Version 0.72.0 of Trivy is now available. security-devops-action is using Trivy version is 0.69.3

[HuijinLiuInforma]

Version 0.72.0 of Trivy is now available, current c0f7383 run Trivy version 0.69.3. https://github.com/microsoft/security-devops-action says : "runs the latest versions of static analysis tools".

[DimaBir]

Ack

[DimaBir]

You are right that the README claim was inaccurate, and #272 corrects it.

The action does not resolve tool versions independently. Third-party tools ship as redist packages pinned to a Microsoft Security DevOps CLI release, so a version published upstream is only picked up once a CLI release bundling it exists. The "installs the latest versions of static analysis tools" wording set an expectation the action cannot meet, so it has been reworded, with an explicit note under the tools table that bundled versions track the CLI release.

That is a documentation correction rather than a version bump — picking up a newer Trivy still depends on a CLI release that bundles it, which is tracked separately with the CLI team.