[LarsLaskowski]

Pull Request

📖 Description

Updating the bundled Trivy is manual, because Dependabot is not configured for Docker images in this repository, and decision records 0015 and 0016 require every new version to be measured again. This adds the update checklist to docs/CONTRIBUTING.md (release section): digest and pull check, binary version and static linking, the #367 cases against an unreachable TRIVY_SERVER, the check.trivy.dev check with a control run, and the places that change together. It lives in CONTRIBUTING rather than an area document because docs/areas/README.md states that development and release process are not areas. Documentation only; no code changes.

🎫 Issues

Closes #377

💬 Reviewer Notes

Please check the checklist against decision records 0015 (Consequences) and 0016, and the list of places in step 5 against the Dockerfile and both compose files.

📑 Test Plan

Documentation change only. Format check reports no file needing formatting; links and anchors were verified by the review.

✅ Checklist

• I have added or updated Unit Tests for the change.
• I have tested my changes.
• I have run Format and Build from .squad/stack.md, and the Analyzer gate reports no diagnostic in a changed file.
• The Coverage gate in .squad/stack.md passes (line coverage on new or changed production code and overall).
• I have updated the project documentation (README.md, ARCHITECTURE.md) to reflect my changes.
• I have read the CONTRIBUTING documentation and followed the project's code style guidelines.
• New dependencies, if any, were added the way Dependencies in .squad/stack.md prescribes.

⏭ Next Steps

None.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud