Trivy Scanner v0.41.0

Released 2026-09-14. GitHub release

Features

chart: production-ready chart with an independent release line (fa76805)

Bug Fixes

chart: let the chart release PR restamp the version in the generated README (#72)
deps: Bump x/crypto to v0.56.0 and x/text to v0.41.0 (#108)

Documentation

add production Scan All numbers to the SBOM fast-path bullet (#71)
drop obsolete README content and fix config table facts (#80)

Container Image

Multi-arch image (linux/amd64, linux/arm64) signed with cosign.

Image	Reference
`harbor-scanner-trivy`	`8gears.container-registry.com/8gcr/harbor-scanner-trivy:v0.41.0`

Verify the image signature:

cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-scanner-trivy/.github/workflows/publish-image.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-scanner-trivy:v0.41.0

Verify the SBOM attestation:

cosign verify-attestation \
  --certificate-identity "https://github.com/container-registry/harbor-scanner-trivy/.github/workflows/publish-image.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --type spdxjson \
  8gears.container-registry.com/8gcr/harbor-scanner-trivy@sha256:f84267a190e6f976950343031e9cd6081cbc266e1d7326e26dd8bfcfcf11a36b

Helm Chart

The chart is released separately - see the chart-v* releases. To deploy this adapter version with the latest chart:

helm install harbor-scanner-trivy \
  oci://8gears.container-registry.com/8gcr/charts/harbor-scanner-trivy \
  --set image.tag=v0.41.0

Binaries

Static linux/amd64 and linux/arm64 binaries are attached to this release (checksums.txt has the SHA256 sums):

Asset	Contents
`scanner-trivy_linux-<arch>.tar.gz`	Harbor scanner adapter v0.41.0
`trivy_linux-<arch>.tar.gz`	Trivy CLI v0.74.0, built from source