Fix Trivy template compatibility and bump Go to 1.26.5 - #565
Merged
Conversation
## Summary - Create temporary Trivy templates with the required `.tpl` extension. - Clean up temporary files when writing or closing them fails. - Add regression coverage for the template filename and contents. - Clean up temporary templates created by the scanner tests. - Bump Go from 1.26.1 to 1.26.5. ## Root cause Trivy v0.70.0 began requiring custom template filenames to end in `.tpl`. `GetTemplateFile` created an extensionless temporary file, causing scans with newer Trivy versions to fail before scanning any images. The scanner retried the invalid invocation and eventually returned an `Unrecoverable` error, preventing downstream security-alert issues from being created or updated. ## Validation - Ran `go mod verify`. - Ran `go test ./securityscanutils`. - Confirmed the tests use Go 1.26.5. - Validated the new changelog entry. - Ran `git diff --check`. ## Follow-up Consumers should upgrade to the resulting `go-utils` release before updating their pinned Trivy version to v0.70.0 or later. Signed-off-by: David L. Chandler <david.chandler@solo.io>
Signed-off-by: David L. Chandler <david.chandler@solo.io>
andy-fong
approved these changes
Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.tplextension.Root cause
Trivy v0.70.0 began requiring custom template filenames to end in
.tpl.GetTemplateFilecreated an extensionless temporary file, causing scans with newer Trivy versions to fail before scanning any images.The scanner retried the invalid invocation and eventually returned an
Unrecoverableerror, preventing downstream security-alert issues from being created or updated.Validation
go mod verify.go test ./securityscanutils.git diff --check.Follow-up
Consumers should upgrade to the resulting
go-utilsrelease before updating their pinned Trivy version to v0.70.0 or later.