🔐 Security update: eMudhra CA incident 🛡️

Trivy v0.76.1 includes mitigations for the eMudhra intermediate CA key compromise.

• Official binaries are built with Go 1.27.3, which includes the certificate distrust mitigation tracked as CVE-2026-111943.
• Official container images include an updated Alpine CA trust store that rejects the affected certificate chains.

We recommend upgrading to v0.76.1 and redeploying container images to apply these updates. If you build Trivy from source, use Go 1.27.3 or later and keep your runtime CA trust store up to date.

Changelog

• e713f67 release: v0.76.1 [release/v0.76] (#11445)
• 6647bd6 fix(deps): bump the aws group across 1 directory with 6 updates [backport: release/v0.76] (#11446)
• e0964c9 fix(deps): bump the docker group with 3 updates [backport: release/v0.76] (#11443)
• 992c360 fix(deps): bump the common group with 3 updates [backport: release/v0.76] (#11442)

⚡ Highlights ⚡

👉 https://github.com/aquasecurity/trivy/discussions/11409

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0760-2026-10-14

⚡ Highlights ⚡

👉 https://github.com/aquasecurity/trivy/discussions/11333

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0750-2026-10-01

⚡ Highlights ⚡

👉 https://github.com/aquasecurity/trivy/discussions/11096

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0740-2026-08-14

⚡ Highlights ⚡

👉 https://github.com/aquasecurity/trivy/discussions/11033

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0730-2026-08-03

⚡ Highlights ⚡

👉 https://github.com/aquasecurity/trivy/discussions/10907

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0720-2026-06-30

Changelog

• 055a5c8 release: v0.71.2 [release/v0.71] (#10871)
• 875328a fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870)
• 998f7b3 chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867)

Changelog

• 164b383 release: v0.71.1 [release/v0.71] (#10818)
• a72d9a4 fix(oci): validate artifact filename
• 3dd9847 fix: forward ospkg detector options through ospkg.NewScanner [backport: release/v0.71] (#10825)
• a62cbe4 fix(vex): load VEX documents from within the repository directory [backport: release/v0.71] (#10821)
• 43d1d26 fix: surface the original analysis error instead of context cancellation [backport: release/v0.71] (#10812)
• ac7696c ci: expect GitHub App bot as backport PR author [backport: release/v0.71] (#10815)

⚡ Highlights ⚡

👉 https://github.com/aquasecurity/trivy/discussions/10767

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0710-2026-06-01

⚡ Highlights ⚡

👉 #10546

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0700-2026-04-16