chore(mise): update tool trivy to v0.74.0 [automerge]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
trivy	tools	minor	0.72.0 → 0.74.0

---

Release Notes

aquasecurity/trivy (trivy)

v0.74.0

Compare Source

⚡ Highlights ⚡

👉 https://redirect.github.com/aquasecurity/trivy/discussions/11096

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0740-2026-08-14

v0.73.0

Compare Source

Features

• add bounded read helpers (#​10974) (35384b4)
• java: read Jenkins plugin manifest licenses (#​10939) (f065203)
• java: support user-defined Maven mirrors in trivy.yaml (#​11006) (8e5509c)
• seal: detect no-prefix packages by version suffix (#​10911) (69da733)
• vex: discover OpenVEX in generic in-toto OCI referrers (#​10986) (990d765)
• vex: native discovery of VEX documents stored as OCI artifacts (#​10932) (38d5dbd)

Bug Fixes

• conda: avoid panic on an all-operator dependency line (#​10955) (f964fa2)
• dotnet: identify deps.json root project from dependency graph (#​10954) (3c6a1a2)
• java: set per-file digest for nested JARs (#​10855) (c3c7d17)
• misconf: guard nil Healthcheck when building Dockerfile from history (#​10899) (824e2ed)
• nodejs: support pnpm workspaces with overlapping packages (#​10894) (19f2ddc)
• vex: handle 304 status code (#​10307) (e73c76d)
• vex: reject non-local VEX repository names (#​10987) (2c64b8f)
• vuln: don't skip packages covered by a driver's own advisory feed (#​10980) (86acabe)

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • "every weekend,on Friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.