A container build pipeline that scans images with Trivy starts failing on a base image that previously passed, with no changes made to the Dockerfile.

Since the Dockerfile is unchanged, the most likely explanation is that the underlying base image tag was updated upstream (if not pinned to a digest) and now includes a newly disclosed CVE that didn't exist (or wasn't yet known) at the time of the previous scan — this highlights why pinning base images by digest gives reproducibility, while pinning by mutable tag means a 'passing' build today can fail tomorrow purely due to upstream changes, independent of anything the team did.