * Support updateinfo handling in arch specific meta data
+
+Update to version 0.6.14:
+
+  * option to disable joliet extensions on media
+  * no joliet extensions on source and debug media anymore
+</description>
+  <package>product-composer</package>
+  <seperate_build_arch/>
+</patchinfo>
--- a/patchinfo.20251104153107003768.187004354831441/_patchinfo
+++ b/patchinfo.20251104153107003768.187004354831441/_patchinfo
@@ -0,0 +1,63 @@
+<patchinfo incident="packagehub-15">
+  <issue tracker="cve" id="2025-11710"/>
+  <issue tracker="cve" id="2025-11709"/>
+  <issue tracker="cve" id="2025-11715"/>
+  <issue tracker="bnc" id="1247774">[SLFO:Main] [SLES16.0] MozillaFirefox fails to build on s390x</issue>
+  <issue tracker="cve" id="2025-11712"/>
+  <issue tracker="cve" id="2025-11708"/>
+  <issue tracker="cve" id="2025-11714"/>
+  <issue tracker="cve" id="2025-11713"/>
+  <issue tracker="cve" id="2025-11711"/>
+  <issue tracker="bnc" id="1251263">VUL-0: MozillaFirefox / MozillaThunderbird: update to 144.0 and 140.4esr</issue>
+  <packager>MSirringhaus</packager>
+  <rating>moderate</rating>
+  <category>security</category>
+  <summary>Security update for MozillaThunderbird</summary>
+  <description>This update for MozillaThunderbird fixes the following issues:
+
+Mozilla Thunderbird 140.4:
+
+  * changed: Account Hub is now disabled by default for second
+    email account
+  * changed: Flatpak runtime has been updated to Freedesktop SDK
+    24.08
+  * fixed: Users could not read mail signed with OpenPGP v6 and
+    PQC keys
+  * fixed: Image preview in Insert Image dialog failed with CSP
+    error for web resources
+  * fixed: Emptying trash on exit did not work with some
+    providers
+  * fixed: Thunderbird could crash when applying filters
+  * fixed: Users were unable to override expired mail server
+    certificate
+  * fixed: Opening Website header link in RSS feed incorrectly
+    re-encoded URL parameters
+  * fixed: Security fixes
+
+MFSA 2025-85 (bsc#1251263):
+
+  * CVE-2025-11708
+    Use-after-free in MediaTrackGraphImpl::GetInstance()
+  * CVE-2025-11709
+    Out of bounds read/write in a privileged process triggered by
+    WebGL textures
+  * CVE-2025-11710
+    Cross-process information leaked due to malicious IPC
+    messages
+  * CVE-2025-11711
+    Some non-writable Object properties could be modified
+  * CVE-2025-11712
+    An OBJECT tag type attribute overrode browser behavior on web
+    resources without a content-type
+  * CVE-2025-11713
+    Potential user-assisted code execution in “Copy as cURL”
+    command
+  * CVE-2025-11714
+    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
+    140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
+  * CVE-2025-11715
+    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
+    ESR 140.4, Firefox 144 and Thunderbird 144
+</description>
+  <package>MozillaThunderbird</package>
+</patchinfo>
--- a/patchinfo.20251106083153138720.187004354831441/_patchinfo
+++ b/patchinfo.20251106083153138720.187004354831441/_patchinfo
@@ -0,0 +1,23 @@
+<patchinfo incident="packagehub-19">
+  <issue tracker="bnc" id="1253089">VUL-0: chromium: release 142.0.7444.134</issue>
+  <issue tracker="cve" id="2025-12727"/>
+  <issue tracker="cve" id="2025-12725"/>
+  <issue tracker="cve" id="2025-12729">VUL-0: chromium: release 142.0.7444.134</issue>
+  <issue tracker="cve" id="2025-12728"/>
+  <issue tracker="cve" id="2025-12726"/>
+  <packager>AndreasStieger</packager>
+  <rating>moderate</rating>
+  <category>security</category>
+  <summary>Security update for chromium</summary>
+  <description>This update for chromium fixes the following issues:
+
+Chromium 142.0.7444.134 (boo#1253089):
+
+  * CVE-2025-12725: Out of bounds write in WebGPU
+  * CVE-2025-12726: Inappropriate implementation in Views
+  * CVE-2025-12727: Inappropriate implementation in V8
+  * CVE-2025-12728: Inappropriate implementation in Omnibox
+  * CVE-2025-12729: Inappropriate implementation in Omnibox
+</description>
+  <package>chromium</package>
+</patchinfo>
--- a/patchinfo.20251111094408723997.187004354831441/_patchinfo
+++ b/patchinfo.20251111094408723997.187004354831441/_patchinfo
@@ -0,0 +1,14 @@
+<patchinfo incident="packagehub-20">
+  <packager>adrianSuSE</packager>
+  <rating>moderate</rating>
+  <category>recommended</category>
+  <summary>Recommended update for product-composer</summary>
+  <description>This update for product-composer fixes the following issues:
+
+Update to version 0.6.17:
+
+  - fix multiarch media handling of updateinfo id's
+</description>
+  <package>product-composer</package>
+  <seperate_build_arch/>
+</patchinfo>
--- a/patchinfo.20251112154630847363.187004354831441/_patchinfo
+++ b/patchinfo.20251112154630847363.187004354831441/_patchinfo
@@ -0,0 +1,16 @@
+<patchinfo incident="packagehub-21">
+  <issue tracker="bnc" id="1253267">VUL-0: chromium: release 142.0.7444.162</issue>
+  <issue tracker="cve" id="2025-13042">VUL-0: chromium: release 142.0.7444.162</issue>
+  <packager>AndreasStieger</packager>
+  <rating>important</rating>
+  <category>security</category>
+  <summary>Security update for chromium</summary>
+  <description>This update for chromium fixes the following issues:
+
+Chromium 142.0.7444.162 (boo#1253267):
+
+  * CVE-2025-13042: Inappropriate implementation in V8
+</description>
+  <package>chromium</package>
+  <seperate_build_arch/>
+</patchinfo>
--- a/patchinfo.20251114110535882810.90520734224245/_patchinfo
+++ b/patchinfo.20251114110535882810.90520734224245/_patchinfo
@@ -0,0 +1,16 @@
+<patchinfo incident="packagehub-22">
+  <packager>AndreasStieger</packager>
+  <rating>important</rating>
+  <category>security</category>
+  <summary>Security update for certbot</summary>
+  <description>This update for certbot fixes the following issues:
+
+This update adds the certbot stack. (python modules: ConfigArgParse, acme, certbot, certbot-nginx, josepy, pyRFC3339).
+</description>
+<package>python-ConfigArgParse</package>
+<package>python-acme</package>
+<package>python-certbot</package>
+<package>python-certbot-nginx</package>
+<package>python-josepy</package>
+<package>python-pyRFC3339</package>
+</patchinfo>
--- a/patchinfo.20251126122954168954.187004354831441/_patchinfo
+++ b/patchinfo.20251126122954168954.187004354831441/_patchinfo
@@ -0,0 +1,713 @@
+<patchinfo>
+  <issue tracker="bnc" id="1250625">VUL-0: CVE-2025-11065: trivy: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs</issue>
+  <issue tracker="cve" id="2025-30204">VUL-0: CVE-2025-30204: TRACKERBUG: github.com/golang-jwt/jwt/v4,github.com/golang-jwt/jwt/v5: jwt-go allows excessive memory allocation during header parsing</issue>
+  <issue tracker="cve" id="2024-3817">VUL-0: CVE-2024-3817: TRACKERBUG: hashicorp/go-getter: argument injection when fetching remote default git branches</issue>
+  <issue tracker="bnc" id="1234512">VUL-0: CVE-2024-45337: trivy: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto</issue>
+  <issue tracker="cve" id="2025-46569">VUL-0: CVE-2025-46569: TRACKERBUG: github.com/open-policy-agent/opa/server: HTTP request path can be crafted to inject Rego code into a constructed query when a virtual document is requested through the Data API</issue>
+  <issue tracker="bnc" id="1240466">VUL-0: CVE-2025-30204: trivy: github.com/golang-jwt/jwt/v4,github.com/golang-jwt/jwt/v5: jwt-go allows excessive memory allocation during header parsing</issue>
+  <issue tracker="cve" id="2024-51744">VUL-0: CVE-2024-51744: TRACKERBUG: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations</issue>
+  <issue tracker="cve" id="2025-53547">VUL-0: CVE-2025-53547: TRACKERBUG: helm,helm.sh/helm/v3: Helm Chart Code Execution</issue>
+  <issue tracker="bnc" id="1232948">VUL-0: CVE-2024-51744: trivy: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt</issue>
+  <issue tracker="cve" id="2025-22872">VUL-0: CVE-2025-22872: TRACKERBUG: golang.org/x/net/html: tags incorrectly interpreted by tokenizer can lead to content being placed in the wrong scope during</issue>
+  <issue tracker="cve" id="2025-27144">VUL-0: CVE-2025-27144: TRACKERBUG: gopkg.in/square/go-jose.v2,gopkg.in/go-jose/go-jose.v2,github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Go JOSE's Parsing Vulnerable to Denial of Service</issue>
+  <issue tracker="bnc" id="1239225">VUL-0: CVE-2025-22868: trivy: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2</issue>
+  <issue tracker="cve" id="2025-47291">VUL-0: CVE-2025-47291: TRACKERBUG: github.com/containerd/containerd/v2,containerd: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.</issue>
+  <issue tracker="cve" id="2025-58058">VUL-0: CVE-2025-58058: TRACKERBUG: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory</issue>
+  <issue tracker="cve" id="2024-45338">VUL-0: CVE-2024-45338: TRACKERBUG: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content</issue>
+  <issue tracker="bnc" id="1243633">VUL-0: CVE-2025-47291: trivy: github.com/containerd/containerd/v2: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.</issue>
+  <issue tracker="bnc" id="1235265">VUL-0: CVE-2024-45338: trivy: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content</issue>
+  <issue tracker="cve" id="2025-21613">VUL-0: CVE-2025-21613: TRACKERBUG: github.com/go-git/go-git/v5: argument injection via the URL field</issue>
+  <issue tracker="bnc" id="1241724">VUL-0: CVE-2025-22872: trivy: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction</issue>
+  <issue tracker="cve" id="2025-22868">VUL-0: CVE-2025-22868: TRACKERBUG: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2</issue>
+  <issue tracker="bnc" id="1246151">VUL-0: CVE-2025-53547: trivy: helm.sh/helm/v3: Helm Chart Code Execution</issue>
+  <issue tracker="bnc" id="1227010">VUL-0: CVE-2024-3817: trivy: hashicorp/go-getter: argument injection when fetching remote default git branches</issue>
+  <issue tracker="bnc" id="1248897">VUL-0: CVE-2025-58058: trivy: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory</issue>
+  <issue tracker="cve" id="2025-11065">VUL-0: TRACKERBUG: CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs</issue>
+  <issue tracker="bnc" id="1248937">VUL-0: CVE-2025-58058: hauler: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory</issue>
+  <issue tracker="bnc" id="1237618">VUL-0: CVE-2025-27144: trivy: gopkg.in/go-jose/go-jose.v2: Go JOSE's Parsing Vulnerable to Denial of Service</issue>
+  <issue tracker="bnc" id="1239385">VUL-0: CVE-2025-22869: trivy: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh</issue>
+  <issue tracker="cve" id="2025-22869">VUL-0: CVE-2025-22869: TRACKERBUG: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh</issue>
+  <issue tracker="cve" id="2025-21614">CVE-2025-21614 go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies</issue>
+  <issue tracker="bnc" id="1246730">VUL-0: CVE-2025-46569: trivy: github.com/open-policy-agent/opa: HTTP request path can be crafted to inject Rego code into a constructed query when a virtual document is requested through the Data API</issue>
+  <issue tracker="cve" id="2024-45337">VUL-0: CVE-2024-45337: TRACKERBUG: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto</issue>
+  <packager>dirkmueller</packager>
+  <rating>important</rating>
+  <category>security</category>
+  <summary>Security update for trivy</summary>
+  <description>This update for trivy fixes the following issues:
+
+Changes in trivy:
+
+Update to version 0.67.2 (bsc#1250625, CVE-2025-11065, bsc#1248897, CVE-2025-58058):
+
+  * fix: Use `fetch-level: 1` to check out trivy-repo in the release workflow [backport: release/v0.67] (#9638)
+  * fix: restore compatibility for google.protobuf.Value [backport: release/v0.67] (#9631)
+  * fix: using SrcVersion instead of Version for echo detector [backport: release/v0.67] (#9629)
+  * fix: add `buildInfo` for `BlobInfo` in `rpc` package [backport: release/v0.67] (#9615)
+  * fix(vex): don't use reused BOM [backport: release/v0.67] (#9612)
+  * fix(vex): don't  suppress vulns for packages with infinity loop (#9465)
+  * fix(aws): use `BuildableClient` insead of `xhttp.Client` (#9436)
+  * refactor(misconf): replace github.com/liamg/memoryfs with internal mapfs and testing/fstest (#9282)
+  * docs: clarify inline ignore limitations for resource-less checks (#9537)
+  * fix(k8s): disable parallel traversal with fs cache for k8s images (#9534)
+  * fix(misconf): handle tofu files in module detection (#9486)
+  * feat(seal): add seal support (#9370)
+  * docs: fix modules path and update code example (#9539)
+  * fix: close file descriptors and pipes on error paths (#9536)
+  * feat: add documentation URL for database lock errors (#9531)
+  * fix(db): Dowload database when missing but metadata still exists (#9393)
+  * feat(cloudformation): support default values and list results in Fn::FindInMap (#9515)
+  * fix(misconf): unmark cty values before access (#9495)
+  * feat(cli): change --list-all-pkgs default to true (#9510)
+  * fix(nodejs): parse workspaces as objects for package-lock.json files (#9518)
+  * refactor(fs): use underlyingPath to determine virtual files more reliably (#9302)
+  * refactor: remove google/wire dependency and implement manual DI (#9509)
+  * chore(deps): bump the aws group with 6 updates (#9481)
+  * chore(deps): bump the common group across 1 directory with 24 updates (#9507)
+  * fix(misconf): wrap legacy ENV values in quotes to preserve spaces (#9497)
+  * docs: move info about `detection priority` into coverage section (#9469)
+  * feat(sbom): added support for CoreOS (#9448)
+  * fix(misconf): strip build metadata suffixes from image history (#9498)
+  * feat(cyclonedx): preserve SBOM structure when scanning SBOM files with vulnerability updates (#9439)
+  * docs: Fix typo in terraform docs (#9492)
+  * feat(redhat): add os-release detection for RHEL-based images (#9458)
+  * ci(deps): add 3-day cooldown period for Dependabot updates (#9475)
+  * refactor: migrate from go-json-experiment to encoding/json/v2 (#9422)
+  * fix(vuln): compare `nuget` package names in lower case (#9456)
+  * chore: Update release flow to include chocolatey (#9460)
+  * docs: document eol supportability (#9434)
+  * docs(report): add nuanses about secret/license scanner in summary table (#9442)
+  * ci: use environment variables in GitHub Actions for improved security (#9433)
+  * chore: bump Go to 1.24.7 (#9435)
+  * fix(nodejs): use snapshot string as `Package.ID` for pnpm packages (#9330)
+  * ci(helm): bump Trivy version to 0.66.0 for Trivy Helm Chart 0.18.0 (#9425)
+
+Update to version 0.66.0 (bsc#1248937, CVE-2025-58058):
+
+  * chore(deps): bump the aws group with 7 updates (#9419)
+  * refactor(secret): clarify secret scanner messages (#9409)
+  * fix(cyclonedx): handle multiple license types (#9378)
+  * fix(repo): sanitize git repo URL before inserting into report metadata (#9391)
+  * test: add HTTP basic authentication to git test server (#9407)
+  * fix(sbom): add support for `file` component type of `CycloneDX` (#9372)
+  * fix(misconf): ensure module source is known (#9404)
+  * ci: migrate GitHub Actions from version tags to SHA pinning (#9405)
+  * fix: create temp file under composite fs dir (#9387)
+  * chore(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#9403)
+  * refactor: switch to stable azcontainerregistry SDK package (#9319)
+  * chore(deps): bump the common group with 7 updates (#9382)
+  * refactor(misconf): migrate from custom Azure JSON parser (#9222)
+  * fix(repo): preserve RepoMetadata on FS cache hit (#9389)
+  * refactor(misconf): use atomic.Int32 (#9385)
+  * chore(deps): bump the aws group with 6 updates (#9383)
+  * docs: Fix broken link to "Built-in Checks" (#9375)
+  * fix(plugin): don't remove plugins when updating index.yaml file (#9358)
+  * fix: persistent flag option typo (#9374)
+  * chore(deps): bump the common group across 1 directory with 26 updates (#9347)
+  * fix(image): use standardized HTTP client for ECR authentication (#9322)
+  * refactor: export `systemFileFiltering` Post Handler (#9359)
+  * docs: update links to Semaphore pages (#9352)
+  * fix(conda): memory leak by adding closure method for `package.json` file (#9349)
+  * feat: add timeout handling for cache database operations (#9307)
+  * fix(misconf): use correct field log_bucket instead of target_bucket in gcp bucket (#9296)
+  * fix(misconf): ensure ignore rules respect subdirectory chart paths (#9324)
+  * chore(deps): bump alpine from 3.21.4 to 3.22.1 (#9301)
+  * feat(terraform): use .terraform cache for remote modules in plan scanning (#9277)
+  * chore: fix some function names in comment (#9314)
+  * chore(deps): bump the aws group with 7 updates (#9311)
+  * docs: add explanation for how to use non-system certificates (#9081)
+  * chore(deps): bump the github-actions group across 1 directory with 2 updates (#8962)
+  * fix(misconf): preserve original paths of remote submodules from .terraform (#9294)
+  * refactor(terraform): make Scan method of Terraform plan scanner private (#9272)
+  * fix: suppress debug log for context cancellation errors (#9298)
+  * feat(secret): implement streaming secret scanner with byte offset tracking (#9264)
+  * fix(python): impove package name normalization  (#9290)
+  * feat(misconf): added audit config attribute (#9249)
+  * refactor(misconf): decouple input fs and track extracted files with fs references (#9281)
+  * test(misconf): remove BenchmarkCalculate using outdated check metadata (#9291)
+  * refactor: simplify Detect function signature (#9280)
+  * ci(helm): bump Trivy version to 0.65.0 for Trivy Helm Chart 0.17.0 (#9288)
+  * fix(fs): avoid shadowing errors in file.glob (#9286)
+  * test(misconf): move terraform scan tests to integration tests (#9271)
+  * test(misconf): drop gcp iam test covered by another case (#9285)
+  * chore(deps): bump to alpine from `3.21.3` to `3.21.4` (#9283)
+
+Update to version 0.65.0:
+
+  * fix(cli): ensure correct command is picked by telemetry (#9260)
+  * feat(flag): add schema validation for `--server` flag (#9270)
+  * chore(deps): bump github.com/docker/docker from 28.3.2+incompatible to 28.3.3+incompatible (#9274)
+  * ci: skip undefined labels in discussion triage action (#9175)
+  * feat(repo): add git repository metadata to reports (#9252)
+  * fix(license): handle WITH operator for `LaxSplitLicenses` (#9232)
+  * chore: add modernize tool integration for code modernization (#9251)
+  * fix(secret): add UTF-8 validation in secret scanner to prevent protobuf marshalling errors (#9253)
+  * chore: implement process-safe temp file cleanup (#9241)
+  * fix: prevent graceful shutdown message on normal exit (#9244)
+  * fix(misconf): correctly parse empty port ranges in google_compute_firewall (#9237)
+  * feat: add graceful shutdown with signal handling (#9242)
+  * chore: update template URL for brew formula (#9221)
+  * test: add end-to-end testing framework with image scan and proxy tests (#9231)
+  * refactor(db): use `Getter` interface with `GetParams` for trivy-db sources (#9239)
+  * ci: specify repository for `gh cache delete` in canary worklfow (#9240)
+  * ci: remove invalid `--confirm` flag from `gh cache delete` command in canary builds (#9236)
+  * fix(misconf): fix log bucket in schema (#9235)
+  * chore(deps): bump the common group across 1 directory with 24 updates (#9228)
+  * ci: move runner.os context from job-level env to step-level in canary workflow (#9233)
+  * chore(deps): bump up Trivy-kubernetes to v0.9.1 (#9214)
+  * feat(misconf): added logging and versioning to the gcp storage bucket (#9226)
+  * fix(server): add HTTP transport setup to server mode (#9217)
+  * chore: update the rpm download Update (#9202)
+  * feat(alma): add AlmaLinux 10 support (#9207)
+  * fix(nodejs): don't use prerelease logic for compare npm constraints  (#9208)
+  * fix(rootio): fix severity selection (#9181)
+  * fix(sbom): merge in-graph and out-of-graph OS packages in scan results (#9194)
+  * fix(cli): panic: attempt to get os.Args[1] when len(os.Args) &lt; 2 (#9206)
+  * fix(misconf): correctly adapt azure storage account (#9138)
+  * feat(misconf): add private ip google access attribute to subnetwork (#9199)
+  * feat(report): add CVSS vectors in sarif report (#9157)
+  * fix(terraform): `for_each` on a map returns a resource for every key (#9156)
+  * fix: supporting .egg-info/METADATA in python.Packaging analyzer (#9151)
+  * chore: migrate protoc setup from Docker to buf CLI (#9184)
+  * ci: delete cache after artifacts upload in canary workflow (#9177)
+  * refactor: remove aws flag helper message (#9080)
+  * ci: use gh pr view to get PR number for forked repositories in auto-ready workflow (#9183)
+  * ci: add auto-ready-for-review workflow (#9179)
+  * feat(image): add Docker context resolution (#9166)
+  * ci: optimize golangci-lint performance with cache-based strategy (#9173)
+  * feat: add HTTP request/response tracing support (#9125)
+  * fix(aws): update amazon linux 2 EOL date (#9176)
+  * chore: Update release workflow to trigger version updates (#9162)
+  * chore(deps): bump helm.sh/helm/v3 from 3.18.3 to 3.18.4 (#9164)
+  * fix: also check `filepath` when removing duplicate packages (#9142)
+  * chore: add debug log to show image source location (#9163)
+  * docs: add section on customizing default check data (#9114)
+  * chore(deps): bump the common group across 1 directory with 9 updates (#9153)
+  * docs: partners page content updates (#9149)
+  * chore(license): add missed spdx exceptions: (#9147)
+  * docs: trivy partners page updates (#9133)
+  * fix: migrate from `*.list` to `*.md5sums` files for `dpkg` (#9131)
+  * ci(helm): bump Trivy version to 0.64.1 for Trivy Helm Chart 0.16.1 (#9135)
+  * feat(sbom): add SHA-512 hash support for CycloneDX SBOM (#9126)
+  * fix(misconf): skip rewriting expr if attr is nil (#9113)
+  * fix(license): add missed `GFDL-NIV-1.1` and `GFDL-NIV-1.2` into Trivy mapping (#9116)
+  * fix(cli): Add more non-sensitive flags to telemetry (#9110)
+  * fix(alma): parse epochs from rpmqa file (#9101)
+  * fix(rootio): check full version to detect `root.io` packages (#9117)
+  * chore: drop FreeBSD 32-bit support (#9102)
+  * fix(sbom): use correct field for licenses in CycloneDX reports (#9057)
+  * fix(secret): fix line numbers for multiple-line secrets (#9104)
+  * feat(license): observe pkg types option in license scanner (#9091)
+  * ci(helm): bump Trivy version to 0.64.0 for Trivy Helm Chart 0.16.0 (#9107)
+- (CVE-2025-53547, bsc#1246151)
+
+- Update to version 0.64.1 (bsc#1243633, CVE-2025-47291,
+                           (bsc#1246730, CVE-2025-46569):
+
+  * fix(misconf): skip rewriting expr if attr is nil [backport: release/v0.64] (#9127)
+  * fix(cli): Add more non-sensitive flags to telemetry [backport: release/v0.64] (#9124)
+  * fix(rootio): check full version to detect `root.io` packages [backport: release/v0.64] (#9120)
+  * fix(alma): parse epochs from rpmqa file [backport: release/v0.64] (#9119)
+  * docs(python): fix type with METADATA file name (#9090)
+  * feat: reject unsupported artifact types in remote image retrieval (#9052)
+  * chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 (#9088)
+  * refactor(misconf): rewrite Rego module filtering using functional filters (#9061)
+  * feat(terraform): add partial evaluation for policy templates (#8967)
+  * feat(vuln): add Root.io support for container image scanning (#9073)
+  * feat(sbom): add manufacturer field to CycloneDX tools metadata (#9019)
+  * fix(cli): add some values to the telemetry call (#9056)
+  * feat(ubuntu): add end of life date for Ubuntu 25.04 (#9077)
+  * refactor: centralize HTTP transport configuration (#9058)
+  * test: include integration tests in linting and fix all issues (#9060)
+  * chore(deps): bump the common group across 1 directory with 26 updates (#9063)
+  * feat(java): dereference all maven settings.xml env placeholders (#9024)
+  * fix(misconf): reduce log noise on incompatible check (#9029)
+  * fix(misconf): .Config.User always takes precedence over USER in .History (#9050)
+  * chore(deps): update Docker to v28.2.2 and fix compatibility issues (#9037)
+  * docs(misconf): simplify misconfiguration docs (#9030)
+  * fix(misconf): move disabled checks filtering after analyzer scan (#9002)
+  * docs: add PR review policy for maintainers (#9032)
+  * fix(sbom): remove unnecessary OS detection check in SBOM decoding (#9034)
+  * test: improve and extend tests for iac/adapters/arm (#9028)
+  * chore: bump up Go version to 1.24.4 (#9031)
+  * feat(cli): add version constraints to annoucements (#9023)
+  * fix(misconf): correct Azure value-to-time conversion in AsTimeValue (#9015)
+  * feat(ubuntu): add eol date for 20.04-ESM (#8981)
+  * fix(report): don't panic when report contains vulns, but doesn't contain packages for `table` format (#8549)
+  * fix(nodejs): correctly parse `packages` array of `bun.lock` file (#8998)
+  * refactor: use strings.SplitSeq instead of strings.Split in for-loop (#8983)
+  * docs: change --disable-metrics to --disable-telemetry in example (#8999) (#9003)
+  * feat(misconf): add OpenTofu file extension support (#8747)
+  * refactor(misconf): set Trivy version by default in Rego scanner (#9001)
+  * docs: fix assets with versioning (#8996)
+  * docs: add partners page (#8988)
+  * chore(alpine): add EOL date for Alpine 3.22 (#8992)
+  * fix: don't show corrupted trivy-db warning for first run (#8991)
+  * Update installation.md (#8979)
+  * feat(misconf): normalize CreatedBy for buildah and legacy docker builder (#8953)
+  * chore(k8s): update comments with deprecated command format (#8964)
+  * chore: fix errors and typos in docs (#8963)
+  * fix: Add missing version check flags (#8951)
+  * feat(redhat): Add EOL date for RHEL 10. (#8910)
+  * fix: Correctly check for semver versions for trivy version check (#8948)
+  * refactor(server): change custom advisory and vulnerability data types fr… (#8923)
+  * ci(helm): bump Trivy version to 0.63.0 for Trivy Helm Chart 0.15.0 (#8946)
+  * fix(misconf): use argument value in WithIncludeDeprecatedChecks (#8942)
+  * chore(deps): Bump trivy-checks (#8934)
+  * fix(julia): add `Relationship` field support (#8939)
+  * feat(minimos): Add support for MinimOS (#8792)
+  * feat(alpine): add maintainer field extraction for APK packages (#8930)
+  * feat(echo): Add Echo Support (#8833)
+  * fix(redhat): Also try to find buildinfo in root layer (layer 0) (#8924)
+  * fix(wolfi): support new APK database location (#8937)
+  * feat(k8s): get components from namespaced resources (#8918)
+  * refactor(cloudformation): remove unused ScanFile method from Scanner (#8927)
+  * refactor(terraform): remove result sorting from scanner (#8928)
+  * feat(misconf): Add support for `Minimum Trivy Version` (#8880)
+  * docs: improve skipping files documentation (#8749)
+  * feat(cli): Add available version checking (#8553)
+  * feat(nodejs): add a bun.lock analyzer (#8897)
+  * feat: terraform parser option to set current working directory (#8909)
+  * perf(secret): only match secrets of meaningful length, allow example strings to not be matched (#8602)
+  * feat(misconf): export raw Terraform data to Rego (#8741)
+  * refactor(terraform): simplify AllReferences method signature in Attribute (#8906)
+  * fix: check post-analyzers for StaticPaths (#8904)
+  * feat: add Bottlerocket OS package analyzer (#8653)
+  * feat(license): improve work text licenses with custom classification (#8888)
+  * chore(deps): bump github.com/containerd/containerd/v2 from 2.1.0 to 2.1.1 (#8901)
+  * chore(deps): bump the common group across 1 directory with 9 updates (#8887)
+  * refactor(license): simplify compound license scanning (#8896)
+  * feat(license): Support compound licenses (licenses using SPDX operators) (#8816)
+  * fix(k8s): use in-memory cache backend during misconfig scanning (#8873)
+  * feat(nodejs): add bun.lock parser (#8851)
+  * feat(license): improve work with custom classification of licenses from config file (#8861)
+  * fix(cli): disable `--skip-dir` and `--skip-files` flags for `sbom` command (#8886)
+  * fix: julia parser panicing (#8883)
+  * refactor(db): change logic to detect wrong DB (#8864)
+  * fix(cli): don't use allow values for `--compliance` flag (#8881)
+  * docs(misconf): Reorganize misconfiguration scan pages (#8206)
+  * fix(server): add missed Relationship field for `rpc` (#8872)
+  * feat: add JSONC support for comments and trailing commas (#8862)
+  * fix(vex): use `lo.IsNil` to check `VEX` from OCI artifact (#8858)
+  * feat(go): support license scanning in both GOPATH and vendor (#8843)
+  * fix(redhat): save contentSets for OS packages in fs/vm modes (#8820)
+  * fix: filter all files when processing files installed from package managers (#8842)
+  * feat(misconf): add misconfiguration location to junit template (#8793)
+  * docs(vuln): remove OSV for Python from data sources (#8841)
+  * chore: add an issue template for maintainers (#8838)
+  * chore: enable staticcheck (#8815)
+  * ci(helm): bump Trivy version to 0.62.1 for Trivy Helm Chart 0.14.1 (#8836)
+  * feat(license): scan vendor directory for license for go.mod files (#8689)
+  * docs(java):  Update info about dev deps in gradle lock (#8830)
+  * chore(deps): bump golang.org/x/sync from 0.13.0 to 0.14.0 in the common group (#8822)
+  * fix(java): exclude dev dependencies in gradle lockfile (#8803)
+  * fix: octalLiteral from go-critic (#8811)
+  * fix(redhat): trim invalid suffix from content_sets in manifest parsing (#8818)
+  * chore(deps): bump the common group across 1 directory with 10 updates (#8817)
+  * fix: use-any from revive (#8810)
+  * fix: more revive rules (#8814)
+  * docs: change in java.md: fix the Trity -to-&gt; Trivy typo (#8813)
+  * fix(misconf): check if for-each is known when expanding dyn block (#8808)
+  * ci(helm): bump Trivy version to 0.62.0 for Trivy Helm Chart 0.14.0 (#8802)
+
+- Update to version 0.62.1 (bsc#1239225, CVE-2025-22868,
+                            bsc#1241724, CVE-2025-22872):
+
+  * chore(deps): bump the common group across 1 directory with 10 updates [backport: release/v0.62] (#8831)
+  * fix(misconf): check if for-each is known when expanding dyn block [backport: release/v0.62] (#8826)
+  * fix(redhat): trim invalid suffix from content_sets in manifest parsing [backport: release/v0.62] (#8824)
+  * feat(nodejs): add root and workspace for `yarn` packages (#8535)
+  * fix: unused-parameter rule from revive (#8794)
+  * chore(deps): Update trivy-checks (#8798)
+  * fix: early-return, indent-error-flow and superfluous-else rules from revive  (#8796)
+  * fix(k8s): remove using `last-applied-configuration` (#8791)
+  * refactor(misconf): remove unused methods from providers (#8781)
+  * refactor(misconf): remove unused methods from iac types (#8782)
+  * fix(misconf): filter null nodes when parsing json manifest (#8785)
+  * fix: testifylint last issues (#8768)
+  * fix(misconf): perform operations on attribute safely (#8774)
+  * refactor(ubuntu): update time handling for fixing time (#8780)
+  * chore(deps): bump golangci-lint to v2.1.2 (#8766)
+  * feat(image): save layers metadata into report (#8394)
+  * feat(misconf): convert AWS managed policy to document (#8757)
+  * chore(deps): bump the docker group across 1 directory with 3 updates (#8762)
+  * ci(helm): bump Trivy version to 0.61.1 for Trivy Helm Chart 0.13.1 (#8753)
+  * ci(helm): create a helm branch for patches from main (#8673)
+  * fix(terraform): hcl object expressions to return references (#8271)
+  * chore(terraform): option to pass in instanced logger  (#8738)
+  * ci: use `Skitionek/notify-microsoft-teams` instead of `aquasecurity` fork (#8740)
+  * chore(terraform): remove os.OpenPath call from terraform file functions (#8737)
+  * chore(deps): bump the common group across 1 directory with 23 updates (#8733)
+  * feat(rust): add root and workspace relationships/package for `cargo` lock files (#8676)
+  * refactor(misconf): remove module outputs from parser.EvaluateAll (#8587)
+  * fix(misconf): populate context correctly for module instances (#8656)
+  * fix(misconf): check if metadata is not nil (#8647)
+  * refactor(misconf): switch to x/json  (#8719)
+  * fix(report): clean buffer after flushing (#8725)
+  * ci: improve PR title validation workflow (#8720)
+  * refactor(flag): improve flag system architecture and extensibility (#8718)
+  * fix(terraform): `evaluateStep` to correctly set `EvalContext` for multiple instances of blocks (#8555)
+  * refactor: migrate from `github.com/aquasecurity/jfather` to `github.com/go-json-experiment/json` (#8591)
+  * feat(misconf): support auto_provisioning_defaults in google_container_cluster (#8705)
+  * ci: use `github.event.pull_request.user.login` for release PR check workflow (#8702)
+  * refactor: add hook interface for extended functionality (#8585)
+  * fix(misconf): add missing variable as unknown (#8683)
+  * docs: Update maintainer docs (#8674)
+  * ci(vuln): reduce github action script injection attack risk (#8610)
+  * fix(secret): ignore .dist-info directories during secret scanning (#8646)
+  * fix(server): fix redis key when trying to delete blob (#8649)
+  * chore(deps): bump the testcontainers group with 2 updates (#8650)
+  * test: use `aquasecurity` repository for test images (#8677)
+  * chore(deps): bump the aws group across 1 directory with 5 updates (#8652)
+  * fix(k8s): skip passed misconfigs for the summary report (#8684)
+  * fix(k8s): correct compare artifact versions (#8682)
+  * chore: update Docker lib (#8681)
+  * refactor(misconf): remove unused terraform attribute methods (#8657)
+  * feat(misconf): add option to pass Rego scanner to IaC scanner (#8369)
+  * chore: typo fix to replace `rego` with `repo` on the RepoFlagGroup options error output (#8643)
+  * docs: Add info about helm charts release (#8640)
+  * ci(helm): bump Trivy version to 0.61.0 for Trivy Helm Chart 0.13.0 (#8638)
+
+Update to version 0.61.1 (bsc#1239385, CVE-2025-22869, bsc#1240466, CVE-2025-30204):
+
+  * fix(k8s): skip passed misconfigs for the summary report [backport: release/v0.61] (#8748)
+  * fix(k8s): correct compare artifact versions [backport: release/v0.61] (#8699)
+  * test: use `aquasecurity` repository for test images [backport: release/v0.61] (#8698)
+  * fix(misconf): Improve logging for unsupported checks (#8634)
+  * feat(k8s): add support for controllers (#8614)
+  * fix(debian): don't include empty licenses for `dpkgs` (#8623)
+  * fix(misconf): Check values wholly prior to evalution (#8604)
+  * chore(deps): Bump trivy-checks (#8619)
+  * fix(k8s): show report for `--report all` (#8613)
+  * chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 (#8597)
+  * refactor: rename scanner to service (#8584)
+  * fix(misconf): do not skip loading documents from subdirectories (#8526)
+  * refactor(misconf): get a block or attribute without calling HasChild (#8586)
+  * fix(misconf): identify the chart file exactly by name (#8590)
+  * test: use table-driven tests in Helm scanner tests (#8592)
+  * refactor(misconf): Simplify misconfig checks bundle parsing (#8533)
+  * chore(deps): bump the common group across 1 directory with 10 updates (#8566)
+  * fix(misconf): do not use cty.NilVal for non-nil values (#8567)
+  * docs(cli): improve flag value display format (#8560)
+  * fix(misconf): set default values for AWS::EKS::Cluster.ResourcesVpcConfig (#8548)
+  * docs: remove slack (#8565)
+  * fix: use `--file-patterns` flag for all post analyzers (#7365)
+  * docs(python): Mention pip-compile (#8484)
+  * feat(misconf): adapt aws_opensearch_domain (#8550)
+  * feat(misconf): adapt AWS::EC2::VPC (#8534)
+  * docs: fix a broken link (#8546)
+  * fix(fs): check postAnalyzers for StaticPaths (#8543)
+  * refactor(misconf): remove unused methods for ec2.Instance (#8536)
+  * feat(misconf): adapt aws_default_security_group (#8538)
+  * feat(fs): optimize scanning performance by direct file access for known paths (#8525)
+  * feat(misconf): adapt AWS::DynamoDB::Table (#8529)
+  * style: Fix MD syntax in self-hosting.md (#8523)
+  * perf(misconf): retrieve check metadata from annotations once (#8478)
+  * feat(misconf): Add support for aws_ami (#8499)
+  * fix(misconf): skip Azure CreateUiDefinition (#8503)
+  * refactor(misconf): use OPA v1 (#8518)
+  * fix(misconf): add ephemeral block type to config schema (#8513)
+  * perf(misconf): parse input for Rego once (#8483)
+  * feat: replace TinyGo with standard Go for WebAssembly modules (#8496)
+  * chore: replace deprecated tenv linter with usetesting (#8504)
+  * fix(spdx): save text licenses into `otherLicenses` without normalize (#8502)
+  * chore(deps): bump the common group across 1 directory with 13 updates (#8491)
+  * chore: use go.mod for managing Go tools (#8493)
+  * ci(helm): bump Trivy version to 0.60.0 for Trivy Helm Chart 0.12.0 (#8494)
+  * fix(sbom): improve logic for binding direct dependency to parent component (#8489)
+  * chore(deps): remove missed replace of `trivy-db` (#8492)
+  * chore(deps): bump alpine from 3.21.0 to 3.21.3 in the docker group across 1 directory (#8490)
+  * chore(deps): update Go to 1.24 and switch to go-version-file (#8388)
+  * docs: add abbreviation list (#8453)
+  * chore(terraform): assign *terraform.Module 'parent' field (#8444)
+  * feat: add report summary table (#8177)
+  * chore(deps): bump the github-actions group with 3 updates (#8473)
+  * refactor(vex): improve SBOM reference handling with project standards (#8457)
+  * ci: update GitHub Actions cache to v4 (#8475)
+  * feat: add `--vuln-severity-source` flag (#8269)
+  * fix(os): add mapping OS aliases (#8466)
+  * chore(deps): bump the aws group across 1 directory with 7 updates (#8468)
+  * chore(deps): Bump trivy-checks to v1.7.1 (#8467)
+  * refactor(report): write tables after rendering all results (#8357)
+  * docs: update VEX documentation index page (#8458)
+  * fix(db): fix case when 2 trivy-db were copied at the same time (#8452)
+  * feat(misconf): render causes for Terraform (#8360)
+  * fix(misconf): fix incorrect k8s locations due to JSON to YAML conversion (#8073)
+  * feat(cyclonedx): Add initial support for loading external VEX files from SBOM references (#8254)
+  * chore(deps): update go-rustaudit location (#8450)
+  * fix: update all documentation links (#8045)
+  * chore(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 (#8443)
+  * chore(deps): bump the common group with 6 updates (#8411)
+  * fix(k8s): add missed option `PkgRelationships` (#8442)
+  * fix(sbom): add SBOM file's filePath as Application FilePath if we can't detect its path (#8346)
+  * feat(go): fix parsing main module version for go &gt;= 1.24 (#8433)
+  * refactor(misconf): make Rego scanner independent of config type (#7517)
+  * fix(image): disable AVD-DS-0007 for history scanning (#8366)
+  * fix(server): secrets inspectation for the config analyzer in client server mode (#8418)
+  * chore: remove mockery (#8417)
+  * test(server): replace mock driver with memory cache in server tests (#8416)
+  * test: replace mock with memory cache and fix non-deterministic tests (#8410)
+  * test: replace mock with memory cache in scanner tests (#8413)
+  * test: use memory cache (#8403)
+  * fix(spdx): init `pkgFilePaths` map for all formats (#8380)
+  * chore(deps): bump the common group across 1 directory with 11 updates (#8381)
+  * docs: correct Ruby documentation (#8402)
+  * chore: bump `mockery` to update v2.52.2 version and rebuild mock files (#8390)
+  * fix: don't use `scope` for `trivy registry login` command (#8393)
+  * fix(go): merge nested flags into string for ldflags for Go binaries (#8368)
+  * chore(terraform): export module path on terraform modules (#8374)
+  * fix(terraform): apply parser options to submodule parsing (#8377)
+  * docs: Fix typos in documentation (#8361)
+  * docs: fix navigate links (#8336)
+  * ci(helm): bump Trivy version to 0.59.1 for Trivy Helm Chart 0.11.1 (#8354)
+  * ci(spdx): add `aqua-installer` step to fix `mage` error (#8353)
+  * chore: remove debug prints (#8347)
+  * fix(misconf): do not log scanners when misconfig scanning is disabled (#8345)
+  * fix(report): remove html escaping for `shortDescription` and `fullDescription` fields for sarif reports (#8344)
+  * chore(deps): bump Go to `v1.23.5` (#8341)
+  * fix(python): add `poetry` v2 support (#8323)
+  * chore(deps): bump the github-actions group across 1 directory with 4 updates (#8331)
+  * fix(misconf): ecs include enhanced for container insights (#8326)
+  * fix(sbom): preserve OS packages from multiple SBOMs (#8325)
+  * ci(helm): bump Trivy version to 0.59.0 for Trivy Helm Chart 0.11.0 (#8311)
+  *  (bsc#1237618, CVE-2025-27144)
+
+Update to version 0.59.1:
+
+  * fix(misconf): do not log scanners when misconfig scanning is disabled [backport: release/v0.59] (#8349)
+  * chore(deps): bump Go to `v1.23.5` [backport: release/v0.59] (#8343)
+  * fix(python): add `poetry` v2 support [backport: release/v0.59] (#8335)
+  * fix(sbom): preserve OS packages from multiple SBOMs [backport: release/v0.59] (#8333)
+
+Update to version 0.59.0:
+
+  * feat(image): return error early if total size of layers exceeds limit (#8294)
+  * chore(deps): Bump trivy-checks (#8310)
+  * chore(terraform): add accessors to underlying raw hcl values (#8306)
+  * fix: improve conversion of image config to Dockerfile (#8308)
+  * docs: replace short codes with Unicode emojis (#8296)
+  * feat(k8s): improve artifact selections for specific namespaces (#8248)
+  * chore: update code owners (#8303)
+  * fix(misconf): handle heredocs in dockerfile instructions (#8284)
+  * fix: de-duplicate same `dpkg` packages with different filePaths from different layers (#8298)
+  * chore(deps): bump the aws group with 7 updates (#8299)
+  * chore(deps): bump the common group with 12 updates (#8301)
+  * chore: enable int-conversion from perfsprint (#8194)
+  * feat(fs): use git commit hash as cache key for clean repositories (#8278)
+  * fix(spdx): use the `hasExtractedLicensingInfos` field for licenses that are not listed in the SPDX (#8077)
+  * chore: use require.ErrorContains when possible (#8291)
+  * feat(image): prevent scanning oversized container images (#8178)
+  * chore(deps): use aqua forks for `github.com/liamg/jfather` and `github.com/liamg/iamgo` (#8289)
+  * fix(fs): fix cache key generation to use UUID (#8275)
+  * fix(misconf): correctly handle all YAML tags in K8S templates (#8259)
+  * feat: add support for registry mirrors (#8244)
+  * chore(deps): bump the common group across 1 directory with 29 updates (#8261)
+  * refactor(license): improve license expression normalization (#8257)
+  * feat(misconf): support for ignoring by inline comments for Dockerfile (#8115)
+  * feat: add a examples field to check metadata (#8068)
+  * chore(deps): bump alpine from 3.20.0 to 3.21.0 in the docker group across 1 directory (#8196)
+  * ci: add workflow to restrict direct PRs to release branches (#8240)
+  * fix(suse): SUSE - update OSType constants and references for compatility (#8236)
+  * ci: fix path to main dir for canary builds (#8231)
+  * chore(secret): add reported issues related to secrets in junit template (#8193)
+  * refactor: use trivy-checks/pkg/specs package (#8226)
+  * ci(helm): bump Trivy version to 0.58.1 for Trivy Helm Chart 0.10.0 (#8170)
+  * fix(misconf): allow null values only for tf variables (#8112)
+  * feat(misconf): support for ignoring by inline comments for Helm (#8138)
+  * fix(redhat): check `usr/share/buildinfo/` dir to detect content sets (#8222)
+  * chore(alpine): add EOL date for Alpine 3.21 (#8221)
+  * fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field (#8207)
+  * fix(misconf): disable git terminal prompt on tf module load (#8026)
+  * chore: remove aws iam related scripts (#8179)
+  * docs: Updated JSON schema version 2 in the trivy documentation (#8188)
+  * refactor(python): use once + debug for `License acquired from METADATA...` logs (#8175)
+  * refactor: use slices package instead of custom function (#8172)
+  * chore(deps): bump the common group with 6 updates (#8162)
+  * feat(python): add support for uv dev and optional dependencies (#8134)
+  * feat(python): add support for poetry dev dependencies (#8152)
+  * fix(sbom): attach nested packages to Application (#8144)
+  * docs(vex): use debian minor version in examples (#8166)
+  * refactor: add generic Set implementation (#8149)
+  * chore(deps): bump the aws group across 1 directory with 6 updates (#8163)
+  * fix(python): skip dev group's deps for poetry (#8106)
+  * fix(sbom): use root package for `unknown` dependencies (if exists) (#8104)
+  * chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` (#8140)
+  * chore(vex): suppress CVE-2024-45338 (#8137)
+  * feat(python): add support for uv (#8080)
+  * chore(deps): bump the docker group across 1 directory with 3 updates (#8127)
+  * chore(deps): bump the common group across 1 directory with 14 updates (#8126)
+  * chore: bump go to 1.23.4 (#8123)
+  * test: set dummy value for NUGET_PACKAGES (#8107)
+  * chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` (#8105)
+  * chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 (#8103)
+  * fix: wasm module test (#8099)
+  * fix: CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass (#8088)
+  * chore(vex): suppress CVE-2024-45337 (#8101)
+  * fix(license): always trim leading and trailing spaces for licenses (#8095)
+  * fix(sbom): scan results of SBOMs generated from container images are missing layers (#7635)
+  * fix(redhat): correct rewriting of recommendations for the same vulnerability (#8063)
+  * fix: enable err-error and errorf rules from perfsprint linter (#7859)
+  * chore(deps): bump the aws group across 1 directory with 6 updates (#8074)
+  * perf: avoid heap allocation in applier findPackage (#7883)
+  * fix: Updated twitter icon (#7772)
+  * docs(k8s): add a note about multi-container pods (#7815)
+  * feat: add `--distro` flag to manually specify OS distribution for vulnerability scanning (#8070)
+  * fix(oracle): add architectures support for advisories (#4809)
+  * fix: handle `BLOW_UNKNOWN` error to download DBs (#8060)
+  * feat(misconf): generate placeholders for random provider resources (#8051)
+  * fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type (#8052)
+  * fix(flag): skip hidden flags for `--generate-default-config` command (#8046)
+  * fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props (#8050)
+  * feat(nodejs): respect peer dependencies for dependency tree (#7989)
+  * ci(helm): bump Trivy version to 0.58.0 for Trivy Helm Chart 0.10.0 (#8038)
+  * fix: respect GITHUB_TOKEN to download artifacts from GHCR (#7580)
+  * chore(deps): bump github.com/moby/buildkit from 0.17.2 to 0.18.0 in the docker group (#8029)
+  * fix(misconf): use log instead of fmt for logging (#8033)
+  * docs: add commercial content (#8030)
+
+- Update to version 0.58.2 (
+      bsc#1234512, CVE-2024-45337,
+      bsc#1235265, CVE-2024-45338,
+      bsc#1232948, CVE-2024-51744):
+
+  * fix(misconf): allow null values only for tf variables [backport: release/v0.58] (#8238)
+  * fix(suse): SUSE - update OSType constants and references for compatility [backport: release/v0.58] (#8237)
+  * fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field [backport: release/v0.58] (#8215)
+  * fix(sbom): attach nested packages to Application [backport: release/v0.58] (#8168)
+  * fix(python): skip dev group's deps for poetry [backport: release/v0.58] (#8158)
+  * fix(sbom): use root package for `unknown` dependencies (if exists) [backport: release/v0.58] (#8156)
+  * chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` [backport: release/v0.58] (#8142)
+  * chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` [backport: release/v0.58] (#8136)
+  * fix(redhat): correct rewriting of recommendations for the same vulnerability [backport: release/v0.58] (#8135)
+  * fix(oracle): add architectures support for advisories [backport: release/v0.58] (#8125)
+  * fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type [backport: release/v0.58] (#8124)
+  * chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 [backport: release/v0.58] (#8122)
+  * fix: handle `BLOW_UNKNOWN` error to download DBs [backport: release/v0.58] (#8121)
+  * fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props [backport: release/v0.58] (#8119)
+  * fix(misconf): wrap AWS EnvVar to iac types (#7407)
+  * chore(deps): Upgrade trivy-checks (#8018)
+  * refactor(misconf): Remove unused options (#7896)
+  * docs: add terminology page to explain Trivy concepts (#7996)
+  * feat: add `workspaceRelationship` (#7889)
+  * refactor(sbom): simplify relationship generation (#7985)
+  * chore: remove Go checks (#7907)
+  * docs: improve databases documentation (#7732)
+  * refactor: remove support for custom Terraform checks (#7901)
+  * docs: fix dead links (#7998)
+  * docs: drop AWS account scanning (#7997)
+  * fix(aws): change CPU and Memory type of ContainerDefinition to a string (#7995)
+  * fix(cli): Handle empty ignore files more gracefully (#7962)
+  * fix(misconf): load full Terraform module (#7925)
+  * fix(misconf): properly resolve local Terraform cache (#7983)
+  * refactor(k8s): add v prefix for Go packages (#7839)
+  * test: replace Go checks with Rego (#7867)
+  * feat(misconf): log causes of HCL file parsing errors (#7634)
+  * chore(deps): bump the aws group across 1 directory with 7 updates (#7991)
+  * chore(deps): bump github.com/moby/buildkit from 0.17.0 to 0.17.2 in the docker group across 1 directory (#7990)
+  * chore(deps): update csaf module dependency from csaf-poc to gocsaf (#7992)
+  * chore: downgrade the failed block expand message to debug (#7964)
+  * fix(misconf): do not erase variable type for child modules (#7941)
+  * feat(go): construct dependencies of `go.mod` main module in the parser (#7977)
+  * feat(go): construct dependencies in the parser (#7973)
+  * feat: add cvss v4 score and vector in scan response (#7968)
+  * docs: add `overview` page for `others` (#7972)
+  * fix(sbom): Fixes for Programming Language Vulnerabilities and SBOM Package Maintainer Details (#7871)
+  * feat(suse): Align SUSE/OpenSUSE OS Identifiers (#7965)
+  * chore(deps): bump the common group with 4 updates (#7949)
+  * feat(oracle): add `flavors` support (#7858)
+  * fix(misconf): Update trivy-checks default repo to `mirror.gcr.io` (#7953)
+  * chore(deps): Bump up trivy-checks to v1.3.0 (#7959)
+  * fix(k8s): check all results for vulnerabilities (#7946)
+  * ci(helm): bump Trivy version to 0.57.1 for Trivy Helm Chart 0.9.0 (#7945)
+  * feat(secret): Add built-in secrets rules for Private Packagist (#7826)
+  * docs: Fix broken links (#7900)
+  * docs: fix mistakes/typos (#7942)
+  * feat: Update registry fallbacks (#7679)
+  * fix(alpine): add `UID` for removed packages (#7887)
+  * chore(deps): bump the aws group with 6 updates (#7902)
+  * chore(deps): bump the common group with 6 updates (#7904)
+  * fix(debian): infinite loop (#7928)
+  * fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files (#7912)
+  * docs: add note about temporary podman socket (#7921)
+  * docs: combine trivy.dev into trivy docs (#7884)
+  * test: change branch in spdx schema link to check in integration tests (#7935)
+  * docs: add Headlamp to the Trivy Ecosystem page (#7916)
+  * fix(report): handle `git@github.com` schema for misconfigs in `sarif` report (#7898)
+  * chore(k8s): enhance k8s scan log (#6997)
+  * fix(terraform): set null value as fallback for missing variables (#7669)
+  * fix(misconf): handle null properties in CloudFormation templates (#7813)
+  * fix(fs): add missing defered Cleanup() call to post analyzer fs (#7882)
+  * chore(deps): bump the common group across 1 directory with 20 updates (#7876)
+  * chore: bump containerd to v2.0.0 (#7875)
+  * fix: Improve version comparisons when build identifiers are present (#7873)
+  * feat(k8s): add default commands for unknown platform (#7863)
+  * chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#7868)
+  * refactor(secret): optimize performance by moving ToLower operation outside loop (#7862)
+  * test: save `containerd` image into archive and use in tests (#7816)
+  * chore(deps): bump the github-actions group across 1 directory with 2 updates (#7854)
+  * chore: bump golangci-lint to v1.61.0 (#7853)
+
+Update to version 0.57.1:
+
+  * feat: Update registry fallbacks [backport: release/v0.57] (#7944)
+  * fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files [backport: release/v0.57] (#7939)
+  * test: change branch in spdx schema link to check in integration tests [backport: release/v0.57] (#7940)
+  * release: v0.57.0 [main] (#7710)
+  * chore: lint `errors.Join` (#7845)
+  * feat(db): append errors (#7843)
+  * docs(java): add info about supported scopes (#7842)
+  * docs: add example of creating whitelist of checks (#7821)
+  * chore(deps): Bump trivy-checks (#7819)
+  * fix(go): Do not trim v prefix from versions in Go Mod Analyzer (#7733)
+  * fix(k8s): skip resources without misconfigs (#7797)
+  * fix(sbom):  use `Annotation` instead of `AttributionTexts` for `SPDX` formats (#7811)
+  * fix(cli): add config name to skip-policy-update alias (#7820)
+  * fix(helm): properly handle multiple archived dependencies (#7782)
+  * refactor(misconf): Deprecate `EXCEPTIONS` for misconfiguration scanning (#7776)
+  * fix(k8s)!: support k8s multi container (#7444)
+  * fix(k8s): support kubernetes v1.31 (#7810)
+  * docs: add Windows install instructions (#7800)
+  * ci(helm): auto public Helm chart after PR merged (#7526)
+  * feat: add end of life date for Ubuntu 24.10 (#7787)
+  * feat(report): update gitlab template to populate operating_system value (#7735)
+  * feat(misconf): Show misconfig ID in output (#7762)
+  * feat(misconf): export unresolvable field of IaC types to Rego (#7765)
+  * refactor(k8s): scan config files as a folder (#7690)
+  * fix(license): fix license normalization for Universal Permissive License (#7766)
+  * fix: enable usestdlibvars linter (#7770)
+  * fix(misconf): properly expand dynamic blocks (#7612)
+  * feat(cyclonedx): add file checksums to `CycloneDX` reports (#7507)
+  * fix(misconf): fix for Azure Storage Account network acls adaptation (#7602)
+  * refactor(misconf): simplify k8s scanner (#7717)
+  * feat(parser): ignore white space in pom.xml files (#7747)
+  * test: use forked images (#7755)
+  * fix(java): correctly inherit `version` and `scope` from upper/root `depManagement` and `dependencies` into parents (#7541)
+  * fix(misconf): check if property is not nil before conversion (#7578)
+  * fix(misconf): change default ACL of digitalocean_spaces_bucket to private (#7577)
+  * feat(misconf): ssl_mode support for GCP SQL DB instance (#7564)
+  * test: define constants for test images (#7739)
+  * docs: add note about disabled DS016 check (#7724)
+  * feat(misconf): public network support for Azure Storage Account (#7601)
+  * feat(cli): rename `trivy auth` to `trivy registry` (#7727)
+  * docs: apt-transport-https is a transitional package (#7678)
+  * refactor(misconf): introduce generic scanner (#7515)
+  * fix(cli): `clean --all` deletes only relevant dirs (#7704)
+  * feat(cli): add `trivy auth` (#7664)
+  * fix(sbom): add options for DBs in private registries (#7660)
+  * docs(report): fix reporting doc format (#7671)
+  * fix(repo): `git clone` output to Stderr (#7561)
+  * fix(redhat): include arch in PURL qualifiers (#7654)
+  * fix(report): Fix invalid URI in SARIF report (#7645)
+  * docs(report): Improve SARIF reporting doc (#7655)
+  * fix(db): fix javadb downloading error handling (#7642)
+  * feat(cli): error out when ignore file cannot be found (#7624)
+
+Update to version 0.56.2:
+
+  * fix(redhat): include arch in PURL qualifiers [backport: release/v0.56] (#7702)
+  * fix(sbom): add options for DBs in private registries [backport: release/v0.56] (#7691)
+
+- Update to version 0.51.1 (bsc#1227010, CVE-2024-3817):
+</description>
+  <package>trivy</package>
+</patchinfo>
--- a/2
+++ b/2
--- a/1
+++ b/1
--- a/2
+++ b/2
--- a/1
+++ b/1
--- a/1
+++ b/1
--- a/1
+++ b/1
--- a/1
+++ b/1
--- a/1
+++ b/1
--- a/staging.config
+++ b/staging.config
@@ -1,4 +1,4 @@
 {
  "ObsProject": "openSUSE:Backports:SLE-16.0",
-  "StagingProject": "openSUSE:Backports:SLE-16.0:PullRequest"
+  "StagingProject": "openSUSE:Backports:SLE-16.0:PullRequest",
 }
--- a/2
+++ b/2
Author	SHA256	Message	Date
Marcus Meissner	296478259e	Pull request for security update for trivy All checks were successful ObsStaging OBS Staging build Details	2025-11-26 12:37:55 +00:00
Patchinfo incident numbering	d4abf6dbc4	Update patchinfo incident numbers [skip actions]	2025-11-19 09:24:16 +00:00
AutoGits PR Review Bot	c9eacc40cf	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 18s Details PR: products/PackageHub!224	2025-11-19 09:23:57 +00:00
AutoGits PR Review Bot	1bcd952eb3	Merging Some checks failed Patchinfo incident numbering / use-go-action (push) Has been cancelled Details PR: products/PackageHub!217	2025-11-19 09:23:34 +00:00
Marcus Meissner	17e4e99ab5	filter out xen bsc#1253226 All checks were successful ObsStaging OBS Staging build Details	2025-11-17 16:30:01 +00:00
Marcus Meissner	662a62addd	add patchunfo for certbot All checks were successful ObsStaging OBS Staging build Details	2025-11-14 10:02:45 +00:00
AutoGits PR Review Bot	d9ad5b0d95	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 39s Details PR: products/PackageHub!211	2025-11-14 09:57:31 +00:00
Patchinfo incident numbering	52f1c10e67	Update patchinfo incident numbers [skip actions]	2025-11-13 15:20:09 +00:00
AutoGits PR Review Bot	b95f5de289	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 36s Details PR: products/PackageHub!212	2025-11-13 15:19:32 +00:00
Marcus Meissner	fccc06cc6f	Update submodules from pool/chromium#16 and create patchinfo.20251112154630847363.187004354831441/_patchinfo All checks were successful ObsStaging OBS Staging build Details	2025-11-12 16:46:43 +01:00
Markéta Machová	5e88777506	add certbot stack to PackageHub All checks were successful ObsStaging OBS Staging build Details	2025-11-12 11:39:26 +01:00
Patchinfo incident numbering	b3eb0849c8	Update patchinfo incident numbers [skip actions]	2025-11-11 16:48:59 +00:00
AutoGits PR Review Bot	b52f6924a4	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 22s Details PR: products/PackageHub!210	2025-11-11 16:48:33 +00:00
Marcus Meissner	54b6eca2a4	Update submodules from pool/product-composer#7 and create patchinfo.20251111094408723997.187004354831441/_patchinfo All checks were successful ObsStaging OBS Staging build Details	2025-11-11 10:44:19 +01:00
Patchinfo incident numbering	1d731ee42f	Update patchinfo incident numbers [skip actions]	2025-11-10 17:16:28 +00:00
AutoGits PR Review Bot	7862ce5600	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 13s Details PR: products/PackageHub!207	2025-11-10 17:16:10 +00:00
Patchinfo incident numbering	148e498d69	Update patchinfo incident numbers [skip actions]	2025-11-10 15:41:42 +00:00
AutoGits PR Review Bot	4f2851fe76	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 13s Details PR: products/PackageHub!193	2025-11-10 15:41:26 +00:00
Patchinfo incident numbering	162506107e	Update patchinfo incident numbers [skip actions]	2025-11-10 15:40:56 +00:00
AutoGits PR Review Bot	7863330b11	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 14s Details PR: products/PackageHub!197	2025-11-10 15:40:39 +00:00
Patchinfo incident numbering	fb0e75d1b4	Update patchinfo incident numbers [skip actions]	2025-11-10 15:40:17 +00:00
AutoGits PR Review Bot	7aa51378b7	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 22s Details PR: products/PackageHub!195	2025-11-10 15:39:51 +00:00
AutoGits PR Review Bot	8d87e747e8	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 13s Details PR: products/PackageHub!208	2025-11-07 15:01:00 +00:00
Marcus Meissner	1b0f0f0118	remove product again, we do not need it currently	2025-11-07 10:23:59 +00:00
Patchinfo incident numbering	46d712de4f	Update patchinfo incident numbers [skip actions]	2025-11-07 08:49:01 +00:00
AutoGits PR Review Bot	5003a51c3b	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 23s Details PR: products/PackageHub!206	2025-11-07 08:48:34 +00:00
Marcus Meissner	92d66f0b6b	Update submodules from pool/chromium#15 and create patchinfo.20251106083153138720.187004354831441/_patchinfo All checks were successful ObsStaging OBS Staging build Details	2025-11-06 09:32:10 +01:00
Robert Frohl	351a05e702	Update patchinfo.20251025182836794674.93181000773252/_patchinfo All checks were successful ObsStaging OBS Staging build Details removed <seperate_build_arch/>	2025-11-05 10:56:13 +01:00
Marcus Meissner	dd0d7384d4	Update patchinfo.20251027101618101208.187004354831441/_patchinfo All checks were successful ObsStaging OBS Staging build Details remove seperate build arch	2025-11-05 10:53:41 +01:00
Marcus Meissner	52ba298c89	Update patchinfo.20251027103924170417.187004354831441/_patchinfo All checks were successful ObsStaging OBS Staging build Details remove sdeperate build arch	2025-11-05 10:53:07 +01:00
Marcus Meissner	dc8c823d25	Update patchinfo.20251104153107003768.187004354831441/_patchinfo All checks were successful ObsStaging OBS Staging build Details remove seperate buiild arch	2025-11-05 10:52:05 +01:00
Marcus Meissner	c662779915	Update submodules from pool/MozillaThunderbird#6 and create patchinfo.20251104153107003768.187004354831441/_patchinfo All checks were successful ObsStaging OBS Staging build Details	2025-11-04 16:32:07 +01:00
Marcus Meissner	f5e0640ae8	Merge branch 'leap-16.0' into maintenance-update-1761560177 All checks were successful ObsStaging OBS Staging build Details	2025-11-03 15:55:54 +01:00
Marcus Meissner	b125d840e4	Merge branch 'leap-16.0' into maintenance-update-1761561563 All checks were successful ObsStaging OBS Staging build Details	2025-11-03 15:55:44 +01:00
Elisei Roca	caf037d873	Merge branch 'leap-16.0' into maintenance-update-1761416916 All checks were successful ObsStaging OBS Staging build Details	2025-11-03 15:54:28 +01:00
Robert Frohl	1f1551b5ed	Add new line All checks were successful ObsStaging OBS Staging build Details	2025-11-03 15:45:13 +01:00
AutoGits PR Review Bot	6082776b11	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 16s Details PR: products/PackageHub!204	2025-11-03 13:45:33 +00:00
Marcus Meissner	cf12843bbb	build a product below the pull request so we get productcompose filtering	2025-11-03 10:35:10 +00:00
Patchinfo incident numbering	354f7c73f1	Update patchinfo incident numbers [skip actions]	2025-11-03 10:04:38 +00:00
AutoGits PR Review Bot	25b7a72f48	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 14s Details PR: products/PackageHub!203	2025-11-03 10:04:21 +00:00
Patchinfo incident numbering	aa671f7d22	Update patchinfo incident numbers [skip actions]	2025-11-03 09:21:40 +00:00
AutoGits PR Review Bot	b3a5d3da30	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 23s Details PR: products/PackageHub!192	2025-11-03 09:21:14 +00:00
Patchinfo incident numbering	baeb4dd0f0	Update patchinfo incident numbers [skip actions]	2025-10-31 09:48:08 +00:00
AutoGits PR Review Bot	ed82c1a9b7	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 14s Details PR: products/PackageHub!202	2025-10-31 09:47:49 +00:00
Patchinfo incident numbering	a7f1084c2b	Update patchinfo incident numbers [skip actions]	2025-10-31 08:47:45 +00:00
AutoGits PR Review Bot	faec30d90c	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 24s Details PR: products/PackageHub!177	2025-10-31 08:47:18 +00:00
Robert Frohl	dee17ce819	Update submodules from pool/python-Django#2 and create patchinfo.20251016111300220521.93181000773252/_patchinfo All checks were successful ObsStaging OBS Staging build Details	2025-10-30 15:56:43 +01:00
Marcus Meissner	da03c66eed	Update submodules from pool/product-composer#6 and create patchinfo.20251030134459405257.187004354831441/_patchinfo All checks were successful ObsStaging OBS Staging build Details	2025-10-30 14:45:13 +01:00
Marcus Meissner	1aeb477ba1	Update submodules from pool/chromium#14 and create patchinfo.20251030080843825030.187004354831441/_patchinfo All checks were successful ObsStaging OBS Staging build Details	2025-10-30 09:08:58 +01:00
Patchinfo incident numbering	280b37a43b	Update patchinfo incident numbers [skip actions]	2025-10-29 16:01:09 +00:00
AutoGits PR Review Bot	537ee79523	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 17s Details PR: products/PackageHub!196	2025-10-29 16:00:48 +00:00
AutoGits PR Review Bot	1d8648ba28	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 16s Details PR: products/PackageHub!198	2025-10-29 15:29:34 +00:00
Patchinfo incident numbering	f42dcc1f68	Update patchinfo incident numbers [skip actions]	2025-10-29 11:37:25 +00:00
AutoGits PR Review Bot	45f8a23cee	Merging All checks were successful Patchinfo incident numbering / use-go-action (push) Successful in 14s Details PR: products/PackageHub!190	2025-10-29 11:37:08 +00:00
Elisei Roca	f089aa345a	Fix melange submodule reference All checks were successful ObsStaging OBS Staging build Details For some reason, pool/melange did not have a leap-16.0 branch. I've created one based on .changes, .spec file and sha256sum of the package source archives.	2025-10-27 16:34:51 +01:00
Marcus Meissner	7f9822480c	Update submodules from pool/micropython#2 and create patchinfo.20251027103924170417.187004354831441/_patchinfo All checks were successful ObsStaging OBS Staging build Details	2025-10-27 11:39:35 +01:00
Marcus Meissner	bd04a8821e	Update submodules from pool/MozillaThunderbird#5 and create patchinfo.20251027101939269288.187004354831441/_patchinfo All checks were successful ObsStaging OBS Staging build Details	2025-10-27 11:20:22 +01:00
Marcus Meissner	a391990f93	Update submodules from pool/knot#4 and create patchinfo.20251027101618101208.187004354831441/_patchinfo All checks were successful ObsStaging OBS Staging build Details	2025-10-27 11:16:33 +01:00
Robert Frohl	aa01d6bd01	Update submodules from pool/amarok!1 and create patchinfo.20251025182836794674.93181000773252/_patchinfo All checks were successful ObsStaging OBS Staging build Details	2025-10-25 20:29:27 +02:00
Robert Frohl	47f3feff06	Update submodules from pool/openqa#9 , pool/os-autoinst#4 and create patchinfo.20251025182237146698.93181000773252/_patchinfo All checks were successful ObsStaging OBS Staging build Details	2025-10-25 20:23:15 +02:00
Marcus Meissner	47614025ea	Added fprintd to PHUB All checks were successful ObsStaging OBS Staging build Details	2025-10-23 15:06:14 +02:00