SUSE-CU-2026:13985-1: Security update of private-registry/1.2/harbor-trivy-adapter

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: private-registry/1.2/harbor-trivy-adapter
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13985-1
Container Tags        : private-registry/1.2/harbor-trivy-adapter:1.2.2 , private-registry/1.2/harbor-trivy-adapter:1.2.2-1.155 , private-registry/1.2/harbor-trivy-adapter:latest
Container Release     : 1.155
Severity              : important
Type                  : security
References            : 1288377 1289868 CVE-2026-116585 CVE-2026-116586 CVE-2026-116587
                        CVE-2026-97045 
-----------------------------------------------------------------

The container private-registry/1.2/harbor-trivy-adapter was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5190-1
Released:    Wed Nov 11 08:44:20 2026
Summary:     Security update for trivy
Type:        security
Severity:    important
References:  1288377,1289868,CVE-2026-116585,CVE-2026-116586,CVE-2026-116587,CVE-2026-97045
This update for trivy fixes the following issues:

Update to version 0.76.2.

Security issues fixed:

- CVE-2026-97045: golang.org/x/net/html: missing checks during ancestor namespace transitions when rendering raw
  text can cause parser differentials (bsc#1289868).
- CVE-2026-116585,CVE-2026-116586,CVE-2026-116587: github.com/go-jose/go-jose/v4: multiple security issues in
  github.com/go-jose/go-jose before 4.1.6 (bsc#1288377).

Other updates and bugfixes:

- Update `x/sys` to 0.50.0 to fix ppc64le syscall handling regression.
- Version 0.76.2:
 * fix(deps): bump `golang.org/x/net` from 0.61.0 to 0.62.0 [backport: release/v0.76] (#11554)
 * chore(deps): bump the common group across 1 directory with 14 updates [backport: release/v0.76] (#11555)
 * fix(deps): bump `github.com/go-jose/go-jose/v4` from 4.1.5 to 4.1.6 [backport: release/v0.76] (#11553)
 * fix(deps): bump `alpine` to 3.24.3 in container images [backport: release/v0.76] (#11551)


The following package changes have been done:

- trivy-0.76.2-150000.1.42.1 updated