openSUSE-SU-2026:21072-1

This update for trivy fixes the following issues

Update to version 0.71.2:

• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267268).
• CVE-2026-46680: github.com/containerd/containerd/v2/pkg/oci: containerd user ID handling bypass allows runAsNonRoot evasion (bsc#1268356).
• CVE-2026-47262: github.com/containerd/containerd/v2/pkg/oci: Denial of Service (DoS) condition via a maliciously crafted image (bsc#1268440).
• CVE-2026-50195: containerd: fails to validate the image references specified within a checkpoint image's configuration (bsc#1268399).
• CVE-2026-53488: containerd: CRI plugin propagates labels from an image config to a container without validation (bsc#1268400).
• CVE-2026-53489: containerd: CRI plugin restores container.log from a checkpoint image without validating a symlinked path (bsc#1268404).
• CVE-2026-53492: containerd: improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration (bsc#1268403).

Changes for trivy:

• release: v0.71.2 [release/v0.71] (#10871)
• fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870)
• chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867)
• fix(oci): validate artifact filename
• fix: forward ospkg detector options through ospkg.NewScanner
• fix(vex): load VEX documents from within the repository directory
• fix: surface the original analysis error instead of context cancellation
• ci: expect GitHub App bot as backport PR author