## aquasecurity/trivy — v0.72.0…v0.73.0

_31 commits._

### Features
- **feat(java): support user-defined Maven mirrors in trivy.yaml (#11006)** (8e5509c)
- **feat(vex): discover OpenVEX in generic in-toto OCI referrers (#10986)** (990d765)
- **feat(vex): native discovery of VEX documents stored as OCI artifacts (#10932)** (38d5dbd)
- **feat: add bounded read helpers (#10974)** (35384b4)
- **feat(java): read Jenkins plugin manifest licenses (#10939)** (f065203)
- **feat(seal): detect no-prefix packages by version suffix (#10911)** (69da733)

### Fixes
- **fix(vex): reject non-local VEX repository names (#10987)** (2c64b8f)
- **fix(vex): handle 304 status code (#10307)** (e73c76d)
- **fix(vuln): don't skip packages covered by a driver's own advisory feed (#10980)** (86acabe)
- **fix(conda): avoid panic on an all-operator dependency line (#10955)** (f964fa2)
- **fix(dotnet): identify deps.json root project from dependency graph (#10954)** (3c6a1a2)
- **fix(nodejs): support pnpm workspaces with overlapping packages (#10894)** (19f2ddc)
- **fix(java): set per-file digest for nested JARs (#10855)** (c3c7d17)
- **fix(misconf): guard nil Healthcheck when building Dockerfile from history (#10899)** (824e2ed)

### Backend
- **release: v0.73.0 [main] (#11012)** (40c73e5)

### Docs
- **docs: clarify debug logs when version check or telemetry is disabled (#10984)** (7f33604)
- **docs: ask contributors to coordinate before starting on an issue (#10940)** (beb33f0)

### Chore
- **chore(deps): bump the common group across 1 directory with 17 updates (#11025)** (a525f55)
- **chore(deps): bump the docker group across 1 directory with 2 updates (#10991)** (88ee124)
- **chore(deps): bump the aws group across 1 directory with 6 updates (#10947)** (62bc7c9)
- **refactor(alpine): remove type assertion when reading the APKINDEX archive (#11013)** (9321f90)
- **chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#10995)** (6740bb8)
- **refactor(vuln): add OS.Supplier field and unify supplier terminology (#11007)** (c9f5c85)
- **chore(deps): bump github.com/google/cel-go from 0.28.1 to 0.30.0 (#11009)** (ce8cb97)
- **chore: add schema id (#10969)** (3dc5f87)
- **ci: create release branch with the App token to bypass the merge queue rule (#10931)** (aff9078)
- **chore(deps): bump the common group across 1 directory with 15 updates (#10892)** (bc614b3)
- **chore(deps): bump the testcontainers group with 2 updates (#10918)** (878fdb4)
- **chore(deps): bump the docker group across 1 directory with 4 updates (#10919)** (8b83f66)
- **ci(helm): bump Trivy version to 0.72.0 for Trivy Helm Chart 0.24.0 (#10908)** (4541d9a)
- **ci(helm): allow trivy team to approve Chart.yaml bumps (#10912)** (d205d02)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/aquasecurity/trivy?utm_source=github-action)._