[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
docker/scout-action	action	minor	v1.18.2 → v1.29.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

docker/scout-action

v1.29.0

Compare Source

What's Changed

• Fixes duplicate or inconsistent Debian, Alpine, and Docker Hardened Images package identities when installed package records and embedded SBOMs describe the same package.
• Fixes local policy evaluation ignoring proxy settings for registry requests, which could cause policies to report "No data" on networks that require a proxy.
• Preserves provenance and SBOM attestations for local images when an older cached SBOM lacks those attestations.
• Updates the compression dependency to version 1.18.7 to address CVE-2026-63209.
• Fixes checksum filenames for Scout Action release downloads and verifies the uploaded binaries against their checksum manifest.

Generated Debian and Alpine binary package URLs retain architecture and source-package qualifiers. Existing generated SBOM caches are refreshed automatically; no new option is required.

v1.28.0

Compare Source

What's Changed

• Updates the Brotli decoder to 1.2.7 to incorporate security fixes. @​brianru
• Updates HTTP/2 dependencies to incorporate security fixes. @​brianru
• Fixes missing Debian vulnerability findings in Distroless images by correctly identifying their operating system version. @​brianru

v1.27.0

Compare Source

What's Changed

• Updates the Go toolchain to 1.26.10 to incorporate security fixes. @​thaJeztah

v1.26.0

Compare Source

What's Changed

• Fixes docker scout watch failing with 401 Unauthorized about 15 minutes after it starts. The Docker token is now refreshed before it expires, and an image that fails to process no longer stops the watcher; it is retried on the next check. @​aubm
• Fixes docker scout attest list and docker scout attest get so they find attestations attached as OCI referrers on Docker Hub and other registries. Previously only attestations served by the Scout registry were listed. @​benja-M-1
• Fixes docker scout quickview showing VEX-suppressed CVEs in the Target row when VEX suppresses every CVE in the image. @​whostolebenfrog
• Fixes DHI base-image VEX statements not being applied to multistage builds that use a mirrored DHI base image (<org>/dhi-<name> naming). @​flyingmachine
• Fixes CycloneDX SBOM output to keep the original creation timestamp and generator tool names and versions. @​brianru
• Updates the embedded Trivy (0.72.0) and Syft (1.46.0) scanning engines. @​brianru

v1.25.0

Compare Source

What's Changed

• Adds discovery of software inside Debian and Alpine package archives, preserving package containment and separate package occurrences in SPDX SBOMs. Archive scanning is enabled by default and can be disabled with SCOUT_SBOM_EXPAND_ARCHIVES=false. @​brianru
• Fixes manual vulnerability exception handling so image scans correctly mark suppressed vulnerabilities and filter them with --ignore-suppressed, while reducing network requests. @​whostolebenfrog
• Moves exception details in --format sbom output from the top-level inventory to each vulnerability’s exceptions array. Consumers counting manual suppressions must filter for MANUAL_EXCEPTION. @​whostolebenfrog
• Adds warnings when manual exceptions cannot be applied in local mode or when loading older native SBOMs with legacy exception inventories. Older SBOMs require rescanning to restore manual-exception suppression. @​whostolebenfrog
• Updates the native Scout SBOM format to version 12 to support the expanded package inventory and SPDX relationships. @​brianru

v1.24.0

Compare Source

What's Changed

• Adds local Scout Health Scores to docker scout policy, quickview, and compare. @​cdupuis
• Fixes docker scout cves --only-base and --ignore-base to correctly classify packages from provenance-identified base images. @​andrestylianos
• Updates dependencies, including ORAS, Sigstore, OpenTelemetry, go-git, and pgx.

v1.23.1

Compare Source

What's Changed

• Fixes policy evaluation when using custom Rego policies without details metadata @​whostolebenfrog

v1.23.0

Compare Source

What's Changed

• Prevents empty VEX documents from breaking scanning @​flyingmachine
• Rego policy sources can be served via http(s) through --policy-file @​cdupuis
• Performance improvements on SBOM fetching and policies evaluation @​cdupuis

v1.22.0

Compare Source

What's Changed

• Proxies Trivy's Java DB download through Docker Desktop's HTTP proxy transport @​AndreSilva1993

v1.21.0

Compare Source

What's Changed

• Fix local DHI-derived image handling, including inherited VEX and quickview base-image display
• Improve SBOM package qualifier handling, including DHI distro qualifiers
• Update dependencies and Go toolchain

v1.20.4

Compare Source

What's Changed

• Add JSON output format for docker scout compare @​benja-M-1
• Add image config field changes to docker scout compare output @​benja-M-1
• Fix Docker Desktop proxy detection in WSL2 environments @​benja-M-1
• Update dependencies @​benja-M-1

v1.20.3

Compare Source

What's Changed

• Improve retries of temporary and network errors @​chrispatrick
• Fix handling of dockerfiles included in provenance attestations @​chrispatrick
• Fix handling of cosign sig tags @​chrispatrick
• Use Docker Desktop HTTP proxy transport when available @​benja-M-1
• Escape mentions from CVE descriptions to prevent spam notifications @​benja-M-1

v1.20.2

Compare Source

What's Changed

• Fix binary download logic @​benja-M-1

v1.20.1

Compare Source

What's Changed

• Minor fixes for DHI @​cdupuis
• Add docker scout vex get command to get a merged VEX document from all VEX attestations @​cdupuis
• VEX and SPDX fixes @​cdupuis
• Documentation updates @​craig-osterhout @​dvdksn
• CVE fixes @​cdupuis
• Update dependencies @​cdupuis
• Handle attestation source failures more gracefully @​chrispatrick
• Bug fixes including around VEX, versioning and indexing @​cdupuis
• Fix vulnerabilities @​jpbriend
• Fix apk version handling @​cdupuis
• Support SLSA v1 Provenance @​chrispatrick
• Fix Go purl versioning @​cdupuis
• Fix VCS provenance parsing @​chrispatrick

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud