Repository navigation
Document the procedure for updating the bundled Trivy version #377
Description
Updating the bundled Trivy is manual: Dependabot does not cover Docker in this repository, and the pin sits in the TRIVY_IMAGE build argument as a digest. Record 0015 requires every later Trivy update to be measured again with the #367 cases, and #372 showed that a new version can also add network behavior (v0.76.1 calls check.trivy.dev on every scan unless the update check and telemetry are off, record 0016). None of this is written down as a procedure.
Add a short update checklist to the area documents (docs/areas/hosting.md or docs/areas/vulnerabilities.md#trivy):
- Take the digest of the new version's image index and check that it can be pulled.
- Extract the binary from the image and check
--versionand that it is statically linked. - Re-run the Trivy scan target can begin with a dash #367 cases against it with
TRIVY_SERVERpointing at an unreachable server: no--with--config=x.y/z:latestis read as an option; after--,--config=…,--input=…and-a/btargets are image names, exit non-zero, no file read;-- library/alpine:3.20takes the normal scan path. - Check that the process makes no connection to
check.trivy.devwithTRIVY_SKIP_VERSION_CHECKandTRIVY_DISABLE_TELEMETRYset, with a control run without them. - Change the Dockerfile
TRIVY_IMAGEdefault, both compose Trivy servers (client and server stay on one version) and the version named in the area documents and records together.
Follows from #372.
Activity
LarsLaskowski commentedon Oct 29, 2026
Squad working record
log.md
Squad run metrics
No squad lessons.