build(deps): bump github.com/aquasecurity/trivy from 0.62.1 to 0.63.0

[dependabot]

Bumps github.com/aquasecurity/trivy from 0.62.1 to 0.63.0.

Release notes

Sourced from github.com/aquasecurity/trivy's releases.

v0.63.0

👉 Trivy v.63.0 release notes (click here)

⬇️ Download Trivy

• MacOS Apple Silicon
• MacOS Intel
• Linux Intel
• Linux ARM
• Windows Intel

Full changelog

Changelog

Sourced from github.com/aquasecurity/trivy's changelog.

0.63.0 (2025-05-29)

Features

• add Bottlerocket OS package analyzer (#8653) (07ef63b)
• add JSONC support for comments and trailing commas (#8862) (0b0e406)
• alpine: add maintainer field extraction for APK packages (#8930) (104bbc1)
• cli: Add available version checking (#8553) (5a0bf9e)
• echo: Add Echo Support (#8833) (c7b8cc3)
• go: support license scanning in both GOPATH and vendor (#8843) (26437be)
• k8s: get components from namespaced resources (#8918) (4f1ab23)
• license: improve work text licenses with custom classification (#8888) (ee52230)
• license: improve work with custom classification of licenses from config file (#8861) (c321fdf)
• license: scan vendor directory for license for go.mod files (#8689) (dd6a6e5)
• license: Support compound licenses (licenses using SPDX operators) (#8816) (39f9ed1)
• minimos: Add support for MinimOS (#8792) (c2dde33)
• misconf: add misconfiguration location to junit template (#8793) (a516775)
• misconf: Add support for Minimum Trivy Version (#8880) (3b2a397)
• misconf: export raw Terraform data to Rego (#8741) (aaecc29)
• nodejs: add a bun.lock analyzer (#8897) (7ca656d)
• nodejs: add bun.lock parser (#8851) (1dcf816)
• terraform parser option to set current working directory (#8909) (8939451)

Bug Fixes

• check post-analyzers for StaticPaths (#8904) (93e6680)
• cli: disable --skip-dir and --skip-files flags for sbom command (#8886) (69a5fa1)
• cli: don't use allow values for --compliance flag (#8881) (35e8889)
• filter all files when processing files installed from package managers (#8842) (6ebde88)
• java: exclude dev dependencies in gradle lockfile (#8803) (8995838)
• julia parser panicing (#8883) (be8c7b7)
• julia: add Relationship field support (#8939) (22f040f)
• k8s: use in-memory cache backend during misconfig scanning (#8873) (fe12771)
• misconf: check if for-each is known when expanding dyn block (#8808) (5706603)
• misconf: use argument value in WithIncludeDeprecatedChecks (#8942) (7e9a54c)
• more revive rules (#8814) (3ab459e)
• octalLiteral from go-critic (#8811) (a19e0aa)
• redhat: Also try to find buildinfo in root layer (layer 0) (#8924) (906b037)
• redhat: save contentSets for OS packages in fs/vm modes (#8820) (9256804)
• redhat: trim invalid suffix from content_sets in manifest parsing (#8818) (fa1077b)
• server: add missed Relationship field for rpc (#8872) (38f17c9)
• use-any from revive (#8810) (883c63b)
• vex: use lo.IsNil to check VEX from OCI artifact (#8858) (e97af98)
• wolfi: support new APK database location (#8937) (b15d9a6)

Performance Improvements

... (truncated)

Commits

• 69093d2 release: v0.63.0 [main] (#8809)
• 7e9a54c fix(misconf): use argument value in WithIncludeDeprecatedChecks (#8942)
• 78e3304 chore(deps): Bump trivy-checks (#8934)
• 22f040f fix(julia): add Relationship field support (#8939)
• c2dde33 feat(minimos): Add support for MinimOS (#8792)
• 104bbc1 feat(alpine): add maintainer field extraction for APK packages (#8930)
• c7b8cc3 feat(echo): Add Echo Support (#8833)
• 906b037 fix(redhat): Also try to find buildinfo in root layer (layer 0) (#8924)
• b15d9a6 fix(wolfi): support new APK database location (#8937)
• 4f1ab23 feat(k8s): get components from namespaced resources (#8918)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like github.com/aquasecurity/trivy is up-to-date now, so this is no longer needed.