Repository navigation
Version 0.72.0 of Trivy is now available. security-devops-action is using Trivy version is 0.69.3 #267
Description
Version 0.72.0 of Trivy is now available, current c0f7383 run Trivy version 0.69.3. https://github.com/microsoft/security-devops-action says : "runs the latest versions of static analysis tools".
Activity
DimaBir commentedon Jul 15, 2026
Ack
DimaBir commentedon Jul 28, 2026
You are right that the README claim was inaccurate, and #272 corrects it.
The action does not resolve tool versions independently. Third-party tools ship as redist packages pinned to a Microsoft Security DevOps CLI release, so a version published upstream is only picked up once a CLI release bundling it exists. The "installs the latest versions of static analysis tools" wording set an expectation the action cannot meet, so it has been reworded, with an explicit note under the tools table that bundled versions track the CLI release.
That is a documentation correction rather than a version bump — picking up a newer Trivy still depends on a CLI release that bundles it, which is tracked separately with the CLI team.