Spacelift experienced a minor incident on March 2, 2026, lasting 1h 4m. The incident has been resolved; the full update timeline is below.
Update timeline
- identified Mar 02, 2026, 12:59 PM UTC
The Trivy Spacelift plugin is currently causing runs to fail during the Initializing phase due to a security incident from Trivy (https://github.com/aquasecurity/trivy/discussions/10265) that caused GitHub release artifacts to be deleted. We have identified the issue and are currently working on deploying a fix.
- resolved Mar 02, 2026, 02:03 PM UTC
This incident has been resolved. See the postmortem for resolution instructions.
- postmortem Mar 02, 2026, 02:53 PM UTC
📣 Trivy Plugin Action Required If you're using the previous version of the Trivy plugin, runs may fail during initialization due to missing release artifacts following a security incident in the upstream Trivy project \(details here: [https://github.com/aquasecurity/trivy/discussions/10265](https://github.com/aquasecurity/trivy/discussions/10265)\). We've updated the Spacelift Trivy plugin to **v0.69.2** and rolled the fix out to production - everything is now working as expected. To make sure your stacks use the updated version: 1. Go to **Plugins → Account plugins** and delete the existing Trivy plugin 2. Go to **Plugins → Templates** and install the Trivy plugin again Once done, all new runs will automatically use the fixed version. Thanks for your patience, and as always, reach out to support if you need anything.