[kycheng]

Why

harbor v2.14 release scan (vs-harbor-cve-260911-0151) of goharbor-trivy-adapter-photon reports, all against /usr/local/bin/trivy (v0.68.3-alauda-13):

CVE	Package	Status on this branch
CVE-2026-54448 (HIGH)	trivy	already backported — 77fd1d0
CVE-2026-55092 (HIGH)	trivy	already backported — 56d4de8 (GHSA-mcj4-mphf-j9ff)
CVE-2026-63328 (MED)	trivy	already backported — a5b4071 (cherry-pick of upstream d4213d7)
CVE-2026-53495 (MED)	containerd v1.7.33 / v2 v2.2.5	fixed here
CVE-2026-33997 (MED)	docker/docker v28.5.3	no fix under this module path (fix is 29.3.1, github.com/docker/docker stops at v28.5.2)
GO-2026-5932	x/crypto v0.56.0	no fixed version

The three trivy rows are flagged only because the scanner compares the module version string v0.68.3-alauda-* against upstream 0.71.x; the fixes are in the code.

What

• github.com/containerd/containerd v1.7.33 → v1.7.35
• github.com/containerd/containerd/v2 v2.2.5 → v2.2.8
• google.golang.org/protobuf follows to the version containerd v2.2.8 requires

Verification

• GOEXPERIMENT=jsonv2 go build ./cmd/trivy OK (Go 1.26.7)
• go test ./pkg/fanal/image/... ./pkg/plugin/... ./pkg/oci/... OK
• trivy rootfs scan of the rebuilt binary: only CVE-2026-33997 and GO-2026-5932 remain (both without a usable fix)

After merge, a new v0.68.3-alauda-14 release is needed, then bump TRIVY_VERSION in harbor-helm .tekton/all-in-one.yaml.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NY16mjhU8wy9dWiatF3pBL