chore(deps): bump the trivy group across 1 directory with 2 updates

[dependabot]

This PR carries additional commits on top of the Dependabot bump, adapting vuls to the Trivy 0.74 changes:

• scanner/trivy/jar (bc1e5b3): follow Trivy 0.74's fix "read artifact properties only from the MANIFEST.MF main section" (fix(java): read artifact properties only from the MANIFEST.MF main section aquasecurity/trivy#11066). The manifest parser now reads only the main section (stopping at the first empty line), unfolds continuation lines, handles CRLF/LF/lone-CR line terminators, and caps the decompressed manifest at 10 MiB — ported from upstream's unexported parser, with a provenance comment for future bumps. Golden data updated: entries that used to pick up per-entry Name: section attributes (e.g. xml-apis) now fall back to filename + SHA-1 and are resolved via the Trivy Java DB at detect time (verified end-to-end with the juddiv3 WAR: all :artifactId entries are completed to full groupId:artifactId coordinates by vuls report).
• models (bc1e5b3, 4105815): register the new trivy-db source rapidfort as CveContentType trivy:rapidfort, placed last in the trivy precedence lists to match trivy-db's AllSourceIDs order and the convention of previously added sources (echo, minimos, rootio).
• tests (c9ba3d0, 928c5db, 41934e3): manifest parser tests are table-driven in an external jar_test package (via export_test.go), with inputs expressed as lines + lineBreak and basic cases (LF/CRLF, all supported attributes, empty manifest, %variable skipping) alongside the corner cases.

For reference, the trivy-db bump (a0049d7...0e0340a, not itemized by Dependabot below) consists of exactly two commits:

• feat(vulnsrc): add RapidFort Security Advisories source aquasecurity/trivy-db#654: add the RapidFort Security Advisories source (SourceID rapidfort, appended last in AllSourceIDs precedence) — the counterpart of the models change above.
• feat: parse description for redhat csaf advisory aquasecurity/trivy-db#682: the redhat-csaf source now parses the vulnerability description from CSAF notes[category=description] — data-side only, no new SourceID; vuls does not map redhat-csaf-vex yet.

---

Bumps the trivy group with 1 update in the / directory: github.com/aquasecurity/trivy.

Updates github.com/aquasecurity/trivy from 0.72.0 to 0.74.0

Release notes

Sourced from github.com/aquasecurity/trivy's releases.

v0.74.0

⚡ Highlights ⚡

👉 aquasecurity/trivy#11096

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0740-2026-08-14

v0.73.0

⚡ Highlights ⚡

👉 aquasecurity/trivy#11033

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0730-2026-08-03

Changelog

Sourced from github.com/aquasecurity/trivy's changelog.

0.74.0 (2026-08-14)

Features

• add RapidFort curated image scanner (#10452) (2c3b86c)
• java: resolve JAR license URLs to SPDX IDs (Bundle-License, pom <url>) (#10948) (171e391)

Bug Fixes

• java: read artifact properties only from the MANIFEST.MF main section (#11066) (018bfbf)
• misconf: parse Azure flexible server parameters under their own names (#11072) (d59f0f8)
• misconf: unmark cty values outside the evaluation context (#11078) (9e85b6b)
• python: normalize dependency names in PEP 621 pyproject.toml (#11050) (0012281)
• server: preserve check aliases and query in uploaded blobs (#11080) (0512d6d)
• terraform: avoid panic when for_each local has unknown object values (#11019) (199a126)
• terraform: support OpenTofu language block (#10923) (bacf17f)

0.73.0 (2026-08-03)

Features

• add bounded read helpers (#10974) (35384b4)
• java: read Jenkins plugin manifest licenses (#10939) (f065203)
• java: support user-defined Maven mirrors in trivy.yaml (#11006) (8e5509c)
• seal: detect no-prefix packages by version suffix (#10911) (69da733)
• vex: discover OpenVEX in generic in-toto OCI referrers (#10986) (990d765)
• vex: native discovery of VEX documents stored as OCI artifacts (#10932) (38d5dbd)

Bug Fixes

• conda: avoid panic on an all-operator dependency line (#10955) (f964fa2)
• dotnet: identify deps.json root project from dependency graph (#10954) (3c6a1a2)
• java: set per-file digest for nested JARs (#10855) (c3c7d17)
• misconf: guard nil Healthcheck when building Dockerfile from history (#10899) (824e2ed)
• nodejs: support pnpm workspaces with overlapping packages (#10894) (19f2ddc)
• vex: handle 304 status code (#10307) (e73c76d)
• vex: reject non-local VEX repository names (#10987) (2c64b8f)
• vuln: don't skip packages covered by a driver's own advisory feed (#10980) (86acabe)

Commits

• e1fd17a release: v0.74.0 [main] (#11037)
• ed3557f chore(deps): update golang.org/x modules (#11094)
• 63b3f3f chore(deps): bump the docker group with 2 updates (#11090)
• d6664d7 docs: update release branch ruleset instructions (#11093)
• 3c15b84 chore(deps): bump the common group across 1 directory with 7 updates (#11086)
• 9e85b6b fix(misconf): unmark cty values outside the evaluation context (#11078)
• b307b12 chore(deps): bump the aws group across 1 directory with 6 updates (#11053)
• d59f0f8 fix(misconf): parse Azure flexible server parameters under their own names (#...
• d1985da chore(deps): bump the docker group with 2 updates (#11054)
• 2c3b86c feat: add RapidFort curated image scanner (#10452)
• Additional commits viewable in compare view

Updates github.com/aquasecurity/trivy-db from 0.0.0-20260629102122-a0049d7ad12f to 0.0.0-20260813095258-0e0340a01b57

Commits

• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
github.com/aquasecurity/trivy	[>= 0.50.2.a, < 0.50.3]
github.com/aquasecurity/trivy	[< 0.51, > 0.50.1]

[Copilot]

Pull request overview

Updates Trivy and Trivy DB dependencies, improves JAR manifest parsing, and adds RapidFort vulnerability-source support.

Changes:

• Upgrades Trivy and related dependencies.
• Adds bounded, folded JAR manifest parsing.
• Adds RapidFort CVE handling and refreshes tests and fixtures.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Summary
scanner/trivy/jar/parse.go	Improves bounded manifest parsing.
scanner/trivy/jar/parse_test.go	Adds manifest parsing and folding tests.
scanner/testdata/golden/juddiv3-war-3.3.5.war.json	Updates expected scanner output.
models/vulninfos_test.go	Tests RapidFort severity scoring.
models/cvecontents.go	Adds RapidFort source support.
models/cvecontents_test.go	Tests RapidFort source mapping.
go.sum	Refreshes dependency checksums.
go.mod	Updates dependency versions.

Suppressed comments (3)

models/cvecontents.go:461

• Adding TrivyRapidFort to this shared list makes VulnInfo.Cvss3Scores visit it in both loops (models/vulninfos.go:536 and :558). RapidFort entries contain only Cvss3Severity (as the new test demonstrates), so the first loop emits a zero-score entry and the second emits the calculated score; reporters enumerating Cvss3Scores will show duplicate RapidFort rows, including a None HIGH row. Filter severity-only content from the direct-score loop or otherwise emit each source once, and add a regression test for Cvss3Scores.

		return []CveContentType{Trivy, TrivyNVD, TrivyRedHat, TrivyRedHatOVAL, TrivyDebian, TrivyUbuntu, TrivyCentOS, TrivyRocky, TrivyFedora, TrivyAmazon, TrivyAzure, TrivyOracleOVAL, TrivySuseCVRF, TrivyAlpine, TrivyArchLinux, TrivyAlma, TrivyCBLMariner, TrivyPhoton, TrivyCoreOS, TrivyBottlerocket, TrivyRapidFort, TrivyRubySec, TrivyPhpSecurityAdvisories, TrivyNodejsSecurityWg, TrivyGHSA, TrivyGLAD, TrivyOSV, TrivyWolfi, TrivyChainguard, TrivyBitnamiVulndb, TrivyK8sVulnDB, TrivyGoVulnDB, TrivyAqua, TrivyEcho, TrivyMinimOS, TrivyRootIO}

scanner/trivy/jar/parse.go:295

• The splitter has a separate CRLF path (advance++), but the new tests cover LF and lone CR only. Add a CRLF manifest case (including the section separator) so a regression in the two-byte advance cannot silently change the parsed main-section attributes and library identity.

			if i+1 < len(data) && data[i+1] == '\n' {
				advance++
			}

scanner/trivy/jar/parse.go:275

• The decompressed-size guard is security-relevant, but no test exercises a MANIFEST.MF larger than maxManifestSize. Add an oversized fixture and assert parsing fails; otherwise a future removal or incorrect wiring of MaxBytesReader would go unnoticed and reintroduce unbounded manifest reads.

	return parseManifestMainSection(xio.MaxBytesReader(file, maxManifestSize))

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (1)

scanner/trivy/jar/parse.go:34

• Could you add a regression test for the new decompressed-size limit? The current tests cover section selection and folding, but never feed parseManifest a manifest larger than maxManifestSize; asserting the propagated limit error would ensure future parser changes cannot silently bypass this decompression-bomb protection.

const maxManifestSize = 10 << 20 // 10 MiB

[Copilot]

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated no new comments.

Suppressed comments (2)

models/cvecontents.go:461

• The new RapidFort precedence is not covered by TestGetCveContentTypes: that test never exercises the Trivy branch. Add a case asserting GetCveContentTypes(string(Trivy)) contains TrivyRapidFort as its final Trivy source, so a future omission or reordering cannot silently change which source supplies vulnerability fields.

		return []CveContentType{Trivy, TrivyNVD, TrivyRedHat, TrivyRedHatOVAL, TrivyDebian, TrivyUbuntu, TrivyCentOS, TrivyRocky, TrivyFedora, TrivyAmazon, TrivyAzure, TrivyOracleOVAL, TrivySuseCVRF, TrivyAlpine, TrivyArchLinux, TrivyAlma, TrivyCBLMariner, TrivyPhoton, TrivyCoreOS, TrivyBottlerocket, TrivyRubySec, TrivyPhpSecurityAdvisories, TrivyNodejsSecurityWg, TrivyGHSA, TrivyGLAD, TrivyOSV, TrivyWolfi, TrivyChainguard, TrivyBitnamiVulndb, TrivyK8sVulnDB, TrivyGoVulnDB, TrivyAqua, TrivyEcho, TrivyMinimOS, TrivyRootIO, TrivyRapidFort}

scanner/trivy/jar/parse.go:281

• The new decompressed-size guard is not covered by the added tests. A regression that removes the MaxBytesReader wrapper or stops propagating its limit error would still pass every current case, even though this protects parsing untrusted ZIP entries from decompression bombs. Add a test with more than 10 MiB of short, non-empty manifest lines (so it exceeds the total limit without hitting Scanner's per-line limit) and assert that parsing returns the limit error.

	return parseManifestMainSection(xio.MaxBytesReader(file, maxManifestSize))

[MaineK00n]

🪤