So about that trivy thing

[ncook-hxgn]

We use MSDO in our organisation to scan IaC for issues. One of the tools used by msdo for our terraform is Trivy.

Over the weekend, Trivy was hit by a pretty devestating attack via github action..
aquasecurity/trivy#10265

Will MSDO be updating to the latest version of Trivy for Microsoft.Guardian.TerrascanRedist_linux_amd64 (and also windows)?

[github-actions]

Thank you for bringing this critical security issue to our attention. The Trivy supply chain attack is indeed a serious concern for anyone using affected versions.

I've escalated this to the MSDO maintainers as questions about tool version updates and security patch timelines require their direct input. They'll be able to provide information about:

• Current Trivy version bundled in MSDO
• Timeline for updating to patched versions
• Any immediate mitigation steps

The maintainers will respond as soon as possible given the security-sensitive nature of this issue.

AI generated by MSDO Issue Triage Assistant

[DimaBir]

Hey @ncook-hxgn, thanks for flagging this.

We looked into the Trivy incident and MSDO is not directly impacted. The Trivy binary in MSDO is distributed as a pre-packaged NuGet package (Microsoft.Guardian.TrivyRedist) hosted on Microsoft infrastructure — it's not downloaded from GitHub Releases at runtime. Same story for the vulnerability database, which is fetched from container registries (ghcr.io, ECR, Docker Hub), not GitHub. As the Trivy team noted themselves: "If you've used Trivy via container image, or a package manager, you should not observe any issues."

That said, the current version bundled in MSDO is 0.65.0 and the latest stable Trivy is 0.69.2 (the post-incident clean release). We're tracking an update and will prioritize it given the circumstances. I'll update this issue once the upgrade ships.

Best, @DimaBir