Check for updates

[itaysk]

Description

Trivy is moving fast, releasing monthly with new features and fixes being introduced constantly, sometimes the UI/usage of trivy changes. Avid users are following release notes and adapting, but substential portion of users are using old versions and patterns. It would be beneifical to make this information available for users right within the tool, instead of relying on them actively searching for it online as many popular dev tools do (see below).

High level implementation proposal:

1. network call checks the latest version on scan
2. make sure this check non-blocking, best-effort and won't impact the scan time
3. check the latest Trivy version
4. check if user is using a soon to be deprecated feature or flag
5. check if there is important new information
6. print to stderr like other log messages so won't affect output processing
7. Provide a clear and easy way to turn this off

Note: This is related but distinct from assets (e.g trivy-db) updating mechanism. As that one is mandatory for normal operation it has different requirements (for example it is blocking, it is taking action).

examples:

• https://docs.npmjs.com/cli/v8/using-npm/config#update-notifier
• https://pip.pypa.io/en/stable/cli/pip/#cmdoption-disable-pip-version-check
• https://docs.conda.io/projects/conda/en/stable/user-guide/tasks/manage-conda.html#suppressing-warning-message-about-updating-conda
• https://github.com/cli/cli/blob/0750750f7c96616ec890b497e203320701b3ce4c/pkg/cmd/root/help_topic.go#L89
• https://developer.hashicorp.com/terraform/cli/commands#upgrade-and-security-bulletin-checks
• and many more..

Target

None

Scanner

None

[owenrumney]

This is tracked in #8552