Trivy v0.76.1 — Release Notes & Engineering Impact

Source available — automated, not human-reviewed

Component: trivy · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Compatibility not verified — check source notes

📄 .MD

🔧 Bug Fixes 3

⚡ Executive Summary (TL;DR)

Trivy v0.76.1. Source highlight: 🔐 Security update: eMudhra CA incident 🛡️

Visit Trivy Official Site ↗ Official Release Source ↗ All Trivy Releases 📡 Trivy RSS

Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

📊 Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

⚙️ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

🔧 Bug Fixes & Patches (3)

6647bd6ec5924087956285b773b8cae10508736e fix(deps): bump the aws group across 1 directory with 6 updates [backport: release/v0.76] (#11446)
e0964c97819b1d6a45b7e0426803745f173fc550 fix(deps): bump the docker group with 3 updates [backport: release/v0.76] (#11443)
992c360c33d9f9627bb24c1fe3f20815110c88e5 fix(deps): bump the common group with 3 updates [backport: release/v0.76] (#11442)

📄 View Raw Release Notes (Original Developer Log)

## 🔐 Security update: eMudhra CA incident 🛡️ Trivy v0.76.1 includes mitigations for the [eMudhra intermediate CA key compromise](https://blog.cloudflare.com/emudhra-certificate-compromise/). - Official binaries are built with Go 1.27.3, which includes the certificate distrust mitigation tracked as [CVE-2026-111943](https://go.dev/issue/82345). - Official container images include an updated Alpine CA trust store that rejects the affected certificate chains. We recommend upgrading to v0.76.1 and redeploying container images to apply these updates. If you build Trivy from source, use Go 1.27.3 or later and keep your runtime CA trust store up to date. ## Changelog * e713f67f7d54decdcd9b3132c9751833dcced698 release: v0.76.1 [release/v0.76] (#11445) * 6647bd6ec5924087956285b773b8cae10508736e fix(deps): bump the aws group across 1 directory with 6 updates [backport: release/v0.76] (#11446) * e0964c97819b1d6a45b7e0426803745f173fc550 fix(deps): bump the docker group with 3 updates [backport: release/v0.76] (#11443) * 992c360c33d9f9627bb24c1fe3f20815110c88e5 fix(deps): bump the common group with 3 updates [backport: release/v0.76] (#11442)

← Older Version Trivy v0.76.0

Newer Version → Latest Tracked Version ✓