Trivy v0.76.0 Released: What Terraform Users Need to Know

Introduction

Aqua Security shipped Trivy v0.76.0 on 2026-10-14. Trivy is widely used in Terraform pipelines as a misconfiguration scanner (trivy config) alongside its container and dependency scanning capabilities. This article covers what the release notes actually state, how to upgrade, and how to confirm the new version works correctly against your Terraform code.

What Is New

The published release notes for v0.76.0 are unusually thin: they point to a GitHub Discussion thread marked "Highlights" and to the CHANGELOG.md entry for 0.76.0, but no concrete feature names, flags, or PR/issue numbers are included in the notes provided here.

Because this article only reports details that are explicitly present in the supplied release notes, no specific new checks, new flags, deprecations, or breaking changes can be listed for Terraform scanning in this write-up. If you rely on Trivy for IaC scanning in CI, check the linked CHANGELOG and discussion directly before assuming behavior is unchanged, since policy/check updates (new or removed Terraform misconfiguration rules, rego policy changes) are common in Trivy point releases even when the GitHub release body is sparse.

Recommended next step: open the release page and the CHANGELOG link above and skim for any config/terraform scoped entries before rolling this out broadly in CI/CD.

Upgrade Steps

If you install Trivy via a package manager, update it directly:

# Homebrew
brew upgrade trivy
 
# Debian/Ubuntu (apt repo already configured)
sudo apt-get update && sudo apt-get install trivy

If you pin Trivy by binary download or in a Dockerfile, update the version pin explicitly:

# Direct binary install script, pinned to v0.76.0
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | \
  sh -s -- -b /usr/local/bin v0.76.0

FROM aquasec/trivy:0.76.0

If you invoke Trivy's Terraform scanning in a GitHub Actions workflow via aquasecurity/trivy-action, pin the Trivy version input:

- name: Run Trivy config scan
  uses: aquasecurity/trivy-action@master
  with:
    scan-type: 'config'
    scan-ref: '.'
    trivy-version: 'v0.76.0'

There is no Terraform provider or module version constraint to change here since Trivy itself is not a Terraform provider; the upgrade is purely at the tool/binary/image level.

Verify

Confirm the installed version and run a quick scan against a Terraform directory to confirm misconfiguration checks still execute:

trivy --version
# Should report Version: 0.76.0
 
trivy config ./terraform/ --severity HIGH,CRITICAL

Compare the number and IDs of findings against your previous Trivy version's output on the same codebase (keep a baseline report with trivy config ./terraform/ -f json -o before.json prior to upgrading) to catch any silent rule additions or removals that aren't called out in the release notes.

Conclusion

v0.76.0 is available now, but the release notes shared here don't list concrete Terraform-relevant changes, flags, or fixes. Treat this as a routine version bump: pin the new version in CI, re-run scans against a known Terraform codebase, and diff the results against your previous baseline before trusting it in production pipelines. For authoritative details, consult the linked CHANGELOG and discussion thread directly.