From 7afebc4e72f08afdb79e19aa9e3ad04494ed8551 Mon Sep 17 00:00:00 2001 From: Anso Date: Wed, 29 Apr 2026 01:39:55 -0400 Subject: [PATCH] ci: force latest trivy version in scans (#841) * fix(docker): upgrade CLI to v29.4.1 and Compose to v5.1.3, clear VEX * fix(vex): restore CVE-2026-34040 not_affected statement for compose * fix: correct VEX product matching for CVE-2026-34040 * ci: specify trivy-version latest to resolve CVE-2026-34040 false positive --- .github/workflows/ci.yml | 1 + .github/workflows/docker-publish.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 569587fe..7381d000 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -164,6 +164,7 @@ jobs: exit-code: '1' severity: 'CRITICAL,HIGH' format: 'table' + trivy-version: 'latest' trivy-config: trivy.yaml # Mirror of the release-time pre-publish smoke gate in docker-publish.yml. diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index fc950090..4eb7c561 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -112,6 +112,7 @@ jobs: exit-code: '1' severity: 'CRITICAL,HIGH' format: 'table' + trivy-version: 'latest' trivy-config: trivy.yaml # Start the scanned image headless on the runner and poll /api/health