trivy-operator

Generate Kubernetes-native security reports

aquasecurity/trivy-operator · Kubernetes Security · scanned v0.36.1 (released 2026-10-29) · commit b40091af2bfb · last scan 2026-11-02

425

declared dependencies

0 / 0

critical / high advisories

advisories with a fixed version

advisories with vulnerable code in the go1.27.3 binary

7.5

OpenSSF Scorecard (of 10); Scorecard CLI run by this workflow

verified

release verification

Changes since last week

no change.

Known vulnerabilities (1)

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. OSV: also reported by OSV-Scanner. Released binary: for Go tools, whether govulncheck found the vulnerable code in the shipped Linux binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Select an advisory for every catalog tool it matches. If a match is wrong or does not apply, use Dispute; accepted disputes are annotated here and listed on the corrections page, and the match stays visible.

Severity	Advisory	Package	Version	Fixed in	OSV	Released binary	KEV	EPSS	Declared in	Dispute
Unknown	`GO-2026-5932` source	`golang.org/x/crypto` golang	`v0.58.0`	no fix listed	✓	vulnerable code in binary	no	—	`go.mod`	Dispute

Second opinion: OSV-Scanner

OSV-Scanner found 2 advisories in the same files; 1 of Grype's matches are confirmed by it (marked ✓ above). 1 advisories were reported only by OSV-Scanner.

Reported only by OSV-Scanner (1)

Advisory	Package	Version	Severity
`CVE-2026-33634, GHSA-69fq-xp46-6x23, GO-2026-4919`	`github.com/aquasecurity/trivy`	`0.76.1`	Unknown

Vulnerable code in the released binary

govulncheck analyzed trivy-operator from trivy_operator_Linux_x86_64.tar.gz, built with go1.27.3. 1 advisory has vulnerable functions compiled into it: 0 in the Go standard library and 1 in dependencies.

Of the 1 Go advisories Grype matched in the source, 0 are in modules or code paths that are not in the shipped binary.

The Go linker removes unreachable functions, so a vulnerable function in the binary is likely reachable. Standard-library advisories are fixed by rebuilding with a newer Go release.

Advisory	Module	Version	Fixed in	Summary
`GO-2026-5932`	`golang.org/x/crypto`	`v0.58.0`	—	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

Release integrity

Verdict: verified for trivy_operator_Linux_x86_64.tar.gz. The download matches GitHub's recorded digest.

Checksums file: yes
Signatures: yes
SLSA provenance: no
SBOM published with the release: no

Check	Result	Detail
Cosign signature	verified	GitHub Actions workflow in aquasecurity/trivy-operator
GitHub immutable release	verified	GitHub attests the file is unchanged since the release was published

Verified means a signature, provenance, or attestation was checked against an identity in aquasecurity/trivy-operator's own GitHub Actions workflows.

Repository security (OpenSSF Scorecard)

Score 7.5/10, assessed 2026-11-02 (Scorecard CLI run by this workflow). Scorecard viewer

All checks

Check	Score	Reason
CII-Best-Practices	0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	0	project is not fuzzed
SAST	0	SAST tool is not run on all commits -- score normalized to 0
Security-Policy	0	security policy file not detected
Branch-Protection	5	branch protection is not maximal on development and all release branches
Pinned-Dependencies	8	dependency not pinned by hash detected -- score normalized to 8
Signed-Releases	8	5 out of the last 5 releases have a total of 5 signed artifacts.
Vulnerabilities	8	2 existing vulnerabilities detected
Token-Permissions	9	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	10	no binaries found in the repo
CI-Tests	10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Code-Review	10	all changesets reviewed
Contributors	10	project has 42 contributing companies or organizations
Dangerous-Workflow	10	no dangerous workflow patterns detected
Dependency-Update-Tool	10	update tool detected
License	10	license file detected
Maintained	10	21 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging	10	packaging workflow detected

GitHub Actions workflow audit (zizmor)

1 potential issues in 9 workflow files at this release: 1 high, 0 medium, 0 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.

All findings

Severity	Rule	Location	Note
High	github-app dangerous use of GitHub App tokens	`.github/workflows/publish-helm-chart.yaml:24`	app token inherits blanket installation permissions

Dependencies (425)

By ecosystem: golang 404, github 21.

Licenses (as declared in the SBOM): unknown 425.

golang (404)

Name	Version	Declared in
`cel.dev/expr`	`v0.25.2`	`go.mod`
`cloud.google.com/go`	`v0.123.0`	`go.mod`
`cloud.google.com/go/auth`	`v0.23.3`	`go.mod`
`cloud.google.com/go/auth/oauth2adapt`	`v0.2.8`	`go.mod`
`cloud.google.com/go/compute/metadata`	`v0.9.1`	`go.mod`
`cloud.google.com/go/iam`	`v1.13.0`	`go.mod`
`cloud.google.com/go/monitoring`	`v1.30.0`	`go.mod`
`cloud.google.com/go/storage`	`v1.68.0`	`go.mod`
`dario.cat/mergo`	`v1.0.2`	`go.mod`
`github.com/agext/levenshtein`	`v1.2.3`	`go.mod`
`github.com/agnivade/levenshtein`	`v1.2.1`	`go.mod`
`github.com/alecthomas/chroma`	`v0.10.0`	`go.mod`
`github.com/anchore/go-struct-converter`	`v0.1.0`	`go.mod`
`github.com/apparentlymart/go-cidr`	`v1.1.1`	`go.mod`
`github.com/apparentlymart/go-textseg/v15`	`v15.0.0`	`go.mod`
`github.com/apparentlymart/go-textseg/v17`	`v17.0.1`	`go.mod`
`github.com/aquasecurity/go-gem-version`	`v0.0.0-20201115065557-8eed6fe000ce`	`go.mod`
`github.com/aquasecurity/go-npm-version`	`v0.0.3-0.20261005070944-1f16ed76cf11`	`go.mod`
`github.com/aquasecurity/go-pep440-version`	`v0.0.2-0.20260224065243-f9bba28c51a4`	`go.mod`
`github.com/aquasecurity/go-version`	`v0.0.1`	`go.mod`
`github.com/aquasecurity/iamgo`	`v0.0.10`	`go.mod`
`github.com/aquasecurity/jfather`	`v0.0.8`	`go.mod`
`github.com/aquasecurity/table`	`v1.11.0`	`go.mod`
`github.com/aquasecurity/tml`	`v0.6.1`	`go.mod`
`github.com/aquasecurity/trivy`	`v0.76.1`	`go.mod`
`github.com/aquasecurity/trivy-checks`	`v1.12.2-0.20261012053351-ac85645895ed`	`go.mod`
`github.com/aquasecurity/trivy-db`	`v0.0.0-20261012084708-cbebf2ecd6df`	`go.mod`
`github.com/aquasecurity/trivy-java-db`	`v0.0.0-20240109071736-184bd7481d48`	`go.mod`
`github.com/aquasecurity/trivy-kubernetes`	`v0.9.1`	`go.mod`
`github.com/asaskevich/govalidator`	`v0.0.0-20230301143203-a9d515a09cc2`	`go.mod`
`github.com/aws/aws-sdk-go-v2`	`v1.47.3`	`go.mod`
`github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream`	`v1.7.22`	`go.mod`
`github.com/aws/aws-sdk-go-v2/config`	`v1.33.9`	`go.mod`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.20.9`	`go.mod`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.20.3`	`go.mod`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.5.6`	`go.mod`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.8.6`	`go.mod`
`github.com/aws/aws-sdk-go-v2/internal/v4a`	`v1.5.6`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/ebs`	`v1.22.1`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/ec2`	`v1.338.4`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/ecr`	`v1.66.4`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.13.21`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/internal/checksum`	`v1.11.7`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.14.6`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/internal/s3shared`	`v1.20.6`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/s3`	`v1.114.3`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.10.4`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.38.4`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.43.4`	`go.mod`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.51.4`	`go.mod`
`github.com/aws/smithy-go`	`v1.28.5`	`go.mod`
`github.com/Azure/azure-sdk-for-go/sdk/azcore`	`v1.23.3`	`go.mod`
`github.com/Azure/azure-sdk-for-go/sdk/azidentity`	`v1.14.1`	`go.mod`
`github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry`	`v0.2.3`	`go.mod`
`github.com/Azure/azure-sdk-for-go/sdk/internal`	`v1.13.0`	`go.mod`
`github.com/Azure/go-ansiterm`	`v0.0.0-20250102033503-faa5f7b0171c`	`go.mod`
`github.com/AzureAD/microsoft-authentication-library-for-go`	`v1.8.0`	`go.mod`
`github.com/beorn7/perks`	`v1.0.1`	`go.mod`
`github.com/bgentry/go-netrc`	`v0.0.0-20140422174119-9fd32a8b3d3d`	`go.mod`
`github.com/bitnami/go-version`	`v0.0.0-20231130084017-bb00604d650c`	`go.mod`
`github.com/blang/semver/v4`	`v4.0.0`	`go.mod`
`github.com/bluele/gcache`	`v0.0.2`	`go.mod`
`github.com/bmatcuk/doublestar/v4`	`v4.10.2`	`go.mod`
`github.com/briandowns/spinner`	`v1.23.0`	`go.mod`
`github.com/BurntSushi/toml`	`v1.6.0`	`go.mod`
`github.com/caarlos0/env/v6`	`v6.10.1`	`go.mod`
`github.com/cenkalti/backoff/v5`	`v5.0.3`	`go.mod`
`github.com/cenkalti/backoff/v6`	`v6.0.1`	`go.mod`
`github.com/cespare/xxhash/v2`	`v2.3.0`	`go.mod`
`github.com/chai2010/gettext-go`	`v1.0.2`	`go.mod`
`github.com/cheggaaa/pb/v3`	`v3.2.1`	`go.mod`
`github.com/clipperhouse/uax29/v2`	`v2.7.0`	`go.mod`
`github.com/cloudflare/circl`	`v1.6.4`	`go.mod`
`github.com/cncf/xds/go`	`v0.0.0-20260202195803-dba9d589def2`	`go.mod`
`github.com/containerd/cgroups/v3`	`v3.1.3`	`go.mod`
`github.com/containerd/containerd/api`	`v1.12.0`	`go.mod`
`github.com/containerd/containerd/v2`	`v2.4.1`	`go.mod`
`github.com/containerd/continuity`	`v0.5.0`	`go.mod`
`github.com/containerd/errdefs`	`v1.0.0`	`go.mod`
`github.com/containerd/errdefs/pkg`	`v0.3.0`	`go.mod`
`github.com/containerd/fifo`	`v1.1.0`	`go.mod`
`github.com/containerd/log`	`v0.2.0`	`go.mod`
`github.com/containerd/log/otel`	`v0.1.0`	`go.mod`
`github.com/containerd/platforms`	`v1.0.0-rc.5`	`go.mod`
`github.com/containerd/plugin`	`v1.1.0`	`go.mod`
`github.com/containerd/ttrpc`	`v1.2.10`	`go.mod`
`github.com/containerd/typeurl/v2`	`v2.3.0`	`go.mod`
`github.com/CycloneDX/cyclonedx-go`	`v0.12.0`	`go.mod`
`github.com/cyphar/filepath-securejoin`	`v0.7.0`	`go.mod`
`github.com/DataDog/zstd`	`v1.5.5`	`go.mod`
`github.com/davecgh/go-spew`	`v1.1.2-0.20180830191138-d8f796af33cc`	`go.mod`
`github.com/decred/dcrd/dcrec/secp256k1/v4`	`v4.4.1`	`go.mod`
`github.com/distribution/reference`	`v0.6.0`	`go.mod`
`github.com/dlclark/regexp2`	`v1.11.0`	`go.mod`
`github.com/docker/cli`	`v29.8.2+incompatible`	`go.mod`
`github.com/docker/docker-credential-helpers`	`v0.9.9`	`go.mod`
`github.com/docker/go-connections`	`v0.8.1`	`go.mod`
`github.com/docker/go-units`	`v0.5.0`	`go.mod`
`github.com/dsnet/compress`	`v0.0.2-0.20230904184137-39efe44ab707`	`go.mod`
`github.com/dustin/go-humanize`	`v1.1.0`	`go.mod`
`github.com/dylibso/observe-sdk/go`	`v0.0.0-20240819160327-2d926c5d788a`	`go.mod`
`github.com/emicklei/go-restful/v3`	`v3.13.0`	`go.mod`
`github.com/emirpasic/gods`	`v1.18.1`	`go.mod`
`github.com/envoyproxy/go-control-plane/envoy`	`v1.37.0`	`go.mod`
`github.com/envoyproxy/protoc-gen-validate`	`v1.3.3`	`go.mod`
`github.com/evanphx/json-patch`	`v5.9.11+incompatible`	`go.mod`
`github.com/evanphx/json-patch/v5`	`v5.9.11`	`go.mod`
`github.com/exponent-io/jsonpath`	`v0.0.0-20210407135951-1de76d718b3f`	`go.mod`
`github.com/extism/go-sdk`	`v1.7.1`	`go.mod`
`github.com/fatih/color`	`v1.19.0`	`go.mod`
`github.com/felixge/httpsnoop`	`v1.1.0`	`go.mod`
`github.com/fluxcd/cli-utils`	`v1.2.2`	`go.mod`
`github.com/fsnotify/fsnotify`	`v1.10.1`	`go.mod`
`github.com/fvbommel/sortorder`	`v1.2.0`	`go.mod`
`github.com/fxamacker/cbor/v2`	`v2.9.4`	`go.mod`
`github.com/go-errors/errors`	`v1.5.1`	`go.mod`
`github.com/go-git/gcfg`	`v1.5.1-0.20230307220236-3a3c6141e376`	`go.mod`
`github.com/go-git/go-billy/v5`	`v5.9.2`	`go.mod`
`github.com/go-git/go-git/v5`	`v5.19.3`	`go.mod`
`github.com/go-gorp/gorp/v3`	`v3.1.0`	`go.mod`
`github.com/go-jose/go-jose/v4`	`v4.1.6`	`go.mod`
`github.com/go-logr/logr`	`v1.4.4`	`go.mod`
`github.com/go-logr/stdr`	`v1.2.2`	`go.mod`
`github.com/go-logr/zapr`	`v1.3.0`	`go.mod`
`github.com/go-openapi/analysis`	`v1.0.0`	`go.mod`
`github.com/go-openapi/errors`	`v0.22.9`	`go.mod`
`github.com/go-openapi/jsonpointer`	`v1.0.1`	`go.mod`
`github.com/go-openapi/jsonreference`	`v1.0.1`	`go.mod`
`github.com/go-openapi/loads`	`v0.25.2`	`go.mod`
`github.com/go-openapi/runtime`	`v0.33.2`	`go.mod`
`github.com/go-openapi/runtime/server-middleware`	`v0.33.2`	`go.mod`
`github.com/go-openapi/spec`	`v1.0.0`	`go.mod`
`github.com/go-openapi/strfmt`	`v0.27.2`	`go.mod`
`github.com/go-openapi/swag`	`v0.29.2`	`go.mod`
`github.com/go-openapi/swag/cmdutils`	`v0.29.2`	`go.mod`
`github.com/go-openapi/swag/conv`	`v0.29.2`	`go.mod`
`github.com/go-openapi/swag/fileutils`	`v0.29.2`	`go.mod`
`github.com/go-openapi/swag/jsonutils`	`v0.29.2`	`go.mod`
`github.com/go-openapi/swag/loading`	`v0.29.2`	`go.mod`
`github.com/go-openapi/swag/mangling`	`v0.29.2`	`go.mod`
`github.com/go-openapi/swag/netutils`	`v0.29.2`	`go.mod`
`github.com/go-openapi/swag/pools`	`v0.29.2`	`go.mod`
`github.com/go-openapi/swag/stringutils`	`v0.29.2`	`go.mod`
`github.com/go-openapi/swag/typeutils`	`v0.29.2`	`go.mod`
`github.com/go-openapi/swag/yamlutils`	`v0.29.2`	`go.mod`
`github.com/go-openapi/validate`	`v1.0.0`	`go.mod`
`github.com/go-task/slim-sprig/v3`	`v3.0.0`	`go.mod`
`github.com/go-viper/mapstructure/v2`	`v2.5.0`	`go.mod`
`github.com/gobwas/glob`	`v1.0.0`	`go.mod`
`github.com/goccy/go-json`	`v0.11.2`	`go.mod`
`github.com/gocsaf/csaf/v3`	`v3.6.0`	`go.mod`
`github.com/gofrs/flock`	`v0.13.1`	`go.mod`
`github.com/gogo/protobuf`	`v1.3.2`	`go.mod`
`github.com/golang-jwt/jwt/v5`	`v5.3.1`	`go.mod`
`github.com/golang/groupcache`	`v0.0.0-20241129210726-2c02b8208cf8`	`go.mod`
`github.com/google/btree`	`v1.1.3`	`go.mod`
`github.com/google/gnostic-models`	`v0.7.0`	`go.mod`
`github.com/google/go-cmp`	`v0.7.0`	`go.mod`
`github.com/google/go-containerregistry`	`v0.22.1`	`go.mod`
`github.com/google/go-github/v62`	`v62.0.0`	`go.mod`
`github.com/google/go-querystring`	`v1.1.0`	`go.mod`
`github.com/google/jsonschema-go`	`v0.4.3`	`go.mod`
`github.com/google/licenseclassifier/v2`	`v2.0.0`	`go.mod`
`github.com/google/pprof`	`v0.0.0-20260402051712-545e8a4df936`	`go.mod`
`github.com/google/s2a-go`	`v0.1.10`	`go.mod`
`github.com/google/uuid`	`v1.6.0`	`go.mod`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.22`	`go.mod`
`github.com/googleapis/gax-go/v2`	`v2.24.1`	`go.mod`
`github.com/GoogleCloudPlatform/docker-credential-gcr/v2`	`v2.2.1`	`go.mod`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.34.0`	`go.mod`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric`	`v0.57.0`	`go.mod`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping`	`v0.57.0`	`go.mod`
`github.com/gorhill/cronexpr`	`v0.0.0-20180427100037-88b0669f7d75`	`go.mod`
`github.com/gosuri/uitable`	`v0.0.4`	`go.mod`
`github.com/grpc-ecosystem/grpc-gateway/v2`	`v2.31.0`	`go.mod`
`github.com/hashicorp/aws-sdk-go-base/v2`	`v2.0.0-beta.74`	`go.mod`
`github.com/hashicorp/errwrap`	`v1.1.0`	`go.mod`
`github.com/hashicorp/go-cleanhttp`	`v0.5.2`	`go.mod`
`github.com/hashicorp/go-getter`	`v1.8.10`	`go.mod`
`github.com/hashicorp/go-multierror`	`v1.1.1`	`go.mod`
`github.com/hashicorp/go-retryablehttp`	`v0.7.8`	`go.mod`
`github.com/hashicorp/go-uuid`	`v1.0.4`	`go.mod`
`github.com/hashicorp/go-version`	`v1.9.0`	`go.mod`
`github.com/hashicorp/golang-lru/v2`	`v2.0.7`	`go.mod`
`github.com/hashicorp/hcl/v2`	`v2.25.0`	`go.mod`
`github.com/huandu/xstrings`	`v1.6.2`	`go.mod`
`github.com/ianlancetaylor/demangle`	`v0.0.0-20250417193237-f615e6bd150b`	`go.mod`
`github.com/in-toto/attestation`	`v1.2.0`	`go.mod`
`github.com/in-toto/in-toto-golang`	`v0.11.0`	`go.mod`
`github.com/inconshreveable/mousetrap`	`v1.1.0`	`go.mod`
`github.com/Intevation/gval`	`v1.3.0`	`go.mod`
`github.com/Intevation/jsonpath`	`v0.2.1`	`go.mod`
`github.com/jbenet/go-context`	`v0.0.0-20150711004518-d14ea06fba99`	`go.mod`
`github.com/jmoiron/sqlx`	`v1.4.0`	`go.mod`
`github.com/josephburnett/jd/v2`	`v2.3.0`	`go.mod`
`github.com/json-iterator/go`	`v1.1.12`	`go.mod`
`github.com/kevinburke/ssh_config`	`v1.2.0`	`go.mod`
`github.com/klauspost/compress`	`v1.20.1`	`go.mod`
`github.com/knqyf263/go-apk-version`	`v0.0.0-20200609155635-041fdbb8563f`	`go.mod`
`github.com/knqyf263/go-deb-version`	`v0.0.0-20241115132648-6f4aee6ccd23`	`go.mod`
`github.com/knqyf263/go-rpm-version`	`v0.0.0-20260811110310-1815e1f1b790`	`go.mod`
`github.com/knqyf263/go-rpmdb`	`v0.1.1`	`go.mod`
`github.com/knqyf263/nested`	`v0.0.1`	`go.mod`
`github.com/kylelemons/godebug`	`v1.1.0`	`go.mod`
`github.com/lann/builder`	`v0.0.0-20180802200727-47ae307949d0`	`go.mod`
`github.com/lann/ps`	`v0.0.0-20150810152359-62de8c46ede0`	`go.mod`
`github.com/lestrrat-go/blackmagic`	`v1.0.4`	`go.mod`
`github.com/lestrrat-go/dsig`	`v1.4.0`	`go.mod`
`github.com/lestrrat-go/dsig-secp256k1`	`v1.0.0`	`go.mod`
`github.com/lestrrat-go/httpcc`	`v1.0.1`	`go.mod`
`github.com/lestrrat-go/httprc/v3`	`v3.0.6`	`go.mod`
`github.com/lestrrat-go/jwx/v3`	`v3.3.0`	`go.mod`
`github.com/lestrrat-go/option/v2`	`v2.0.0`	`go.mod`
`github.com/liamg/memoryfs`	`v1.6.0`	`go.mod`
`github.com/lib/pq`	`v1.12.3`	`go.mod`
`github.com/liggitt/tabwriter`	`v0.0.0-20181228230101-89fcab3d43de`	`go.mod`
`github.com/lunixbochs/struc`	`v0.0.0-20200707160740-784aaebc1d40`	`go.mod`
`github.com/magefile/mage`	`v1.17.2`	`go.mod`
`github.com/MakeNowJust/heredoc`	`v1.0.0`	`go.mod`
`github.com/masahiro331/go-disk`	`v0.0.0-20260423015231-f7a470ebd472`	`go.mod`
`github.com/masahiro331/go-ebs-file`	`v0.0.0-20260422020928-9d24e29aac27`	`go.mod`
`github.com/masahiro331/go-ext4-filesystem`	`v0.0.0-20260423010602-fe51f5b5e52b`	`go.mod`
`github.com/masahiro331/go-mvn-version`	`v0.0.0-20260119054159-d21fcd2e7de1`	`go.mod`
`github.com/masahiro331/go-vmdk-parser`	`v0.0.0-20260423020818-08305fa668d2`	`go.mod`
`github.com/masahiro331/go-xfs-filesystem`	`v0.0.0-20260422061116-d21e5e4481bb`	`go.mod`
`github.com/Masterminds/goutils`	`v1.1.1`	`go.mod`
`github.com/Masterminds/semver/v3`	`v3.5.0`	`go.mod`
`github.com/Masterminds/sprig/v3`	`v3.3.0`	`go.mod`
`github.com/Masterminds/squirrel`	`v1.5.4`	`go.mod`
`github.com/mattn/go-colorable`	`v0.1.15`	`go.mod`
`github.com/mattn/go-isatty`	`v0.0.24`	`go.mod`
`github.com/mattn/go-runewidth`	`v0.0.30`	`go.mod`
`github.com/mattn/go-shellwords`	`v1.0.16`	`go.mod`
`github.com/Microsoft/go-winio`	`v0.6.3-0.20251027160822-ad3df93bed29`	`go.mod`
`github.com/Microsoft/hcsshim`	`v0.15.0-rc.4`	`go.mod`
`github.com/mitchellh/copystructure`	`v1.2.0`	`go.mod`
`github.com/mitchellh/go-homedir`	`v1.1.0`	`go.mod`
`github.com/mitchellh/go-wordwrap`	`v1.0.1`	`go.mod`
`github.com/mitchellh/hashstructure/v2`	`v2.0.2`	`go.mod`
`github.com/mitchellh/mapstructure`	`v1.5.1-0.20231216201459-8508981c8b6c`	`go.mod`
`github.com/mitchellh/reflectwalk`	`v1.0.2`	`go.mod`
`github.com/moby/buildkit`	`v0.34.0`	`go.mod`
`github.com/moby/docker-image-spec`	`v1.3.1`	`go.mod`
`github.com/moby/locker`	`v1.0.1`	`go.mod`
`github.com/moby/moby/api`	`v1.56.1`	`go.mod`
`github.com/moby/moby/client`	`v0.6.1`	`go.mod`
`github.com/moby/sys/atomicwriter`	`v0.1.0`	`go.mod`
`github.com/moby/sys/mountinfo`	`v0.7.2`	`go.mod`
`github.com/moby/sys/sequential`	`v0.7.0`	`go.mod`
`github.com/moby/sys/signal`	`v0.7.1`	`go.mod`
`github.com/moby/sys/user`	`v0.4.1`	`go.mod`
`github.com/moby/sys/userns`	`v0.2.1`	`go.mod`
`github.com/moby/term`	`v0.5.2`	`go.mod`
`github.com/modern-go/concurrent`	`v0.0.0-20180306012644-bacd9c7ef1dd`	`go.mod`
`github.com/modern-go/reflect2`	`v1.0.3-0.20250322232337-35a7c28c31ee`	`go.mod`
`github.com/monochromegane/go-gitignore`	`v0.0.0-20200626010858-205db1a8cc00`	`go.mod`
`github.com/morikuni/aec`	`v1.1.0`	`go.mod`
`github.com/munnerz/goautoneg`	`v0.0.0-20191010083416-a7dc8b61c822`	`go.mod`
`github.com/nikolalohinski/gonja/v2`	`v2.9.1`	`go.mod`
`github.com/oklog/ulid/v2`	`v2.1.2`	`go.mod`
`github.com/onsi/ginkgo/v2`	`v2.33.1`	`go.mod`
`github.com/onsi/gomega`	`v1.44.0`	`go.mod`
`github.com/open-policy-agent/opa`	`v1.21.1`	`go.mod`
`github.com/opencontainers/go-digest`	`v1.0.0`	`go.mod`
`github.com/opencontainers/image-spec`	`v1.1.1`	`go.mod`
`github.com/opencontainers/runtime-spec`	`v1.3.0`	`go.mod`
`github.com/openshift/api`	`v0.0.0-20231025170628-b8a18fdc040d`	`go.mod`
`github.com/openvex/go-vex`	`v0.2.9`	`go.mod`
`github.com/owenrumney/go-sarif/v2`	`v2.3.3`	`go.mod`
`github.com/owenrumney/squealer`	`v1.2.12`	`go.mod`
`github.com/package-url/packageurl-go`	`v0.1.7`	`go.mod`
`github.com/pandatix/go-cvss`	`v0.6.2`	`go.mod`
`github.com/pelletier/go-toml/v2`	`v2.4.3`	`go.mod`
`github.com/peterbourgon/diskv`	`v2.0.1+incompatible`	`go.mod`
`github.com/pjbgf/sha1cd`	`v0.7.0`	`go.mod`
`github.com/pkg/browser`	`v0.0.0-20240102092130-5ac0b6a4141c`	`go.mod`
`github.com/pkg/errors`	`v0.9.1`	`go.mod`
`github.com/planetscale/vtprotobuf`	`v0.6.1-0.20240319094008-0393e58bdf10`	`go.mod`
`github.com/pmezard/go-difflib`	`v1.0.1-0.20181226105442-5d4384ee4fb2`	`go.mod`
`github.com/prometheus/client_golang`	`v1.25.0`	`go.mod`
`github.com/prometheus/client_model`	`v0.6.3`	`go.mod`
`github.com/prometheus/common`	`v0.72.0`	`go.mod`
`github.com/prometheus/procfs`	`v0.22.0`	`go.mod`
`github.com/ProtonMail/go-crypto`	`v1.5.2`	`go.mod`
`github.com/quasilyte/go-ruleguard/dsl`	`v0.3.23`	`go.mod`
`github.com/rcrowley/go-metrics`	`v0.0.0-20250401214520-65e299d6c5c9`	`go.mod`
`github.com/redis/go-redis/extra/rediscmd/v9`	`v9.5.3`	`go.mod`
`github.com/redis/go-redis/v9`	`v9.23.0`	`go.mod`
`github.com/rubenv/sql-migrate`	`v1.8.1`	`go.mod`
`github.com/russross/blackfriday/v2`	`v2.1.0`	`go.mod`
`github.com/rust-secure-code/go-rustaudit`	`v0.0.0-20250226111315-e20ec32e963c`	`go.mod`
`github.com/sagikazarmark/locafero`	`v0.12.0`	`go.mod`
`github.com/samber/lo`	`v1.53.0`	`go.mod`
`github.com/samber/oops`	`v1.18.1`	`go.mod`
`github.com/santhosh-tekuri/jsonschema/v6`	`v6.0.3`	`go.mod`
`github.com/sassoftware/go-rpmutils`	`v0.4.0`	`go.mod`
`github.com/secure-systems-lab/go-securesystemslib`	`v0.11.1`	`go.mod`
`github.com/segmentio/asm`	`v1.2.1`	`go.mod`
`github.com/sergi/go-diff`	`v1.4.0`	`go.mod`
`github.com/shibumi/go-pathspec`	`v1.3.0`	`go.mod`
`github.com/shopspring/decimal`	`v1.4.0`	`go.mod`
`github.com/sigstore/protobuf-specs`	`v0.5.1`	`go.mod`
`github.com/sigstore/rekor`	`v1.5.4`	`go.mod`
`github.com/sigstore/sigstore`	`v1.10.9`	`go.mod`
`github.com/sirupsen/logrus`	`v1.10.2`	`go.mod`
`github.com/skeema/knownhosts`	`v1.3.1`	`go.mod`
`github.com/spdx/tools-golang`	`v0.5.7`	`go.mod`
`github.com/spf13/afero`	`v1.15.0`	`go.mod`
`github.com/spf13/cast`	`v1.10.0`	`go.mod`
`github.com/spf13/cobra`	`v1.10.2`	`go.mod`
`github.com/spf13/pflag`	`v1.0.10`	`go.mod`
`github.com/spf13/viper`	`v1.21.0`	`go.mod`
`github.com/spiffe/go-spiffe/v2`	`v2.8.1`	`go.mod`
`github.com/stretchr/objx`	`v0.5.3`	`go.mod`
`github.com/stretchr/testify`	`v1.12.1`	`go.mod`
`github.com/subosito/gotenv`	`v1.6.0`	`go.mod`
`github.com/tchap/go-patricia/v2`	`v2.3.3`	`go.mod`
`github.com/tetratelabs/wabin`	`v0.0.0-20230304001439-f6f874872834`	`go.mod`
`github.com/tetratelabs/wazero`	`v1.12.0`	`go.mod`
`github.com/tonistiigi/go-csvvalue`	`v0.0.0-20240814133006-030d3b2625d0`	`go.mod`
`github.com/toqueteos/webbrowser`	`v1.2.1`	`go.mod`
`github.com/twitchtv/twirp`	`v8.1.3+incompatible`	`go.mod`
`github.com/ulikunitz/xz`	`v0.5.17`	`go.mod`
`github.com/valyala/fastjson`	`v1.6.10`	`go.mod`
`github.com/vektah/gqlparser/v2`	`v2.5.59`	`go.mod`
`github.com/VividCortex/ewma`	`v1.2.0`	`go.mod`
`github.com/vmihailenco/msgpack/v5`	`v5.4.1`	`go.mod`
`github.com/vmihailenco/tagparser/v2`	`v2.0.0`	`go.mod`
`github.com/x448/float16`	`v0.8.4`	`go.mod`
`github.com/xanzy/ssh-agent`	`v0.3.3`	`go.mod`
`github.com/xeipuuv/gojsonpointer`	`v0.0.0-20190905194746-02993c407bfb`	`go.mod`
`github.com/xeipuuv/gojsonreference`	`v0.0.0-20180127040603-bd5ef7bd5415`	`go.mod`
`github.com/xi2/xz`	`v0.0.0-20171230120015-48954b6210f8`	`go.mod`
`github.com/xlab/treeprint`	`v1.2.0`	`go.mod`
`github.com/yashtewari/glob-intersection`	`v0.2.0`	`go.mod`
`github.com/youmark/pkcs8`	`v0.0.0-20240726163527-a2c0da244d78`	`go.mod`
`github.com/zclconf/go-cty`	`v1.19.0`	`go.mod`
`github.com/zclconf/go-cty-yaml`	`v1.2.0`	`go.mod`
`go.etcd.io/bbolt`	`v1.5.0`	`go.mod`
`go.opentelemetry.io/auto/sdk`	`v1.2.1`	`go.mod`
`go.opentelemetry.io/contrib/detectors/gcp`	`v1.44.0`	`go.mod`
`go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc`	`v0.71.0`	`go.mod`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.71.0`	`go.mod`
`go.opentelemetry.io/otel`	`v1.46.0`	`go.mod`
`go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`	`v1.46.0`	`go.mod`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace`	`v1.46.0`	`go.mod`
`go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`	`v1.46.0`	`go.mod`
`go.opentelemetry.io/otel/metric`	`v1.46.0`	`go.mod`
`go.opentelemetry.io/otel/sdk`	`v1.46.0`	`go.mod`
`go.opentelemetry.io/otel/sdk/metric`	`v1.46.0`	`go.mod`
`go.opentelemetry.io/otel/trace`	`v1.46.0`	`go.mod`
`go.opentelemetry.io/proto/otlp`	`v1.11.1`	`go.mod`
`go.uber.org/atomic`	`v1.12.0`	`go.mod`
`go.uber.org/automaxprocs`	`v1.6.0`	`go.mod`
`go.uber.org/multierr`	`v1.11.0`	`go.mod`
`go.uber.org/zap`	`v1.28.0`	`go.mod`
`go.yaml.in/yaml/v2`	`v2.4.4`	`go.mod`
`go.yaml.in/yaml/v3`	`v3.0.5`	`go.mod`
`go.yaml.in/yaml/v4`	`v4.0.0-rc.3`	`go.mod`
`golang.org/x/crypto`	`v0.58.0`	`go.mod`
`golang.org/x/exp`	`v0.0.0-20260908205506-85c1c2202aba`	`go.mod`
`golang.org/x/mod`	`v0.41.0`	`go.mod`
`golang.org/x/net`	`v0.62.0`	`go.mod`
`golang.org/x/oauth2`	`v0.37.0`	`go.mod`
`golang.org/x/sync`	`v0.24.0`	`go.mod`
`golang.org/x/sys`	`v0.49.0`	`go.mod`
`golang.org/x/term`	`v0.47.0`	`go.mod`
`golang.org/x/text`	`v0.43.0`	`go.mod`
`golang.org/x/time`	`v0.16.0`	`go.mod`
`golang.org/x/tools`	`v0.51.0`	`go.mod`
`golang.org/x/xerrors`	`v0.0.0-20240903120638-7835f813f4da`	`go.mod`
`gomodules.xyz/jsonpatch/v2`	`v2.4.0`	`go.mod`
`google.golang.org/api`	`v0.299.0`	`go.mod`
`google.golang.org/genproto`	`v0.0.0-20260715232425-e75dac1f907d`	`go.mod`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260928230214-8a89bd6388cc`	`go.mod`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260928230214-8a89bd6388cc`	`go.mod`
`google.golang.org/grpc`	`v1.84.0`	`go.mod`
`google.golang.org/protobuf`	`v1.36.12`	`go.mod`
`gopkg.in/evanphx/json-patch.v4`	`v4.13.0`	`go.mod`
`gopkg.in/inf.v0`	`v0.9.1`	`go.mod`
`gopkg.in/ini.v1`	`v1.67.3`	`go.mod`
`gopkg.in/warnings.v0`	`v0.1.2`	`go.mod`
`gopkg.in/yaml.v3`	`v3.0.1`	`go.mod`
`helm.sh/helm/v4`	`v4.3.0`	`go.mod`
`k8s.io/api`	`v0.37.1`	`go.mod`
`k8s.io/apiextensions-apiserver`	`v0.37.0`	`go.mod`
`k8s.io/apimachinery`	`v0.37.1`	`go.mod`
`k8s.io/apiserver`	`v0.37.0`	`go.mod`
`k8s.io/cli-runtime`	`v0.37.0`	`go.mod`
`k8s.io/client-go`	`v0.37.0`	`go.mod`
`k8s.io/component-base`	`v0.37.0`	`go.mod`
`k8s.io/klog/v2`	`v2.140.0`	`go.mod`
`k8s.io/kube-openapi`	`v0.0.0-20260721132016-d427ff9ee9ad`	`go.mod`
`k8s.io/kubectl`	`v0.37.0`	`go.mod`
`k8s.io/utils`	`v0.0.0-20260626114624-be93311217bd`	`go.mod`
`mvdan.cc/sh/v3`	`v3.13.1`	`go.mod`
`oras.land/oras-go/v2`	`v2.6.2`	`go.mod`
`sigs.k8s.io/controller-runtime`	`v0.24.1`	`go.mod`
`sigs.k8s.io/json`	`v0.0.0-20250730193827-2d320260d730`	`go.mod`
`sigs.k8s.io/kustomize/api`	`v0.21.1`	`go.mod`
`sigs.k8s.io/kustomize/kyaml`	`v0.21.1`	`go.mod`
`sigs.k8s.io/randfill`	`v1.0.0`	`go.mod`
`sigs.k8s.io/structured-merge-diff/v6`	`v6.4.2`	`go.mod`
`sigs.k8s.io/yaml`	`v1.6.0`	`go.mod`

github (21)

Name	Version	Declared in
`actions/checkout`	`v4`	`.github/workflows/build.yaml`
`actions/checkout`	`v6.0.2`	`.github/workflows/zizmor.yaml`
`actions/create-github-app-token`	`v3.2.0`	`.github/workflows/publish-helm-chart.yaml`
`actions/setup-go`	`v6`	`.github/workflows/build.yaml`
`actions/setup-python`	`5`	`.github/workflows/publish-docs.yaml`
`actions/setup-python`	`v5.6.0`	`.github/workflows/chart-testing.yaml`
`aquaproj/aqua-installer`	`v4.0.0`	`.github/workflows/build.yaml`
`aquasecurity/trivy-action`	`97e0b3872f55f89b95b2f65b3dbab56962816478`	`.github/workflows/release-snapshot.yaml`
`codecov/codecov-action`	`v5`	`.github/workflows/build.yaml`
`docker/login-action`	`v3.4.0`	`.github/workflows/release.yaml`
`docker/setup-buildx-action`	`v3`	`.github/workflows/build.yaml`
`docker/setup-qemu-action`	`v3`	`.github/workflows/build.yaml`
`engineerd/setup-kind`	`v0.6.2`	`.github/workflows/build.yaml`
`golangci/golangci-lint-action`	`v9.2.0`	`.github/workflows/build.yaml`
`goreleaser/goreleaser-action`	`v6`	`.github/workflows/build.yaml`
`helm/chart-testing-action`	`v2.7.0`	`.github/workflows/chart-testing.yaml`
`ibiqlik/action-yamllint`	`v3`	`.github/workflows/build.yaml`
`mikefarah/yq`	`88a31ae8c6b34aad77d2efdecc146113cb3315d0`	`.github/workflows/chart-testing.yaml`
`peter-evans/repository-dispatch`	`v3`	`.github/workflows/release.yaml`
`sigstore/cosign-installer`	`v3.8.2`	`.github/workflows/release-snapshot.yaml`
`zizmorcore/zizmor-action`	`v0.5.2`	`.github/workflows/zizmor.yaml`

History

Week	Version	Dependencies	Critical	High	Medium	Low	Unknown	Changes
2026-11-02	v0.36.1	425	0	0	0	0	1	—
2026-11-01	v0.36.1	425	0	0	0	0	1	—

SBOM minimum elements

Scored by sbomlyze on the generated source SBOM. A source SBOM usually lacks supplier and hash data, so these scores mostly reflect what the project's manifests declare.

Standard	Score	Checks passed	Failed checks
NTIA 2021	71	5/7	Supplier Name, Dependency Relationship
CISA 2025	50	5/10	Software Producer, Dependency Relationship, License Information, Component Hash, SBOM Author
BSI TR-03183	44	4/9	Component Creator, Distribution Licences, SHA-512 Hash, Dependency Relationship, SBOM Creator Contact

Evidence

Downloads for this week: CycloneDX SBOM · Grype report

Permanent copy of the raw SBOM, Grype, OSV-Scanner, and govulncheck output and release checks: release report-2026-11-02, folder supply-chain-shard-*/aquasecurity__trivy-operator/.

11 manifests and lockfiles scanned

.github/workflows/build.yaml, .github/workflows/chart-testing.yaml, .github/workflows/publish-docs.yaml, .github/workflows/publish-helm-chart.yaml, .github/workflows/release-snapshot.yaml, .github/workflows/release.yaml, .github/workflows/title-validation.yaml, .github/workflows/validate-chart-appVersion.yaml, .github/workflows/zizmor.yaml, go.mod, go.sum

Full JSON for this project · Atom feed of weekly changes

Badges

shields.io endpoints refreshed with each weekly scan. They report this week's result for the latest release, nothing more.

[![release verification](https://img.shields.io/endpoint?url=https%3A%2F%2Frezmoss.github.io%2Fawesome-security-pipeline%2Fbadges%2Faquasecurity%2Ftrivy-operator%2Frelease.json)](https://rezmoss.github.io/awesome-security-pipeline/projects/aquasecurity/trivy-operator/index.html)
[![vulnerable code in binary](https://img.shields.io/endpoint?url=https%3A%2F%2Frezmoss.github.io%2Fawesome-security-pipeline%2Fbadges%2Faquasecurity%2Ftrivy-operator%2Fin-binary.json)](https://rezmoss.github.io/awesome-security-pipeline/projects/aquasecurity/trivy-operator/index.html)

How this report is made

Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.

Tool	What it does here	Version this week
Syft	Generates a CycloneDX SBOM from each release's manifests and lockfiles.	1.55.0
Grype	Matches the SBOM against known vulnerabilities.	0.121.0
OSV-Scanner	Checks the same files against the OSV database to confirm or add matches.	2.7.0
govulncheck	For Go tools, finds which advisories have vulnerable code compiled into the released Linux binary.	1.9.0
zizmor	Audits the project's GitHub Actions workflows for injection, unpinned actions, and excessive permissions.	1.31.1
OpenSSF Scorecard	Scores repository security practices such as code review, branch protection, and pinned dependencies.	5.6.0
Cosign	Verifies Sigstore signatures on the release binary or its checksums file.	3.1.4
slsa-verifier	Verifies SLSA build provenance published with the release.	2.7.1
GitHub CLI attestations	Verifies GitHub artifact attestations for the release binary.	—
sbomlyze	Diffs each SBOM against last week and scores NTIA, CISA, and BSI minimum elements. Maintained by this repository's maintainer.	0.6.0