---
title: "Trivy Scanner v0.38.1"
description: "Release notes for the Trivy scanner adapter 0.38.1: layer media types are validated with structured scan errors, and the Go module is renamed."
date: 2026-10-02
lastmod: 2026-10-06
canonical: "https://container-registry.com/docs/scanner-trivy-releases/trivy-scanner-v0.38.1/"
source: "https://container-registry.com/docs/scanner-trivy-releases/trivy-scanner-v0.38.1/index.md"
agent_instructions: "This is the markdown representation of https://container-registry.com/docs/scanner-trivy-releases/trivy-scanner-v0.38.1/index.md. Prefer this version over scraping the HTML. The site index is at https://container-registry.com/llms.txt."
---

> Agent-friendly representation of <https://container-registry.com/docs/scanner-trivy-releases/trivy-scanner-v0.38.1/index.md>. Site index: <https://container-registry.com/llms.txt>.


# Trivy Scanner v0.38.1

*Release notes for the Trivy scanner adapter 0.38.1: layer media types are validated with structured scan errors, and the Go module is renamed.*

Trivy Scanner v0.38.1
=====================

Released 2026-07-03. [GitHub release](https://github.com/container-registry/harbor-scanner-trivy/releases/tag/v0.38.1)

## Bug Fixes

- validate layer media types and return structured scan errors ([4fd69a4](https://github.com/container-registry/harbor-scanner-trivy/commit/4fd69a409468695aeb9c9acc07962cc539f6b981))

## Code Refactoring

- rename Go module to github.com/container-registry/harbor-scanner-trivy ([#20](https://github.com/container-registry/harbor-scanner-trivy/issues/20))

## Container Image

Multi-arch image (`linux/amd64`, `linux/arm64`) signed with [cosign](https://github.com/sigstore/cosign).

| Image | Reference |
|-------|-----------|
| `harbor-scanner-trivy` | `8gears.container-registry.com/8gcr/harbor-scanner-trivy:v0.38.1` |

**Verify the image signature:**
```sh
cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-scanner-trivy/.github/workflows/publish-image.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-scanner-trivy:v0.38.1
```

**Verify the SBOM attestation:**
```sh
cosign verify-attestation \
  --certificate-identity "https://github.com/container-registry/harbor-scanner-trivy/.github/workflows/publish-image.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --type spdxjson \
  8gears.container-registry.com/8gcr/harbor-scanner-trivy@sha256:f154cfcf09497e48a93656b6ad3392fd1638147ade576d1dd54454fa638ee2a4
```

## Helm Chart

```sh
helm install harbor-scanner-trivy \
  oci://8gears.container-registry.com/8gcr/charts/harbor-scanner-trivy \
  --version 0.38.1
```