v0.37.2

[aqua-bot]

💔Breaking Change💔

Java DB

Added breaking change to Trivy Java DB.
Users who are using Trivy v0.37.0 or v0.37.1 for Java scanning need to remove the local cached Java DB with trivy image --reset and update Trivy to v0.37.2.

Changelog

• 12b563b BREAKING: use normalized trivy-java-db (BREAKING: use normalized trivy-java-db #3583)
• 72a14c6 fix(image): add timeout for remote images (fix(image): add timeout for remote images #3582)
• 4c01d73 chore(deps): bump golang.org/x/mod from 0.6.0 to 0.7.0 (chore(deps): bump golang.org/x/mod from 0.6.0 to 0.7.0 #3532)
• 10dd5d1 chore(deps): bump golang.org/x/text from 0.5.0 to 0.6.0 (chore(deps): bump golang.org/x/text from 0.5.0 to 0.6.0 #3534)
• 439c541 fix(misconf): handle dot files better (fix(misconf): handle dot files better #3550)
• 200e04a chore: bump Go to 1.19 (chore: bump Go to 1.19 #3551)
• a533ca8 chore(deps): bump alpine from 3.17.0 to 3.17.1 (chore(deps): bump alpine from 3.17.0 to 3.17.1 #3522)
• 4bccbe6 chore(deps): bump docker/build-push-action from 3 to 4 (chore(deps): bump docker/build-push-action from 3 to 4 #3523)
• d056208 chore(deps): bump actions/cache from 3.2.2 to 3.2.4 (chore(deps): bump actions/cache from 3.2.2 to 3.2.4 #3524)
• f5e6574 chore(deps): bump golangci/golangci-lint-action from 3.3.0 to 3.4.0 (chore(deps): bump golangci/golangci-lint-action from 3.3.0 to 3.4.0 #3525)
• d3da459 chore(deps): bump aquaproj/aqua-installer from 1.2.0 to 2.0.2 (chore(deps): bump aquaproj/aqua-installer from 1.2.0 to 2.0.2 #3526)

---

This discussion was created from the release v0.37.2.

[charego]

From #3583:

New java-db has different struct. This version of Trivy is not compatible with old version of java-db.

What does this mean for users? Do we need to run trivy image --reset before using the new version?

[knqyf263]

Do we need to run trivy image --reset before using the new version?

Yes. I've updated the release note.