chore(deps): bump github.com/aquasecurity/trivy from 0.55.2 to 0.56.1

[dependabot]

Trivy 0.56.1 can handle multiple vulnerability DB repositories and java DB repositories.

• feat: support multiple DB repositories for vulnerability and Java DB aquasecurity/trivy#7605

Main change is Vuls now handles multiple DBs in report subcommand by

• add TrivyConf.TrivyDBRepositories
  • corresponds to newly created command line option "-trivy-db-repository"
• add TrivyConf.TrivyJavaDBRepositories
  • corresponds to existing command line option "-trivy-java-db-repository"
    • comma-separated list of strings
    • compatible to the previous single-value option
  • TrivyConf.TrivyJavaDBRepository is left untouched for backword compatibility

Additonal changes:

• Also, tui subcommand has above configs and missing options.
• vulnerability db path is now defaulted to ~/.cache/trivy/db/
  • because at some piont (i forgot), trivy added "db/" to the vulnerability db path

Command line examples:

vuls report -trivy-db-repository=ghcr.io/aquasecurity/trivy-db:2,public.ecr.aws/aquasecurity/trivy-db:2

vuls report --trivy-java-db-repository=ghcr.io/aquasecurity/trivy-java-db:1,public.ecr.aws/aquasecurity/trivy-java-db:1

---

Bumps github.com/aquasecurity/trivy from 0.55.2 to 0.56.1.

Release notes

Sourced from github.com/aquasecurity/trivy's releases.

v0.56.1

Changelog

• 95dbf1152b2049a6ae2ae90a507630df01798bf1 release: v0.56.1 [release/v0.56] (#7648)
• 5dbdadfe4578288d5c3f2a5b625fff4a3580f8c5 fix(db): fix javadb downloading error handling [backport: release/v0.56] (#7646)

v0.56.0

⚡Release highlights and summary⚡

👉aquasecurity/trivy#7640

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0560-2024-10-03

Changelog

Sourced from github.com/aquasecurity/trivy's changelog.

0.56.1 (2024-10-03)

Bug Fixes

• db: fix javadb downloading error handling [backport: release/v0.56] (#7646) (5dbdadf)

0.56.0 (2024-10-03)

Features

• java: add empty versions if pom.xml dependency versions can't be detected (#7520) (b836232)
• license: improve license normalization (#7131) (6472e3c)
• misconf: add ability to disable checks by ID (#7536) (ef0a27d)
• misconf: Register checks only when needed (#7435) (f768d3a)
• misconf: Support --skip-* for all included modules (#7579) (c0e8da3)
• secret: enhance secret scanning for python binary files (#7223) (60725f8)
• support multiple DB repositories for vulnerability and Java DB (#7605) (3562529)
• support RPM archives (#7628) (69bf7e0)
• suse: added SUSE Linux Enterprise Micro support (#7294) (efdb68d)

Bug Fixes

• allow access to '..' in mapfs (#7575) (a8fbe46)
• db: check DownloadedAt for trivy-java-db (#7592) (13ef3e7)
• java: use dependencyManagement from root/child pom's for dependencies from parents (#7497) (5442949)
• license: stop spliting a long license text (#7336) (4926da7)
• misconf: Disable deprecated checks by default (#7632) (82e2adc)
• misconf: disable DS016 check for image history analyzer (#7540) (de40df9)
• misconf: escape all special sequences (#7558) (ea0cf03)
• misconf: Fix logging typo (#7473) (56db43c)
• misconf: Fixed scope for China Cloud (#7560) (37d549e)
• misconf: not to warn about missing selectors of libraries (#7638) (fcaea74)
• oracle: Update EOL date for Oracle 7 (#7480) (dd0a64a)
• report: change a receiver of MarshalJSON (#7483) (927c6e0)
• report: fix error with unmarshal of ExperimentalModifiedFindings (#7463) (7ff9aff)
• sbom: export bom-ref when converting a package to a component (#7340) (5dd94eb)
• sbom: parse type framework as library when unmarshalling CycloneDX files (#7527) (aeb7039)
• secret: change grafana token regex to find them without unquoted (#7627) (3e1fa21)

Performance Improvements

• misconf: use port ranges instead of enumeration (#7549) (1f9fc13)

Reverts

... (truncated)

Commits

• 95dbf11 release: v0.56.1 [release/v0.56] (#7648)
• 5dbdadf fix(db): fix javadb downloading error handling [backport: release/v0.56] (#7646)
• d246401 release: v0.56.0 [main] (#7447)
• fcaea74 fix(misconf): not to warn about missing selectors of libraries (#7638)
• 69bf7e0 feat: support RPM archives (#7628)
• 3e1fa21 fix(secret): change grafana token regex to find them without unquoted (#7627)
• 8735242 chore(deps): Bump trivy-checks to v1.1.0 (#7631)
• 82e2adc fix(misconf): Disable deprecated checks by default (#7632)
• 1faf529 chore: add prefixes to log messages (#7625)
• c0e8da3 feat(misconf): Support --skip-* for all included modules (#7579)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
github.com/aquasecurity/trivy	[>= 0.50.2.a, < 0.50.3]
github.com/aquasecurity/trivy	[< 0.51, > 0.50.1]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[shino]

Execution example:

% ./vuls report -config config.toml -refresh-cve -trivy-db-repository=ghcr.io/aquasecurity/trivy-db:2,public.ecr.aws/aquasecurity/trivy-db:2
[Oct  8 17:18:30]  INFO [localhost] vuls-v0.26.0-build-20241008_145646_aa21f61
[Oct  8 17:18:30]  INFO [localhost] Validating config...
[Oct  8 17:18:30]  INFO [localhost] cveDict.type=sqlite3, cveDict.url=, cveDict.SQLite3Path=/data/vulsctl/docker/cve.sqlite3
[Oct  8 17:18:30]  INFO [localhost] ovalDict.type=sqlite3, ovalDict.url=, ovalDict.SQLite3Path=/data/vulsctl/docker/oval.sqlite3
[Oct  8 17:18:30]  INFO [localhost] gost.type=sqlite3, gost.url=, gost.SQLite3Path=/data/vulsctl/docker/gost.sqlite3
[Oct  8 17:18:30]  INFO [localhost] exploit.type=sqlite3, exploit.url=, exploit.SQLite3Path=/data/vulsctl/docker/go-exploitdb.sqlite3
[Oct  8 17:18:30]  INFO [localhost] metasploit.type=sqlite3, metasploit.url=, metasploit.SQLite3Path=/data/vulsctl/docker/go-msfdb.sqlite3
[Oct  8 17:18:30]  INFO [localhost] kevuln.type=sqlite3, kevuln.url=, kevuln.SQLite3Path=/data/vulsctl/docker/go-kev.sqlite3
[Oct  8 17:18:30]  INFO [localhost] cti.type=sqlite3, cti.url=, cti.SQLite3Path=/data/vulsctl/docker/go-cti.sqlite3
[Oct  8 17:18:30]  INFO [localhost] Loaded: /home/shino/g/vuls/results/2024-10-08T15-14-21+0900
[Oct  8 17:18:30]  INFO [localhost] Updating library db...
[Oct  8 17:18:30]  INFO [localhost] Need to update DB
[Oct  8 17:18:30]  INFO [localhost] Downloading DB from ghcr.io/aquasecurity/trivy-db:2, public.ecr.aws/aquasecurity/trivy-db:2...
2024-10-08T17:18:30+09:00       INFO    Downloading vulnerability DB...
2024-10-08T17:18:30+09:00       INFO    Downloading artifact... repo="ghcr.io/aquasecurity/trivy-db:2"
2024-10-08T17:18:31+09:00       ERROR   Failed to download artifact     repo="ghcr.io/aquasecurity/trivy-db:2" err="OCI repository error: 1 error occurred:\n\t* GET https://ghcr.io/v2/aquasecurity/trivy-db/manifests/2: TOOMANYREQUESTS: retry-after: 790.625µs, allowed: 44000/minute\n\n"
2024-10-08T17:18:31+09:00       INFO    Trying to download artifact from other repository...
2024-10-08T17:18:31+09:00       INFO    Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-db:2"
54.01 MiB / 54.01 MiB [------------------------------------------------------------------------------------------------------------------------] 100.00% 3.73 MiB p/s 15s
2024-10-08T17:18:47+09:00       INFO    Artifact successfully downloaded        repo="public.ecr.aws/aquasecurity/trivy-db:2"
[Oct  8 17:18:47]  INFO [localhost] jar: 5 CVEs are detected with Library

% ./vuls tui -config config.toml -refresh-cve --trivy-java-db-repository=ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db:1
[Oct  8 16:57:54]  INFO [localhost] vuls-v0.26.0-build-20241008_145646_aa21f61
[Oct  8 16:57:54]  INFO [localhost] Validating config...
[Oct  8 16:57:54]  INFO [localhost] cveDict.type=sqlite3, cveDict.url=, cveDict.SQLite3Path=/data/vulsctl/docker/cve.sqlite3
[Oct  8 16:57:54]  INFO [localhost] ovalDict.type=sqlite3, ovalDict.url=, ovalDict.SQLite3Path=/data/vulsctl/docker/oval.sqlite3
[Oct  8 16:57:54]  INFO [localhost] gost.type=sqlite3, gost.url=, gost.SQLite3Path=/data/vulsctl/docker/gost.sqlite3
[Oct  8 16:57:54]  INFO [localhost] exploit.type=sqlite3, exploit.url=, exploit.SQLite3Path=/data/vulsctl/docker/go-exploitdb.sqlite3
[Oct  8 16:57:54]  INFO [localhost] metasploit.type=sqlite3, metasploit.url=, metasploit.SQLite3Path=/data/vulsctl/docker/go-msfdb.sqlite3
[Oct  8 16:57:54]  INFO [localhost] kevuln.type=sqlite3, kevuln.url=, kevuln.SQLite3Path=/data/vulsctl/docker/go-kev.sqlite3
[Oct  8 16:57:54]  INFO [localhost] cti.type=sqlite3, cti.url=, cti.SQLite3Path=/data/vulsctl/docker/go-cti.sqlite3
[Oct  8 16:57:54]  INFO [localhost] Loaded: /home/shino/g/vuls/results/2024-10-08T15-14-21+0900
[Oct  8 16:57:54]  INFO [localhost] Updating library db...
[Oct  8 16:57:54]  INFO [localhost] Trivy Java DB Repository: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db:1
[Oct  8 16:57:54]  INFO [localhost] Downloading Trivy Java DB...
[Oct  8 16:57:54]  INFO [localhost] Adding schema version to the DB repository for backward compatibility. repository: ghcr.io/aquasecurity/trivy-java-db:1
2024-10-08T16:57:54+09:00       INFO    Downloading artifact... repo="ghcr.io/aquasecurity/trivy-java-db:1"
2024-10-08T16:57:55+09:00       ERROR   Failed to download artifact     repo="ghcr.io/aquasecurity/trivy-java-db:1" err="oci download error: failed to fetch the layer: GET https://ghcr.io/v2/aquasecurity/trivy-java-db/blobs/sha256:f9c4dd92ea562b6d60856df454f822c0f03a5a9f7c4002088cf7686009351186: TOOMANYREQUESTS: retry-after: 62.674µs, a
llowed: 44000/minute"
2024-10-08T16:57:55+09:00       INFO    Trying to download artifact from other repository...
2024-10-08T16:57:55+09:00       INFO    Downloading artifact... repo="public.ecr.aws/aquasecurity/trivy-java-db:1"
650.32 MiB / 650.32 MiB [--------------------------------------------------------------------------------------------------------------------] 100.00% 3.64 MiB p/s 2m59s
2024-10-08T17:00:56+09:00       INFO    Artifact successfully downloaded        repo="public.ecr.aws/aquasecurity/trivy-java-db:1"
[Oct  8 17:00:56]  INFO [localhost] jar: 5 CVEs are detected with Library