feat(ci-cd): add trivy scan instead of synk

[vaibhavbhalla2505]

Description

add trivy scan instead of synk

Fixes # (issue)

GH-267

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Intermediate change (work in progress)

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration

• Test A
• Test B

Checklist:

• Performed a self-review of my own code
• npm test passes on your machine
• New tests added or existing tests modified to cover all changes
• Code conforms with the style guide
• API Documentation in code was updated
• Any dependent changes have been merged and published in downstream modules

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[stale]

This pull request has been marked stale because it has not seen any activity within two months. It will be closed within 15 days of being stale unless there is new activity.

[stale]

This pull request has been closed due to continued inactivity. If you are interested in finishing the proposed changes, then feel free to re-open this pull request or open a new one.

[sonarqubecloud]

SonarQube reviewer guide

Summary: Replaces Snyk security scanning with Trivy, updates dependencies, and bumps version to 13.0.0

Review Focus:

• The new Trivy workflow configuration and security policy (trivy.yml) for appropriate vulnerability thresholds
• Dependency updates across Loopback packages and core libraries like axios, debug, and mocha for breaking changes
• Semver override in passport-apple vendor package ensuring consistent version usage

Start review at: .github/workflows/trivy.yaml. This introduces the new security scanning tool that will gate PRs, so verifying the configuration (scan types, exit codes, severity levels) is critical before merging.

💬 Please send your feedback

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud