cayne/image-factory

Watch

Fork 0

generated from cayne/template

chore(deps): update dependency trivy to v0.74.0 #7

Open

opencode wants to merge 1 commit from renovate/trivy-0.x into main

opencode commented

2026-09-01 04:01:46 +00:00

Collaborator

This PR contains the following updates:

Package	Update	Change
trivy	minor	`latest` → `0.74.0`

Release Notes

aquasecurity/trivy (trivy)

`v0.74.0`

Features

add RapidFort curated image scanner (#10452) (2c3b86c)
java: resolve JAR license URLs to SPDX IDs (Bundle-License, pom <url>) (#10948) (171e391)

Bug Fixes

java: read artifact properties only from the MANIFEST.MF main section (#11066) (018bfbf)
misconf: parse Azure flexible server parameters under their own names (#11072) (d59f0f8)
misconf: unmark cty values outside the evaluation context (#11078) (9e85b6b)
python: normalize dependency names in PEP 621 pyproject.toml (#11050) (0012281)
server: preserve check aliases and query in uploaded blobs (#11080) (0512d6d)
terraform: avoid panic when for_each local has unknown object values (#11019) (199a126)
terraform: support OpenTofu language block (#10923) (bacf17f)

`v0.73.0`

Features

add bounded read helpers (#10974) (35384b4)
java: read Jenkins plugin manifest licenses (#10939) (f065203)
java: support user-defined Maven mirrors in trivy.yaml (#11006) (8e5509c)
seal: detect no-prefix packages by version suffix (#10911) (69da733)
vex: discover OpenVEX in generic in-toto OCI referrers (#10986) (990d765)
vex: native discovery of VEX documents stored as OCI artifacts (#10932) (38d5dbd)

Bug Fixes

conda: avoid panic on an all-operator dependency line (#10955) (f964fa2)
dotnet: identify deps.json root project from dependency graph (#10954) (3c6a1a2)
java: set per-file digest for nested JARs (#10855) (c3c7d17)
misconf: guard nil Healthcheck when building Dockerfile from history (#10899) (824e2ed)
nodejs: support pnpm workspaces with overlapping packages (#10894) (19f2ddc)
vex: handle 304 status code (#10307) (e73c76d)
vex: reject non-local VEX repository names (#10987) (2c64b8f)
vuln: don't skip packages covered by a driver's own advisory feed (#10980) (86acabe)

`v0.72.0`

⚠ BREAKING CHANGES

migrate docker config to dockers_v2 (#10783)

Features

bottlerocket: add vulnerability matching for Bottlerocket OS (#10893) (246ee3c)
dotnet: detect bundled runtime in self-contained deployments (#10786) (bd78842)
java: detect JAR licenses from packaged LICENSE files (#10856) (b8a1ccd)
java: detect JAR licenses from the embedded pom.xml (#10851) (0a166c3)
misconf: Adds CloudFront standard logging v2 support to AVD-AWS-0010 (#10848) (a848925)
secret: add OpenAI secret detection rules (#10798) (65e5128)
secret: support new stateless format for GitHub App installation tokens (#10826) (e68f3d2)

Bug Fixes

correct format verbs in diagnostic messages (#10805) (859a933)
forward ospkg detector options through ospkg.NewScanner (#10811) (28d44d3)
image: deterministic OS package deduplication for images with embedded SBOMs (#10777) (888911b)
image: lookup origin layer for custom resources in merged layers (#10788) (dccb128)
misconf: support github_repository_vulnerability_alerts resource (#10680) (abb5174)
nodejs: parse project dependencies from multi-document pnpm-lock.yaml (#10861) (a10291b)
server: propagate package repository class in client/server mode (#10874) (a2777ae)
spdx: guard against nil root component in SPDX marshaler (#10771) (c0654e1)
surface the original analysis error instead of context cancellation (#10793) (3054b3b)
terraform: avoid data race on global getter.Getters in remote module resolver (#10843) (0aff3fd)
use random suffix for process temp directory instead of PID (#10431) (c8d1d0d)
vex: load VEX documents from within the repository directory (#10820) (1f56a34)
vuln: fall back to UNKNOWN severity when vulnerability details are missing (#10795) (dfd53cf)

Continuous Integration

migrate docker config to dockers_v2 (#10783) (848d135)

`v0.71.2`

Changelog

055a5c8 release: v0.71.2 [release/v0.71] (#10871)
875328a fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870)
998f7b3 chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867)

`v0.71.1`

Changelog

164b383 release: v0.71.1 [release/v0.71] (#10818)
a72d9a4 fix(oci): validate artifact filename
3dd9847 fix: forward ospkg detector options through ospkg.NewScanner [backport: release/v0.71] (#10825)
a62cbe4 fix(vex): load VEX documents from within the repository directory [backport: release/v0.71] (#10821)
43d1d26 fix: surface the original analysis error instead of context cancellation [backport: release/v0.71] (#10812)
ac7696c ci: expect GitHub App bot as backport PR author [backport: release/v0.71] (#10815)

`v0.71.0`

Features

add WithDriver and WithProvider options to ospkg detector (#10740) (f8a6ddb)
java: support <mirrors> from settings.xml (#10692) (c080ce3)
sbom: support for CycloneDX 1.7 (#10715) (04f739e)
seal: add vendor support for language file detection. (#10297) (b08bf6a)
secret: add a way to customize skipped folders, files and exts (#10550) (e4325b1)
secret: add Azure secret detection rules (#10562) (69dcd18)
secret: add Maven rules to detect passwords and passphrases in settings.xml and settings-security.xml files (#10704) (9ad901d)
spdx: add SHA-512 hash algorithm support to SPDX serializer (#10719) (f2a1237)
ubuntu: detect Ubuntu 26.04 LTS (#10592) (a61feac)

Bug Fixes

cloudformation: propagate AWS::EC2::Instance MetadataOptions (#10731) (ac2f3d7)
image: correctly reconstruct RUN instructions built without BuildKit (#10714) (519eac9)
java: surface 429 from a remote Maven repository as a fatal error when scanning pom.xml files (#10693) (f8fdb93)
misconf: fix rendering of nested values in terraform plan lists (#10746) (9c1cf65)
misconf: make identifiers in ignore rules case-insensitive (#10375) (a75a468)
misconf: prevent path traversal in Terraform filesystem functions (#10664) (9d91b88)
misconf: reject nil plays during playbook parsing (#10273) (0bc5c6d)
misconf: skip null cty values in AsMapValue to prevent panic (#10723) (f080e1e)
misconf: skip resources with no after changes (#10352) (f099dc4)
nodejs: handle legacy license formats in npm lockfile parser (#10684) (451fd99)
nodejs: silently skip subdirectory package.json files with invalid names (#10609) (0e4dc66)
overwrite OS packages PURLs after overwrite OS (#10298) (39a28ed)
pull instead of clone when test repo already exists (#10636) (3a2f7fb)
report: don't produce trailing comma in gitlab.tpl links array (#10728) (69e78e2)
secret: correctly skip secret-scanner config file from scanning (#10666) (fc1e46f)

`v0.69.3`

Changelog

6fb20c8 release: v0.69.3 [release/v0.69] (#10293)
dabefec fix(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 [backport: release/v0.69] (#10291)

`v0.69.0`

⚠ BREAKING CHANGES

misconf: use ID instead of AVDID for providers mapping (#9752)

Features

activestate: add support ActiveState images (#10081) (676709d)
add AnalyzedBy field to track which analyzer detected packages (#10059) (1953824)
cloudformation: add support for Fn::ForEach (#9508) (d65b504)
debian: detect third-party packages using maintainer list (#9917) (effc1c0)
flag: add JSON Schema for trivy.yaml configuration file (#9971) (4caf731)
helm: add sslCertDir parameter (#9697) (879e4fc)
julia: enable vulnerability scanning for the Julia language ecosystem (#9800) (c2f82ad)
misconf: add action block to Terraform schema (#10035) (b06ef6d)
misconf: initial ansible scanning support (#9332) (9275e15)
misconf: support for ARM resources defined as an object (#9959) (92d3465)
misconf: support for azurerm_*_web_app (#9944) (37b5da8)
misconf: Update Azure Database schema (#9811) (48dfede)
misconf: use Terraform plan configuration to partially restore schema (#9623) (5fced3a)
nodejs: parse licenses from package-lock.json file (#9983) (b64d5ad)
php: add support for dev dependencies in Composer (#9910) (56b59e8)
report: add Trivy version to JSON output (#10065) (fe7d20a)
rocky: enable modular package vulnerability detection (#10069) (31c4780)
rootio: Update trivy db to support usage of Severity from root.io feed (#9930) (d3096e7)
sbom: exclude PEP 770 SBOMs in .dist-info/sboms/ (#10033) (07ff788)
secret: add detection for Symfony default secret key (#9892) (34baef2)
vex: support per-repo tls configuration (#10030) (f809066)
vuln: skip vulnerability scanning for third-party packages in Debian/Ubuntu (#9932) (74819bf)

Bug Fixes

docker: fix non-det scan results for images with embedded SBOM (#9866) (7f71b57)
go: use ldflags version for all pseudo-versions (#10037) (3c0ab97)
image: race condition in image artifact inspection (#9966) (18acf4f)
java: add hash of GAV+root pom file path for pkgID for packages from pom.xml files (#9880) (809db46)
java: correctly inherit properties from parent fields for pom.xml files (#9111) (2933b01)
java: correctly propagate repositories from upper POMs to dependencies (#10077) (b9415a3)
license: normalize licenses for PostAnalyzers (#9941) (11dd3fa)
misconf: correct typos in block and attribute names (#9993) (ac061f8)
misconf: respect .yml files when Helm charts are detected (#9912) (18ecf75)
misconf: safely parse rotation_period in google_kms_crypto_key (#9980) (a0ecc8e)
move enum into items for array-type fields in JSON Schema (#10039) (4e06c3d)
remove trailing tab in statefulset template (#9889) (9db123c)
repo: return a nil interface for gitAuth if missing (#10097) (036c05b)
rust: add cargo workspace members glob support (#10032) (d2dc46a)
rust: implement version inheritance for Cargo mono repos (#10011) (47d3103)
secret: improve word boundary detection for Hugging Face tokens (#10046) (cdb28ee)
use canonical SPDX license IDs from embedded licenses.json (#10053) (c233735)
vex: add CVE-2025-66564 as not_affected into Trivy VEX file (#9924) (335cc99)
vuln: skip vulns detection for CentOS Stream family without scan failure (#9964) (b46cde0)

Performance Improvements

misconf: optimize string concatenation in azure scanner (#9969) (10a50a7)

Code Refactoring

misconf: use ID instead of AVDID for providers mapping (#9752) (6462dc8)

`v0.66.0`

Features

add timeout handling for cache database operations (#9307) (235c24e)
misconf: added audit config attribute (#9249) (4d4a244)
secret: implement streaming secret scanner with byte offset tracking (#9264) (5a5e097)
terraform: use .terraform cache for remote modules in plan scanning (#9277) (298a994)

Bug Fixes

conda: memory leak by adding closure method for package.json file (#9349) (03d039f)
create temp file under composite fs dir (#9387) (ce22f54)
cyclonedx: handle multiple license types (#9378) (46ab76a)
fs: avoid shadowing errors in file.glob (#9286) (b51c789)
image: use standardized HTTP client for ECR authentication (#9322) (84fbf86)
misconf: ensure ignore rules respect subdirectory chart paths (#9324) (d3cd101)
misconf: ensure module source is known (#9404) (81d9425)
misconf: preserve original paths of remote submodules from .terraform (#9294) (1319d8d)
misconf: use correct field log_bucket instead of target_bucket in gcp bucket (#9296) (04ad0c4)
persistent flag option typo (#9374) (6e99dd3)
plugin: don't remove plugins when updating index.yaml file (#9358) (5f067ac)
python: improve package name normalization (#9290) (1473e88)
repo: preserve RepoMetadata on FS cache hit (#9389) (4f2a44e)
repo: sanitize git repo URL before inserting into report metadata (#9391) (1ac9b1f)
sbom: add support for file component type of CycloneDX (#9372) (aa7cf43)
suppress debug log for context cancellation errors (#9298) (2458d5e)

`v0.65.0`

Features

add graceful shutdown with signal handling (#9242) (2c05882)
add HTTP request/response tracing support (#9125) (aa5b32a)
alma: add AlmaLinux 10 support (#9207) (861d51e)
flag: add schema validation for --server flag (#9270) (ed4640e)
image: add Docker context resolution (#9166) (99cd4e7)
license: observe pkg types option in license scanner (#9091) (d44af8c)
misconf: add private ip google access attribute to subnetwork (#9199) (263845c)
misconf: added logging and versioning to the gcp storage bucket (#9226) (110f80e)
repo: add git repository metadata to reports (#9252) (f4b2cf1)
report: add CVSS vectors in sarif report (#9157) (60723e6)
sbom: add SHA-512 hash support for CycloneDX SBOM (#9126) (12d6706)

Bug Fixes

alma: parse epochs from rpmqa file (#9101) (82db2fc)
also check filepath when removing duplicate packages (#9142) (4d10a81)
aws: update amazon linux 2 EOL date (#9176) (0ecfed6)
cli: Add more non-sensitive flags to telemetry (#9110) (7041a39)
cli: ensure correct command is picked by telemetry (#9260) (b4ad00f)
cli: panic: attempt to get os.Args[1] when len(os.Args) < 2 (#9206) (adfa879)
license: add missed GFDL-NIV-1.1 and GFDL-NIV-1.2 into Trivy mapping (#9116) (a692f29)
license: handle WITH operator for LaxSplitLicenses (#9232) (b4193d0)
migrate from *.list to *.md5sums files for dpkg (#9131) (f224de3)
misconf: correctly adapt azure storage account (#9138) (51aa022)
misconf: correctly parse empty port ranges in google_compute_firewall (#9237) (77bab7b)
misconf: fix log bucket in schema (#9235) (7ebc129)
misconf: skip rewriting expr if attr is nil (#9113) (42ccd3d)
nodejs: don't use prerelease logic for compare npm constraints (#9208) (fe96436)
prevent graceful shutdown message on normal exit (#9244) (6095984)
rootio: check full version to detect root.io packages (#9117) (c2ddd44)
rootio: fix severity selection (#9181) (6fafbeb)
sbom: merge in-graph and out-of-graph OS packages in scan results (#9194) (aa944cc)
sbom: use correct field for licenses in CycloneDX reports (#9057) (143da88)
secret: add UTF-8 validation in secret scanner to prevent protobuf marshalling errors (#9253) (54832a7)
secret: fix line numbers for multiple-line secrets (#9104) (e579746)
server: add HTTP transport setup to server mode (#9217) (1163b04)
supporting .egg-info/METADATA in python.Packaging analyzer (#9151) (e306e2d)
terraform: for_each on a map returns a resource for every key (#9156) (153318f)

`v0.63.0`

Features

add Bottlerocket OS package analyzer (#8653) (07ef63b)
add JSONC support for comments and trailing commas (#8862) (0b0e406)
alpine: add maintainer field extraction for APK packages (#8930) (104bbc1)
cli: Add available version checking (#8553) (5a0bf9e)
echo: Add Echo Support (#8833) (c7b8cc3)
go: support license scanning in both GOPATH and vendor (#8843) (26437be)
k8s: get components from namespaced resources (#8918) (4f1ab23)
license: improve work text licenses with custom classification (#8888) (ee52230)
license: improve work with custom classification of licenses from config file (#8861) (c321fdf)
license: scan vendor directory for license for go.mod files (#8689) (dd6a6e5)
license: Support compound licenses (licenses using SPDX operators) (#8816) (39f9ed1)
minimos: Add support for MinimOS (#8792) (c2dde33)
misconf: add misconfiguration location to junit template (#8793) (a516775)
misconf: Add support for Minimum Trivy Version (#8880) (3b2a397)
misconf: export raw Terraform data to Rego (#8741) (aaecc29)
nodejs: add a bun.lock analyzer (#8897) (7ca656d)
nodejs: add bun.lock parser (#8851) (1dcf816)
terraform parser option to set current working directory (#8909) (8939451)

Bug Fixes

check post-analyzers for StaticPaths (#8904) (93e6680)
cli: disable --skip-dir and --skip-files flags for sbom command (#8886) (69a5fa1)
cli: don't use allow values for --compliance flag (#8881) (35e8889)
filter all files when processing files installed from package managers (#8842) (6ebde88)
java: exclude dev dependencies in gradle lockfile (#8803) (8995838)
julia parser panicking (#8883) (be8c7b7)
julia: add Relationship field support (#8939) (22f040f)
k8s: use in-memory cache backend during misconfig scanning (#8873) (fe12771)
misconf: check if for-each is known when expanding dyn block (#8808) (5706603)
misconf: use argument value in WithIncludeDeprecatedChecks (#8942) (7e9a54c)
more revive rules (#8814) (3ab459e)
octalLiteral from go-critic (#8811) (a19e0aa)
redhat: Also try to find buildinfo in root layer (layer 0) (#8924) (906b037)
redhat: save contentSets for OS packages in fs/vm modes (#8820) (9256804)
redhat: trim invalid suffix from content_sets in manifest parsing (#8818) (fa1077b)
server: add missed Relationship field for rpc (#8872) (38f17c9)
use-any from revive (#8810) (883c63b)
vex: use lo.IsNil to check VEX from OCI artifact (#8858) (e97af98)
wolfi: support new APK database location (#8937) (b15d9a6)

Performance Improvements

secret: only match secrets of meaningful length, allow example strings to not be matched (#8602) (60fef1b)

`v0.61.0`

Features

fs: optimize scanning performance by direct file access for known paths (#8525) (8bf6caf)
k8s: add support for controllers (#8614) (1bf0117)
misconf: adapt aws_default_security_group (#8538) (b57eccb)
misconf: adapt aws_opensearch_domain (#8550) (9913465)
misconf: adapt AWS::DynamoDB::Table (#8529) (8112cdf)
misconf: adapt AWS::EC2::VPC (#8534) (0d9865f)
misconf: Add support for aws_ami (#8499) (573502e)
replace TinyGo with standard Go for WebAssembly modules (#8496) (529957e)

Bug Fixes

debian: don't include empty licenses for dpkgs (#8623) (346f5b3)
fs: check postAnalyzers for StaticPaths (#8543) (c228307)
k8s: show report for --report all (#8613) (dbb6f28)
misconf: add ephemeral block type to config schema (#8513) (41512f8)
misconf: Check values wholly prior to evaluation (#8604) (ad58cf4)
misconf: do not skip loading documents from subdirectories (#8526) (de7eb13)
misconf: do not use cty.NilVal for non-nil values (#8567) (400a79c)
misconf: identify the chart file exactly by name (#8590) (ba77dbe)
misconf: Improve logging for unsupported checks (#8634) (5b7704d)
misconf: set default values for AWS::EKS::Cluster.ResourcesVpcConfig (#8548) (1f05b45)
misconf: skip Azure CreateUiDefinition (#8503) (c7814f1)
spdx: save text licenses into otherLicenses without normalize (#8502) (e5072f1)
use --file-patterns flag for all post analyzers (#7365) (8b88238)

Performance Improvements

misconf: parse input for Rego once (#8483) (0e5e909)
misconf: retrieve check metadata from annotations once (#8478) (7b96351)

`v0.60.0`

Features

add --vuln-severity-source flag (#8269) (d464807)
add report summary table (#8177) (dd54f80)
cyclonedx: Add initial support for loading external VEX files from SBOM references (#8254) (4820eb7)
go: fix parsing main module version for go >= 1.24 (#8433) (e58dcfc)
misconf: render causes for Terraform (#8360) (a99498c)

Bug Fixes

db: fix case when 2 trivy-db were copied at the same time (#8452) (bb3cca6)
don't use scope for trivy registry login command (#8393) (8715e5d)
go: merge nested flags into string for ldflags for Go binaries (#8368) (b675b06)
image: disable AVD-DS-0007 for history scanning (#8366) (a3cd693)
k8s: add missed option PkgRelationships (#8442) (f987e41)
misconf: do not log scanners when misconfig scanning is disabled (#8345) (5695eb2)
misconf: ecs include enhanced for container insights (#8326) (39789ff)
misconf: fix incorrect k8s locations due to JSON to YAML conversion (#8073) (a994453)
os: add mapping OS aliases (#8466) (6b4cebe)
python: add poetry v2 support (#8323) (10cd98c)
report: remove html escaping for shortDescription and fullDescription fields for sarif reports (#8344) (3eb0b03)
sbom: add SBOM file's filePath as Application FilePath if we can't detect its path (#8346) (ecc01bb)
sbom: improve logic for binding direct dependency to parent component (#8489) (85cca8c)
sbom: preserve OS packages from multiple SBOMs (#8325) (bd5baaf)
server: secrets inspectation for the config analyzer in client server mode (#8418) (a1c4bd7)
spdx: init pkgFilePaths map for all formats (#8380) (72ea4b0)
terraform: apply parser options to submodule parsing (#8377) (398620b)
update all documentation links (#8045) (49456ba)

`v0.59.0`

Features

add --distro flag to manually specify OS distribution for vulnerability scanning (#8070) (da17dc7)
add a examples field to check metadata (#8068) (6d84e0c)
add support for registry mirrors (#8244) (4316bcb)
fs: use git commit hash as cache key for clean repositories (#8278) (b5062f3)
image: prevent scanning oversized container images (#8178) (509e030)
image: return error early if total size of layers exceeds limit (#8294) (73bd20d)
k8s: improve artifact selections for specific namespaces (#8248) (db9e57a)
misconf: generate placeholders for random provider resources (#8051) (ffe24e1)
misconf: support for ignoring by inline comments for Dockerfile (#8115) (c002327)
misconf: support for ignoring by inline comments for Helm (#8138) (a0429f7)
nodejs: respect peer dependencies for dependency tree (#7989) (7389961)
python: add support for poetry dev dependencies (#8152) (774e04d)
python: add support for uv (#8080) (c4a4a5f)
python: add support for uv dev and optional dependencies (#8134) (49c54b4)

Bug Fixes

CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass (#8088) (d7ac286)
CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field (#8207) (670fbf2)
de-duplicate same dpkg packages with different filePaths from different layers (#8298) (846498d)
enable err-error and errorf rules from perfsprint linter (#7859) (156a2aa)
flag: skip hidden flags for --generate-default-config command (#8046) (5e68bdc)
fs: fix cache key generation to use UUID (#8275) (eafd810)
handle BLOW_UNKNOWN error to download DBs (#8060) (51f2123)
improve conversion of image config to Dockerfile (#8308) (2e8e38a)
java: correctly overwrite version from depManagement if dependency uses project.* props (#8050) (9d9f80d)
license: always trim leading and trailing spaces for licenses (#8095) (f5e4291)
misconf: allow null values only for tf variables (#8112) (23dc3a6)
misconf: correctly handle all YAML tags in K8S templates (#8259) (f12054e)
misconf: disable git terminal prompt on tf module load (#8026) (bbc5a85)
misconf: handle heredocs in dockerfile instructions (#8284) (0a3887c)
misconf: use log instead of fmt for logging (#8033) (07b2d7f)
oracle: add architectures support for advisories (#4809) (90f1d8d)
python: skip dev group's deps for poetry (#8106) (a034d26)
redhat: check usr/share/buildinfo/ dir to detect content sets (#8222) (f352f6b)
redhat: correct rewriting of recommendations for the same vulnerability (#8063) (4202c4b)
respect GITHUB_TOKEN to download artifacts from GHCR (#7580) (21b68e1)
sbom: attach nested packages to Application (#8144) (735335f)
sbom: fix wrong overwriting of applications obtained from different sbom files but having same app type (#8052) (fd07074)
sbom: scan results of SBOMs generated from container images are missing layers (#7635) (f9fceb5)
sbom: use root package for unknown dependencies (if exists) (#8104) (7558df7)
spdx: use the hasExtractedLicensingInfos field for licenses that are not listed in the SPDX (#8077) (aec8885)
suse: SUSE - update OSType constants and references for compatibility (#8236) (ae28398)
Updated twitter icon (#7772) (2c41ac8)
wasm module test (#8099) (2200f38)

Performance Improvements

avoid heap allocation in applier findPackage (#7883) (9bd6ed7)

`v0.58.0`

Features

add workspaceRelationship (#7889) (d622ca2)
add cvss v4 score and vector in scan response (#7968) (e0f2054)
go: construct dependencies in the parser (#7973) (bcdc0bb)
go: construct dependencies of go.mod main module in the parser (#7977) (5448ba2)
k8s: add default commands for unknown platform (#7863) (b1c7f55)
misconf: log causes of HCL file parsing errors (#7634) (e9a899a)
oracle: add flavors support (#7858) (b9b383e)
secret: Add built-in secrets rules for Private Packagist (#7826) (132d9df)
suse: Align SUSE/OpenSUSE OS Identifiers (#7965) (45d3b40)
Update registry fallbacks (#7679) (5ba9a83)

Bug Fixes

alpine: add UID for removed packages (#7887) (07915da)
aws: change CPU and Memory type of ContainerDefinition to a string (#7995) (aeeba70)
cli: Handle empty ignore files more gracefully (#7962) (4cfb2a9)
debian: infinite loop (#7928) (d982e6a)
fs: add missing deferred Cleanup() call to post analyzer fs (#7882) (ab32297)
Improve version comparisons when build identifiers are present (#7873) (eda4d76)
k8s: check all results for vulnerabilities (#7946) (797b36f)
misconf: do not erase variable type for child modules (#7941) (de3b7ea)
misconf: handle null properties in CloudFormation templates (#7813) (99b2db3)
misconf: load full Terraform module (#7925) (fbc42a0)
misconf: properly resolve local Terraform cache (#7983) (fe3a897)
misconf: Update trivy-checks default repo to mirror.gcr.io (#7953) (9988147)
misconf: wrap AWS EnvVar to iac types (#7407) (54130dc)
redhat: don't return error if root/buildinfo/content_manifests/ contains files that are not contentSets files (#7912) (38775a5)
report: handle git@github.com schema for misconfigs in sarif report (#7898) (19aea4b)
sbom: Fixes for Programming Language Vulnerabilities and SBOM Package Maintainer Details (#7871) (461a68a)
terraform: set null value as fallback for missing variables (#7669) (611558e)

`v0.57.0`

⚠ BREAKING CHANGES

k8s: support k8s multi container (#7444)

Features

add end of life date for Ubuntu 24.10 (#7787) (ad3c09e)
cli: add trivy auth (#7664) (27117f8)
cli: error out when ignore file cannot be found (#7624) (cb0b3a9)
cli: rename trivy auth to trivy registry (#7727) (633a7ab)
cyclonedx: add file checksums to CycloneDX reports (#7507) (c225883)
db: append errors (#7843) (5e78b6c)
misconf: export unresolvable field of IaC types to Rego (#7765) (9514148)
misconf: public network support for Azure Storage Account (#7601) (ad91412)
misconf: Show misconfig ID in output (#7762) (f75c0d1)
misconf: ssl_mode support for GCP SQL DB instance (#7564) (2eaa17e)
parser: ignore white space in pom.xml files (#7747) (a7baa93)
report: update gitlab template to populate operating_system value (#7735) (c0d79fa)

Bug Fixes

cli: clean --all deletes only relevant dirs (#7704) (672e886)
cli: add config name to skip-policy-update alias (#7820) (b661d68)
db: fix javadb downloading error handling (#7642) (2c87f0c)
enable usestdlibvars linter (#7770) (57e24aa)
go: Do not trim v prefix from versions in Go Mod Analyzer (#7733) (e872ec0)
helm: properly handle multiple archived dependencies (#7782) (6fab88d)
java: correctly inherit version and scope from upper/root depManagement and dependencies into parents (#7541) (778df82)
k8s: skip resources without misconfigs (#7797) (7882776)
k8s: support k8s multi container (#7444) (c434775)
k8s: support kubernetes v1.31 (#7810) (7a4f4d8)
license: fix license normalization for Universal Permissive License (#7766) (f6acdf7)
misconf: change default ACL of digitalocean_spaces_bucket to private (#7577) (9da84f5)
misconf: check if property is not nil before conversion (#7578) (c8c14d3)
misconf: fix for Azure Storage Account network acls adaptation (#7602) (35fd018)
misconf: properly expand dynamic blocks (#7612) (8d5dbc9)
redhat: include arch in PURL qualifiers (#7654) (a585e95)
repo: git clone output to Stderr (#7561) (fdf203c)
report: Fix invalid URI in SARIF report (#7645) (015bb88)
sbom: add options for DBs in private registries (#7660) (1f2e91b)
sbom: use Annotation instead of AttributionTexts for SPDX formats (#7811) (f2bb9c6)

`v0.55.0`

⚠ BREAKING CHANGES

cli: delete deprecated SBOM flags (#7266)

Features

cli: delete deprecated SBOM flags (#7266) (7024572)
go: use toolchain as stdlib version for go.mod files (#7163) (2d80769)
java: add test scope support for pom.xml files (#7414) (2d97700)
misconf: Add support for using spec from on-disk bundle (#7179) (be86126)
misconf: ignore duplicate checks (#7317) (9ef05fc)
misconf: iterator argument support for dynamic blocks (#7236) (fe92072)
misconf: port and protocol support for EC2 networks (#7146) (98e136e)
misconf: scanning support for YAML and JSON (#7311) (efdbd8f)
misconf: support for ignore by nested attributes (#7205) (44e4686)
misconf: support for policy and bucket grants (#7284) (a817fae)
misconf: variable support for Terraform Plan (#7228) (db2c955)
python: use minimum version for pip packages (#7348) (e9b43f8)
report: export modified findings in JSON (#7383) (7aea79d)
sbom: set User-Agent header on requests to Rekor (#7396) (af1d257)
server: add internal --path-prefix flag for client/server mode (#7321) (24a4563)
server: Make Trivy Server Multiplexer Exported (#7389) (4c6e8ca)
vm: Support direct filesystem (#7058) (45b3f34)
vm: support the Ext2/Ext3 filesystems (#6983) (35c60f0)
vuln: Add --detection-priority flag for accuracy tuning (#7288) (fd8348d)

Bug Fixes

aws: handle ECR repositories in different regions (#6217) (feaef96)
flag: incorrect behavior for deprecated flag --clear-cache (#7281) (2a0e529)
helm: explicitly define kind and apiVersion of volumeClaimTemplate element (#7362) (da4ebfa)
java: Return error when trying to find a remote pom to avoid segfault (#7275) (49d5270)
license: add license handling to JUnit template (#7409) (f80183c)
logger initialization before flags parsing (#7372) (c929290)
misconf: change default TLS values for the Azure storage account (#7345) (aadb090)
misconf: do not filter Terraform plan JSON by name (#7406) (9d7264a)
misconf: do not recreate filesystem map (#7416) (3a5d091)
misconf: do not register Rego libs in checks registry (#7420) (a5aa63e)
misconf: do not set default value for default_cache_behavior (#7234) (f0ed5e4)
misconf: fix infer type for null value (#7424) (0cac3ac)
misconf: init frameworks before updating them (#7376) (b65b32d)
misconf: load only submodule if it is specified in source (#7112) (a4180bd)
misconf: support deprecating for Go checks (#7377) (2a6c7ab)
misconf: use module to log when metadata retrieval fails (#7405) (0799770)
misconf: wrap Azure PortRange in iac types (#7357) (c5c62d5)
nodejs: check all importers to detect dev deps from pnpm-lock.yaml file (#7387) (fd9ed3a)
plugin: do not call GitHub content API for releases and tags (#7274) (b3ee6da)
report: escape Message field in asff.tpl template (#7401) (dd9733e)
safely check if the directory exists (#7353) (05a8297)
sbom: use NOASSERTION for licenses fields in SPDX formats (#7403) (c96dcdd)
secret: use .eyJ keyword for JWT secret (#7410) (bf64003)
secret: use only line with secret for long secret lines (#7412) (391448a)
terraform: add aws_region name to presets (#7184) (bb2e26a)

Performance Improvements

misconf: do not convert contents of a YAML file to string (#7292) (85dadf5)
misconf: optimize work with context (#6968) (2b6d8d9)
misconf: use json.Valid to check validity of JSON (#7308) (c766831)

`v0.53.0`

⚠ BREAKING CHANGES

k8s: node-collector dynamic commands support (#6861)
add clean subcommand (#6993)
aws: Remove aws subcommand (#6995)

Features

add clean subcommand (#6993) (8d0ae1f)
Add local ImageID to SARIF metadata (#6522) (f144e91)
add memory cache backend (#7048) (55ccd06)
aws: Remove aws subcommand (#6995) (979e118)
conda: add licenses support for environment.yml files (#6953) (654217a)
dart: use first version of constraint for dependencies using SDK version (#6239) (042d6b0)
image: Set User-Agent header for Trivy container registry requests (#6868) (9b31697)
java: add support for maven-metadata.xml files for remote snapshot repositories. (#6950) (1f8fca1)
java: add support for sbt projects using sbt-dependency-lock (#6882) (f18d035)
k8s: node-collector dynamic commands support (#6861) (8d618e4)
misconf: add metadata to Cloud schema (#6831) (02d5404)
misconf: add support for AWS::EC2::SecurityGroupIngress/Egress (#6755) (55fa610)
misconf: API Gateway V1 support for CloudFormation (#6874) (8491469)
misconf: support of selectors for all providers for Rego (#6905) (bc3741a)
php: add installed.json file support (#4865) (edc556b)
plugin: add support for nested archives (#6845) (622c67b)
sbom: migrate to CycloneDX v1.6 (#6903) (09e50ce)

Bug Fixes

c: don't skip conan files from file-patterns and scan .conan2 cache dir (#6949) (38b35dd)
cli: show info message only when --scanners is available (#7032) (e9fc3e3)
cyclonedx: trim non-URL info for advisory.url (#6952) (417212e)
debian: take installed files from the origin layer (#6849) (089b953)
image: parse image.inspect.Created field only for non-empty values (#6948) (0af5730)
license: return license separation using separators ,, or, etc. (#6916) (52f7aa5)
misconf: fix caching of modules in subdirectories (#6814) (0bcfedb)
misconf: fix parsing of engine links and frameworks (#6937) (ec68c9a)
misconf: handle source prefix to ignore (#6945) (c3192f0)
misconf: parsing numbers without fraction as int (#6834) (8141a13)
nodejs: fix infinite loop when package link from package-lock.json file is broken (#6858) (cf5aa33)
nodejs: fix infinity loops for pnpm with cyclic imports (#6857) (7d083bc)
plugin: respect --insecure (#7022) (3d02a31)
purl: add missed os types (#6955) (2d85a00)
python: compare pkg names from poetry.lock and pyproject.toml in lowercase (#6852) (faa9d92)
sbom: don't overwrite srcEpoch when decoding SBOM files (#6866) (04af59c)
sbom: fix panic when scanning SBOM file without root component into SBOM format (#7051) (3d4ae8b)
sbom: take pkg name from purl for maven pkgs (#7008) (a76e328)
sbom: use purl for bitnami pkg names (#6982) (7eabb92)
sbom: use package UIDs for uniqueness (#7042) (14d71ba)
secret: Asymmetric Private Key shouldn't start with space (#6867) (bb26445)
suse: Add SLES 15.6 and Leap 15.6 (#6964) (5ee4e9d)
use embedded when command path not found (#7037) (137c916)

`v0.52.0`

Features

Add Julia language analyzer support (#5635) (fecafb1)
add support for plugin index (#6674) (26faf8f)
misconf: Add support for deprecating a check (#6664) (88702cf)
misconf: add Terraform 'removed' block to schema (#6640) (b7a0a13)
misconf: register builtin Rego funcs from trivy-checks (#6616) (7c22ee3)
misconf: resolve tf module from OpenTofu compatible registry (#6743) (ac74520)
misconf: support for VPC resources for inbound/outbound rules (#6779) (349caf9)
misconf: support symlinks inside of Helm archives (#6621) (4eae37c)
nodejs: add v9 pnpm lock file support (#6617) (1e08648)
plugin: specify plugin version (#6683) (d6dc567)
python: add license support for requirement.txt files (#6782) (29615be)
python: add line number support for requirement.txt files (#6729) (2bc54ad)
report: Include licenses and secrets filtered by rego to ModifiedFindings (#6483) (fa3cf99)
vex: improve relationship support in CSAF VEX (#6735) (a447f6b)
vex: support non-root components for products in OpenVEX (#6728) (9515695)

Bug Fixes

clean up golangci lint configuration (#6797) (62de6f3)
cli: always output fatal errors to stderr (#6827) (c2b9132)
close APKINDEX archive file (#6672) (5caf437)
close settings.xml (#6768) (9c3e895)
close testfile (#6830) (aa0c413)
conda: add support pip deps for environment.yml files (#6675) (150a773)
go: add only non-empty root modules for gobinaries (#6710) (c96f2a5)
go: include only .version|.ver (no prefixes) ldflags for gobinaries (#6705) (afb4f9d)
Golang version parsing from binaries w/GOEXPERIMENT (#6696) (696f2ae)
include packages unless it is not needed (#6765) (56dbe1f)
misconf: don't shift ignore rule related to code (#6708) (39a746c)
misconf: skip Rego errors with a nil location (#6638) (a2c522d)
misconf: skip Rego errors with a nil location (#6666) (a126e10)
node-collector high and critical cves (#6707) (ff32deb)
plugin: initialize logger (#6836) (728e77a)
python: add package name and version validation for requirements.txt files. (#6804) (ea3a124)
report: hide empty tables if all vulns has been filtered (#6352) (3d388d8)
sbom: fix panic for convert mode when scanning json file derived from sbom file (#6808) (f92ea09)
use of specified context to obtain cluster name (#6645) (39ebed4)

Performance Improvements

misconf: parse rego input once (#6615) (67c6b1d)

`v0.26.0`

Changelog

a0047a7 feat(alpine): warn mixing versions (#2000)
d786655 Update ASFF template (#1914)
a02cf65 chore(deps): replace containerd/containerd version to fix CVE-2022-23648 (#1994)
613e38c chore(deps): bump alpine from 3.15.3 to 3.15.4 (#1993)
3b6d65b test(go): add integration tests for gomod (#1989)
22f5b93 fix(python): fixed panic when scan .egg archive (#1992)
485637c fix(go): set correct go modules type (#1990)
6fdb554 feat(alpine): support apk repositories (#1987)
d9bddb9 docs: add CBL-Mariner (#1982)
1cf1873 docs(go): fix version (#1986)
d77dbe8 feat(go): support go.mod in Go 1.17+ (#1985)
32bd1e4 ci: fix URLs in the PR template (#1972)
94a5a18 ci: add semantic pull requests check (#1968)
72d94b2 docs(issue): added docs for wrong detection issues (#1961)

`v0.25.3`

Changelog

d4e3df8 fix(downloadDB): add dbRepositoryFlag to repository and rootfs commands (#1956)
7e48cc1 fix(misconf): update BurntSushi/toml for fix runtime error (#1948)
c9efa8c fix(misconf): Update fanal/defsec to resolve missing metadata issues (#1947)
52b7154 feat(jar): allow setting Maven Central URL using environment variable (#1939)
21f7a41 chore(chart): update Trivy version in HelmChart to 0.25.0 (#1931)
ff2b3d1 chore(chart): remove version comments (#1933)

`v0.24.4`

Changelog

06659f1 fix(docker): Getting images without a tag (#1852)
a91cc50 docs(gitlab-ci): Use environment variables TRIVY_CACHE_DIR and TRIVY_NO_PROGRESS (#1801)

eebf9c8 fix(pom): keep an order of dependencies (#1784)
971092b chore: bump up Go to 1.17 (#1781)
2f2d822 chore(deps): bump actions/setup-python from 2 to 3 (#1776)
a2afd6e chore(deps): bump golangci/golangci-lint-action from 2 to 3.1.0 (#1777)

Docker images

docker pull aquasec/trivy:0.24.2
docker pull ghcr.io/aquasecurity/trivy:0.24.2
docker pull public.ecr.aws/aquasecurity/trivy:0.24.2

`v0.24.1`

Changelog

a423b99 fix(python): correct handling pip package names with a hyphen (#1771)
a069ad7 doc(docker): fix command to run trivy with docker on linux (#1761)
015055e feat(helm): Add support for custom labels (#1767)
cbaa363 chore(helm): bump chart to trivy 0.24.0 (#1762)
bec02f0 docs: remove erroneous command (#1763)

Docker images

docker pull aquasec/trivy:0.24.1
docker pull ghcr.io/aquasecurity/trivy:0.24.1
docker pull public.ecr.aws/aquasecurity/trivy:0.24.1

`v0.24.0`

Changelog

d7f8b92 chore(deps): bump github.com/spf13/afero from 1.6.0 to 1.8.1 (#1708)
59ea0d5 fix(option): warn list-all-pkgs only with the table format (#1755)
c788676 feat(option): warn "--list-all-pkgs" with "--format table" (#1632)
58ade46 feat(report): add support for CycloneDX (#1081)
77cab6e chore(deps): update the defsec and tfsec versions (#1747)
2ede15d fix(scanner): fix skip of language-specific files when scanning rootf… (#1751)
d266c74 chore(deps): bump github.com/google/wire from 0.4.0 to 0.5.0 (#1712)
4423396 feat(report): considering App.Writer when printing results (#1722)
356ae30 chore(deps): replace satori version and skipping examples folder (#1745)
477dc7d build: add s390x container images (#1726)
89b8d7f feat(template) Add misconfigurations to junit report (#1724)
219b71b chore(deps): bump github.com/twitchtv/twirp (#1709)
aa6e1eb feat(client): configure TLS InsecureSkipVerify for server connection (#1287)
de6c3cb fix(rpc): Supports RPC calls for new identifier CustomResource (#1605)
b7d4d1e chore(deps): bump go.uber.org/zap from 1.20.0 to 1.21.0 (#1705)
e6c029d chore(deps): bump github.com/caarlos0/env/v6 from 6.0.0 to 6.9.1 (#1707)
ec6cb1a feat(helm): Parameterise ServiceAccount annotations (#1677)
7dfc16c chore(deps): bump github.com/hashicorp/go-getter from 1.5.2 to 1.5.11 (#1710)
42d8fd6 chore(deps): bump github.com/cheggaaa/pb/v3 from 3.0.3 to 3.0.8 (#1704)
c3ef203 chore(deps): bump github.com/open-policy-agent/opa from 0.36.1 to 0.37.2 (#1711)
274103e chore(dependabot): enable gomod monthly (#1699)
e618d83 fix(gitlab tpl): escape double quote (#1635)
3b0b2ed build: Make make protoc be consistent (#1682)
5c8d098 feat(purl): add generate purl package utilities (#1574)
11f4f81 refactor: move result structs under types (#1696)
6db2092 feat(mariner): add support for CBL-Mariner 2.0 (#1694)
8898bb0 docs(gitlab-ci): fix Script in GitLab CI Example #1688
33d0833 chore: Upgrade helm chart version (#1683)
13874d8 chore(mod): update Go dependencies (#1681)
f26a06b docs: fix typos in markdown docs (#1674)
e2821a4 docs: update documentation for image scanning of tar files to use a tag present on Docker Hub (#1671)
ef8a1af fix(repo): --no-progress suppresses git output (#1669)

Docker images

docker pull aquasec/trivy:0.24.0
docker pull ghcr.io/aquasecurity/trivy:0.24.0
docker pull public.ecr.aws/aquasecurity/trivy:0.24.0

`v0.23.0`

Changelog

449add2 docs: add ACR navigator (#1651)
cb9afc8 fix: update example Rego files and docs (#1628)
78b2b89 feat(option): show a link to GitHub Discussions for --light deprecation (#1650)
52fd3c2 fix(sarif): fix the warning message (#1647)
8d5882b refactor: migrate to prefixed buckets (#1644)
84dd33f feat(mariner): add support for CBL-Mariner (#1640)
9e903a1 docs: commercial use available (#1641)
f4c746a feat: support azure acr (#1611)
420f8ab feat(os-pkg): add data sources (#1636)
d2827cb feat(redhat): support build info in RHEL (#807)
ce703ce fix: change links in pull_request_template to static URLs (#1634)
50bb938 feat(lang-pkg): add data sources (#1625)
a31ddbe feat(detector): support custom detector (#1615)
3a4e18a docs(contribution): change role who should resolve comments (#1618)
8ba6836 docs: add PR template (#1602)
f5c5573 feat(rocky): support Rocky Linux (#1570)
eab2b42 Add the ability to set dockerhub credentials in the helm chart (#1569)
cabd18d feat(cache): redis TLS support (#1297)
02c3c36 feat(java): add support for PAR files (#1599)
4f7b768 refactor(rust): move rust-advisory-db to OSV (#1591)
d754cb8 feat: log ignored vulnerabilities on debug (#1378)
a936e67 chore(mod): hcl2json deps update (#1585)
af116d3 fix(rpm): do not ignore installed files via third-party rpm (#1594)
b507360 feat(fs): allow scanning a single file (#1578)
7fcbf44 refactor(python): drop Safety DB (#1580)
478d279 feat: added insecure tls skip to scan git repo (#1528)
33bd41b Supress git clone output (#1590)
39a1008 fix(alma): skip modular package because MODULARITYLABEL is not set (#1588)
37abd61 feat(photon os): added EOL dates check (#1587)
78de33e docs: update supported os (#1586)
2205462 BREAKING: remove root command (#1579)
28ddcf1 docs: add Rust to Language-specific Packages Table (#1577)
df134c7 docs: update int doc for gitlab ci (#1575)
8da20c8 BREAKING: migrate the sarif template to Go code (#1437)
714b5ca refactor: remove unused field (#1567)
51e152b chore(deps): bump helm/chart-testing-action from 2.1.0 to 2.2.0 (#1554)
884daff docs: gitlab integration (#1381)
2a8336b feat(alma): support AlmaLinux (#1238)
1e171af docs: added note about default template path when Trivy installed using rpm (#1551)
e65274e BREAKING: Trivy DB from GHCR (#1539)
db35450 feat(cli): Do not set default commands when a plugin is being run (#1549)
24254d1 fix: add fingerprint field to codequality template (#1541)
2ee0745 fix(image): correct handling of uncompressed layers (#1544)
0aef82c chore: helm chart app version 0.22.0 (#1535)
8b2a799 test(integration): use fixtures (#1532)

Docker images

docker pull aquasec/trivy:0.23.0
docker pull ghcr.io/aquasecurity/trivy:0.23.0
docker pull public.ecr.aws/aquasecurity/trivy:0.23.0

`v0.22.0`

Changelog

42f795f fix(java/pom): ignore unsupported requirements (#1514)
8f737cc feat(cli): warning for root command (#1516)
76249bd BREAKING: disable JAR detection in fs/repo scanning (#1512)
59957d4 feat(scan): support --offline-scan option (#1511)
da8b72d fix: improve memory usage (#1509)
b713ad0 feat(java): support pom.xml (#1501)
56115e9 docs: fixing rust link to security advisory (#1504)
7f859af Add missing IacMetdata (#1505)
628a796 feat(jar): add file path (#1498)
82fba77 feat(rpm): support NDB (#1497)
d5269da feat: added misconfiguration field for html.tpl (#1444)

Docker images

docker pull aquasec/trivy:0.22.0
docker pull ghcr.io/aquasecurity/trivy:0.22.0
docker pull public.ecr.aws/aquasecurity/trivy:0.22.0

`v0.21.2`

Changelog

7beed30 docs: provide more information on scanning Google's GCR (#1426)
f50e1f4 docs(misconfiguration): added instruction for misconfiguration detection (#1428)
3ae4de5 Update git-repository.md (#1430)
6e35b8f fix(hooks): exclude unrelated lib types from system files filtering (#1431)
beb60b0 chore: run go fmt (#1429)
582e7fd fix(sarif): change help field in the sarif template. (#1423)
11bc290 Update fanal with cfsec version update (#1425)
392f689 Replace deprecated option in goreleaser (#1406)
101d576 feat(alpine): support 3.15 (#1422)
bd3ba68 chore: test the helm chart in the PR and used the commit hash (#1414)
3860d6e chore(deps): bump alpine from 3.14 to 3.15.0 (#1417)
4f82673 chore(release): add ubuntu older versions to deploy script (#1416)

Docker images

docker pull aquasec/trivy:0.21.2
docker pull ghcr.io/aquasecurity/trivy:0.21.2
docker pull public.ecr.aws/aquasecurity/trivy:0.21.2

`v0.21.1`

Changelog

b9a51de chore(mod): tidy (#1415)
7f24834 fix(rpc): fix nil layer transmit (#1410)
af3eaef Lang advisory order (#1409)
07c9200 chore: add support for s390x arch (#1304)
8bc8a4a fix(chart): ingress helm manifest-update trivy image (#1323)
9076a49 docs: Add comparison for cfsec (#1388)
bb316d9 remove: delete unused functions in utils package (#1379)

Docker images

docker pull aquasec/trivy:0.21.1
docker pull ghcr.io/aquasecurity/trivy:0.21.1
docker pull public.ecr.aws/aquasecurity/trivy:0.21.1

`v0.21.0`

Changelog

efdb29d fix(sarif): fix validation errors (#1376)
9bcf9e7 docs: add Bitbucket Pipelines (#1374)
3147097 docs: add community integrations (#1361)
33f74b3 Use a stable SARIF identifier (#1230)
5915ffb fix(python): fix parsing of requirements.txt with hash checking mode available in pip since version 8.0
ae4c42b feat(iac): Add line information (#1366)
19747d0 feat(cloudformation): Adding support for cfsec IaC scanning (#1360)
da45061 chore: send debug and info logs to stdout in install.sh, not stderr. (#1264)
cb1a4ed Update containerd to v1.5.7 and docker-cli to v20.10.9 (#1356)
69dae54 chore: update SBOM generation (#1349)

Docker images

docker pull aquasec/trivy:0.21.0
docker pull ghcr.io/aquasecurity/trivy:0.21.0
docker pull public.ecr.aws/aquasecurity/trivy:0.21.0

`v0.20.2`

Changelog

5dc8cfe docs: update builtin.md (#1335)
798b564 chore: fix issues with Homebrew formula (#1329)
21bf5e5 chore: bump GoReleaser to v0.183.0 (#1328)
e0f4ebd docs: update iac.md for a typo (#1326)
23a9a5e docs: typo fix (#1308)
1f5d17f Add new networking API features to Ingress (#1262)

Docker images

docker pull aquasec/trivy:0.20.2
docker pull ghcr.io/aquasecurity/trivy:0.20.2
docker pull public.ecr.aws/aquasecurity/trivy:0.20.2

`v0.19.2`

Changelog

f3f3029 Updated the Alpine Image to 3.14 (latest) (#1130)
0e52fde Added EOL for Ubuntu 21.10 (#1131)
9b3fba0 fix(image): disabled scanning of config files within container images (#1133)
1101634 docs: fixed typo (#1124)
499b7a6 update cyclonedx github action to v0.3.0 (#1127)

Docker images

docker pull aquasec/trivy:0.19.2
docker pull ghcr.io/aquasecurity/trivy:0.19.2
docker pull public.ecr.aws/aquasecurity/trivy:0.19.2
docker pull aquasec/trivy:latest
docker pull ghcr.io/aquasecurity/trivy:latest
docker pull public.ecr.aws/aquasecurity/trivy:latest

`v0.19.1`

Changelog

cea9b0b fix(policy): fix panic on the first run (#1116)

Docker images

docker pull aquasec/trivy:0.19.1
docker pull ghcr.io/aquasecurity/trivy:0.19.1
docker pull public.ecr.aws/aquasecurity/trivy:0.19.1
docker pull aquasec/trivy:latest
docker pull ghcr.io/aquasecurity/trivy:latest
docker pull public.ecr.aws/aquasecurity/trivy:latest

`v0.18.3`

Changelog

85e45ca chore(ci): change to more granular tokens (#1014)
9fa512a chore(ci): add Go scanning and update dependencies (#1001)
349371b docs: Add HIGH severity to Trivy command in GitLab CI example to match comment (#1013)

Docker images

docker pull aquasec/trivy:0.18.3
docker pull ghcr.io/aquasecurity/trivy:0.18.3
docker pull public.ecr.aws/aquasecurity/trivy:0.18.3
docker pull aquasec/trivy:latest
docker pull ghcr.io/aquasecurity/trivy:latest
docker pull public.ecr.aws/aquasecurity/trivy:latest

`v0.18.2`

Changelog

4446961 fix(image): disable go.sum scanning (#1007)
04473ad fix(gomod): handle go.sum with an empty line (#1006)
1b66b77 feat: prepare for config scanning (#1005)
8fc6ea6 Clarify that dev dependencies are excluded (#986)

Docker images

docker pull aquasec/trivy:0.18.2
docker pull ghcr.io/aquasecurity/trivy:0.18.2
docker pull public.ecr.aws/aquasecurity/trivy:0.18.2
docker pull aquasec/trivy:latest
docker pull ghcr.io/aquasecurity/trivy:latest
docker pull public.ecr.aws/aquasecurity/trivy:latest

`v0.18.1`

Changelog

eaf2da2 Include target value in Sarif template ruleID (#991)
083c157 chore(mkdocs): allow workflow_dispatch (#989)

Docker images

docker pull aquasec/trivy:0.18.1
docker pull ghcr.io/aquasecurity/trivy:0.18.1
docker pull public.ecr.aws/aquasecurity/trivy:0.18.1
docker pull aquasec/trivy:latest
docker pull ghcr.io/aquasecurity/trivy:latest
docker pull public.ecr.aws/aquasecurity/trivy:latest

`v0.18.0`

Release Note

https://github.com/aquasecurity/trivy/discussions/990

Changelog

e26e39a fix(vuln) unique vulnerabilities from different data sources (#984)
04e7cca feat(go): added support of gomod analyzer (#978)

Docker images

docker pull aquasec/trivy:0.18.0
docker pull ghcr.io/aquasecurity/trivy:0.18.0
docker pull public.ecr.aws/aquasecurity/trivy:0.18.0
docker pull aquasec/trivy:latest
docker pull ghcr.io/aquasecurity/trivy:latest
docker pull public.ecr.aws/aquasecurity/trivy:latest

`v0.17.2`

Changelog

415e1d8 fix: scan only regular files (#976)
3bb8852 docs: mention upx binaries (#974)
c0fddd9 chore: upgrade alpine to fix git and libcurl vulnerabilities in trivy docker image scan (#971)

Docker images

docker pull aquasec/trivy:0.17.2
docker pull ghcr.io/aquasecurity/trivy:0.17.2
docker pull public.ecr.aws/aquasecurity/trivy:0.17.2
docker pull aquasec/trivy:latest
docker pull ghcr.io/aquasecurity/trivy:latest
docker pull public.ecr.aws/aquasecurity/trivy:latest

`v0.17.1`

Changelog

41c066d fix(fs): skip dirs (#969)

Docker images

docker pull aquasec/trivy:0.17.1
docker pull ghcr.io/aquasecurity/trivy:0.17.1
docker pull public.ecr.aws/aquasecurity/trivy:0.17.1
docker pull aquasec/trivy:latest
docker pull ghcr.io/aquasecurity/trivy:latest
docker pull public.ecr.aws/aquasecurity/trivy:latest

`v0.16.0`

Features

Support Podman (#825)

[EXPERIMENTAL] This feature might change without preserving backwards compatibility.

Scan your image in Podman (>=2.0) running locally. The remote Podman is not supported. Before performing Trivy commands, you must enable the podman.sock systemd service on your machine. For more details, see here

$ systemctl --user enable --now podman.socket

Then, you can scan your image in Podman.

$ cat Dockerfile
FROM alpine:3.12
RUN apk add --no-cache bash
$ podman build -t test .
$ podman images
REPOSITORY                TAG     IMAGE ID      CREATED      SIZE
localhost/test            latest  efc372d4e0de  About a minute ago  7.94 MB
$ trivy image test

Support modular packages in RHEL 8/CentOS 8 (#790)

Trivy is able to scan RHEL 8/CentOS 8 more accurately now.

Add redis cache backend configuration options in the Helm chart (#784)

Trivy can be deployed to Kubernetes with Redis cache.

Thanks, @czunker!

Support PEP 440 (#816)

Trivy is able to scan Python vulnerabilities more accurately now.

Support alpine 3.13 (#819)

Trivy is able to scan Alpine Linux 3.13 now.

Fixes

Fix compatibility for Jenkins xunit plugin (#820)
Update EOL dates (#824)
Parse redis backend url (#804)
Fix errors in SARIF format (#801)
Fix env variable for github token (#796)
Set unknown severity for empty values (#793)
Remove global flags from filesystem command (#772)
Fix formatting of log message (#785)

Changelog

cdabe7f Fix compatibility for Jenkins xunit plugin (#820)
b0fe439 README: add Gitlab job that uses a container with trivy (#823)
6685cd4 feat: support Podman (#825)
7a683bd fix(eol): update EOL dates (#824)
6ed03a8 fix(python): follow PEP 440 (#816)
182cb80 Support alpine 3.13 (#819)
2acd1ca Changed the output string to "Using your github token". (#814)
dd35bfd Align comment with code (#812)
1f17e71 Parse redis backend url (#804)
0954f6b Update README.md (#810)
6b29bf1 Added nodeSelector, affinity and tolerations to helm chart (#803)
f6afdf0 Fix readme typo in policy flag (#805)
412847d Fix errors in SARIF format (#801)
5b27862 Fix env variable for github token (#796)
6ed25c1 fix(vulnerability): set unknown severity for empty values (#793)
e2c483f Remove global flags from filesystem command (#772)
5c5e0cb Add imagePullSecrets to helm Chart (#789)
b9b84cd Add redis cache backend configuration options (#784)
e517bcc Update README.md (#735)
7f5a6d4 feat(redhat): support modular packages (#790)
8de09dd Fix formatting of log message (#785)
e08ae8d chore(ci): migrate unit tests to GitHub Actions (#779)
a00d719 shifted: brews.github to brews.tap (#780)

Docker images

docker pull docker.io/aquasec/trivy:0.16.0
docker pull docker.io/aquasec/trivy:latest
docker pull ghcr.io/aquasecurity/trivy:0.16.0
docker pull ghcr.io/aquasecurity/trivy:latest

`v0.15.0`

Features

NuGet Scanner (#686)

Trivy now supports a lock file packages.lock.json of NuGet.

packages.lock.json
==================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

+-------------+------------------+----------+-------------------+----------------+--------------------------------------+
|   LIBRARY   | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION  |                TITLE                 |
+-------------+------------------+----------+-------------------+----------------+--------------------------------------+
| MessagePack | CVE-2020-5234    | MEDIUM   | 1.9.10            | 2.1.90, 1.9.11 | Untrusted data can lead to DoS       |
|             |                  |          |                   |                | attack due to hash collisions and... |
|             |                  |          |                   |                | -->avd.aquasec.com/nvd/cve-2020-5234 |
+-------------+------------------+----------+-------------------+----------------+--------------------------------------+

Thanks to @Johannestegner

Redis support as the cache backend (#770)

For the detail, see here

$ docker run -d --name redis -p 6379:6379 redis:5.0
$ trivy server --cache-backend redis://localhost:6379

$ trivy client alpine:3.11

HTML template (#567)

$ trivy image -f template --template "@contrib/html.tpl" -o report.html alpine:3.12

Thanks to @irrandon

Helm chart (#751, #769)

For the detail, see here

$ cd helm/trivy
$ helm install my-release .

Thanks to @czunker

Fixes

redhat: skip modular packages (#776)

Close #771 and #741

Thanks to @masahiro331

Make the table output less wide. (#763)

alpine:3.10 (alpine 3.10.5)
===========================
Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

+--------------+------------------+----------+-------------------+---------------+---------------------------------------+
|   LIBRARY    | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
+--------------+------------------+----------+-------------------+---------------+---------------------------------------+
| libcrypto1.1 | CVE-2020-1971    | MEDIUM   | 1.1.1g-r0         | 1.1.1i-r0     | openssl: EDIPARTYNAME                 |
|              |                  |          |                   |               | NULL pointer de-reference             |
|              |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2020-1971  |
+--------------+                  +          +                   +               +                                       +
| libssl1.1    |                  |          |                   |               |                                       |
|              |                  |          |                   |               |                                       |
|              |                  |          |                   |               |                                       |
+--------------+------------------+          +-------------------+---------------+---------------------------------------+
| musl         | CVE-2020-28928   |          | 1.1.22-r3         | 1.1.22-r4     | In musl libc through 1.2.1,           |
|              |                  |          |                   |               | wcsnrtombs mishandles particular      |
|              |                  |          |                   |               | combinations of destination buffer... |
|              |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2020-28928 |
+--------------+                  +          +                   +               +                                       +
| musl-utils   |                  |          |                   |               |                                       |
|              |                  |          |                   |               |                                       |
|              |                  |          |                   |               |                                       |
|              |                  |          |                   |               |                                       |
+--------------+------------------+----------+-------------------+---------------+---------------------------------------+

Changelog

08ca1b0 Feat: NuGet Scanner (#686)
7b86f81 feat(cache): support Redis (#770)
8cd4afe fix(redhat): skip module packages (#776)
b606b62 chore: migrate from master to main (#778)
5c2b14b chore(circleci): remove gofmt (#777)
a19a023 chore(README): remove experimental (#775)
e6cef75 NVD: Add timestamps. (#761)
1371f72 (fix): Make the table output less wide. (#763)
8ecaa2f Add gitHubToken to prevent rate limit problems (#769)
8132174 Add helm chart to install trivy in server mode. (#751)
bcc2850 chore(docs): add nix install (#762)
cb36972 HTML template (#567)

Docker images

docker pull docker.io/aquasec/trivy:0.15.0
docker pull docker.io/aquasec/trivy:latest
docker pull ghcr.io/aquasecurity/trivy:0.15.0
docker pull ghcr.io/aquasecurity/trivy:latest

`v0.14.0`

Features

Add primary URLs (#752)

Trivy shows a primary URL in the result as follows.

alpine:3.10 (alpine 3.10.5)
===========================
Total: 2 (UNKNOWN: 2, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

+------------+------------------+----------+-------------------+---------------+--------------------------------+------------------------------------+
|  LIBRARY   | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |             TITLE              |                URL                 |
+------------+------------------+----------+-------------------+---------------+--------------------------------+------------------------------------+
| musl       | CVE-2020-28928   | UNKNOWN  | 1.1.22-r3         | 1.1.22-r4     | In musl libc through 1.2.1,    | avd.aquasec.com/nvd/cve-2020-28928 |
|            |                  |          |                   |               | wcsnrtombs mishandles          |                                    |
|            |                  |          |                   |               | particular combinations of     |                                    |
|            |                  |          |                   |               | destination buffer...          |                                    |
+------------+                  +          +                   +               +                                +                                    +
| musl-utils |                  |          |                   |               |                                |                                    |
|            |                  |          |                   |               |                                |                                    |
|            |                  |          |                   |               |                                |                                    |
|            |                  |          |                   |               |                                |                                    |
+------------+------------------+----------+-------------------+---------------+--------------------------------+------------------------------------+

[
  {
    "Target": "alpine:3.10 (alpine 3.10.5)",
    "Type": "alpine",
    "Vulnerabilities": [
      {
        "VulnerabilityID": "CVE-2020-28928",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2020-28928",
        ...
      }
    ]
  }
]

In these cases, you can see https://avd.aquasec.com/nvd/cve-2020-28928 as a primary URL.

Remove rpm dependency (#753)

Trivy no longer requires the rpm command on the host. You can scan a RHEL-based image without rpm.

$ rpm
bash: rpm: command not found
$ trivy image -o /dev/null centos:7

centos:7 (centos 7.9.2009)
==========================
Total: 601 (UNKNOWN: 0, LOW: 358, MEDIUM: 240, HIGH: 3, CRITICAL: 0)

Bug fixes

--light shows less results (#755)

There was a bug where vulnerabilities with unknown severity do not appear in the result when using the --light option.

Changelog

9bdbeab feat: remove rpm dependency (#753)
d85cb77 fix(vulnerability): make an empty severity UNKNOWN (#759)
1bee83c chore(README): add TRIVY_INSECURE (#760)
4d18943 feat(vulnerability): add primary URLs (#752)

Docker images

docker pull docker.io/aquasec/trivy:0.14.0
docker pull docker.io/aquasec/trivy:latest
docker pull ghcr.io/aquasecurity/trivy:0.14.0
docker pull ghcr.io/aquasecurity/trivy:latest

`v0.13.0`

Important change

Support npm and RubyGems versioning semantics (#740)

npm and RubyGems have different versioning/constraint semantics from other languages, so we developed libraries for them. In the future, we will probably develop libraries for other languages such as Python.

New features

Skip downloading DB if a remote DB is not updated (#717)

Once the vulnerability DB is downloaded, it will not be updated within one hour so that Trivy will not download the same DB many times by mistake.

Support

Add back support for FreeBSD & OpenBSD (#728)

Provide binaries for FreeBSD & OpenBSD

Add support for ppc64le architecture (#724)

Provide binaries for the ppc64le (Power) architecture.

Bug fixes

Handle ksplice advisories of Oracle Linux(#745)

Skip ksplice advisories when the installed package is not a ksplice package during Oracle Linux scanning. Also, if the package is a ksplice one, we should not use the normal advisories.

Skip packages from unsupported repository (remi) (#695)

Skip scanning RPM packages installed from the remi repository

Changelog

1391b3b fix(oracle): handle ksplice advisories (#745)
b6d5b82 fix: version comparison (#740)
9dfb0fe updated Readme.md (#737)
4555469 Add suse sles 15.2 to the EOL list as well (#734)
c189aa6 Update README.md (#731)
8442528 Warn when a user attempts to use trivy without a detectable lockfile (#729)
d09787e Add back support for FreeBSD & OpenBSD (#728)
0285a89 Add support for ppc64le architecture (#724)
7d7784f Skip packages from unsupported repository (remi) (#695)
ca6f196 Skip downloading DB if a remote DB is not updated (#717)
e621cf2 Sunsetting VendorVectors (#718)
906ab54 Add GitHub Container Registry to README (#712)
1549c25 update BUG_REPORT.md using H2 instead of bold formatting (#714)
fe1d07e fix(ci/deb): do not remove old packages for EOL versions (#706)
793a1aa Add linter check support (#679)
4a94477 Optimize images (#696)
9bc2b19 Update triage.md (#701)

Docker images

docker pull docker.io/aquasec/trivy:0.13.0
docker pull docker.io/aquasec/trivy:latest
docker pull ghcr.io/aquasecurity/trivy:0.13.0
docker pull ghcr.io/aquasecurity/trivy:latest

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [trivy](https://github.com/aquasecurity/trivy) | minor | `latest` → `0.74.0` | --- ### Release Notes <details> <summary>aquasecurity/trivy (trivy)</summary> ### [`v0.74.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0740-2026-08-14) ##### Features - add RapidFort curated image scanner ([#10452](https://github.com/aquasecurity/trivy/issues/10452)) ([2c3b86c](https://github.com/aquasecurity/trivy/commit/2c3b86c9bba05beb8a0ad6ff06de9678dddc8a4e)) - **java:** resolve JAR license URLs to SPDX IDs (Bundle-License, pom \<url>) ([#10948](https://github.com/aquasecurity/trivy/issues/10948)) ([171e391](https://github.com/aquasecurity/trivy/commit/171e39168b1ad100f7c5ddc7bc65c1e796d8d2d5)) ##### Bug Fixes - **java:** read artifact properties only from the MANIFEST.MF main section ([#11066](https://github.com/aquasecurity/trivy/issues/11066)) ([018bfbf](https://github.com/aquasecurity/trivy/commit/018bfbff1c37ccaff016973dd7c4468545edf3bf)) - **misconf:** parse Azure flexible server parameters under their own names ([#11072](https://github.com/aquasecurity/trivy/issues/11072)) ([d59f0f8](https://github.com/aquasecurity/trivy/commit/d59f0f872fddca976c756d92e99caa817c11f741)) - **misconf:** unmark cty values outside the evaluation context ([#11078](https://github.com/aquasecurity/trivy/issues/11078)) ([9e85b6b](https://github.com/aquasecurity/trivy/commit/9e85b6b9d8df113a134d425ba1ad70768345a516)) - **python:** normalize dependency names in PEP 621 pyproject.toml ([#11050](https://github.com/aquasecurity/trivy/issues/11050)) ([0012281](https://github.com/aquasecurity/trivy/commit/0012281c8a8adad2eff1889f12fe08a0ca5a7bfc)) - **server:** preserve check aliases and query in uploaded blobs ([#11080](https://github.com/aquasecurity/trivy/issues/11080)) ([0512d6d](https://github.com/aquasecurity/trivy/commit/0512d6dcdfac47622f1a15ded9bab9d0d5764c40)) - **terraform:** avoid panic when for\_each local has unknown object values ([#11019](https://github.com/aquasecurity/trivy/issues/11019)) ([199a126](https://github.com/aquasecurity/trivy/commit/199a12624b84d82aaa48a14f85b38c1a3ea3e9ca)) - **terraform:** support OpenTofu language block ([#10923](https://github.com/aquasecurity/trivy/issues/10923)) ([bacf17f](https://github.com/aquasecurity/trivy/commit/bacf17fe52a45dda1adaec8c0bb04ccc3cd98c65)) ### [`v0.73.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0730-2026-08-03) ##### Features - add bounded read helpers ([#10974](https://github.com/aquasecurity/trivy/issues/10974)) ([35384b4](https://github.com/aquasecurity/trivy/commit/35384b44ef87a7d0505f6814650fa905ff14cf1a)) - **java:** read Jenkins plugin manifest licenses ([#10939](https://github.com/aquasecurity/trivy/issues/10939)) ([f065203](https://github.com/aquasecurity/trivy/commit/f06520353fc632e69eaf9d669ecdd785e770305a)) - **java:** support user-defined Maven mirrors in trivy.yaml ([#11006](https://github.com/aquasecurity/trivy/issues/11006)) ([8e5509c](https://github.com/aquasecurity/trivy/commit/8e5509c940bd1baa9070344ea2386634b40f4c68)) - **seal:** detect no-prefix packages by version suffix ([#10911](https://github.com/aquasecurity/trivy/issues/10911)) ([69da733](https://github.com/aquasecurity/trivy/commit/69da7331bb11f5f18e237aad3950aef52224ebf9)) - **vex:** discover OpenVEX in generic in-toto OCI referrers ([#10986](https://github.com/aquasecurity/trivy/issues/10986)) ([990d765](https://github.com/aquasecurity/trivy/commit/990d76568ecab5583381facd112bfd5ac6f4266b)) - **vex:** native discovery of VEX documents stored as OCI artifacts ([#10932](https://github.com/aquasecurity/trivy/issues/10932)) ([38d5dbd](https://github.com/aquasecurity/trivy/commit/38d5dbd226d201d7c7939713b601d261354f1dec)) ##### Bug Fixes - **conda:** avoid panic on an all-operator dependency line ([#10955](https://github.com/aquasecurity/trivy/issues/10955)) ([f964fa2](https://github.com/aquasecurity/trivy/commit/f964fa2bb61e1b59088d2b35397ca8fd39045b00)) - **dotnet:** identify deps.json root project from dependency graph ([#10954](https://github.com/aquasecurity/trivy/issues/10954)) ([3c6a1a2](https://github.com/aquasecurity/trivy/commit/3c6a1a2aca33893f231412a34d3dfddc4f64b456)) - **java:** set per-file digest for nested JARs ([#10855](https://github.com/aquasecurity/trivy/issues/10855)) ([c3c7d17](https://github.com/aquasecurity/trivy/commit/c3c7d174f94649e4552275854dfdee3c4e7b7d5d)) - **misconf:** guard nil Healthcheck when building Dockerfile from history ([#10899](https://github.com/aquasecurity/trivy/issues/10899)) ([824e2ed](https://github.com/aquasecurity/trivy/commit/824e2ed2a45e1e7fb0b70bcbfc243f4f48f229e0)) - **nodejs:** support pnpm workspaces with overlapping packages ([#10894](https://github.com/aquasecurity/trivy/issues/10894)) ([19f2ddc](https://github.com/aquasecurity/trivy/commit/19f2ddc3752906b0602e2e739de41b945a49f495)) - **vex:** handle 304 status code ([#10307](https://github.com/aquasecurity/trivy/issues/10307)) ([e73c76d](https://github.com/aquasecurity/trivy/commit/e73c76d83b609cd5c387833e2467dbb52df06e46)) - **vex:** reject non-local VEX repository names ([#10987](https://github.com/aquasecurity/trivy/issues/10987)) ([2c64b8f](https://github.com/aquasecurity/trivy/commit/2c64b8f58b63dfd33f4bec32fc001662c705c002)) - **vuln:** don't skip packages covered by a driver's own advisory feed ([#10980](https://github.com/aquasecurity/trivy/issues/10980)) ([86acabe](https://github.com/aquasecurity/trivy/commit/86acabe7c3357d3e0d5a7241a37f2b5de23bc0e5)) ### [`v0.72.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0720-2026-06-30) ##### ⚠ BREAKING CHANGES - migrate docker config to dockers\_v2 ([#10783](https://github.com/aquasecurity/trivy/issues/10783)) ##### Features - **bottlerocket:** add vulnerability matching for Bottlerocket OS ([#10893](https://github.com/aquasecurity/trivy/issues/10893)) ([246ee3c](https://github.com/aquasecurity/trivy/commit/246ee3ca56b666e3c6e6462bf7c0ecd6f059341a)) - **dotnet:** detect bundled runtime in self-contained deployments ([#10786](https://github.com/aquasecurity/trivy/issues/10786)) ([bd78842](https://github.com/aquasecurity/trivy/commit/bd788423970f08ea64ad7bc7638dd16bc7e9e43b)) - **java:** detect JAR licenses from packaged LICENSE files ([#10856](https://github.com/aquasecurity/trivy/issues/10856)) ([b8a1ccd](https://github.com/aquasecurity/trivy/commit/b8a1ccd68a6e06e101de618dbc97b564d902e2f2)) - **java:** detect JAR licenses from the embedded pom.xml ([#10851](https://github.com/aquasecurity/trivy/issues/10851)) ([0a166c3](https://github.com/aquasecurity/trivy/commit/0a166c3fd42e941f37f524cc3905ad3f07062438)) - **misconf:** Adds CloudFront standard logging v2 support to AVD-AWS-0010 ([#10848](https://github.com/aquasecurity/trivy/issues/10848)) ([a848925](https://github.com/aquasecurity/trivy/commit/a848925c613a3308524cbbcff98fa258c89fe3e3)) - **secret:** add OpenAI secret detection rules ([#10798](https://github.com/aquasecurity/trivy/issues/10798)) ([65e5128](https://github.com/aquasecurity/trivy/commit/65e51285de53aa1cfb430cde59001c244fc5f0fd)) - **secret:** support new stateless format for GitHub App installation tokens ([#10826](https://github.com/aquasecurity/trivy/issues/10826)) ([e68f3d2](https://github.com/aquasecurity/trivy/commit/e68f3d2d3476b59c57de2ef2c2806edb001147ee)) ##### Bug Fixes - correct format verbs in diagnostic messages ([#10805](https://github.com/aquasecurity/trivy/issues/10805)) ([859a933](https://github.com/aquasecurity/trivy/commit/859a933cd05e6cb0e06d80e47a6e96f96d337567)) - forward ospkg detector options through ospkg.NewScanner ([#10811](https://github.com/aquasecurity/trivy/issues/10811)) ([28d44d3](https://github.com/aquasecurity/trivy/commit/28d44d3af5e7c6ba56edbfd53e178fa613fbd94b)) - **image:** deterministic OS package deduplication for images with embedded SBOMs ([#10777](https://github.com/aquasecurity/trivy/issues/10777)) ([888911b](https://github.com/aquasecurity/trivy/commit/888911bcd3d0fdcd0cccbb2d45b9cb4cc267d926)) - **image:** lookup origin layer for custom resources in merged layers ([#10788](https://github.com/aquasecurity/trivy/issues/10788)) ([dccb128](https://github.com/aquasecurity/trivy/commit/dccb12835679d01930574ecb53be7686cee607fb)) - **misconf:** support github\_repository\_vulnerability\_alerts resource ([#10680](https://github.com/aquasecurity/trivy/issues/10680)) ([abb5174](https://github.com/aquasecurity/trivy/commit/abb5174b7e6932ffcee88ccd35c5c8cf7c55df12)) - **nodejs:** parse project dependencies from multi-document pnpm-lock.yaml ([#10861](https://github.com/aquasecurity/trivy/issues/10861)) ([a10291b](https://github.com/aquasecurity/trivy/commit/a10291be6f44a512977e887180faab3f3dd240c5)) - **server:** propagate package repository class in client/server mode ([#10874](https://github.com/aquasecurity/trivy/issues/10874)) ([a2777ae](https://github.com/aquasecurity/trivy/commit/a2777aed340e4bb11c6cea6d7cf5d4bf137587ec)) - **spdx:** guard against nil root component in SPDX marshaler ([#10771](https://github.com/aquasecurity/trivy/issues/10771)) ([c0654e1](https://github.com/aquasecurity/trivy/commit/c0654e17eb27a222bada78e22384c86039430d94)) - surface the original analysis error instead of context cancellation ([#10793](https://github.com/aquasecurity/trivy/issues/10793)) ([3054b3b](https://github.com/aquasecurity/trivy/commit/3054b3b953a59d536d5e13ab7210501dbfc55a40)) - **terraform:** avoid data race on global getter.Getters in remote module resolver ([#10843](https://github.com/aquasecurity/trivy/issues/10843)) ([0aff3fd](https://github.com/aquasecurity/trivy/commit/0aff3fdf3b8924fe6b9ee69b05276db37a68d0d8)) - use random suffix for process temp directory instead of PID ([#10431](https://github.com/aquasecurity/trivy/issues/10431)) ([c8d1d0d](https://github.com/aquasecurity/trivy/commit/c8d1d0d113b0bd3a058f566ede786b18ff94f75e)) - **vex:** load VEX documents from within the repository directory ([#10820](https://github.com/aquasecurity/trivy/issues/10820)) ([1f56a34](https://github.com/aquasecurity/trivy/commit/1f56a3450a4e0a7d42c273b4acfeec1f584979ab)) - **vuln:** fall back to UNKNOWN severity when vulnerability details are missing ([#10795](https://github.com/aquasecurity/trivy/issues/10795)) ([dfd53cf](https://github.com/aquasecurity/trivy/commit/dfd53cfcb6888d8af57bec63d6c33f648ba87380)) ##### Continuous Integration - migrate docker config to dockers\_v2 ([#10783](https://github.com/aquasecurity/trivy/issues/10783)) ([848d135](https://github.com/aquasecurity/trivy/commit/848d13595fea770c2f6488957cd0771654eb2659)) ### [`v0.71.2`](https://github.com/aquasecurity/trivy/releases/tag/v0.71.2) #### Changelog - [`055a5c8`](https://github.com/aquasecurity/trivy/commit/055a5c8a53bfd61f7a8e276a5b2f0c3fc1673420) release: v0.71.2 \[release/v0.71] ([#10871](https://github.com/aquasecurity/trivy/issues/10871)) - [`875328a`](https://github.com/aquasecurity/trivy/commit/875328a4138f26e8559cfee80adaef82b6693076) fix(deps): bump alpine to 3.24.1 \[backport: release/v0.71] ([#10870](https://github.com/aquasecurity/trivy/issues/10870)) - [`998f7b3`](https://github.com/aquasecurity/trivy/commit/998f7b3c3f3c9de2132bc4358970eeafbd797fba) chore(deps): bump the common group with 4 updates \[backport: release/v0.71] ([#10867](https://github.com/aquasecurity/trivy/issues/10867)) ### [`v0.71.1`](https://github.com/aquasecurity/trivy/releases/tag/v0.71.1) #### Changelog - [`164b383`](https://github.com/aquasecurity/trivy/commit/164b383121351c2d49c5d354c2245719d972752b) release: v0.71.1 \[release/v0.71] ([#10818](https://github.com/aquasecurity/trivy/issues/10818)) - [`a72d9a4`](https://github.com/aquasecurity/trivy/commit/a72d9a4d997c25fbb6534e231b4e206c9b202b31) fix(oci): validate artifact filename - [`3dd9847`](https://github.com/aquasecurity/trivy/commit/3dd98471dfbbc4a95edd5cd866468d3a8c87fd17) fix: forward ospkg detector options through ospkg.NewScanner \[backport: release/v0.71] ([#10825](https://github.com/aquasecurity/trivy/issues/10825)) - [`a62cbe4`](https://github.com/aquasecurity/trivy/commit/a62cbe40a240d3a3f568401b8a5f86e14114e371) fix(vex): load VEX documents from within the repository directory \[backport: release/v0.71] ([#10821](https://github.com/aquasecurity/trivy/issues/10821)) - [`43d1d26`](https://github.com/aquasecurity/trivy/commit/43d1d2628725e913db110b89419f0bebd36f58a8) fix: surface the original analysis error instead of context cancellation \[backport: release/v0.71] ([#10812](https://github.com/aquasecurity/trivy/issues/10812)) - [`ac7696c`](https://github.com/aquasecurity/trivy/commit/ac7696c7b50d633183ce2ff44898d4b5c6eae565) ci: expect GitHub App bot as backport PR author \[backport: release/v0.71] ([#10815](https://github.com/aquasecurity/trivy/issues/10815)) ### [`v0.71.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0710-2026-06-01) ##### Features - add WithDriver and WithProvider options to ospkg detector ([#10740](https://github.com/aquasecurity/trivy/issues/10740)) ([f8a6ddb](https://github.com/aquasecurity/trivy/commit/f8a6ddb45e5d041ac209f3d3732afcdcafb61ef6)) - **java:** support \<mirrors> from settings.xml ([#10692](https://github.com/aquasecurity/trivy/issues/10692)) ([c080ce3](https://github.com/aquasecurity/trivy/commit/c080ce34639b6f22c990f59a3b4f9dd19385d129)) - **sbom:** support for CycloneDX 1.7 ([#10715](https://github.com/aquasecurity/trivy/issues/10715)) ([04f739e](https://github.com/aquasecurity/trivy/commit/04f739e5244db8bd157eb4a2a2fe2caa8dbfa61f)) - **seal:** add vendor support for language file detection. ([#10297](https://github.com/aquasecurity/trivy/issues/10297)) ([b08bf6a](https://github.com/aquasecurity/trivy/commit/b08bf6a0a59785ff72900a4a6873f25a9d7b2921)) - **secret:** add a way to customize skipped folders, files and exts ([#10550](https://github.com/aquasecurity/trivy/issues/10550)) ([e4325b1](https://github.com/aquasecurity/trivy/commit/e4325b18246dc90d2d18bf7e032fe47db89108e5)) - **secret:** add Azure secret detection rules ([#10562](https://github.com/aquasecurity/trivy/issues/10562)) ([69dcd18](https://github.com/aquasecurity/trivy/commit/69dcd18eff5c810948738644d9a2df79a470f0e0)) - **secret:** add Maven rules to detect passwords and passphrases in settings.xml and settings-security.xml files ([#10704](https://github.com/aquasecurity/trivy/issues/10704)) ([9ad901d](https://github.com/aquasecurity/trivy/commit/9ad901d510ff1013878818f55a899091efd6e46f)) - **spdx:** add SHA-512 hash algorithm support to SPDX serializer ([#10719](https://github.com/aquasecurity/trivy/issues/10719)) ([f2a1237](https://github.com/aquasecurity/trivy/commit/f2a12375772a93ab9bd6f754c33378f1c0356a76)) - **ubuntu:** detect Ubuntu 26.04 LTS ([#10592](https://github.com/aquasecurity/trivy/issues/10592)) ([a61feac](https://github.com/aquasecurity/trivy/commit/a61feac3c558ba9d9f7bee58fb5862d3a1d56fd9)) ##### Bug Fixes - **cloudformation:** propagate AWS::EC2::Instance MetadataOptions ([#10731](https://github.com/aquasecurity/trivy/issues/10731)) ([ac2f3d7](https://github.com/aquasecurity/trivy/commit/ac2f3d79770b6ae65241fec1a7656e0faa069e84)) - **image:** correctly reconstruct RUN instructions built without BuildKit ([#10714](https://github.com/aquasecurity/trivy/issues/10714)) ([519eac9](https://github.com/aquasecurity/trivy/commit/519eac97accaa4068a4f81ce94cbdb74a91a7b7f)) - **java:** surface 429 from a remote Maven repository as a fatal error when scanning pom.xml files ([#10693](https://github.com/aquasecurity/trivy/issues/10693)) ([f8fdb93](https://github.com/aquasecurity/trivy/commit/f8fdb932dd8ef6586bebc467a3ee3b098d040a51)) - **misconf:** fix rendering of nested values in terraform plan lists ([#10746](https://github.com/aquasecurity/trivy/issues/10746)) ([9c1cf65](https://github.com/aquasecurity/trivy/commit/9c1cf658d461b2bc73ac10317947ab6ce8b2e51e)) - **misconf:** make identifiers in ignore rules case-insensitive ([#10375](https://github.com/aquasecurity/trivy/issues/10375)) ([a75a468](https://github.com/aquasecurity/trivy/commit/a75a468facbff12c81da00742709c88c0a4ad29d)) - **misconf:** prevent path traversal in Terraform filesystem functions ([#10664](https://github.com/aquasecurity/trivy/issues/10664)) ([9d91b88](https://github.com/aquasecurity/trivy/commit/9d91b888cf63023e9c09b64259a4c1cea8dfe993)) - **misconf:** reject nil plays during playbook parsing ([#10273](https://github.com/aquasecurity/trivy/issues/10273)) ([0bc5c6d](https://github.com/aquasecurity/trivy/commit/0bc5c6dfa453aa8866ec7fd27044b2603d77cbcc)) - **misconf:** skip null cty values in AsMapValue to prevent panic ([#10723](https://github.com/aquasecurity/trivy/issues/10723)) ([f080e1e](https://github.com/aquasecurity/trivy/commit/f080e1ec0986833aa95b94c92bb84f14e1889f9d)) - **misconf:** skip resources with no after changes ([#10352](https://github.com/aquasecurity/trivy/issues/10352)) ([f099dc4](https://github.com/aquasecurity/trivy/commit/f099dc431dd836adbd4c2ed8d7ed0764b9c86b8c)) - **nodejs:** handle legacy license formats in npm lockfile parser ([#10684](https://github.com/aquasecurity/trivy/issues/10684)) ([451fd99](https://github.com/aquasecurity/trivy/commit/451fd996c0c29459ab8574ab5b8ab85518495a59)) - **nodejs:** silently skip subdirectory package.json files with invalid names ([#10609](https://github.com/aquasecurity/trivy/issues/10609)) ([0e4dc66](https://github.com/aquasecurity/trivy/commit/0e4dc6686658c4d29c084bedb7b3a925ab85482c)) - overwrite OS packages PURLs after overwrite OS ([#10298](https://github.com/aquasecurity/trivy/issues/10298)) ([39a28ed](https://github.com/aquasecurity/trivy/commit/39a28edd7f70f63dd4b48dc6838a16c42d36c8dc)) - pull instead of clone when test repo already exists ([#10636](https://github.com/aquasecurity/trivy/issues/10636)) ([3a2f7fb](https://github.com/aquasecurity/trivy/commit/3a2f7fb2636189a1f703a509125ee34d5c0b9eaa)) - **report:** don't produce trailing comma in gitlab.tpl links array ([#10728](https://github.com/aquasecurity/trivy/issues/10728)) ([69e78e2](https://github.com/aquasecurity/trivy/commit/69e78e21598898ca57fe31449570d6979e811009)) - **secret:** correctly skip secret-scanner config file from scanning ([#10666](https://github.com/aquasecurity/trivy/issues/10666)) ([fc1e46f](https://github.com/aquasecurity/trivy/commit/fc1e46fb0214d32f5b91581ff221a3309ebaa94a)) ### [`v0.69.3`](https://github.com/aquasecurity/trivy/releases/tag/v0.69.3) #### Changelog - [`6fb20c8`](https://github.com/aquasecurity/trivy/commit/6fb20c8edd70745d6b34bff0387b53b03c8a760a) release: v0.69.3 \[release/v0.69] ([#10293](https://github.com/aquasecurity/trivy/issues/10293)) - [`dabefec`](https://github.com/aquasecurity/trivy/commit/dabefec57d099184bc8bd268dea23cd5d502f9cc) fix(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 \[backport: release/v0.69] ([#10291](https://github.com/aquasecurity/trivy/issues/10291)) ### [`v0.69.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0690-2026-01-30) ##### ⚠ BREAKING CHANGES - **misconf:** use ID instead of AVDID for providers mapping ([#9752](https://github.com/aquasecurity/trivy/issues/9752)) ##### Features - **activestate:** add support ActiveState images ([#10081](https://github.com/aquasecurity/trivy/issues/10081)) ([676709d](https://github.com/aquasecurity/trivy/commit/676709de44639e6c4329e1c69ee34a5e2760555f)) - add AnalyzedBy field to track which analyzer detected packages ([#10059](https://github.com/aquasecurity/trivy/issues/10059)) ([1953824](https://github.com/aquasecurity/trivy/commit/195382400fc9bf93cf303910453d44f6ba3b5dad)) - **cloudformation:** add support for Fn::ForEach ([#9508](https://github.com/aquasecurity/trivy/issues/9508)) ([d65b504](https://github.com/aquasecurity/trivy/commit/d65b504cb24a4d71f054bfbd6a872b58385bb0d3)) - **debian:** detect third-party packages using maintainer list ([#9917](https://github.com/aquasecurity/trivy/issues/9917)) ([effc1c0](https://github.com/aquasecurity/trivy/commit/effc1c0d4d46e01efa896f53ccc72eb87d175d91)) - **flag:** add JSON Schema for trivy.yaml configuration file ([#9971](https://github.com/aquasecurity/trivy/issues/9971)) ([4caf731](https://github.com/aquasecurity/trivy/commit/4caf7312b63f93024c188f243cda957d97b30a88)) - **helm:** add sslCertDir parameter ([#9697](https://github.com/aquasecurity/trivy/issues/9697)) ([879e4fc](https://github.com/aquasecurity/trivy/commit/879e4fca12b53010e3b6a22fcb9c6e2b8eefad96)) - **julia:** enable vulnerability scanning for the Julia language ecosystem ([#9800](https://github.com/aquasecurity/trivy/issues/9800)) ([c2f82ad](https://github.com/aquasecurity/trivy/commit/c2f82add3a59a509f581cc245630ce29e801de6a)) - **misconf:** add action block to Terraform schema ([#10035](https://github.com/aquasecurity/trivy/issues/10035)) ([b06ef6d](https://github.com/aquasecurity/trivy/commit/b06ef6d2706fddb5b9c5bc42c7d26598eb105f28)) - **misconf:** initial ansible scanning support ([#9332](https://github.com/aquasecurity/trivy/issues/9332)) ([9275e15](https://github.com/aquasecurity/trivy/commit/9275e1532b11c5f1842f334660303a7ebf46a2c6)) - **misconf:** support for ARM resources defined as an object ([#9959](https://github.com/aquasecurity/trivy/issues/9959)) ([92d3465](https://github.com/aquasecurity/trivy/commit/92d3465cee297cad6f6e1efbb4597676e081c275)) - **misconf:** support for azurerm\_\*\_web\_app ([#9944](https://github.com/aquasecurity/trivy/issues/9944)) ([37b5da8](https://github.com/aquasecurity/trivy/commit/37b5da895bcac45a617fee00f9de2bececb3b26a)) - **misconf:** Update Azure Database schema ([#9811](https://github.com/aquasecurity/trivy/issues/9811)) ([48dfede](https://github.com/aquasecurity/trivy/commit/48dfedeb1e13d1654e2b9239f403d847af353e2e)) - **misconf:** use Terraform plan configuration to partially restore schema ([#9623](https://github.com/aquasecurity/trivy/issues/9623)) ([5fced3a](https://github.com/aquasecurity/trivy/commit/5fced3ae492281f0fe000e5ccf3c634425c008d8)) - **nodejs:** parse licenses from `package-lock.json` file ([#9983](https://github.com/aquasecurity/trivy/issues/9983)) ([b64d5ad](https://github.com/aquasecurity/trivy/commit/b64d5adc6b90fde205e4eeaf7b58332bf10372d2)) - **php:** add support for dev dependencies in Composer ([#9910](https://github.com/aquasecurity/trivy/issues/9910)) ([56b59e8](https://github.com/aquasecurity/trivy/commit/56b59e8abbb891564bf03608b8150bceaeb60ded)) - **report:** add Trivy version to JSON output ([#10065](https://github.com/aquasecurity/trivy/issues/10065)) ([fe7d20a](https://github.com/aquasecurity/trivy/commit/fe7d20a31c02b7ce61d85d264883831208132002)) - **rocky:** enable modular package vulnerability detection ([#10069](https://github.com/aquasecurity/trivy/issues/10069)) ([31c4780](https://github.com/aquasecurity/trivy/commit/31c4780f720c5adeb6488440406dc7fad7637dae)) - **rootio:** Update trivy db to support usage of Severity from root.io feed ([#9930](https://github.com/aquasecurity/trivy/issues/9930)) ([d3096e7](https://github.com/aquasecurity/trivy/commit/d3096e7617a6b5d6bc5beb2abce1b18a70c05c08)) - **sbom:** exclude PEP 770 SBOMs in .dist-info/sboms/ ([#10033](https://github.com/aquasecurity/trivy/issues/10033)) ([07ff788](https://github.com/aquasecurity/trivy/commit/07ff7885df5397531271b837d4d9402a7d58e8a3)) - **secret:** add detection for Symfony default secret key ([#9892](https://github.com/aquasecurity/trivy/issues/9892)) ([34baef2](https://github.com/aquasecurity/trivy/commit/34baef28ecb31c7a9ba414a118b220da97b29634)) - **vex:** support per-repo tls configuration ([#10030](https://github.com/aquasecurity/trivy/issues/10030)) ([f809066](https://github.com/aquasecurity/trivy/commit/f809066b0745769876be8006e00dcf44017ffe96)) - **vuln:** skip vulnerability scanning for third-party packages in Debian/Ubuntu ([#9932](https://github.com/aquasecurity/trivy/issues/9932)) ([74819bf](https://github.com/aquasecurity/trivy/commit/74819bf45733eda0a8377c40d09a60daefe9210a)) ##### Bug Fixes - **docker:** fix non-det scan results for images with embedded SBOM ([#9866](https://github.com/aquasecurity/trivy/issues/9866)) ([7f71b57](https://github.com/aquasecurity/trivy/commit/7f71b577a0e138fc2908f9a8c2932b11004041db)) - **go:** use ldflags version for all pseudo-versions ([#10037](https://github.com/aquasecurity/trivy/issues/10037)) ([3c0ab97](https://github.com/aquasecurity/trivy/commit/3c0ab97e10dc451a7fb91ef6283a932c9c4db6bf)) - **image:** race condition in image artifact inspection ([#9966](https://github.com/aquasecurity/trivy/issues/9966)) ([18acf4f](https://github.com/aquasecurity/trivy/commit/18acf4f71dfa0668b0fe8b0ffcafd960f88b46d1)) - **java:** add hash of GAV+root pom file path for pkgID for packages from pom.xml files ([#9880](https://github.com/aquasecurity/trivy/issues/9880)) ([809db46](https://github.com/aquasecurity/trivy/commit/809db462317fb43317e2d4f7116a8e96c1b2a728)) - **java:** correctly inherit properties from parent fields for pom.xml files ([#9111](https://github.com/aquasecurity/trivy/issues/9111)) ([2933b01](https://github.com/aquasecurity/trivy/commit/2933b01cd55bc73ab99e6e867532093f2d65c94f)) - **java:** correctly propagate repositories from upper POMs to dependencies ([#10077](https://github.com/aquasecurity/trivy/issues/10077)) ([b9415a3](https://github.com/aquasecurity/trivy/commit/b9415a309cf6bd34505afcda05dc0b0ad8b78059)) - **license:** normalize licenses for PostAnalyzers ([#9941](https://github.com/aquasecurity/trivy/issues/9941)) ([11dd3fa](https://github.com/aquasecurity/trivy/commit/11dd3fac3825b45e5d4c5dd473f18c0c76e18bf5)) - **misconf:** correct typos in block and attribute names ([#9993](https://github.com/aquasecurity/trivy/issues/9993)) ([ac061f8](https://github.com/aquasecurity/trivy/commit/ac061f8e887ab5a415b8c13474493c0541a48317)) - **misconf:** respect .yml files when Helm charts are detected ([#9912](https://github.com/aquasecurity/trivy/issues/9912)) ([18ecf75](https://github.com/aquasecurity/trivy/commit/18ecf75176a1cadcf20e088a991af899e96fe40b)) - **misconf:** safely parse rotation\_period in google\_kms\_crypto\_key ([#9980](https://github.com/aquasecurity/trivy/issues/9980)) ([a0ecc8e](https://github.com/aquasecurity/trivy/commit/a0ecc8e9267cb63ee3d2cd28c82561e39533031d)) - move enum into items for array-type fields in JSON Schema ([#10039](https://github.com/aquasecurity/trivy/issues/10039)) ([4e06c3d](https://github.com/aquasecurity/trivy/commit/4e06c3df5b77f92e5390dc7d3559036f1fdf6cad)) - remove trailing tab in statefulset template ([#9889](https://github.com/aquasecurity/trivy/issues/9889)) ([9db123c](https://github.com/aquasecurity/trivy/commit/9db123ccf80e55b30bee53db7163b9fd9a38bd75)) - **repo:** return a nil interface for gitAuth if missing ([#10097](https://github.com/aquasecurity/trivy/issues/10097)) ([036c05b](https://github.com/aquasecurity/trivy/commit/036c05b9a12eaccd7ebe8ee2f69d610fb7eea1fc)) - **rust:** add cargo workspace members glob support ([#10032](https://github.com/aquasecurity/trivy/issues/10032)) ([d2dc46a](https://github.com/aquasecurity/trivy/commit/d2dc46ad60178371ff9e1099bc8cbe838e1190ad)) - **rust:** implement version inheritance for Cargo mono repos ([#10011](https://github.com/aquasecurity/trivy/issues/10011)) ([47d3103](https://github.com/aquasecurity/trivy/commit/47d3103c50d455df02c299d0f3e954b61e77fc8e)) - **secret:** improve word boundary detection for Hugging Face tokens ([#10046](https://github.com/aquasecurity/trivy/issues/10046)) ([cdb28ee](https://github.com/aquasecurity/trivy/commit/cdb28eeeb176684e5b62b1bafbaf52e4cea79d4a)) - use canonical SPDX license IDs from embedded licenses.json ([#10053](https://github.com/aquasecurity/trivy/issues/10053)) ([c233735](https://github.com/aquasecurity/trivy/commit/c233735b023974c0a5c321c370c7f3ebe5f20eec)) - **vex:** add CVE-2025-66564 as not\_affected into Trivy VEX file ([#9924](https://github.com/aquasecurity/trivy/issues/9924)) ([335cc99](https://github.com/aquasecurity/trivy/commit/335cc993fa76cddf2e263cb8e09d0cbbb0b98a09)) - **vuln:** skip vulns detection for CentOS Stream family without scan failure ([#9964](https://github.com/aquasecurity/trivy/issues/9964)) ([b46cde0](https://github.com/aquasecurity/trivy/commit/b46cde0ebe651cfad461fcde510cfe8b847391c3)) ##### Performance Improvements - **misconf:** optimize string concatenation in azure scanner ([#9969](https://github.com/aquasecurity/trivy/issues/9969)) ([10a50a7](https://github.com/aquasecurity/trivy/commit/10a50a7429dd18377747c54db53fc68c376135d7)) ##### Code Refactoring - **misconf:** use ID instead of AVDID for providers mapping ([#9752](https://github.com/aquasecurity/trivy/issues/9752)) ([6462dc8](https://github.com/aquasecurity/trivy/commit/6462dc8a5888003de0d08a5a2b2eb8ce464b6ae2)) ### [`v0.66.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0660-2025-09-02) ##### Features - add timeout handling for cache database operations ([#9307](https://github.com/aquasecurity/trivy/issues/9307)) ([235c24e](https://github.com/aquasecurity/trivy/commit/235c24e71a546b6196f7264fced2d02d836e3f85)) - **misconf:** added audit config attribute ([#9249](https://github.com/aquasecurity/trivy/issues/9249)) ([4d4a244](https://github.com/aquasecurity/trivy/commit/4d4a2444b692512aca137dcbd367ff224fe25597)) - **secret:** implement streaming secret scanner with byte offset tracking ([#9264](https://github.com/aquasecurity/trivy/issues/9264)) ([5a5e097](https://github.com/aquasecurity/trivy/commit/5a5e0972c72e629ddf2915ef066d632d58b8d3b0)) - **terraform:** use .terraform cache for remote modules in plan scanning ([#9277](https://github.com/aquasecurity/trivy/issues/9277)) ([298a994](https://github.com/aquasecurity/trivy/commit/298a9941f098d2701b9524a703b9f9b1b9451785)) ##### Bug Fixes - **conda:** memory leak by adding closure method for `package.json` file ([#9349](https://github.com/aquasecurity/trivy/issues/9349)) ([03d039f](https://github.com/aquasecurity/trivy/commit/03d039f17d94cf668152e83d0cf9dabf3b27d3dd)) - create temp file under composite fs dir ([#9387](https://github.com/aquasecurity/trivy/issues/9387)) ([ce22f54](https://github.com/aquasecurity/trivy/commit/ce22f54a39a1abac08fa3ad540697c668792bf50)) - **cyclonedx:** handle multiple license types ([#9378](https://github.com/aquasecurity/trivy/issues/9378)) ([46ab76a](https://github.com/aquasecurity/trivy/commit/46ab76a5af828c98cf93fc988ed6a405b7b07392)) - **fs:** avoid shadowing errors in file.glob ([#9286](https://github.com/aquasecurity/trivy/issues/9286)) ([b51c789](https://github.com/aquasecurity/trivy/commit/b51c789330141d634a9b14bd10994c997862940f)) - **image:** use standardized HTTP client for ECR authentication ([#9322](https://github.com/aquasecurity/trivy/issues/9322)) ([84fbf86](https://github.com/aquasecurity/trivy/commit/84fbf8674dfc0f91d8795a50bafa6041cce83ba2)) - **misconf:** ensure ignore rules respect subdirectory chart paths ([#9324](https://github.com/aquasecurity/trivy/issues/9324)) ([d3cd101](https://github.com/aquasecurity/trivy/commit/d3cd101266eb7bf9b8ffe5899765efa7bd1abe30)) - **misconf:** ensure module source is known ([#9404](https://github.com/aquasecurity/trivy/issues/9404)) ([81d9425](https://github.com/aquasecurity/trivy/commit/81d94253c8bc816ad932f7e0c0b8907e1cd759bb)) - **misconf:** preserve original paths of remote submodules from .terraform ([#9294](https://github.com/aquasecurity/trivy/issues/9294)) ([1319d8d](https://github.com/aquasecurity/trivy/commit/1319d8dc7f4796177876af18f0e13ba1f7086348)) - **misconf:** use correct field log\_bucket instead of target\_bucket in gcp bucket ([#9296](https://github.com/aquasecurity/trivy/issues/9296)) ([04ad0c4](https://github.com/aquasecurity/trivy/commit/04ad0c4fc2926a92e9e9ec11bb8eae826ed95827)) - persistent flag option typo ([#9374](https://github.com/aquasecurity/trivy/issues/9374)) ([6e99dd3](https://github.com/aquasecurity/trivy/commit/6e99dd304c7fad8213489039e7ca42909383b5ff)) - **plugin:** don't remove plugins when updating index.yaml file ([#9358](https://github.com/aquasecurity/trivy/issues/9358)) ([5f067ac](https://github.com/aquasecurity/trivy/commit/5f067ac15e5c609283bef26a211746a279b6b5d0)) - **python:** improve package name normalization ([#9290](https://github.com/aquasecurity/trivy/issues/9290)) ([1473e88](https://github.com/aquasecurity/trivy/commit/1473e88b74ca269691de7827e045703612b90050)) - **repo:** preserve RepoMetadata on FS cache hit ([#9389](https://github.com/aquasecurity/trivy/issues/9389)) ([4f2a44e](https://github.com/aquasecurity/trivy/commit/4f2a44ea45bed1e842bb2072077da67ec7e744ac)) - **repo:** sanitize git repo URL before inserting into report metadata ([#9391](https://github.com/aquasecurity/trivy/issues/9391)) ([1ac9b1f](https://github.com/aquasecurity/trivy/commit/1ac9b1f07cea429cc122bf9721e8909c649549cf)) - **sbom:** add support for `file` component type of `CycloneDX` ([#9372](https://github.com/aquasecurity/trivy/issues/9372)) ([aa7cf43](https://github.com/aquasecurity/trivy/commit/aa7cf4387c5e82c1f629ac14cd6a35b48fc95983)) - suppress debug log for context cancellation errors ([#9298](https://github.com/aquasecurity/trivy/issues/9298)) ([2458d5e](https://github.com/aquasecurity/trivy/commit/2458d5e28a54da9adec0b36f6b1e6bd4f15a72ce)) ### [`v0.65.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0650-2025-07-30) ##### Features - add graceful shutdown with signal handling ([#9242](https://github.com/aquasecurity/trivy/issues/9242)) ([2c05882](https://github.com/aquasecurity/trivy/commit/2c05882f45071928c14d8212ef6c4f0f7048245d)) - add HTTP request/response tracing support ([#9125](https://github.com/aquasecurity/trivy/issues/9125)) ([aa5b32a](https://github.com/aquasecurity/trivy/commit/aa5b32a19f4d61d0df72c11fd314c5a0b7284202)) - **alma:** add AlmaLinux 10 support ([#9207](https://github.com/aquasecurity/trivy/issues/9207)) ([861d51e](https://github.com/aquasecurity/trivy/commit/861d51e99a45ee448f86fe195dedcaefb811c919)) - **flag:** add schema validation for `--server` flag ([#9270](https://github.com/aquasecurity/trivy/issues/9270)) ([ed4640e](https://github.com/aquasecurity/trivy/commit/ed4640ec27f2575a50d7e6d516c9e2e45a59bb7f)) - **image:** add Docker context resolution ([#9166](https://github.com/aquasecurity/trivy/issues/9166)) ([99cd4e7](https://github.com/aquasecurity/trivy/commit/99cd4e776c0c6cc689126e53fa86ee6333ba6277)) - **license:** observe pkg types option in license scanner ([#9091](https://github.com/aquasecurity/trivy/issues/9091)) ([d44af8c](https://github.com/aquasecurity/trivy/commit/d44af8cfa21a145d14ca6e5e1ed4742d892f2dc5)) - **misconf:** add private ip google access attribute to subnetwork ([#9199](https://github.com/aquasecurity/trivy/issues/9199)) ([263845c](https://github.com/aquasecurity/trivy/commit/263845cfc1419401f24adc8bc6316f3ea0caacad)) - **misconf:** added logging and versioning to the gcp storage bucket ([#9226](https://github.com/aquasecurity/trivy/issues/9226)) ([110f80e](https://github.com/aquasecurity/trivy/commit/110f80ea29951863997dd5a1c48fe14eb81e230b)) - **repo:** add git repository metadata to reports ([#9252](https://github.com/aquasecurity/trivy/issues/9252)) ([f4b2cf1](https://github.com/aquasecurity/trivy/commit/f4b2cf10e917d58c0840f789e083bd3f268a8af1)) - **report:** add CVSS vectors in sarif report ([#9157](https://github.com/aquasecurity/trivy/issues/9157)) ([60723e6](https://github.com/aquasecurity/trivy/commit/60723e6cfce82ede2863cf545a189c581246f4e9)) - **sbom:** add SHA-512 hash support for CycloneDX SBOM ([#9126](https://github.com/aquasecurity/trivy/issues/9126)) ([12d6706](https://github.com/aquasecurity/trivy/commit/12d6706961423acb12430c8b3d986b4aa4671d04)) ##### Bug Fixes - **alma:** parse epochs from rpmqa file ([#9101](https://github.com/aquasecurity/trivy/issues/9101)) ([82db2fc](https://github.com/aquasecurity/trivy/commit/82db2fcc8034c911cc7a67f5a82d2f081d9c1fdf)) - also check `filepath` when removing duplicate packages ([#9142](https://github.com/aquasecurity/trivy/issues/9142)) ([4d10a81](https://github.com/aquasecurity/trivy/commit/4d10a815dde53f5e128366f1dd0837a1dc29c17b)) - **aws:** update amazon linux 2 EOL date ([#9176](https://github.com/aquasecurity/trivy/issues/9176)) ([0ecfed6](https://github.com/aquasecurity/trivy/commit/0ecfed6ea75cfe33e0f436a9015ac72a679e754e)) - **cli:** Add more non-sensitive flags to telemetry ([#9110](https://github.com/aquasecurity/trivy/issues/9110)) ([7041a39](https://github.com/aquasecurity/trivy/commit/7041a39bdcf21c5b3114137d9a931f529eac2566)) - **cli:** ensure correct command is picked by telemetry ([#9260](https://github.com/aquasecurity/trivy/issues/9260)) ([b4ad00f](https://github.com/aquasecurity/trivy/commit/b4ad00f301a5fd7326060a567871c6f4a9711696)) - **cli:** panic: attempt to get os.Args\[1] when len(os.Args) < 2 ([#9206](https://github.com/aquasecurity/trivy/issues/9206)) ([adfa879](https://github.com/aquasecurity/trivy/commit/adfa879e4e8ab88f211222a13d2b89013ae9a853)) - **license:** add missed `GFDL-NIV-1.1` and `GFDL-NIV-1.2` into Trivy mapping ([#9116](https://github.com/aquasecurity/trivy/issues/9116)) ([a692f29](https://github.com/aquasecurity/trivy/commit/a692f296d15f7241ba5ff082e4e69926b1c728a8)) - **license:** handle WITH operator for `LaxSplitLicenses` ([#9232](https://github.com/aquasecurity/trivy/issues/9232)) ([b4193d0](https://github.com/aquasecurity/trivy/commit/b4193d0d31a167aafdcd9d9ccd89f3f124eef7ee)) - migrate from `*.list` to `*.md5sums` files for `dpkg` ([#9131](https://github.com/aquasecurity/trivy/issues/9131)) ([f224de3](https://github.com/aquasecurity/trivy/commit/f224de3e39b08672212ec0f94660c36bef77bc30)) - **misconf:** correctly adapt azure storage account ([#9138](https://github.com/aquasecurity/trivy/issues/9138)) ([51aa022](https://github.com/aquasecurity/trivy/commit/51aa0222604829706193eb2ff3a6886742bb42b4)) - **misconf:** correctly parse empty port ranges in google\_compute\_firewall ([#9237](https://github.com/aquasecurity/trivy/issues/9237)) ([77bab7b](https://github.com/aquasecurity/trivy/commit/77bab7b6d25c712e2db7dc53956985c2721728e9)) - **misconf:** fix log bucket in schema ([#9235](https://github.com/aquasecurity/trivy/issues/9235)) ([7ebc129](https://github.com/aquasecurity/trivy/commit/7ebc129ab726f3133d940708837b7edda2621105)) - **misconf:** skip rewriting expr if attr is nil ([#9113](https://github.com/aquasecurity/trivy/issues/9113)) ([42ccd3d](https://github.com/aquasecurity/trivy/commit/42ccd3df9a7c838a99facb8248e1a68eaf47a999)) - **nodejs:** don't use prerelease logic for compare npm constraints ([#9208](https://github.com/aquasecurity/trivy/issues/9208)) ([fe96436](https://github.com/aquasecurity/trivy/commit/fe96436b99bae3bbfc7498d2ad222d4acccdfcf1)) - prevent graceful shutdown message on normal exit ([#9244](https://github.com/aquasecurity/trivy/issues/9244)) ([6095984](https://github.com/aquasecurity/trivy/commit/6095984d5340633740204a7a40f002a5643802b9)) - **rootio:** check full version to detect `root.io` packages ([#9117](https://github.com/aquasecurity/trivy/issues/9117)) ([c2ddd44](https://github.com/aquasecurity/trivy/commit/c2ddd44d98594a2066cb5b5acbb9ad2aaad8fd96)) - **rootio:** fix severity selection ([#9181](https://github.com/aquasecurity/trivy/issues/9181)) ([6fafbeb](https://github.com/aquasecurity/trivy/commit/6fafbeb60609a020b47266743250ea847234cbbd)) - **sbom:** merge in-graph and out-of-graph OS packages in scan results ([#9194](https://github.com/aquasecurity/trivy/issues/9194)) ([aa944cc](https://github.com/aquasecurity/trivy/commit/aa944cc6da43e2035f74e9d842f487c0d2f993f4)) - **sbom:** use correct field for licenses in CycloneDX reports ([#9057](https://github.com/aquasecurity/trivy/issues/9057)) ([143da88](https://github.com/aquasecurity/trivy/commit/143da88dd82dfbe204f4c2afe46af3b01701675d)) - **secret:** add UTF-8 validation in secret scanner to prevent protobuf marshalling errors ([#9253](https://github.com/aquasecurity/trivy/issues/9253)) ([54832a7](https://github.com/aquasecurity/trivy/commit/54832a77b50e2da3a3ceacbb6ce1b13e45605cde)) - **secret:** fix line numbers for multiple-line secrets ([#9104](https://github.com/aquasecurity/trivy/issues/9104)) ([e579746](https://github.com/aquasecurity/trivy/commit/e57974649e4a3a275b9cf02db191b3f6bf10340f)) - **server:** add HTTP transport setup to server mode ([#9217](https://github.com/aquasecurity/trivy/issues/9217)) ([1163b04](https://github.com/aquasecurity/trivy/commit/1163b044c7e91a81bba3a862cc4a38e90182f0b4)) - supporting .egg-info/METADATA in python.Packaging analyzer ([#9151](https://github.com/aquasecurity/trivy/issues/9151)) ([e306e2d](https://github.com/aquasecurity/trivy/commit/e306e2dc5275c0e75f056c8c7ee9ff9261c78e7f)) - **terraform:** `for_each` on a map returns a resource for every key ([#9156](https://github.com/aquasecurity/trivy/issues/9156)) ([153318f](https://github.com/aquasecurity/trivy/commit/153318f65f7e5059bcc064bd2cd651cc720791a9)) ### [`v0.63.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0630-2025-05-29) ##### Features - add Bottlerocket OS package analyzer ([#8653](https://github.com/aquasecurity/trivy/issues/8653)) ([07ef63b](https://github.com/aquasecurity/trivy/commit/07ef63b4830f9f3d791a07433287a99118d7590a)) - add JSONC support for comments and trailing commas ([#8862](https://github.com/aquasecurity/trivy/issues/8862)) ([0b0e406](https://github.com/aquasecurity/trivy/commit/0b0e4061ef955efc0f94280d2d390f11ff6e2409)) - **alpine:** add maintainer field extraction for APK packages ([#8930](https://github.com/aquasecurity/trivy/issues/8930)) ([104bbc1](https://github.com/aquasecurity/trivy/commit/104bbc18ea85caec17125296dc4fe2dea9c49826)) - **cli:** Add available version checking ([#8553](https://github.com/aquasecurity/trivy/issues/8553)) ([5a0bf9e](https://github.com/aquasecurity/trivy/commit/5a0bf9ed31ad34248895e69231da602935e66785)) - **echo:** Add Echo Support ([#8833](https://github.com/aquasecurity/trivy/issues/8833)) ([c7b8cc3](https://github.com/aquasecurity/trivy/commit/c7b8cc392eb28eb63e10561cf1ff7991e5e3c548)) - **go:** support license scanning in both GOPATH and vendor ([#8843](https://github.com/aquasecurity/trivy/issues/8843)) ([26437be](https://github.com/aquasecurity/trivy/commit/26437be083960d17bee8b1b37b8a6780eff07981)) - **k8s:** get components from namespaced resources ([#8918](https://github.com/aquasecurity/trivy/issues/8918)) ([4f1ab23](https://github.com/aquasecurity/trivy/commit/4f1ab238693919772a65450de9fb9fb2f873c0d6)) - **license:** improve work text licenses with custom classification ([#8888](https://github.com/aquasecurity/trivy/issues/8888)) ([ee52230](https://github.com/aquasecurity/trivy/commit/ee522300b73a2afc72829fc2fa7ff419712fc89a)) - **license:** improve work with custom classification of licenses from config file ([#8861](https://github.com/aquasecurity/trivy/issues/8861)) ([c321fdf](https://github.com/aquasecurity/trivy/commit/c321fdfcdd58f34d076fc730e2b63fdd13e426a9)) - **license:** scan vendor directory for license for go.mod files ([#8689](https://github.com/aquasecurity/trivy/issues/8689)) ([dd6a6e5](https://github.com/aquasecurity/trivy/commit/dd6a6e50a44b7b543fd9dba634da599a76650acb)) - **license:** Support compound licenses (licenses using SPDX operators) ([#8816](https://github.com/aquasecurity/trivy/issues/8816)) ([39f9ed1](https://github.com/aquasecurity/trivy/commit/39f9ed128b2c0fb599ad9092a3cf5675106bffdc)) - **minimos:** Add support for MinimOS ([#8792](https://github.com/aquasecurity/trivy/issues/8792)) ([c2dde33](https://github.com/aquasecurity/trivy/commit/c2dde33c3f19d499258a7089d7658a9f90722acf)) - **misconf:** add misconfiguration location to junit template ([#8793](https://github.com/aquasecurity/trivy/issues/8793)) ([a516775](https://github.com/aquasecurity/trivy/commit/a516775da6fda92a55a62418a081561127a1d5ca)) - **misconf:** Add support for `Minimum Trivy Version` ([#8880](https://github.com/aquasecurity/trivy/issues/8880)) ([3b2a397](https://github.com/aquasecurity/trivy/commit/3b2a3976ac7e7785828655903b132e84ebd9d727)) - **misconf:** export raw Terraform data to Rego ([#8741](https://github.com/aquasecurity/trivy/issues/8741)) ([aaecc29](https://github.com/aquasecurity/trivy/commit/aaecc29e909db4d5dac03caa0daf223035bfb877)) - **nodejs:** add a bun.lock analyzer ([#8897](https://github.com/aquasecurity/trivy/issues/8897)) ([7ca656d](https://github.com/aquasecurity/trivy/commit/7ca656d54b99346253fc6ac6422eecaca169514e)) - **nodejs:** add bun.lock parser ([#8851](https://github.com/aquasecurity/trivy/issues/8851)) ([1dcf816](https://github.com/aquasecurity/trivy/commit/1dcf81666f1c814600702b9ab603b4070da0b940)) - terraform parser option to set current working directory ([#8909](https://github.com/aquasecurity/trivy/issues/8909)) ([8939451](https://github.com/aquasecurity/trivy/commit/893945117464bf6e090a55e3822f8299825f26d4)) ##### Bug Fixes - check post-analyzers for StaticPaths ([#8904](https://github.com/aquasecurity/trivy/issues/8904)) ([93e6680](https://github.com/aquasecurity/trivy/commit/93e6680b1c6bbb590157f521c667c0f611775143)) - **cli:** disable `--skip-dir` and `--skip-files` flags for `sbom` command ([#8886](https://github.com/aquasecurity/trivy/issues/8886)) ([69a5fa1](https://github.com/aquasecurity/trivy/commit/69a5fa18ca86ff7e5206abacf98732d46c000c7a)) - **cli:** don't use allow values for `--compliance` flag ([#8881](https://github.com/aquasecurity/trivy/issues/8881)) ([35e8889](https://github.com/aquasecurity/trivy/commit/35e88890c3c201b3eb11f95376172e57bf44df4b)) - filter all files when processing files installed from package managers ([#8842](https://github.com/aquasecurity/trivy/issues/8842)) ([6ebde88](https://github.com/aquasecurity/trivy/commit/6ebde88dbcaf22f25932bad4844b3c9eaca90560)) - **java:** exclude dev dependencies in gradle lockfile ([#8803](https://github.com/aquasecurity/trivy/issues/8803)) ([8995838](https://github.com/aquasecurity/trivy/commit/8995838e8d184ee9178d5b52d2d3fa9b4e403015)) - julia parser panicking ([#8883](https://github.com/aquasecurity/trivy/issues/8883)) ([be8c7b7](https://github.com/aquasecurity/trivy/commit/be8c7b796dbe36d8dc3889e0bdea23336de9a1ab)) - **julia:** add `Relationship` field support ([#8939](https://github.com/aquasecurity/trivy/issues/8939)) ([22f040f](https://github.com/aquasecurity/trivy/commit/22f040f94790060132c7b0a635f44c35d5a35fb6)) - **k8s:** use in-memory cache backend during misconfig scanning ([#8873](https://github.com/aquasecurity/trivy/issues/8873)) ([fe12771](https://github.com/aquasecurity/trivy/commit/fe127715e505d753e0d878d52c5f280cdc326b76)) - **misconf:** check if for-each is known when expanding dyn block ([#8808](https://github.com/aquasecurity/trivy/issues/8808)) ([5706603](https://github.com/aquasecurity/trivy/commit/570660314698472ab831a7e0d55044e0b1e9c6c0)) - **misconf:** use argument value in WithIncludeDeprecatedChecks ([#8942](https://github.com/aquasecurity/trivy/issues/8942)) ([7e9a54c](https://github.com/aquasecurity/trivy/commit/7e9a54cd6bf4bc15e485c6233d140b389e432fe5)) - more revive rules ([#8814](https://github.com/aquasecurity/trivy/issues/8814)) ([3ab459e](https://github.com/aquasecurity/trivy/commit/3ab459e3b674f319bf349d478917a531a69754c0)) - octalLiteral from go-critic ([#8811](https://github.com/aquasecurity/trivy/issues/8811)) ([a19e0aa](https://github.com/aquasecurity/trivy/commit/a19e0aa1ba0350198c898fd57c9405fbf38fa432)) - **redhat:** Also try to find buildinfo in root layer (layer 0) ([#8924](https://github.com/aquasecurity/trivy/issues/8924)) ([906b037](https://github.com/aquasecurity/trivy/commit/906b037cff97060267d20f8947f429e078419d66)) - **redhat:** save contentSets for OS packages in fs/vm modes ([#8820](https://github.com/aquasecurity/trivy/issues/8820)) ([9256804](https://github.com/aquasecurity/trivy/commit/9256804df8577d8a746fb8b97c508c247ab82f8f)) - **redhat:** trim invalid suffix from content\_sets in manifest parsing ([#8818](https://github.com/aquasecurity/trivy/issues/8818)) ([fa1077b](https://github.com/aquasecurity/trivy/commit/fa1077bbf5863a519f6f180a600afe5e2d6180d8)) - **server:** add missed Relationship field for `rpc` ([#8872](https://github.com/aquasecurity/trivy/issues/8872)) ([38f17c9](https://github.com/aquasecurity/trivy/commit/38f17c945e3ef7784607037c0457fb1e06a99959)) - use-any from revive ([#8810](https://github.com/aquasecurity/trivy/issues/8810)) ([883c63b](https://github.com/aquasecurity/trivy/commit/883c63bf29568f0feab37e5d36ae1c417eef88f5)) - **vex:** use `lo.IsNil` to check `VEX` from OCI artifact ([#8858](https://github.com/aquasecurity/trivy/issues/8858)) ([e97af98](https://github.com/aquasecurity/trivy/commit/e97af9806ab13e1ec8b792e0586b486c4982c170)) - **wolfi:** support new APK database location ([#8937](https://github.com/aquasecurity/trivy/issues/8937)) ([b15d9a6](https://github.com/aquasecurity/trivy/commit/b15d9a60e6a3ed40811d5ca6387082266ae92ea7)) ##### Performance Improvements - **secret:** only match secrets of meaningful length, allow example strings to not be matched ([#8602](https://github.com/aquasecurity/trivy/issues/8602)) ([60fef1b](https://github.com/aquasecurity/trivy/commit/60fef1b615a765248c5870b814ba0c4345220c0e)) ### [`v0.61.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0610-2025-03-28) ##### Features - **fs:** optimize scanning performance by direct file access for known paths ([#8525](https://github.com/aquasecurity/trivy/issues/8525)) ([8bf6caf](https://github.com/aquasecurity/trivy/commit/8bf6caf98e2b1eff7bd16987f6791122d827747c)) - **k8s:** add support for controllers ([#8614](https://github.com/aquasecurity/trivy/issues/8614)) ([1bf0117](https://github.com/aquasecurity/trivy/commit/1bf0117f776953bbfe67cf32e4231360010fdf33)) - **misconf:** adapt aws\_default\_security\_group ([#8538](https://github.com/aquasecurity/trivy/issues/8538)) ([b57eccb](https://github.com/aquasecurity/trivy/commit/b57eccb09c33df4ad0423fb148ddeaa292028401)) - **misconf:** adapt aws\_opensearch\_domain ([#8550](https://github.com/aquasecurity/trivy/issues/8550)) ([9913465](https://github.com/aquasecurity/trivy/commit/9913465a535c29b377bd2f2563163ccf7cbcd6a4)) - **misconf:** adapt AWS::DynamoDB::Table ([#8529](https://github.com/aquasecurity/trivy/issues/8529)) ([8112cdf](https://github.com/aquasecurity/trivy/commit/8112cdf8d638fa2bf57e5687e32f54b704c7e6b7)) - **misconf:** adapt AWS::EC2::VPC ([#8534](https://github.com/aquasecurity/trivy/issues/8534)) ([0d9865f](https://github.com/aquasecurity/trivy/commit/0d9865f48f46e85595af40140faa5ff6f02b9a02)) - **misconf:** Add support for aws\_ami ([#8499](https://github.com/aquasecurity/trivy/issues/8499)) ([573502e](https://github.com/aquasecurity/trivy/commit/573502e2e83ff18020d5e7dcad498468a548733e)) - replace TinyGo with standard Go for WebAssembly modules ([#8496](https://github.com/aquasecurity/trivy/issues/8496)) ([529957e](https://github.com/aquasecurity/trivy/commit/529957eac1fc790c57fa3d93524a901ce842a9f5)) ##### Bug Fixes - **debian:** don't include empty licenses for `dpkgs` ([#8623](https://github.com/aquasecurity/trivy/issues/8623)) ([346f5b3](https://github.com/aquasecurity/trivy/commit/346f5b3553b9247f99f89d859d4f835e955d34e9)) - **fs:** check postAnalyzers for StaticPaths ([#8543](https://github.com/aquasecurity/trivy/issues/8543)) ([c228307](https://github.com/aquasecurity/trivy/commit/c22830766e8cf1532f20198864757161eed6fda4)) - **k8s:** show report for `--report all` ([#8613](https://github.com/aquasecurity/trivy/issues/8613)) ([dbb6f28](https://github.com/aquasecurity/trivy/commit/dbb6f288712240ef5dec59952e33b73e3a6d5b06)) - **misconf:** add ephemeral block type to config schema ([#8513](https://github.com/aquasecurity/trivy/issues/8513)) ([41512f8](https://github.com/aquasecurity/trivy/commit/41512f846e75bae73984138ad7b3d03284a53f19)) - **misconf:** Check values wholly prior to evaluation ([#8604](https://github.com/aquasecurity/trivy/issues/8604)) ([ad58cf4](https://github.com/aquasecurity/trivy/commit/ad58cf4457ebef80ff0bc4c113d4ab4c86a9fe56)) - **misconf:** do not skip loading documents from subdirectories ([#8526](https://github.com/aquasecurity/trivy/issues/8526)) ([de7eb13](https://github.com/aquasecurity/trivy/commit/de7eb13938f2709983a27ab3f59dbfac3fb74651)) - **misconf:** do not use cty.NilVal for non-nil values ([#8567](https://github.com/aquasecurity/trivy/issues/8567)) ([400a79c](https://github.com/aquasecurity/trivy/commit/400a79c2c693e462ad2e1cfc21305ef13d2ec224)) - **misconf:** identify the chart file exactly by name ([#8590](https://github.com/aquasecurity/trivy/issues/8590)) ([ba77dbe](https://github.com/aquasecurity/trivy/commit/ba77dbe5f952d67bbbbc0f43543d5f34135bc280)) - **misconf:** Improve logging for unsupported checks ([#8634](https://github.com/aquasecurity/trivy/issues/8634)) ([5b7704d](https://github.com/aquasecurity/trivy/commit/5b7704d1d091a12822df060ee7a679135185f2ae)) - **misconf:** set default values for AWS::EKS::Cluster.ResourcesVpcConfig ([#8548](https://github.com/aquasecurity/trivy/issues/8548)) ([1f05b45](https://github.com/aquasecurity/trivy/commit/1f05b4545d8f1de3ee703de66a7b3df2baaa07a7)) - **misconf:** skip Azure CreateUiDefinition ([#8503](https://github.com/aquasecurity/trivy/issues/8503)) ([c7814f1](https://github.com/aquasecurity/trivy/commit/c7814f1401b0cc66a557292fe07da24d0ea7b5cc)) - **spdx:** save text licenses into `otherLicenses` without normalize ([#8502](https://github.com/aquasecurity/trivy/issues/8502)) ([e5072f1](https://github.com/aquasecurity/trivy/commit/e5072f1eef8f3a78f4db48b4ac3f7c48aeec5e92)) - use `--file-patterns` flag for all post analyzers ([#7365](https://github.com/aquasecurity/trivy/issues/7365)) ([8b88238](https://github.com/aquasecurity/trivy/commit/8b88238f07e389cc32e2478f84aceaf860e421ef)) ##### Performance Improvements - **misconf:** parse input for Rego once ([#8483](https://github.com/aquasecurity/trivy/issues/8483)) ([0e5e909](https://github.com/aquasecurity/trivy/commit/0e5e9097650f60bc54f47a21ecc937a66e66e225)) - **misconf:** retrieve check metadata from annotations once ([#8478](https://github.com/aquasecurity/trivy/issues/8478)) ([7b96351](https://github.com/aquasecurity/trivy/commit/7b96351c32d264d136978fe8fd9e113ada69bb2b)) ### [`v0.60.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0600-2025-03-05) ##### Features - add `--vuln-severity-source` flag ([#8269](https://github.com/aquasecurity/trivy/issues/8269)) ([d464807](https://github.com/aquasecurity/trivy/commit/d4648073211e8451d66e4c0399e9441250b60a76)) - add report summary table ([#8177](https://github.com/aquasecurity/trivy/issues/8177)) ([dd54f80](https://github.com/aquasecurity/trivy/commit/dd54f80d3fda7821dba13553480e9893ba8b4cb3)) - **cyclonedx:** Add initial support for loading external VEX files from SBOM references ([#8254](https://github.com/aquasecurity/trivy/issues/8254)) ([4820eb7](https://github.com/aquasecurity/trivy/commit/4820eb70fc926a35d759c373112dbbdca890fd46)) - **go:** fix parsing main module version for go >= 1.24 ([#8433](https://github.com/aquasecurity/trivy/issues/8433)) ([e58dcfc](https://github.com/aquasecurity/trivy/commit/e58dcfcf9f102c12825d5343ebbcc12a2d6c05c5)) - **misconf:** render causes for Terraform ([#8360](https://github.com/aquasecurity/trivy/issues/8360)) ([a99498c](https://github.com/aquasecurity/trivy/commit/a99498cdd9b7bdac000140af6654bfe30135242d)) ##### Bug Fixes - **db:** fix case when 2 trivy-db were copied at the same time ([#8452](https://github.com/aquasecurity/trivy/issues/8452)) ([bb3cca6](https://github.com/aquasecurity/trivy/commit/bb3cca6018551e96fdd357563dc177215ca29bd4)) - don't use `scope` for `trivy registry login` command ([#8393](https://github.com/aquasecurity/trivy/issues/8393)) ([8715e5d](https://github.com/aquasecurity/trivy/commit/8715e5d14a727667c2e62d6f7a4b5308a0323386)) - **go:** merge nested flags into string for ldflags for Go binaries ([#8368](https://github.com/aquasecurity/trivy/issues/8368)) ([b675b06](https://github.com/aquasecurity/trivy/commit/b675b06e897aaf374e7b1262d4323060a8a62edb)) - **image:** disable AVD-DS-0007 for history scanning ([#8366](https://github.com/aquasecurity/trivy/issues/8366)) ([a3cd693](https://github.com/aquasecurity/trivy/commit/a3cd693a5ea88def2f9057df6178b0c0e7a6bdb0)) - **k8s:** add missed option `PkgRelationships` ([#8442](https://github.com/aquasecurity/trivy/issues/8442)) ([f987e41](https://github.com/aquasecurity/trivy/commit/f987e4157494434f6e4e4566fedfedda92167565)) - **misconf:** do not log scanners when misconfig scanning is disabled ([#8345](https://github.com/aquasecurity/trivy/issues/8345)) ([5695eb2](https://github.com/aquasecurity/trivy/commit/5695eb22dfed672eafacb64a71da8e9bdfbaab87)) - **misconf:** ecs include enhanced for container insights ([#8326](https://github.com/aquasecurity/trivy/issues/8326)) ([39789ff](https://github.com/aquasecurity/trivy/commit/39789fff438d11bc6eccd254b3b890beb68c240b)) - **misconf:** fix incorrect k8s locations due to JSON to YAML conversion ([#8073](https://github.com/aquasecurity/trivy/issues/8073)) ([a994453](https://github.com/aquasecurity/trivy/commit/a994453a7d0f543fe30c4dc8adbc92ad0c21bcbc)) - **os:** add mapping OS aliases ([#8466](https://github.com/aquasecurity/trivy/issues/8466)) ([6b4cebe](https://github.com/aquasecurity/trivy/commit/6b4cebe9592f3a06bd91aa58ba6d65869afebbee)) - **python:** add `poetry` v2 support ([#8323](https://github.com/aquasecurity/trivy/issues/8323)) ([10cd98c](https://github.com/aquasecurity/trivy/commit/10cd98cf55263749cb2583063a2e9e9953c7371a)) - **report:** remove html escaping for `shortDescription` and `fullDescription` fields for sarif reports ([#8344](https://github.com/aquasecurity/trivy/issues/8344)) ([3eb0b03](https://github.com/aquasecurity/trivy/commit/3eb0b03f7c9ee462daccfacb291b2c463d848ff5)) - **sbom:** add SBOM file's filePath as Application FilePath if we can't detect its path ([#8346](https://github.com/aquasecurity/trivy/issues/8346)) ([ecc01bb](https://github.com/aquasecurity/trivy/commit/ecc01bb3fb876fd0cc503cb38efa23e4fb9484b4)) - **sbom:** improve logic for binding direct dependency to parent component ([#8489](https://github.com/aquasecurity/trivy/issues/8489)) ([85cca8c](https://github.com/aquasecurity/trivy/commit/85cca8c07affee4ded5c232efb45b05dacf22242)) - **sbom:** preserve OS packages from multiple SBOMs ([#8325](https://github.com/aquasecurity/trivy/issues/8325)) ([bd5baaf](https://github.com/aquasecurity/trivy/commit/bd5baaf93054d71223e0721c7547a0567dea3b02)) - **server:** secrets inspectation for the config analyzer in client server mode ([#8418](https://github.com/aquasecurity/trivy/issues/8418)) ([a1c4bd7](https://github.com/aquasecurity/trivy/commit/a1c4bd746f5f901e2a8f09f48f58b973b9103165)) - **spdx:** init `pkgFilePaths` map for all formats ([#8380](https://github.com/aquasecurity/trivy/issues/8380)) ([72ea4b0](https://github.com/aquasecurity/trivy/commit/72ea4b0632308bd6150aaf2f1549a3f10b60dc23)) - **terraform:** apply parser options to submodule parsing ([#8377](https://github.com/aquasecurity/trivy/issues/8377)) ([398620b](https://github.com/aquasecurity/trivy/commit/398620b471c25e467018bc23df53a3a1c2aa661c)) - update all documentation links ([#8045](https://github.com/aquasecurity/trivy/issues/8045)) ([49456ba](https://github.com/aquasecurity/trivy/commit/49456ba8410e0e4cc1756906ccea1fdd60006d2d)) ### [`v0.59.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0590-2025-01-30) ##### Features - add `--distro` flag to manually specify OS distribution for vulnerability scanning ([#8070](https://github.com/aquasecurity/trivy/issues/8070)) ([da17dc7](https://github.com/aquasecurity/trivy/commit/da17dc72782cd68b5d2c4314a67936343462b75e)) - add a examples field to check metadata ([#8068](https://github.com/aquasecurity/trivy/issues/8068)) ([6d84e0c](https://github.com/aquasecurity/trivy/commit/6d84e0cc0d48ae5c490cad868bb4e5e76392241c)) - add support for registry mirrors ([#8244](https://github.com/aquasecurity/trivy/issues/8244)) ([4316bcb](https://github.com/aquasecurity/trivy/commit/4316bcbc5b9038eed21214a826981c49696bb27f)) - **fs:** use git commit hash as cache key for clean repositories ([#8278](https://github.com/aquasecurity/trivy/issues/8278)) ([b5062f3](https://github.com/aquasecurity/trivy/commit/b5062f3ae20044d1452bf293f210a24cd1d419b3)) - **image:** prevent scanning oversized container images ([#8178](https://github.com/aquasecurity/trivy/issues/8178)) ([509e030](https://github.com/aquasecurity/trivy/commit/509e03030c36d17f9427ab50a4e99fb1846ba65a)) - **image:** return error early if total size of layers exceeds limit ([#8294](https://github.com/aquasecurity/trivy/issues/8294)) ([73bd20d](https://github.com/aquasecurity/trivy/commit/73bd20d6199a777d1ed7eb560e0184d8f1b4b550)) - **k8s:** improve artifact selections for specific namespaces ([#8248](https://github.com/aquasecurity/trivy/issues/8248)) ([db9e57a](https://github.com/aquasecurity/trivy/commit/db9e57a34e460ac6934ee21dffaa2322db9fd56b)) - **misconf:** generate placeholders for random provider resources ([#8051](https://github.com/aquasecurity/trivy/issues/8051)) ([ffe24e1](https://github.com/aquasecurity/trivy/commit/ffe24e18dc3dca816ec9ce5ccf66d5d7b5ea70d6)) - **misconf:** support for ignoring by inline comments for Dockerfile ([#8115](https://github.com/aquasecurity/trivy/issues/8115)) ([c002327](https://github.com/aquasecurity/trivy/commit/c00232720a89df659c6cd0b56d99304d5ffea1a7)) - **misconf:** support for ignoring by inline comments for Helm ([#8138](https://github.com/aquasecurity/trivy/issues/8138)) ([a0429f7](https://github.com/aquasecurity/trivy/commit/a0429f773b4f696fc613d91f1600cd0da38fb2c8)) - **nodejs:** respect peer dependencies for dependency tree ([#7989](https://github.com/aquasecurity/trivy/issues/7989)) ([7389961](https://github.com/aquasecurity/trivy/commit/73899610e8eece670d2e5ddc1478fcc0a2a5760d)) - **python:** add support for poetry dev dependencies ([#8152](https://github.com/aquasecurity/trivy/issues/8152)) ([774e04d](https://github.com/aquasecurity/trivy/commit/774e04d19dc2067725ac2e18ca871872f74082ab)) - **python:** add support for uv ([#8080](https://github.com/aquasecurity/trivy/issues/8080)) ([c4a4a5f](https://github.com/aquasecurity/trivy/commit/c4a4a5fa971d73ae924afcf2259631f15e96e520)) - **python:** add support for uv dev and optional dependencies ([#8134](https://github.com/aquasecurity/trivy/issues/8134)) ([49c54b4](https://github.com/aquasecurity/trivy/commit/49c54b49c6563590dd82007d52e425a7a4e07ac0)) ##### Bug Fixes - CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass ([#8088](https://github.com/aquasecurity/trivy/issues/8088)) ([d7ac286](https://github.com/aquasecurity/trivy/commit/d7ac286085077c969734225a789e6cc056d5c5f5)) - CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field ([#8207](https://github.com/aquasecurity/trivy/issues/8207)) ([670fbf2](https://github.com/aquasecurity/trivy/commit/670fbf2d81ea20ea691a86e4ed25a7454baf08e5)) - de-duplicate same `dpkg` packages with different filePaths from different layers ([#8298](https://github.com/aquasecurity/trivy/issues/8298)) ([846498d](https://github.com/aquasecurity/trivy/commit/846498dd23a80531881f803147077eee19004a50)) - enable err-error and errorf rules from perfsprint linter ([#7859](https://github.com/aquasecurity/trivy/issues/7859)) ([156a2aa](https://github.com/aquasecurity/trivy/commit/156a2aa4c49386828c0446f8978473c8da7a8754)) - **flag:** skip hidden flags for `--generate-default-config` command ([#8046](https://github.com/aquasecurity/trivy/issues/8046)) ([5e68bdc](https://github.com/aquasecurity/trivy/commit/5e68bdc9d08f96d22451d7b5dd93e79ca576eeb7)) - **fs:** fix cache key generation to use UUID ([#8275](https://github.com/aquasecurity/trivy/issues/8275)) ([eafd810](https://github.com/aquasecurity/trivy/commit/eafd810d7cb366215efbd0ab3b72c4651d31c6a6)) - handle `BLOW_UNKNOWN` error to download DBs ([#8060](https://github.com/aquasecurity/trivy/issues/8060)) ([51f2123](https://github.com/aquasecurity/trivy/commit/51f2123c5ccc4f7a37d1068830b6670b4ccf9ac8)) - improve conversion of image config to Dockerfile ([#8308](https://github.com/aquasecurity/trivy/issues/8308)) ([2e8e38a](https://github.com/aquasecurity/trivy/commit/2e8e38a8c094f3392893693ab15a605ab0d378f9)) - **java:** correctly overwrite version from depManagement if dependency uses `project.*` props ([#8050](https://github.com/aquasecurity/trivy/issues/8050)) ([9d9f80d](https://github.com/aquasecurity/trivy/commit/9d9f80d9791f38a0b4c727152166ae4d237a83a9)) - **license:** always trim leading and trailing spaces for licenses ([#8095](https://github.com/aquasecurity/trivy/issues/8095)) ([f5e4291](https://github.com/aquasecurity/trivy/commit/f5e429179df1637de96962ab9c19e4336056bb5d)) - **misconf:** allow null values only for tf variables ([#8112](https://github.com/aquasecurity/trivy/issues/8112)) ([23dc3a6](https://github.com/aquasecurity/trivy/commit/23dc3a67535b7458728b2939514a96bd3de3aa81)) - **misconf:** correctly handle all YAML tags in K8S templates ([#8259](https://github.com/aquasecurity/trivy/issues/8259)) ([f12054e](https://github.com/aquasecurity/trivy/commit/f12054e669f9df93c6322ba2755036dbccacaa83)) - **misconf:** disable git terminal prompt on tf module load ([#8026](https://github.com/aquasecurity/trivy/issues/8026)) ([bbc5a85](https://github.com/aquasecurity/trivy/commit/bbc5a85444ec86b7bb26d6db27803d199431a8e6)) - **misconf:** handle heredocs in dockerfile instructions ([#8284](https://github.com/aquasecurity/trivy/issues/8284)) ([0a3887c](https://github.com/aquasecurity/trivy/commit/0a3887ca0350d7dabf5db7e08aaf8152201fdf0d)) - **misconf:** use log instead of fmt for logging ([#8033](https://github.com/aquasecurity/trivy/issues/8033)) ([07b2d7f](https://github.com/aquasecurity/trivy/commit/07b2d7fbd7f8ef5473c2438c560fffc8bdadf913)) - **oracle:** add architectures support for advisories ([#4809](https://github.com/aquasecurity/trivy/issues/4809)) ([90f1d8d](https://github.com/aquasecurity/trivy/commit/90f1d8d78aa20b47fafab2c8ecb07247f075ef45)) - **python:** skip dev group's deps for poetry ([#8106](https://github.com/aquasecurity/trivy/issues/8106)) ([a034d26](https://github.com/aquasecurity/trivy/commit/a034d26443704601c1fe330a5cc1f019f6974524)) - **redhat:** check `usr/share/buildinfo/` dir to detect content sets ([#8222](https://github.com/aquasecurity/trivy/issues/8222)) ([f352f6b](https://github.com/aquasecurity/trivy/commit/f352f6b66355fe3636c9e4e9f3edd089c551a81c)) - **redhat:** correct rewriting of recommendations for the same vulnerability ([#8063](https://github.com/aquasecurity/trivy/issues/8063)) ([4202c4b](https://github.com/aquasecurity/trivy/commit/4202c4ba0d8fcff4b89499fe03050ef4efd37330)) - respect GITHUB\_TOKEN to download artifacts from GHCR ([#7580](https://github.com/aquasecurity/trivy/issues/7580)) ([21b68e1](https://github.com/aquasecurity/trivy/commit/21b68e18188f91935ac1055a78ee97a7f35a110d)) - **sbom:** attach nested packages to Application ([#8144](https://github.com/aquasecurity/trivy/issues/8144)) ([735335f](https://github.com/aquasecurity/trivy/commit/735335f08f84936f3928cbbc3eb71af3a3a4918d)) - **sbom:** fix wrong overwriting of applications obtained from different sbom files but having same app type ([#8052](https://github.com/aquasecurity/trivy/issues/8052)) ([fd07074](https://github.com/aquasecurity/trivy/commit/fd07074e8033530eee2732193b00e59f27c73096)) - **sbom:** scan results of SBOMs generated from container images are missing layers ([#7635](https://github.com/aquasecurity/trivy/issues/7635)) ([f9fceb5](https://github.com/aquasecurity/trivy/commit/f9fceb58bf64657dee92302df1ed97e597e474c9)) - **sbom:** use root package for `unknown` dependencies (if exists) ([#8104](https://github.com/aquasecurity/trivy/issues/8104)) ([7558df7](https://github.com/aquasecurity/trivy/commit/7558df7c227c769235e5441fbdd3f9f7efb1ff84)) - **spdx:** use the `hasExtractedLicensingInfos` field for licenses that are not listed in the SPDX ([#8077](https://github.com/aquasecurity/trivy/issues/8077)) ([aec8885](https://github.com/aquasecurity/trivy/commit/aec8885bc7f7e3c5a2a68214dca9aff28accd122)) - **suse:** SUSE - update OSType constants and references for compatibility ([#8236](https://github.com/aquasecurity/trivy/issues/8236)) ([ae28398](https://github.com/aquasecurity/trivy/commit/ae283985c926ca828b25b69ad0338008be31e5fe)) - Updated twitter icon ([#7772](https://github.com/aquasecurity/trivy/issues/7772)) ([2c41ac8](https://github.com/aquasecurity/trivy/commit/2c41ac83a95e9347605d36f483171a60ffce0fa2)) - wasm module test ([#8099](https://github.com/aquasecurity/trivy/issues/8099)) ([2200f38](https://github.com/aquasecurity/trivy/commit/2200f3846d675c64ab9302af43224d663a67c944)) ##### Performance Improvements - avoid heap allocation in applier findPackage ([#7883](https://github.com/aquasecurity/trivy/issues/7883)) ([9bd6ed7](https://github.com/aquasecurity/trivy/commit/9bd6ed73e5d49d52856c76124e84c268475c5456)) ### [`v0.58.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0580-2024-12-02) ##### Features - add `workspaceRelationship` ([#7889](https://github.com/aquasecurity/trivy/issues/7889)) ([d622ca2](https://github.com/aquasecurity/trivy/commit/d622ca2b1fe40a0eb588478ba9e15d3bd8471a78)) - add cvss v4 score and vector in scan response ([#7968](https://github.com/aquasecurity/trivy/issues/7968)) ([e0f2054](https://github.com/aquasecurity/trivy/commit/e0f2054f9d12dce87e8a0226350f6317f7167195)) - **go:** construct dependencies in the parser ([#7973](https://github.com/aquasecurity/trivy/issues/7973)) ([bcdc0bb](https://github.com/aquasecurity/trivy/commit/bcdc0bbf1f63777ff79d3ecadb8d4f916f376b7d)) - **go:** construct dependencies of `go.mod` main module in the parser ([#7977](https://github.com/aquasecurity/trivy/issues/7977)) ([5448ba2](https://github.com/aquasecurity/trivy/commit/5448ba2a5c1ee36cbcf74ee1c2e83409092c5715)) - **k8s:** add default commands for unknown platform ([#7863](https://github.com/aquasecurity/trivy/issues/7863)) ([b1c7f55](https://github.com/aquasecurity/trivy/commit/b1c7f5516fc39c6cbb76cbeae5c8677ccc9ce5dd)) - **misconf:** log causes of HCL file parsing errors ([#7634](https://github.com/aquasecurity/trivy/issues/7634)) ([e9a899a](https://github.com/aquasecurity/trivy/commit/e9a899a3cfe41a622202808a0241b7f40b54d338)) - **oracle:** add `flavors` support ([#7858](https://github.com/aquasecurity/trivy/issues/7858)) ([b9b383e](https://github.com/aquasecurity/trivy/commit/b9b383eb2714e88357af75900c856db2900b83ec)) - **secret:** Add built-in secrets rules for Private Packagist ([#7826](https://github.com/aquasecurity/trivy/issues/7826)) ([132d9df](https://github.com/aquasecurity/trivy/commit/132d9dfa19a8835c94f332c6939ab7f64641ee5f)) - **suse:** Align SUSE/OpenSUSE OS Identifiers ([#7965](https://github.com/aquasecurity/trivy/issues/7965)) ([45d3b40](https://github.com/aquasecurity/trivy/commit/45d3b40044202dec91384847ce2b50a7271f5977)) - Update registry fallbacks ([#7679](https://github.com/aquasecurity/trivy/issues/7679)) ([5ba9a83](https://github.com/aquasecurity/trivy/commit/5ba9a83a447c4f9e577ae6235c315df71f50b452)) ##### Bug Fixes - **alpine:** add `UID` for removed packages ([#7887](https://github.com/aquasecurity/trivy/issues/7887)) ([07915da](https://github.com/aquasecurity/trivy/commit/07915da4816d4d9ec8a6c5e4cba17be2a0f4ad65)) - **aws:** change CPU and Memory type of ContainerDefinition to a string ([#7995](https://github.com/aquasecurity/trivy/issues/7995)) ([aeeba70](https://github.com/aquasecurity/trivy/commit/aeeba70d15c11443d9fe7c26f90fc7d9dcc7f92c)) - **cli:** Handle empty ignore files more gracefully ([#7962](https://github.com/aquasecurity/trivy/issues/7962)) ([4cfb2a9](https://github.com/aquasecurity/trivy/commit/4cfb2a97b27923182ab45c178544542ec65981d4)) - **debian:** infinite loop ([#7928](https://github.com/aquasecurity/trivy/issues/7928)) ([d982e6a](https://github.com/aquasecurity/trivy/commit/d982e6ab89967629f71ec09100cdc61e30a27c63)) - **fs:** add missing deferred Cleanup() call to post analyzer fs ([#7882](https://github.com/aquasecurity/trivy/issues/7882)) ([ab32297](https://github.com/aquasecurity/trivy/commit/ab32297e0a8220a427fa330025f8625281e02275)) - Improve version comparisons when build identifiers are present ([#7873](https://github.com/aquasecurity/trivy/issues/7873)) ([eda4d76](https://github.com/aquasecurity/trivy/commit/eda4d7660d8908705bc08a6edc55d8144d02806a)) - **k8s:** check all results for vulnerabilities ([#7946](https://github.com/aquasecurity/trivy/issues/7946)) ([797b36f](https://github.com/aquasecurity/trivy/commit/797b36fbad90b8e7f04e16e2cf08d6bdc0255ac7)) - **misconf:** do not erase variable type for child modules ([#7941](https://github.com/aquasecurity/trivy/issues/7941)) ([de3b7ea](https://github.com/aquasecurity/trivy/commit/de3b7ea24c282bce22ce9cacb49a43d8d90e2bde)) - **misconf:** handle null properties in CloudFormation templates ([#7813](https://github.com/aquasecurity/trivy/issues/7813)) ([99b2db3](https://github.com/aquasecurity/trivy/commit/99b2db3978562689cef956a71281abb84ff0ce47)) - **misconf:** load full Terraform module ([#7925](https://github.com/aquasecurity/trivy/issues/7925)) ([fbc42a0](https://github.com/aquasecurity/trivy/commit/fbc42a04ea24e2246f81491434a965846d55ed69)) - **misconf:** properly resolve local Terraform cache ([#7983](https://github.com/aquasecurity/trivy/issues/7983)) ([fe3a897](https://github.com/aquasecurity/trivy/commit/fe3a8971b6697d896c1ec30b5326a10c20349d14)) - **misconf:** Update trivy-checks default repo to `mirror.gcr.io` ([#7953](https://github.com/aquasecurity/trivy/issues/7953)) ([9988147](https://github.com/aquasecurity/trivy/commit/9988147b8b0e463464fe494122bfcc66ccdf04e0)) - **misconf:** wrap AWS EnvVar to iac types ([#7407](https://github.com/aquasecurity/trivy/issues/7407)) ([54130dc](https://github.com/aquasecurity/trivy/commit/54130dcc1d775506d34b83a558952176fc549914)) - **redhat:** don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files ([#7912](https://github.com/aquasecurity/trivy/issues/7912)) ([38775a5](https://github.com/aquasecurity/trivy/commit/38775a5ed985eefe2b410e72407c454cdad3d075)) - **report:** handle `git@github.com` schema for misconfigs in `sarif` report ([#7898](https://github.com/aquasecurity/trivy/issues/7898)) ([19aea4b](https://github.com/aquasecurity/trivy/commit/19aea4b01f3ce5a3cd05d5a1091da5b0b3ba4af6)) - **sbom:** Fixes for Programming Language Vulnerabilities and SBOM Package Maintainer Details ([#7871](https://github.com/aquasecurity/trivy/issues/7871)) ([461a68a](https://github.com/aquasecurity/trivy/commit/461a68afd60b77dd67e91047b3b4d558fa5bd2ec)) - **terraform:** set null value as fallback for missing variables ([#7669](https://github.com/aquasecurity/trivy/issues/7669)) ([611558e](https://github.com/aquasecurity/trivy/commit/611558e4ce61818330118684274534f26b1fda99)) ### [`v0.57.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0570-2024-10-31) ##### ⚠ BREAKING CHANGES - **k8s:** support k8s multi container ([#7444](https://github.com/aquasecurity/trivy/issues/7444)) ##### Features - add end of life date for Ubuntu 24.10 ([#7787](https://github.com/aquasecurity/trivy/issues/7787)) ([ad3c09e](https://github.com/aquasecurity/trivy/commit/ad3c09e006e134f3c5b879ffc34ce9895a8c860f)) - **cli:** add `trivy auth` ([#7664](https://github.com/aquasecurity/trivy/issues/7664)) ([27117f8](https://github.com/aquasecurity/trivy/commit/27117f81d52483c3ceec56fe56ac298e242fbc9a)) - **cli:** error out when ignore file cannot be found ([#7624](https://github.com/aquasecurity/trivy/issues/7624)) ([cb0b3a9](https://github.com/aquasecurity/trivy/commit/cb0b3a9279b31810ecd686a385e5140e567ce86f)) - **cli:** rename `trivy auth` to `trivy registry` ([#7727](https://github.com/aquasecurity/trivy/issues/7727)) ([633a7ab](https://github.com/aquasecurity/trivy/commit/633a7abeea4287899392a24f2705f96dfeb7e312)) - **cyclonedx:** add file checksums to `CycloneDX` reports ([#7507](https://github.com/aquasecurity/trivy/issues/7507)) ([c225883](https://github.com/aquasecurity/trivy/commit/c225883649f58128a99fa2c1cef327d0e57940be)) - **db:** append errors ([#7843](https://github.com/aquasecurity/trivy/issues/7843)) ([5e78b6c](https://github.com/aquasecurity/trivy/commit/5e78b6c12fb5740c12dedeea3d335d48ec2f752b)) - **misconf:** export unresolvable field of IaC types to Rego ([#7765](https://github.com/aquasecurity/trivy/issues/7765)) ([9514148](https://github.com/aquasecurity/trivy/commit/9514148767865baddd73a49245385574927f7a74)) - **misconf:** public network support for Azure Storage Account ([#7601](https://github.com/aquasecurity/trivy/issues/7601)) ([ad91412](https://github.com/aquasecurity/trivy/commit/ad914123c4d203af1e1da6b7e2d3e49d9d3831d8)) - **misconf:** Show misconfig ID in output ([#7762](https://github.com/aquasecurity/trivy/issues/7762)) ([f75c0d1](https://github.com/aquasecurity/trivy/commit/f75c0d1f0069d4856cb4826d6049f32c5b9409d9)) - **misconf:** ssl\_mode support for GCP SQL DB instance ([#7564](https://github.com/aquasecurity/trivy/issues/7564)) ([2eaa17e](https://github.com/aquasecurity/trivy/commit/2eaa17e0717940b27a79050e2efd9213b71178c9)) - **parser:** ignore white space in pom.xml files ([#7747](https://github.com/aquasecurity/trivy/issues/7747)) ([a7baa93](https://github.com/aquasecurity/trivy/commit/a7baa93b00b8636aa097e64cdb8eed97dbd68511)) - **report:** update gitlab template to populate operating\_system value ([#7735](https://github.com/aquasecurity/trivy/issues/7735)) ([c0d79fa](https://github.com/aquasecurity/trivy/commit/c0d79fa09e645f3a3dbff878e393b8631fb17b64)) ##### Bug Fixes - **cli:** `clean --all` deletes only relevant dirs ([#7704](https://github.com/aquasecurity/trivy/issues/7704)) ([672e886](https://github.com/aquasecurity/trivy/commit/672e886aed152ae0f09a16941706746f3053ca94)) - **cli:** add config name to skip-policy-update alias ([#7820](https://github.com/aquasecurity/trivy/issues/7820)) ([b661d68](https://github.com/aquasecurity/trivy/commit/b661d680ff0372c8e4beea0db13bf69d6a2203a8)) - **db:** fix javadb downloading error handling ([#7642](https://github.com/aquasecurity/trivy/issues/7642)) ([2c87f0c](https://github.com/aquasecurity/trivy/commit/2c87f0cb794acd77446a273582ba1a45b9f18980)) - enable usestdlibvars linter ([#7770](https://github.com/aquasecurity/trivy/issues/7770)) ([57e24aa](https://github.com/aquasecurity/trivy/commit/57e24aa85382f749df7f673e241caaf3fcbb45cb)) - **go:** Do not trim v prefix from versions in Go Mod Analyzer ([#7733](https://github.com/aquasecurity/trivy/issues/7733)) ([e872ec0](https://github.com/aquasecurity/trivy/commit/e872ec006c0745a5a142728af0096c6d6bb9ddf3)) - **helm:** properly handle multiple archived dependencies ([#7782](https://github.com/aquasecurity/trivy/issues/7782)) ([6fab88d](https://github.com/aquasecurity/trivy/commit/6fab88dd56c257ef2cc63b617c2a5decb1c4cf98)) - **java:** correctly inherit `version` and `scope` from upper/root `depManagement` and `dependencies` into parents ([#7541](https://github.com/aquasecurity/trivy/issues/7541)) ([778df82](https://github.com/aquasecurity/trivy/commit/778df828eaad9827cb833c6285058a33aa2b83ca)) - **k8s:** skip resources without misconfigs ([#7797](https://github.com/aquasecurity/trivy/issues/7797)) ([7882776](https://github.com/aquasecurity/trivy/commit/78827768a612ab305bf9c55409ce76d6774302a5)) - **k8s:** support k8s multi container ([#7444](https://github.com/aquasecurity/trivy/issues/7444)) ([c434775](https://github.com/aquasecurity/trivy/commit/c4347759234dcb5f372b07f92fb4230ef391d710)) - **k8s:** support kubernetes v1.31 ([#7810](https://github.com/aquasecurity/trivy/issues/7810)) ([7a4f4d8](https://github.com/aquasecurity/trivy/commit/7a4f4d8b12996687f3095a2042cdf2f5985332c9)) - **license:** fix license normalization for Universal Permissive License ([#7766](https://github.com/aquasecurity/trivy/issues/7766)) ([f6acdf7](https://github.com/aquasecurity/trivy/commit/f6acdf713991f8ffdbe765178fcb8a9cde433cba)) - **misconf:** change default ACL of digitalocean\_spaces\_bucket to private ([#7577](https://github.com/aquasecurity/trivy/issues/7577)) ([9da84f5](https://github.com/aquasecurity/trivy/commit/9da84f54fadbe6ad0d73983952e945ed63b666f3)) - **misconf:** check if property is not nil before conversion ([#7578](https://github.com/aquasecurity/trivy/issues/7578)) ([c8c14d3](https://github.com/aquasecurity/trivy/commit/c8c14d36245623019f29d258f813d2325f7490f7)) - **misconf:** fix for Azure Storage Account network acls adaptation ([#7602](https://github.com/aquasecurity/trivy/issues/7602)) ([35fd018](https://github.com/aquasecurity/trivy/commit/35fd018ae7ad86823f114f0ac2f1376726aee444)) - **misconf:** properly expand dynamic blocks ([#7612](https://github.com/aquasecurity/trivy/issues/7612)) ([8d5dbc9](https://github.com/aquasecurity/trivy/commit/8d5dbc9fec3569b22ed81a03c40eaf732768718b)) - **redhat:** include arch in PURL qualifiers ([#7654](https://github.com/aquasecurity/trivy/issues/7654)) ([a585e95](https://github.com/aquasecurity/trivy/commit/a585e95f3398631d9ad10505c5ff642fde21aef7)) - **repo:** `git clone` output to Stderr ([#7561](https://github.com/aquasecurity/trivy/issues/7561)) ([fdf203c](https://github.com/aquasecurity/trivy/commit/fdf203cd209aeb40f454bd12d121a54d6ed7a542)) - **report:** Fix invalid URI in SARIF report ([#7645](https://github.com/aquasecurity/trivy/issues/7645)) ([015bb88](https://github.com/aquasecurity/trivy/commit/015bb885ac414b91201fa9791eead395d878149c)) - **sbom:** add options for DBs in private registries ([#7660](https://github.com/aquasecurity/trivy/issues/7660)) ([1f2e91b](https://github.com/aquasecurity/trivy/commit/1f2e91b02b3606dd11963002a8cfac7962f3478f)) - **sbom:** use `Annotation` instead of `AttributionTexts` for `SPDX` formats ([#7811](https://github.com/aquasecurity/trivy/issues/7811)) ([f2bb9c6](https://github.com/aquasecurity/trivy/commit/f2bb9c6227743dd61f44eb591d4b15192fe110c6)) ### [`v0.55.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0550-2024-09-03) ##### ⚠ BREAKING CHANGES - **cli:** delete deprecated SBOM flags ([#7266](https://github.com/aquasecurity/trivy/issues/7266)) ##### Features - **cli:** delete deprecated SBOM flags ([#7266](https://github.com/aquasecurity/trivy/issues/7266)) ([7024572](https://github.com/aquasecurity/trivy/commit/70245721372720027b7089bd61c693df48add865)) - **go:** use `toolchain` as `stdlib` version for `go.mod` files ([#7163](https://github.com/aquasecurity/trivy/issues/7163)) ([2d80769](https://github.com/aquasecurity/trivy/commit/2d80769c34b118851640411fff9dac0b3e353e82)) - **java:** add `test` scope support for `pom.xml` files ([#7414](https://github.com/aquasecurity/trivy/issues/7414)) ([2d97700](https://github.com/aquasecurity/trivy/commit/2d97700d10665142d2f66d7910202bec82116209)) - **misconf:** Add support for using spec from on-disk bundle ([#7179](https://github.com/aquasecurity/trivy/issues/7179)) ([be86126](https://github.com/aquasecurity/trivy/commit/be861265cafc89787fda09c59b2ef175e3d04204)) - **misconf:** ignore duplicate checks ([#7317](https://github.com/aquasecurity/trivy/issues/7317)) ([9ef05fc](https://github.com/aquasecurity/trivy/commit/9ef05fc6b171a264516a025b0b0bcbbc8cff10bc)) - **misconf:** iterator argument support for dynamic blocks ([#7236](https://github.com/aquasecurity/trivy/issues/7236)) ([fe92072](https://github.com/aquasecurity/trivy/commit/fe9207255a4f7f984ec1447f8a9219ae60e560c4)) - **misconf:** port and protocol support for EC2 networks ([#7146](https://github.com/aquasecurity/trivy/issues/7146)) ([98e136e](https://github.com/aquasecurity/trivy/commit/98e136eb7baa2b66f4233d96875c1490144e1594)) - **misconf:** scanning support for YAML and JSON ([#7311](https://github.com/aquasecurity/trivy/issues/7311)) ([efdbd8f](https://github.com/aquasecurity/trivy/commit/efdbd8f19ab0ab0c3b48293d43e51c81b7b03b89)) - **misconf:** support for ignore by nested attributes ([#7205](https://github.com/aquasecurity/trivy/issues/7205)) ([44e4686](https://github.com/aquasecurity/trivy/commit/44e468603d44b077cc4606327fb3e7d7ca435e05)) - **misconf:** support for policy and bucket grants ([#7284](https://github.com/aquasecurity/trivy/issues/7284)) ([a817fae](https://github.com/aquasecurity/trivy/commit/a817fae85b7272b391b737ec86673a7cab722bae)) - **misconf:** variable support for Terraform Plan ([#7228](https://github.com/aquasecurity/trivy/issues/7228)) ([db2c955](https://github.com/aquasecurity/trivy/commit/db2c95598da098ca610825089eb4ab63b789b215)) - **python:** use minimum version for pip packages ([#7348](https://github.com/aquasecurity/trivy/issues/7348)) ([e9b43f8](https://github.com/aquasecurity/trivy/commit/e9b43f81e67789b067352fcb6aa55bc9478bc518)) - **report:** export modified findings in JSON ([#7383](https://github.com/aquasecurity/trivy/issues/7383)) ([7aea79d](https://github.com/aquasecurity/trivy/commit/7aea79dd93cfb61453766dbbb2e3fc0fbd317852)) - **sbom:** set User-Agent header on requests to Rekor ([#7396](https://github.com/aquasecurity/trivy/issues/7396)) ([af1d257](https://github.com/aquasecurity/trivy/commit/af1d257730422d238871beb674767f8f83c5d06a)) - **server:** add internal `--path-prefix` flag for client/server mode ([#7321](https://github.com/aquasecurity/trivy/issues/7321)) ([24a4563](https://github.com/aquasecurity/trivy/commit/24a45636867b893ff54c5ce07197f3b5c6db1d9b)) - **server:** Make Trivy Server Multiplexer Exported ([#7389](https://github.com/aquasecurity/trivy/issues/7389)) ([4c6e8ca](https://github.com/aquasecurity/trivy/commit/4c6e8ca9cc9591799907cc73075f2d740e303b8f)) - **vm:** Support direct filesystem ([#7058](https://github.com/aquasecurity/trivy/issues/7058)) ([45b3f34](https://github.com/aquasecurity/trivy/commit/45b3f344042bcd90ca63ab696b69bff0e9ab4e36)) - **vm:** support the Ext2/Ext3 filesystems ([#6983](https://github.com/aquasecurity/trivy/issues/6983)) ([35c60f0](https://github.com/aquasecurity/trivy/commit/35c60f030fa48de8d8e57958e5ba379814126831)) - **vuln:** Add `--detection-priority` flag for accuracy tuning ([#7288](https://github.com/aquasecurity/trivy/issues/7288)) ([fd8348d](https://github.com/aquasecurity/trivy/commit/fd8348d610f20c6c33da81cd7b0e7d5504ce26be)) ##### Bug Fixes - **aws:** handle ECR repositories in different regions ([#6217](https://github.com/aquasecurity/trivy/issues/6217)) ([feaef96](https://github.com/aquasecurity/trivy/commit/feaef9699df5d8ca399770e701a59d7c0ff979a3)) - **flag:** incorrect behavior for deprecated flag `--clear-cache` ([#7281](https://github.com/aquasecurity/trivy/issues/7281)) ([2a0e529](https://github.com/aquasecurity/trivy/commit/2a0e529c36057b572119815af59c28e4790034ca)) - **helm:** explicitly define `kind` and `apiVersion` of `volumeClaimTemplate` element ([#7362](https://github.com/aquasecurity/trivy/issues/7362)) ([da4ebfa](https://github.com/aquasecurity/trivy/commit/da4ebfa1a741f3f8b0b43289b4028afe763f7d43)) - **java:** Return error when trying to find a remote pom to avoid segfault ([#7275](https://github.com/aquasecurity/trivy/issues/7275)) ([49d5270](https://github.com/aquasecurity/trivy/commit/49d5270163e305f88fedcf50412973736e69dc69)) - **license:** add license handling to JUnit template ([#7409](https://github.com/aquasecurity/trivy/issues/7409)) ([f80183c](https://github.com/aquasecurity/trivy/commit/f80183c1139b21bb95bc64e216358f4a76001a65)) - logger initialization before flags parsing ([#7372](https://github.com/aquasecurity/trivy/issues/7372)) ([c929290](https://github.com/aquasecurity/trivy/commit/c929290c3c0e4e91337264d69e75ccb60522bc65)) - **misconf:** change default TLS values for the Azure storage account ([#7345](https://github.com/aquasecurity/trivy/issues/7345)) ([aadb090](https://github.com/aquasecurity/trivy/commit/aadb09078843250c66087f46db9a2aa48094a118)) - **misconf:** do not filter Terraform plan JSON by name ([#7406](https://github.com/aquasecurity/trivy/issues/7406)) ([9d7264a](https://github.com/aquasecurity/trivy/commit/9d7264af8e85bcc0dba600b8366d0470d455251c)) - **misconf:** do not recreate filesystem map ([#7416](https://github.com/aquasecurity/trivy/issues/7416)) ([3a5d091](https://github.com/aquasecurity/trivy/commit/3a5d091759564496992a83fb2015a21c84a22213)) - **misconf:** do not register Rego libs in checks registry ([#7420](https://github.com/aquasecurity/trivy/issues/7420)) ([a5aa63e](https://github.com/aquasecurity/trivy/commit/a5aa63eff7e229744090f9ad300c1bec3259397e)) - **misconf:** do not set default value for default\_cache\_behavior ([#7234](https://github.com/aquasecurity/trivy/issues/7234)) ([f0ed5e4](https://github.com/aquasecurity/trivy/commit/f0ed5e4ced7e60af35c88d5d084aa4b7237f4973)) - **misconf:** fix infer type for null value ([#7424](https://github.com/aquasecurity/trivy/issues/7424)) ([0cac3ac](https://github.com/aquasecurity/trivy/commit/0cac3ac7075017628a21a7990941df04cbc16dbe)) - **misconf:** init frameworks before updating them ([#7376](https://github.com/aquasecurity/trivy/issues/7376)) ([b65b32d](https://github.com/aquasecurity/trivy/commit/b65b32ddfa6fc62ac81ad9fa580e1f5a327864f5)) - **misconf:** load only submodule if it is specified in source ([#7112](https://github.com/aquasecurity/trivy/issues/7112)) ([a4180bd](https://github.com/aquasecurity/trivy/commit/a4180bddd43d86e479edf0afe0c362021d071482)) - **misconf:** support deprecating for Go checks ([#7377](https://github.com/aquasecurity/trivy/issues/7377)) ([2a6c7ab](https://github.com/aquasecurity/trivy/commit/2a6c7ab3b338ce4a8f99d6ac3508c2531dcbe812)) - **misconf:** use module to log when metadata retrieval fails ([#7405](https://github.com/aquasecurity/trivy/issues/7405)) ([0799770](https://github.com/aquasecurity/trivy/commit/0799770b8827a8276ad0d6d9ac7e0381c286757c)) - **misconf:** wrap Azure PortRange in iac types ([#7357](https://github.com/aquasecurity/trivy/issues/7357)) ([c5c62d5](https://github.com/aquasecurity/trivy/commit/c5c62d5ff05420321f9cdbfb93e2591e0866a342)) - **nodejs:** check all `importers` to detect dev deps from pnpm-lock.yaml file ([#7387](https://github.com/aquasecurity/trivy/issues/7387)) ([fd9ed3a](https://github.com/aquasecurity/trivy/commit/fd9ed3a330bc66e229bcbdc262dc296a3bf01f54)) - **plugin:** do not call GitHub content API for releases and tags ([#7274](https://github.com/aquasecurity/trivy/issues/7274)) ([b3ee6da](https://github.com/aquasecurity/trivy/commit/b3ee6dac269bd7847674f3ce985a5ff7f8f0ba38)) - **report:** escape `Message` field in `asff.tpl` template ([#7401](https://github.com/aquasecurity/trivy/issues/7401)) ([dd9733e](https://github.com/aquasecurity/trivy/commit/dd9733e950d3127aa2ac90c45ec7e2b88a2b47ca)) - safely check if the directory exists ([#7353](https://github.com/aquasecurity/trivy/issues/7353)) ([05a8297](https://github.com/aquasecurity/trivy/commit/05a829715f99cd90b122c64cd2f40157854e467b)) - **sbom:** use `NOASSERTION` for licenses fields in SPDX formats ([#7403](https://github.com/aquasecurity/trivy/issues/7403)) ([c96dcdd](https://github.com/aquasecurity/trivy/commit/c96dcdd440a14cdd1b01ac473b2c15e4698e387b)) - **secret:** use `.eyJ` keyword for JWT secret ([#7410](https://github.com/aquasecurity/trivy/issues/7410)) ([bf64003](https://github.com/aquasecurity/trivy/commit/bf64003ac8b209f34b88f228918a96d4f9dac5e0)) - **secret:** use only line with secret for long secret lines ([#7412](https://github.com/aquasecurity/trivy/issues/7412)) ([391448a](https://github.com/aquasecurity/trivy/commit/391448aba9fcb0a4138225e5ab305e4e6707c603)) - **terraform:** add aws\_region name to presets ([#7184](https://github.com/aquasecurity/trivy/issues/7184)) ([bb2e26a](https://github.com/aquasecurity/trivy/commit/bb2e26a0ab707b718f6a890cbc87e2492298b6e5)) ##### Performance Improvements - **misconf:** do not convert contents of a YAML file to string ([#7292](https://github.com/aquasecurity/trivy/issues/7292)) ([85dadf5](https://github.com/aquasecurity/trivy/commit/85dadf56265647c000191561db10b08a4948c140)) - **misconf:** optimize work with context ([#6968](https://github.com/aquasecurity/trivy/issues/6968)) ([2b6d8d9](https://github.com/aquasecurity/trivy/commit/2b6d8d9227fb6ecc9386a14333964c23c0370a52)) - **misconf:** use json.Valid to check validity of JSON ([#7308](https://github.com/aquasecurity/trivy/issues/7308)) ([c766831](https://github.com/aquasecurity/trivy/commit/c766831069e188226efafeec184e41498685ed85)) ### [`v0.53.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0530-2024-07-01) ##### ⚠ BREAKING CHANGES - **k8s:** node-collector dynamic commands support ([#6861](https://github.com/aquasecurity/trivy/issues/6861)) - add clean subcommand ([#6993](https://github.com/aquasecurity/trivy/issues/6993)) - **aws:** Remove aws subcommand ([#6995](https://github.com/aquasecurity/trivy/issues/6995)) ##### Features - add clean subcommand ([#6993](https://github.com/aquasecurity/trivy/issues/6993)) ([8d0ae1f](https://github.com/aquasecurity/trivy/commit/8d0ae1f5de72d92a043dcd6b7c164d30e51b6047)) - Add local ImageID to SARIF metadata ([#6522](https://github.com/aquasecurity/trivy/issues/6522)) ([f144e91](https://github.com/aquasecurity/trivy/commit/f144e912d34234f00b5a13b7a11a0019fa978b27)) - add memory cache backend ([#7048](https://github.com/aquasecurity/trivy/issues/7048)) ([55ccd06](https://github.com/aquasecurity/trivy/commit/55ccd06df43f6ff28685f46d215ccb70f55916d2)) - **aws:** Remove aws subcommand ([#6995](https://github.com/aquasecurity/trivy/issues/6995)) ([979e118](https://github.com/aquasecurity/trivy/commit/979e118a9e0ca8943bef9143f492d7eb1fd4d863)) - **conda:** add licenses support for `environment.yml` files ([#6953](https://github.com/aquasecurity/trivy/issues/6953)) ([654217a](https://github.com/aquasecurity/trivy/commit/654217a65485ca0a07771ea61071977894eb4920)) - **dart:** use first version of constraint for dependencies using SDK version ([#6239](https://github.com/aquasecurity/trivy/issues/6239)) ([042d6b0](https://github.com/aquasecurity/trivy/commit/042d6b08c283105c258a3dda98983b345a5305c3)) - **image:** Set User-Agent header for Trivy container registry requests ([#6868](https://github.com/aquasecurity/trivy/issues/6868)) ([9b31697](https://github.com/aquasecurity/trivy/commit/9b31697274c8743d6e5a8f7a1a05daf60cd15910)) - **java:** add support for `maven-metadata.xml` files for remote snapshot repositories. ([#6950](https://github.com/aquasecurity/trivy/issues/6950)) ([1f8fca1](https://github.com/aquasecurity/trivy/commit/1f8fca1fc77b989bb4e3ba820b297464dbdd825f)) - **java:** add support for sbt projects using sbt-dependency-lock ([#6882](https://github.com/aquasecurity/trivy/issues/6882)) ([f18d035](https://github.com/aquasecurity/trivy/commit/f18d035ae13b281c96aa4ed69ca32e507d336e66)) - **k8s:** node-collector dynamic commands support ([#6861](https://github.com/aquasecurity/trivy/issues/6861)) ([8d618e4](https://github.com/aquasecurity/trivy/commit/8d618e48a2f1b60c2e4c49cdd9deb8eb45c972b0)) - **misconf:** add metadata to Cloud schema ([#6831](https://github.com/aquasecurity/trivy/issues/6831)) ([02d5404](https://github.com/aquasecurity/trivy/commit/02d540478d495416b50d7e8b187ff9f5bba41f45)) - **misconf:** add support for AWS::EC2::SecurityGroupIngress/Egress ([#6755](https://github.com/aquasecurity/trivy/issues/6755)) ([55fa610](https://github.com/aquasecurity/trivy/commit/55fa6109cd0463fd3221aae41ca7b1d8c44ad430)) - **misconf:** API Gateway V1 support for CloudFormation ([#6874](https://github.com/aquasecurity/trivy/issues/6874)) ([8491469](https://github.com/aquasecurity/trivy/commit/8491469f0b35bd9df706a433669f5b62239d4ef3)) - **misconf:** support of selectors for all providers for Rego ([#6905](https://github.com/aquasecurity/trivy/issues/6905)) ([bc3741a](https://github.com/aquasecurity/trivy/commit/bc3741ae2c68cdd00fc0aef7e51985568b2eb78a)) - **php:** add installed.json file support ([#4865](https://github.com/aquasecurity/trivy/issues/4865)) ([edc556b](https://github.com/aquasecurity/trivy/commit/edc556b85e3554c31e19b1ece189effb9ba2be12)) - **plugin:** add support for nested archives ([#6845](https://github.com/aquasecurity/trivy/issues/6845)) ([622c67b](https://github.com/aquasecurity/trivy/commit/622c67b7647f94d0a0ca3acf711d8f847cdd8d98)) - **sbom:** migrate to `CycloneDX v1.6` ([#6903](https://github.com/aquasecurity/trivy/issues/6903)) ([09e50ce](https://github.com/aquasecurity/trivy/commit/09e50ce6a82073ba62f1732d5aa0cd2701578693)) ##### Bug Fixes - **c:** don't skip conan files from `file-patterns` and scan `.conan2` cache dir ([#6949](https://github.com/aquasecurity/trivy/issues/6949)) ([38b35dd](https://github.com/aquasecurity/trivy/commit/38b35dd3c804027e7a6e6a9d3c87b7ac333896c5)) - **cli:** show info message only when --scanners is available ([#7032](https://github.com/aquasecurity/trivy/issues/7032)) ([e9fc3e3](https://github.com/aquasecurity/trivy/commit/e9fc3e3397564512038ddeca2adce0efcb3f93c5)) - **cyclonedx:** trim non-URL info for `advisory.url` ([#6952](https://github.com/aquasecurity/trivy/issues/6952)) ([417212e](https://github.com/aquasecurity/trivy/commit/417212e0930aa52a27ebdc1b9370d2943ce0f8fa)) - **debian:** take installed files from the origin layer ([#6849](https://github.com/aquasecurity/trivy/issues/6849)) ([089b953](https://github.com/aquasecurity/trivy/commit/089b953462260f01c40bdf588b2568ae0ef658bc)) - **image:** parse `image.inspect.Created` field only for non-empty values ([#6948](https://github.com/aquasecurity/trivy/issues/6948)) ([0af5730](https://github.com/aquasecurity/trivy/commit/0af5730cbe56686417389c2fad643c1bdbb33999)) - **license:** return license separation using separators `,`, `or`, etc. ([#6916](https://github.com/aquasecurity/trivy/issues/6916)) ([52f7aa5](https://github.com/aquasecurity/trivy/commit/52f7aa54b520a90a19736703f8ea63cc20fab104)) - **misconf:** fix caching of modules in subdirectories ([#6814](https://github.com/aquasecurity/trivy/issues/6814)) ([0bcfedb](https://github.com/aquasecurity/trivy/commit/0bcfedbcaa9bbe30ee5ecade5b98e9ce3cc54c9b)) - **misconf:** fix parsing of engine links and frameworks ([#6937](https://github.com/aquasecurity/trivy/issues/6937)) ([ec68c9a](https://github.com/aquasecurity/trivy/commit/ec68c9ab4580d057720179173d58734402c92af4)) - **misconf:** handle source prefix to ignore ([#6945](https://github.com/aquasecurity/trivy/issues/6945)) ([c3192f0](https://github.com/aquasecurity/trivy/commit/c3192f061d7e84eaf38df8df7c879dc00b4ca137)) - **misconf:** parsing numbers without fraction as int ([#6834](https://github.com/aquasecurity/trivy/issues/6834)) ([8141a13](https://github.com/aquasecurity/trivy/commit/8141a137ba50b553a9da877d95c7ccb491d041c6)) - **nodejs:** fix infinite loop when package link from `package-lock.json` file is broken ([#6858](https://github.com/aquasecurity/trivy/issues/6858)) ([cf5aa33](https://github.com/aquasecurity/trivy/commit/cf5aa336e660e4c98481ebf8d15dd4e54c38581e)) - **nodejs:** fix infinity loops for `pnpm` with cyclic imports ([#6857](https://github.com/aquasecurity/trivy/issues/6857)) ([7d083bc](https://github.com/aquasecurity/trivy/commit/7d083bc890eccc3bf32765c6d7e922cab2e2ef94)) - **plugin:** respect `--insecure` ([#7022](https://github.com/aquasecurity/trivy/issues/7022)) ([3d02a31](https://github.com/aquasecurity/trivy/commit/3d02a31b44924f9e2495aae087f7ca9de3314db4)) - **purl:** add missed os types ([#6955](https://github.com/aquasecurity/trivy/issues/6955)) ([2d85a00](https://github.com/aquasecurity/trivy/commit/2d85a003b22298d1101f84559f7c6b470f2b3909)) - **python:** compare pkg names from `poetry.lock` and `pyproject.toml` in lowercase ([#6852](https://github.com/aquasecurity/trivy/issues/6852)) ([faa9d92](https://github.com/aquasecurity/trivy/commit/faa9d92cfeb8d924deda2dac583b6c97099c08d9)) - **sbom:** don't overwrite `srcEpoch` when decoding SBOM files ([#6866](https://github.com/aquasecurity/trivy/issues/6866)) ([04af59c](https://github.com/aquasecurity/trivy/commit/04af59c2906bcfc7f7970b4e8f45a90f04313170)) - **sbom:** fix panic when scanning SBOM file without root component into SBOM format ([#7051](https://github.com/aquasecurity/trivy/issues/7051)) ([3d4ae8b](https://github.com/aquasecurity/trivy/commit/3d4ae8b5be94cd9b00badeece8d86c2258b2cd90)) - **sbom:** take pkg name from `purl` for maven pkgs ([#7008](https://github.com/aquasecurity/trivy/issues/7008)) ([a76e328](https://github.com/aquasecurity/trivy/commit/a76e3286c413de3dec55394fb41dd627dfee37ae)) - **sbom:** use `purl` for `bitnami` pkg names ([#6982](https://github.com/aquasecurity/trivy/issues/6982)) ([7eabb92](https://github.com/aquasecurity/trivy/commit/7eabb92ec2e617300433445718be07ac74956454)) - **sbom:** use package UIDs for uniqueness ([#7042](https://github.com/aquasecurity/trivy/issues/7042)) ([14d71ba](https://github.com/aquasecurity/trivy/commit/14d71ba63c39e51dd4179ba2d6002b46e1816e90)) - **secret:** `Asymmetric Private Key` shouldn't start with space ([#6867](https://github.com/aquasecurity/trivy/issues/6867)) ([bb26445](https://github.com/aquasecurity/trivy/commit/bb26445e3df198df77930329f532ac5ab7a67af2)) - **suse:** Add SLES 15.6 and Leap 15.6 ([#6964](https://github.com/aquasecurity/trivy/issues/6964)) ([5ee4e9d](https://github.com/aquasecurity/trivy/commit/5ee4e9d30ea814f60fd5705361cabf2e83a47a78)) - use embedded when command path not found ([#7037](https://github.com/aquasecurity/trivy/issues/7037)) ([137c916](https://github.com/aquasecurity/trivy/commit/137c9164238ffd989a0c5ed24f23a55bbf341f6e)) ### [`v0.52.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0520-2024-06-03) ##### Features - Add Julia language analyzer support ([#5635](https://github.com/aquasecurity/trivy/issues/5635)) ([fecafb1](https://github.com/aquasecurity/trivy/commit/fecafb1fc5bb129c7485342a0775f0dd8bedd28e)) - add support for plugin index ([#6674](https://github.com/aquasecurity/trivy/issues/6674)) ([26faf8f](https://github.com/aquasecurity/trivy/commit/26faf8f3f04b1c5f9f81c03ffc6b2008732207e2)) - **misconf:** Add support for deprecating a check ([#6664](https://github.com/aquasecurity/trivy/issues/6664)) ([88702cf](https://github.com/aquasecurity/trivy/commit/88702cfd5918b093defc5b5580f7cbf16f5f2417)) - **misconf:** add Terraform 'removed' block to schema ([#6640](https://github.com/aquasecurity/trivy/issues/6640)) ([b7a0a13](https://github.com/aquasecurity/trivy/commit/b7a0a131a03ed49c08d3b0d481bc9284934fd6e1)) - **misconf:** register builtin Rego funcs from trivy-checks ([#6616](https://github.com/aquasecurity/trivy/issues/6616)) ([7c22ee3](https://github.com/aquasecurity/trivy/commit/7c22ee3df5ee51beb90e44428a99541b3d19ab98)) - **misconf:** resolve tf module from OpenTofu compatible registry ([#6743](https://github.com/aquasecurity/trivy/issues/6743)) ([ac74520](https://github.com/aquasecurity/trivy/commit/ac7452009bf7ca0fa8ee1de8807c792eabad405a)) - **misconf:** support for VPC resources for inbound/outbound rules ([#6779](https://github.com/aquasecurity/trivy/issues/6779)) ([349caf9](https://github.com/aquasecurity/trivy/commit/349caf96bc3dd81551d488044f1adfdb947f39fb)) - **misconf:** support symlinks inside of Helm archives ([#6621](https://github.com/aquasecurity/trivy/issues/6621)) ([4eae37c](https://github.com/aquasecurity/trivy/commit/4eae37c52b035b3576361c12f70d3d9517d0a73c)) - **nodejs:** add v9 pnpm lock file support ([#6617](https://github.com/aquasecurity/trivy/issues/6617)) ([1e08648](https://github.com/aquasecurity/trivy/commit/1e0864842e32a709941d4b4e8f521602bcee684d)) - **plugin:** specify plugin version ([#6683](https://github.com/aquasecurity/trivy/issues/6683)) ([d6dc567](https://github.com/aquasecurity/trivy/commit/d6dc56732babbc9d7f788c280a768d8648aa093d)) - **python:** add license support for `requirement.txt` files ([#6782](https://github.com/aquasecurity/trivy/issues/6782)) ([29615be](https://github.com/aquasecurity/trivy/commit/29615be85e8bfeaf5a0cd51829b1898c55fa4274)) - **python:** add line number support for `requirement.txt` files ([#6729](https://github.com/aquasecurity/trivy/issues/6729)) ([2bc54ad](https://github.com/aquasecurity/trivy/commit/2bc54ad2752aba5de4380cb92c13b09c0abefd73)) - **report:** Include licenses and secrets filtered by rego to ModifiedFindings ([#6483](https://github.com/aquasecurity/trivy/issues/6483)) ([fa3cf99](https://github.com/aquasecurity/trivy/commit/fa3cf993eace4be793f85907b42365269c597b91)) - **vex:** improve relationship support in CSAF VEX ([#6735](https://github.com/aquasecurity/trivy/issues/6735)) ([a447f6b](https://github.com/aquasecurity/trivy/commit/a447f6ba94b6f8b14177dc5e4369a788e2020d90)) - **vex:** support non-root components for products in OpenVEX ([#6728](https://github.com/aquasecurity/trivy/issues/6728)) ([9515695](https://github.com/aquasecurity/trivy/commit/9515695d45e9b5c20890e27e21e3ab45bfd4ce5f)) ##### Bug Fixes - clean up golangci lint configuration ([#6797](https://github.com/aquasecurity/trivy/issues/6797)) ([62de6f3](https://github.com/aquasecurity/trivy/commit/62de6f3feba6e4c56ad3922441d5b0f150c3d6b7)) - **cli:** always output fatal errors to stderr ([#6827](https://github.com/aquasecurity/trivy/issues/6827)) ([c2b9132](https://github.com/aquasecurity/trivy/commit/c2b9132a7e933a68df4cc0eb86aab23719ded1b5)) - close APKINDEX archive file ([#6672](https://github.com/aquasecurity/trivy/issues/6672)) ([5caf437](https://github.com/aquasecurity/trivy/commit/5caf4377f3a7fcb1f6e1a84c67136ae62d100be3)) - close settings.xml ([#6768](https://github.com/aquasecurity/trivy/issues/6768)) ([9c3e895](https://github.com/aquasecurity/trivy/commit/9c3e895fcb0852c00ac03ed21338768f76b5273b)) - close testfile ([#6830](https://github.com/aquasecurity/trivy/issues/6830)) ([aa0c413](https://github.com/aquasecurity/trivy/commit/aa0c413814e8915b38d2285c6a8ba5bc3f0705b4)) - **conda:** add support `pip` deps for `environment.yml` files ([#6675](https://github.com/aquasecurity/trivy/issues/6675)) ([150a773](https://github.com/aquasecurity/trivy/commit/150a77313e980cd63797a89a03afcbc97b285f38)) - **go:** add only non-empty root modules for `gobinaries` ([#6710](https://github.com/aquasecurity/trivy/issues/6710)) ([c96f2a5](https://github.com/aquasecurity/trivy/commit/c96f2a5b3de820da37e14594dd537c3b0949ae9c)) - **go:** include only `.version`|`.ver` (no prefixes) ldflags for `gobinaries` ([#6705](https://github.com/aquasecurity/trivy/issues/6705)) ([afb4f9d](https://github.com/aquasecurity/trivy/commit/afb4f9dc4730671ba004e1734fa66422c4c86dad)) - Golang version parsing from binaries w/GOEXPERIMENT ([#6696](https://github.com/aquasecurity/trivy/issues/6696)) ([696f2ae](https://github.com/aquasecurity/trivy/commit/696f2ae0ecdd4f90303f41249924a09ace70dd78)) - include packages unless it is not needed ([#6765](https://github.com/aquasecurity/trivy/issues/6765)) ([56dbe1f](https://github.com/aquasecurity/trivy/commit/56dbe1f6768fe67fbc1153b74fde0f83eaa1b281)) - **misconf:** don't shift ignore rule related to code ([#6708](https://github.com/aquasecurity/trivy/issues/6708)) ([39a746c](https://github.com/aquasecurity/trivy/commit/39a746c77837f873e87b81be40676818030f44c5)) - **misconf:** skip Rego errors with a nil location ([#6638](https://github.com/aquasecurity/trivy/issues/6638)) ([a2c522d](https://github.com/aquasecurity/trivy/commit/a2c522ddb229f049999c4ce74ef75a0e0f9fdc62)) - **misconf:** skip Rego errors with a nil location ([#6666](https://github.com/aquasecurity/trivy/issues/6666)) ([a126e10](https://github.com/aquasecurity/trivy/commit/a126e1075a44ef0e40c0dc1e214d1c5955f80242)) - node-collector high and critical cves ([#6707](https://github.com/aquasecurity/trivy/issues/6707)) ([ff32deb](https://github.com/aquasecurity/trivy/commit/ff32deb7bf9163c06963f557228260b3b8c161ed)) - **plugin:** initialize logger ([#6836](https://github.com/aquasecurity/trivy/issues/6836)) ([728e77a](https://github.com/aquasecurity/trivy/commit/728e77a7261dc3fcda1e61e79be066c789bbba0c)) - **python:** add package name and version validation for `requirements.txt` files. ([#6804](https://github.com/aquasecurity/trivy/issues/6804)) ([ea3a124](https://github.com/aquasecurity/trivy/commit/ea3a124fc7162c30c7f1a59bdb28db0b3c8bb86d)) - **report:** hide empty tables if all vulns has been filtered ([#6352](https://github.com/aquasecurity/trivy/issues/6352)) ([3d388d8](https://github.com/aquasecurity/trivy/commit/3d388d8552ef42d4d54176309a38c1879008527b)) - **sbom:** fix panic for `convert` mode when scanning json file derived from sbom file ([#6808](https://github.com/aquasecurity/trivy/issues/6808)) ([f92ea09](https://github.com/aquasecurity/trivy/commit/f92ea096856c7c262b05bd4d31c62689ebafac82)) - use of specified context to obtain cluster name ([#6645](https://github.com/aquasecurity/trivy/issues/6645)) ([39ebed4](https://github.com/aquasecurity/trivy/commit/39ebed45f8c218509d264bd3f3ca548fc33d2b3a)) ##### Performance Improvements - **misconf:** parse rego input once ([#6615](https://github.com/aquasecurity/trivy/issues/6615)) ([67c6b1d](https://github.com/aquasecurity/trivy/commit/67c6b1d473999003d682bdb42657bbf3a4a69a9c)) ### [`v0.26.0`](https://github.com/aquasecurity/trivy/releases/tag/v0.26.0) #### Changelog - [`a0047a7`](https://github.com/aquasecurity/trivy/commit/a0047a79) feat(alpine): warn mixing versions ([#2000](https://github.com/aquasecurity/trivy/issues/2000)) - [`d786655`](https://github.com/aquasecurity/trivy/commit/d786655a) Update ASFF template ([#1914](https://github.com/aquasecurity/trivy/issues/1914)) - [`a02cf65`](https://github.com/aquasecurity/trivy/commit/a02cf651) chore(deps): replace `containerd/containerd` version to fix CVE-2022-23648 ([#1994](https://github.com/aquasecurity/trivy/issues/1994)) - [`613e38c`](https://github.com/aquasecurity/trivy/commit/613e38cc) chore(deps): bump alpine from 3.15.3 to 3.15.4 ([#1993](https://github.com/aquasecurity/trivy/issues/1993)) - [`3b6d65b`](https://github.com/aquasecurity/trivy/commit/3b6d65be) test(go): add integration tests for gomod ([#1989](https://github.com/aquasecurity/trivy/issues/1989)) - [`22f5b93`](https://github.com/aquasecurity/trivy/commit/22f5b938) fix(python): fixed panic when scan .egg archive ([#1992](https://github.com/aquasecurity/trivy/issues/1992)) - [`485637c`](https://github.com/aquasecurity/trivy/commit/485637c2) fix(go): set correct go modules type ([#1990](https://github.com/aquasecurity/trivy/issues/1990)) - [`6fdb554`](https://github.com/aquasecurity/trivy/commit/6fdb554a) feat(alpine): support apk repositories ([#1987](https://github.com/aquasecurity/trivy/issues/1987)) - [`d9bddb9`](https://github.com/aquasecurity/trivy/commit/d9bddb90) docs: add CBL-Mariner ([#1982](https://github.com/aquasecurity/trivy/issues/1982)) - [`1cf1873`](https://github.com/aquasecurity/trivy/commit/1cf1873f) docs(go): fix version ([#1986](https://github.com/aquasecurity/trivy/issues/1986)) - [`d77dbe8`](https://github.com/aquasecurity/trivy/commit/d77dbe8a) feat(go): support go.mod in Go 1.17+ ([#1985](https://github.com/aquasecurity/trivy/issues/1985)) - [`32bd1e4`](https://github.com/aquasecurity/trivy/commit/32bd1e48) ci: fix URLs in the PR template ([#1972](https://github.com/aquasecurity/trivy/issues/1972)) - [`94a5a18`](https://github.com/aquasecurity/trivy/commit/94a5a180) ci: add semantic pull requests check ([#1968](https://github.com/aquasecurity/trivy/issues/1968)) - [`72d94b2`](https://github.com/aquasecurity/trivy/commit/72d94b21) docs(issue): added docs for wrong detection issues ([#1961](https://github.com/aquasecurity/trivy/issues/1961)) ### [`v0.25.3`](https://github.com/aquasecurity/trivy/releases/tag/v0.25.3) #### Changelog - [`d4e3df8`](https://github.com/aquasecurity/trivy/commit/d4e3df81) fix(downloadDB): add dbRepositoryFlag to repository and rootfs commands ([#1956](https://github.com/aquasecurity/trivy/issues/1956)) - [`7e48cc1`](https://github.com/aquasecurity/trivy/commit/7e48cc1f) fix(misconf): update BurntSushi/toml for fix runtime error ([#1948](https://github.com/aquasecurity/trivy/issues/1948)) - [`c9efa8c`](https://github.com/aquasecurity/trivy/commit/c9efa8c4) fix(misconf): Update fanal/defsec to resolve missing metadata issues ([#1947](https://github.com/aquasecurity/trivy/issues/1947)) - [`52b7154`](https://github.com/aquasecurity/trivy/commit/52b71542) feat(jar): allow setting Maven Central URL using environment variable ([#1939](https://github.com/aquasecurity/trivy/issues/1939)) - [`21f7a41`](https://github.com/aquasecurity/trivy/commit/21f7a41b) chore(chart): update Trivy version in HelmChart to 0.25.0 ([#1931](https://github.com/aquasecurity/trivy/issues/1931)) - [`ff2b3d1`](https://github.com/aquasecurity/trivy/commit/ff2b3d17) chore(chart): remove version comments ([#1933](https://github.com/aquasecurity/trivy/issues/1933)) ### [`v0.24.4`](https://github.com/aquasecurity/trivy/releases/tag/v0.24.4) #### Changelog - [`06659f1`](https://github.com/aquasecurity/trivy/commit/06659f15) fix(docker): Getting images without a tag ([#1852](https://github.com/aquasecurity/trivy/issues/1852)) - [`a91cc50`](https://github.com/aquasecurity/trivy/commit/a91cc50d) docs(gitlab-ci): Use environment variables TRIVY\_CACHE\_DIR and TRIVY\_NO\_PROGRESS ([#1801](https://github.com/aquasecurity/trivy/issues/1801)) ### [`v0.24.2`](https://github.com/aquasecurity/trivy/releases/tag/v0.24.2) #### Changelog [`eebf9c8`](https://github.com/aquasecurity/trivy/commit/eebf9c8f) fix(pom): keep an order of dependencies ([#1784](https://github.com/aquasecurity/trivy/issues/1784)) [`971092b`](https://github.com/aquasecurity/trivy/commit/971092b8) chore: bump up Go to 1.17 ([#1781](https://github.com/aquasecurity/trivy/issues/1781)) [`2f2d822`](https://github.com/aquasecurity/trivy/commit/2f2d8222) chore(deps): bump actions/setup-python from 2 to 3 ([#1776](https://github.com/aquasecurity/trivy/issues/1776)) [`a2afd6e`](https://github.com/aquasecurity/trivy/commit/a2afd6e6) chore(deps): bump golangci/golangci-lint-action from 2 to 3.1.0 ([#1777](https://github.com/aquasecurity/trivy/issues/1777)) #### Docker images - `docker pull aquasec/trivy:0.24.2` - `docker pull ghcr.io/aquasecurity/trivy:0.24.2` - `docker pull public.ecr.aws/aquasecurity/trivy:0.24.2` ### [`v0.24.1`](https://github.com/aquasecurity/trivy/releases/tag/v0.24.1) #### Changelog [`a423b99`](https://github.com/aquasecurity/trivy/commit/a423b993) fix(python): correct handling pip package names with a hyphen ([#1771](https://github.com/aquasecurity/trivy/issues/1771)) [`a069ad7`](https://github.com/aquasecurity/trivy/commit/a069ad78) doc(docker): fix command to run trivy with docker on linux ([#1761](https://github.com/aquasecurity/trivy/issues/1761)) [`015055e`](https://github.com/aquasecurity/trivy/commit/015055e1) feat(helm): Add support for custom labels ([#1767](https://github.com/aquasecurity/trivy/issues/1767)) [`cbaa363`](https://github.com/aquasecurity/trivy/commit/cbaa3639) chore(helm): bump chart to trivy 0.24.0 ([#1762](https://github.com/aquasecurity/trivy/issues/1762)) [`bec02f0`](https://github.com/aquasecurity/trivy/commit/bec02f09) docs: remove erroneous command ([#1763](https://github.com/aquasecurity/trivy/issues/1763)) #### Docker images - `docker pull aquasec/trivy:0.24.1` - `docker pull ghcr.io/aquasecurity/trivy:0.24.1` - `docker pull public.ecr.aws/aquasecurity/trivy:0.24.1` ### [`v0.24.0`](https://github.com/aquasecurity/trivy/releases/tag/v0.24.0) #### Changelog [`d7f8b92`](https://github.com/aquasecurity/trivy/commit/d7f8b92a) chore(deps): bump github.com/spf13/afero from 1.6.0 to 1.8.1 ([#1708](https://github.com/aquasecurity/trivy/issues/1708)) [`59ea0d5`](https://github.com/aquasecurity/trivy/commit/59ea0d57) fix(option): warn list-all-pkgs only with the table format ([#1755](https://github.com/aquasecurity/trivy/issues/1755)) [`c788676`](https://github.com/aquasecurity/trivy/commit/c788676f) feat(option): warn "--list-all-pkgs" with "--format table" ([#1632](https://github.com/aquasecurity/trivy/issues/1632)) [`58ade46`](https://github.com/aquasecurity/trivy/commit/58ade462) feat(report): add support for CycloneDX ([#1081](https://github.com/aquasecurity/trivy/issues/1081)) [`77cab6e`](https://github.com/aquasecurity/trivy/commit/77cab6e0) chore(deps): update the defsec and tfsec versions ([#1747](https://github.com/aquasecurity/trivy/issues/1747)) [`2ede15d`](https://github.com/aquasecurity/trivy/commit/2ede15d3) fix(scanner): fix skip of language-specific files when scanning rootf… ([#1751](https://github.com/aquasecurity/trivy/issues/1751)) [`d266c74`](https://github.com/aquasecurity/trivy/commit/d266c749) chore(deps): bump github.com/google/wire from 0.4.0 to 0.5.0 ([#1712](https://github.com/aquasecurity/trivy/issues/1712)) [`4423396`](https://github.com/aquasecurity/trivy/commit/4423396b) feat(report): considering App.Writer when printing results ([#1722](https://github.com/aquasecurity/trivy/issues/1722)) [`356ae30`](https://github.com/aquasecurity/trivy/commit/356ae30c) chore(deps): replace `satori` version and skipping examples folder ([#1745](https://github.com/aquasecurity/trivy/issues/1745)) [`477dc7d`](https://github.com/aquasecurity/trivy/commit/477dc7d5) build: add s390x container images ([#1726](https://github.com/aquasecurity/trivy/issues/1726)) [`89b8d7f`](https://github.com/aquasecurity/trivy/commit/89b8d7ff) feat(template) Add misconfigurations to junit report ([#1724](https://github.com/aquasecurity/trivy/issues/1724)) [`219b71b`](https://github.com/aquasecurity/trivy/commit/219b71b4) chore(deps): bump github.com/twitchtv/twirp ([#1709](https://github.com/aquasecurity/trivy/issues/1709)) [`aa6e1eb`](https://github.com/aquasecurity/trivy/commit/aa6e1eb6) feat(client): configure TLS InsecureSkipVerify for server connection ([#1287](https://github.com/aquasecurity/trivy/issues/1287)) [`de6c3cb`](https://github.com/aquasecurity/trivy/commit/de6c3cbb) fix(rpc): Supports RPC calls for new identifier CustomResource ([#1605](https://github.com/aquasecurity/trivy/issues/1605)) [`b7d4d1e`](https://github.com/aquasecurity/trivy/commit/b7d4d1ea) chore(deps): bump go.uber.org/zap from 1.20.0 to 1.21.0 ([#1705](https://github.com/aquasecurity/trivy/issues/1705)) [`e6c029d`](https://github.com/aquasecurity/trivy/commit/e6c029d0) chore(deps): bump github.com/caarlos0/env/v6 from 6.0.0 to 6.9.1 ([#1707](https://github.com/aquasecurity/trivy/issues/1707)) [`ec6cb1a`](https://github.com/aquasecurity/trivy/commit/ec6cb1a6) feat(helm): Parameterise ServiceAccount annotations ([#1677](https://github.com/aquasecurity/trivy/issues/1677)) [`7dfc16c`](https://github.com/aquasecurity/trivy/commit/7dfc16cf) chore(deps): bump github.com/hashicorp/go-getter from 1.5.2 to 1.5.11 ([#1710](https://github.com/aquasecurity/trivy/issues/1710)) [`42d8fd6`](https://github.com/aquasecurity/trivy/commit/42d8fd66) chore(deps): bump github.com/cheggaaa/pb/v3 from 3.0.3 to 3.0.8 ([#1704](https://github.com/aquasecurity/trivy/issues/1704)) [`c3ef203`](https://github.com/aquasecurity/trivy/commit/c3ef2035) chore(deps): bump github.com/open-policy-agent/opa from 0.36.1 to 0.37.2 ([#1711](https://github.com/aquasecurity/trivy/issues/1711)) [`274103e`](https://github.com/aquasecurity/trivy/commit/274103e8) chore(dependabot): enable gomod monthly ([#1699](https://github.com/aquasecurity/trivy/issues/1699)) [`e618d83`](https://github.com/aquasecurity/trivy/commit/e618d83d) fix(gitlab tpl): escape double quote ([#1635](https://github.com/aquasecurity/trivy/issues/1635)) [`3b0b2ed`](https://github.com/aquasecurity/trivy/commit/3b0b2ed4) build: Make `make protoc` be consistent ([#1682](https://github.com/aquasecurity/trivy/issues/1682)) [`5c8d098`](https://github.com/aquasecurity/trivy/commit/5c8d0983) feat(purl): add generate purl package utilities ([#1574](https://github.com/aquasecurity/trivy/issues/1574)) [`11f4f81`](https://github.com/aquasecurity/trivy/commit/11f4f811) refactor: move result structs under types ([#1696](https://github.com/aquasecurity/trivy/issues/1696)) [`6db2092`](https://github.com/aquasecurity/trivy/commit/6db2092c) feat(mariner): add support for CBL-Mariner 2.0 ([#1694](https://github.com/aquasecurity/trivy/issues/1694)) [`8898bb0`](https://github.com/aquasecurity/trivy/commit/8898bb09) docs(gitlab-ci): fix Script in GitLab CI Example [#1688](https://github.com/aquasecurity/trivy/issues/1688) [`33d0833`](https://github.com/aquasecurity/trivy/commit/33d08337) chore: Upgrade helm chart version ([#1683](https://github.com/aquasecurity/trivy/issues/1683)) [`13874d8`](https://github.com/aquasecurity/trivy/commit/13874d86) chore(mod): update Go dependencies ([#1681](https://github.com/aquasecurity/trivy/issues/1681)) [`f26a06b`](https://github.com/aquasecurity/trivy/commit/f26a06b9) docs: fix typos in markdown docs ([#1674](https://github.com/aquasecurity/trivy/issues/1674)) [`e2821a4`](https://github.com/aquasecurity/trivy/commit/e2821a4f) docs: update documentation for image scanning of tar files to use a tag present on Docker Hub ([#1671](https://github.com/aquasecurity/trivy/issues/1671)) [`ef8a1af`](https://github.com/aquasecurity/trivy/commit/ef8a1afc) fix(repo): --no-progress suppresses git output ([#1669](https://github.com/aquasecurity/trivy/issues/1669)) #### Docker images - `docker pull aquasec/trivy:0.24.0` - `docker pull ghcr.io/aquasecurity/trivy:0.24.0` - `docker pull public.ecr.aws/aquasecurity/trivy:0.24.0` ### [`v0.23.0`](https://github.com/aquasecurity/trivy/releases/tag/v0.23.0) #### Changelog [`449add2`](https://github.com/aquasecurity/trivy/commit/449add24) docs: add ACR navigator ([#1651](https://github.com/aquasecurity/trivy/issues/1651)) [`cb9afc8`](https://github.com/aquasecurity/trivy/commit/cb9afc84) fix: update example Rego files and docs ([#1628](https://github.com/aquasecurity/trivy/issues/1628)) [`78b2b89`](https://github.com/aquasecurity/trivy/commit/78b2b899) feat(option): show a link to GitHub Discussions for --light deprecation ([#1650](https://github.com/aquasecurity/trivy/issues/1650)) [`52fd3c2`](https://github.com/aquasecurity/trivy/commit/52fd3c2e) fix(sarif): fix the warning message ([#1647](https://github.com/aquasecurity/trivy/issues/1647)) [`8d5882b`](https://github.com/aquasecurity/trivy/commit/8d5882be) refactor: migrate to prefixed buckets ([#1644](https://github.com/aquasecurity/trivy/issues/1644)) [`84dd33f`](https://github.com/aquasecurity/trivy/commit/84dd33f7) feat(mariner): add support for CBL-Mariner ([#1640](https://github.com/aquasecurity/trivy/issues/1640)) [`9e903a1`](https://github.com/aquasecurity/trivy/commit/9e903a1d) docs: commercial use available ([#1641](https://github.com/aquasecurity/trivy/issues/1641)) [`f4c746a`](https://github.com/aquasecurity/trivy/commit/f4c746a2) feat: support azure acr ([#1611](https://github.com/aquasecurity/trivy/issues/1611)) [`420f8ab`](https://github.com/aquasecurity/trivy/commit/420f8ab1) feat(os-pkg): add data sources ([#1636](https://github.com/aquasecurity/trivy/issues/1636)) [`d2827cb`](https://github.com/aquasecurity/trivy/commit/d2827cba) feat(redhat): support build info in RHEL ([#807](https://github.com/aquasecurity/trivy/issues/807)) [`ce703ce`](https://github.com/aquasecurity/trivy/commit/ce703ce4) fix: change links in pull\_request\_template to static URLs ([#1634](https://github.com/aquasecurity/trivy/issues/1634)) [`50bb938`](https://github.com/aquasecurity/trivy/commit/50bb938a) feat(lang-pkg): add data sources ([#1625](https://github.com/aquasecurity/trivy/issues/1625)) [`a31ddbe`](https://github.com/aquasecurity/trivy/commit/a31ddbe9) feat(detector): support custom detector ([#1615](https://github.com/aquasecurity/trivy/issues/1615)) [`3a4e18a`](https://github.com/aquasecurity/trivy/commit/3a4e18ac) docs(contribution): change role who should resolve comments ([#1618](https://github.com/aquasecurity/trivy/issues/1618)) [`8ba6836`](https://github.com/aquasecurity/trivy/commit/8ba68361) docs: add PR template ([#1602](https://github.com/aquasecurity/trivy/issues/1602)) [`f5c5573`](https://github.com/aquasecurity/trivy/commit/f5c55739) feat(rocky): support Rocky Linux ([#1570](https://github.com/aquasecurity/trivy/issues/1570)) [`eab2b42`](https://github.com/aquasecurity/trivy/commit/eab2b425) Add the ability to set dockerhub credentials in the helm chart ([#1569](https://github.com/aquasecurity/trivy/issues/1569)) [`cabd18d`](https://github.com/aquasecurity/trivy/commit/cabd18da) feat(cache): redis TLS support ([#1297](https://github.com/aquasecurity/trivy/issues/1297)) [`02c3c36`](https://github.com/aquasecurity/trivy/commit/02c3c365) feat(java): add support for PAR files ([#1599](https://github.com/aquasecurity/trivy/issues/1599)) [`4f7b768`](https://github.com/aquasecurity/trivy/commit/4f7b7683) refactor(rust): move rust-advisory-db to OSV ([#1591](https://github.com/aquasecurity/trivy/issues/1591)) [`d754cb8`](https://github.com/aquasecurity/trivy/commit/d754cb8c) feat: log ignored vulnerabilities on debug ([#1378](https://github.com/aquasecurity/trivy/issues/1378)) [`a936e67`](https://github.com/aquasecurity/trivy/commit/a936e675) chore(mod): hcl2json deps update ([#1585](https://github.com/aquasecurity/trivy/issues/1585)) [`af116d3`](https://github.com/aquasecurity/trivy/commit/af116d3c) fix(rpm): do not ignore installed files via third-party rpm ([#1594](https://github.com/aquasecurity/trivy/issues/1594)) [`b507360`](https://github.com/aquasecurity/trivy/commit/b5073600) feat(fs): allow scanning a single file ([#1578](https://github.com/aquasecurity/trivy/issues/1578)) [`7fcbf44`](https://github.com/aquasecurity/trivy/commit/7fcbf44b) refactor(python): drop Safety DB ([#1580](https://github.com/aquasecurity/trivy/issues/1580)) [`478d279`](https://github.com/aquasecurity/trivy/commit/478d2799) feat: added insecure tls skip to scan git repo ([#1528](https://github.com/aquasecurity/trivy/issues/1528)) [`33bd41b`](https://github.com/aquasecurity/trivy/commit/33bd41b4) Supress git clone output ([#1590](https://github.com/aquasecurity/trivy/issues/1590)) [`39a1008`](https://github.com/aquasecurity/trivy/commit/39a10089) fix(alma): skip modular package because MODULARITYLABEL is not set ([#1588](https://github.com/aquasecurity/trivy/issues/1588)) [`37abd61`](https://github.com/aquasecurity/trivy/commit/37abd612) feat(photon os): added EOL dates check ([#1587](https://github.com/aquasecurity/trivy/issues/1587)) [`78de33e`](https://github.com/aquasecurity/trivy/commit/78de33e8) docs: update supported os ([#1586](https://github.com/aquasecurity/trivy/issues/1586)) [`2205462`](https://github.com/aquasecurity/trivy/commit/22054626) BREAKING: remove root command ([#1579](https://github.com/aquasecurity/trivy/issues/1579)) [`28ddcf1`](https://github.com/aquasecurity/trivy/commit/28ddcf1a) docs: add Rust to Language-specific Packages Table ([#1577](https://github.com/aquasecurity/trivy/issues/1577)) [`df134c7`](https://github.com/aquasecurity/trivy/commit/df134c73) docs: update int doc for gitlab ci ([#1575](https://github.com/aquasecurity/trivy/issues/1575)) [`8da20c8`](https://github.com/aquasecurity/trivy/commit/8da20c8c) BREAKING: migrate the sarif template to Go code ([#1437](https://github.com/aquasecurity/trivy/issues/1437)) [`714b5ca`](https://github.com/aquasecurity/trivy/commit/714b5ca2) refactor: remove unused field ([#1567](https://github.com/aquasecurity/trivy/issues/1567)) [`51e152b`](https://github.com/aquasecurity/trivy/commit/51e152b0) chore(deps): bump helm/chart-testing-action from 2.1.0 to 2.2.0 ([#1554](https://github.com/aquasecurity/trivy/issues/1554)) [`884daff`](https://github.com/aquasecurity/trivy/commit/884daff4) docs: gitlab integration ([#1381](https://github.com/aquasecurity/trivy/issues/1381)) [`2a8336b`](https://github.com/aquasecurity/trivy/commit/2a8336b9) feat(alma): support AlmaLinux ([#1238](https://github.com/aquasecurity/trivy/issues/1238)) [`1e171af`](https://github.com/aquasecurity/trivy/commit/1e171af1) docs: added note about default template path when Trivy installed using rpm ([#1551](https://github.com/aquasecurity/trivy/issues/1551)) [`e65274e`](https://github.com/aquasecurity/trivy/commit/e65274e0) BREAKING: Trivy DB from GHCR ([#1539](https://github.com/aquasecurity/trivy/issues/1539)) [`db35450`](https://github.com/aquasecurity/trivy/commit/db35450b) feat(cli): Do not set default commands when a plugin is being run ([#1549](https://github.com/aquasecurity/trivy/issues/1549)) [`24254d1`](https://github.com/aquasecurity/trivy/commit/24254d19) fix: add fingerprint field to codequality template ([#1541](https://github.com/aquasecurity/trivy/issues/1541)) [`2ee0745`](https://github.com/aquasecurity/trivy/commit/2ee07456) fix(image): correct handling of uncompressed layers ([#1544](https://github.com/aquasecurity/trivy/issues/1544)) [`0aef82c`](https://github.com/aquasecurity/trivy/commit/0aef82c5) chore: helm chart app version 0.22.0 ([#1535](https://github.com/aquasecurity/trivy/issues/1535)) [`8b2a799`](https://github.com/aquasecurity/trivy/commit/8b2a7997) test(integration): use fixtures ([#1532](https://github.com/aquasecurity/trivy/issues/1532)) #### Docker images - `docker pull aquasec/trivy:0.23.0` - `docker pull ghcr.io/aquasecurity/trivy:0.23.0` - `docker pull public.ecr.aws/aquasecurity/trivy:0.23.0` ### [`v0.22.0`](https://github.com/aquasecurity/trivy/releases/tag/v0.22.0) #### Changelog [`42f795f`](https://github.com/aquasecurity/trivy/commit/42f795fa) fix(java/pom): ignore unsupported requirements ([#1514](https://github.com/aquasecurity/trivy/issues/1514)) [`8f737cc`](https://github.com/aquasecurity/trivy/commit/8f737cc6) feat(cli): warning for root command ([#1516](https://github.com/aquasecurity/trivy/issues/1516)) [`76249bd`](https://github.com/aquasecurity/trivy/commit/76249bdc) BREAKING: disable JAR detection in fs/repo scanning ([#1512](https://github.com/aquasecurity/trivy/issues/1512)) [`59957d4`](https://github.com/aquasecurity/trivy/commit/59957d4c) feat(scan): support --offline-scan option ([#1511](https://github.com/aquasecurity/trivy/issues/1511)) [`da8b72d`](https://github.com/aquasecurity/trivy/commit/da8b72d2) fix: improve memory usage ([#1509](https://github.com/aquasecurity/trivy/issues/1509)) [`b713ad0`](https://github.com/aquasecurity/trivy/commit/b713ad0f) feat(java): support pom.xml ([#1501](https://github.com/aquasecurity/trivy/issues/1501)) [`56115e9`](https://github.com/aquasecurity/trivy/commit/56115e9d) docs: fixing rust link to security advisory ([#1504](https://github.com/aquasecurity/trivy/issues/1504)) [`7f859af`](https://github.com/aquasecurity/trivy/commit/7f859afa) Add missing IacMetdata ([#1505](https://github.com/aquasecurity/trivy/issues/1505)) [`628a796`](https://github.com/aquasecurity/trivy/commit/628a7964) feat(jar): add file path ([#1498](https://github.com/aquasecurity/trivy/issues/1498)) [`82fba77`](https://github.com/aquasecurity/trivy/commit/82fba771) feat(rpm): support NDB ([#1497](https://github.com/aquasecurity/trivy/issues/1497)) [`d5269da`](https://github.com/aquasecurity/trivy/commit/d5269da5) feat: added misconfiguration field for html.tpl ([#1444](https://github.com/aquasecurity/trivy/issues/1444)) #### Docker images - `docker pull aquasec/trivy:0.22.0` - `docker pull ghcr.io/aquasecurity/trivy:0.22.0` - `docker pull public.ecr.aws/aquasecurity/trivy:0.22.0` ### [`v0.21.2`](https://github.com/aquasecurity/trivy/releases/tag/v0.21.2) #### Changelog [`7beed30`](https://github.com/aquasecurity/trivy/commit/7beed301) docs: provide more information on scanning Google's GCR ([#1426](https://github.com/aquasecurity/trivy/issues/1426)) [`f50e1f4`](https://github.com/aquasecurity/trivy/commit/f50e1f42) docs(misconfiguration): added instruction for misconfiguration detection ([#1428](https://github.com/aquasecurity/trivy/issues/1428)) [`3ae4de5`](https://github.com/aquasecurity/trivy/commit/3ae4de58) Update git-repository.md ([#1430](https://github.com/aquasecurity/trivy/issues/1430)) [`6e35b8f`](https://github.com/aquasecurity/trivy/commit/6e35b8f5) fix(hooks): exclude unrelated lib types from system files filtering ([#1431](https://github.com/aquasecurity/trivy/issues/1431)) [`beb60b0`](https://github.com/aquasecurity/trivy/commit/beb60b05) chore: run `go fmt` ([#1429](https://github.com/aquasecurity/trivy/issues/1429)) [`582e7fd`](https://github.com/aquasecurity/trivy/commit/582e7fd1) fix(sarif): change `help` field in the sarif template. ([#1423](https://github.com/aquasecurity/trivy/issues/1423)) [`11bc290`](https://github.com/aquasecurity/trivy/commit/11bc2901) Update fanal with cfsec version update ([#1425](https://github.com/aquasecurity/trivy/issues/1425)) [`392f689`](https://github.com/aquasecurity/trivy/commit/392f6892) Replace deprecated option in goreleaser ([#1406](https://github.com/aquasecurity/trivy/issues/1406)) [`101d576`](https://github.com/aquasecurity/trivy/commit/101d5760) feat(alpine): support 3.15 ([#1422](https://github.com/aquasecurity/trivy/issues/1422)) [`bd3ba68`](https://github.com/aquasecurity/trivy/commit/bd3ba68c) chore: test the helm chart in the PR and used the commit hash ([#1414](https://github.com/aquasecurity/trivy/issues/1414)) [`3860d6e`](https://github.com/aquasecurity/trivy/commit/3860d6e4) chore(deps): bump alpine from 3.14 to 3.15.0 ([#1417](https://github.com/aquasecurity/trivy/issues/1417)) [`4f82673`](https://github.com/aquasecurity/trivy/commit/4f82673a) chore(release): add ubuntu older versions to deploy script ([#1416](https://github.com/aquasecurity/trivy/issues/1416)) #### Docker images - `docker pull aquasec/trivy:0.21.2` - `docker pull ghcr.io/aquasecurity/trivy:0.21.2` - `docker pull public.ecr.aws/aquasecurity/trivy:0.21.2` ### [`v0.21.1`](https://github.com/aquasecurity/trivy/releases/tag/v0.21.1) #### Changelog [`b9a51de`](https://github.com/aquasecurity/trivy/commit/b9a51de8) chore(mod): tidy ([#1415](https://github.com/aquasecurity/trivy/issues/1415)) [`7f24834`](https://github.com/aquasecurity/trivy/commit/7f248341) fix(rpc): fix nil layer transmit ([#1410](https://github.com/aquasecurity/trivy/issues/1410)) [`af3eaef`](https://github.com/aquasecurity/trivy/commit/af3eaefd) Lang advisory order ([#1409](https://github.com/aquasecurity/trivy/issues/1409)) [`07c9200`](https://github.com/aquasecurity/trivy/commit/07c9200e) chore: add support for s390x arch ([#1304](https://github.com/aquasecurity/trivy/issues/1304)) [`8bc8a4a`](https://github.com/aquasecurity/trivy/commit/8bc8a4ad) fix(chart): ingress helm manifest-update trivy image ([#1323](https://github.com/aquasecurity/trivy/issues/1323)) [`9076a49`](https://github.com/aquasecurity/trivy/commit/9076a49b) docs: Add comparison for cfsec ([#1388](https://github.com/aquasecurity/trivy/issues/1388)) [`bb316d9`](https://github.com/aquasecurity/trivy/commit/bb316d93) remove: delete unused functions in utils package ([#1379](https://github.com/aquasecurity/trivy/issues/1379)) #### Docker images - `docker pull aquasec/trivy:0.21.1` - `docker pull ghcr.io/aquasecurity/trivy:0.21.1` - `docker pull public.ecr.aws/aquasecurity/trivy:0.21.1` ### [`v0.21.0`](https://github.com/aquasecurity/trivy/releases/tag/v0.21.0) #### Changelog [`efdb29d`](https://github.com/aquasecurity/trivy/commit/efdb29d) fix(sarif): fix validation errors ([#1376](https://github.com/aquasecurity/trivy/issues/1376)) [`9bcf9e7`](https://github.com/aquasecurity/trivy/commit/9bcf9e7) docs: add Bitbucket Pipelines ([#1374](https://github.com/aquasecurity/trivy/issues/1374)) [`3147097`](https://github.com/aquasecurity/trivy/commit/3147097) docs: add community integrations ([#1361](https://github.com/aquasecurity/trivy/issues/1361)) [`33f74b3`](https://github.com/aquasecurity/trivy/commit/33f74b3) Use a stable SARIF identifier ([#1230](https://github.com/aquasecurity/trivy/issues/1230)) [`5915ffb`](https://github.com/aquasecurity/trivy/commit/5915ffb) fix(python): fix parsing of requirements.txt with hash checking mode available in pip since version 8.0 [`ae4c42b`](https://github.com/aquasecurity/trivy/commit/ae4c42b) feat(iac): Add line information ([#1366](https://github.com/aquasecurity/trivy/issues/1366)) [`19747d0`](https://github.com/aquasecurity/trivy/commit/19747d0) feat(cloudformation): Adding support for cfsec IaC scanning ([#1360](https://github.com/aquasecurity/trivy/issues/1360)) [`da45061`](https://github.com/aquasecurity/trivy/commit/da45061) chore: send debug and info logs to stdout in install.sh, not stderr. ([#1264](https://github.com/aquasecurity/trivy/issues/1264)) [`cb1a4ed`](https://github.com/aquasecurity/trivy/commit/cb1a4ed) Update containerd to v1.5.7 and docker-cli to v20.10.9 ([#1356](https://github.com/aquasecurity/trivy/issues/1356)) [`69dae54`](https://github.com/aquasecurity/trivy/commit/69dae54) chore: update SBOM generation ([#1349](https://github.com/aquasecurity/trivy/issues/1349)) #### Docker images - `docker pull aquasec/trivy:0.21.0` - `docker pull ghcr.io/aquasecurity/trivy:0.21.0` - `docker pull public.ecr.aws/aquasecurity/trivy:0.21.0` ### [`v0.20.2`](https://github.com/aquasecurity/trivy/releases/tag/v0.20.2) #### Changelog [`5dc8cfe`](https://github.com/aquasecurity/trivy/commit/5dc8cfe) docs: update builtin.md ([#1335](https://github.com/aquasecurity/trivy/issues/1335)) [`798b564`](https://github.com/aquasecurity/trivy/commit/798b564) chore: fix issues with Homebrew formula ([#1329](https://github.com/aquasecurity/trivy/issues/1329)) [`21bf5e5`](https://github.com/aquasecurity/trivy/commit/21bf5e5) chore: bump GoReleaser to v0.183.0 ([#1328](https://github.com/aquasecurity/trivy/issues/1328)) [`e0f4ebd`](https://github.com/aquasecurity/trivy/commit/e0f4ebd) docs: update iac.md for a typo ([#1326](https://github.com/aquasecurity/trivy/issues/1326)) [`23a9a5e`](https://github.com/aquasecurity/trivy/commit/23a9a5e) docs: typo fix ([#1308](https://github.com/aquasecurity/trivy/issues/1308)) [`1f5d17f`](https://github.com/aquasecurity/trivy/commit/1f5d17f) Add new networking API features to Ingress ([#1262](https://github.com/aquasecurity/trivy/issues/1262)) #### Docker images - `docker pull aquasec/trivy:0.20.2` - `docker pull ghcr.io/aquasecurity/trivy:0.20.2` - `docker pull public.ecr.aws/aquasecurity/trivy:0.20.2` ### [`v0.19.2`](https://github.com/aquasecurity/trivy/releases/tag/v0.19.2) #### Changelog [`f3f3029`](https://github.com/aquasecurity/trivy/commit/f3f3029) Updated the Alpine Image to 3.14 (latest) ([#1130](https://github.com/aquasecurity/trivy/issues/1130)) [`0e52fde`](https://github.com/aquasecurity/trivy/commit/0e52fde) Added EOL for Ubuntu 21.10 ([#1131](https://github.com/aquasecurity/trivy/issues/1131)) [`9b3fba0`](https://github.com/aquasecurity/trivy/commit/9b3fba0) fix(image): disabled scanning of config files within container images ([#1133](https://github.com/aquasecurity/trivy/issues/1133)) [`1101634`](https://github.com/aquasecurity/trivy/commit/1101634) docs: fixed typo ([#1124](https://github.com/aquasecurity/trivy/issues/1124)) [`499b7a6`](https://github.com/aquasecurity/trivy/commit/499b7a6) update cyclonedx github action to v0.3.0 ([#1127](https://github.com/aquasecurity/trivy/issues/1127)) #### Docker images - `docker pull aquasec/trivy:0.19.2` - `docker pull ghcr.io/aquasecurity/trivy:0.19.2` - `docker pull public.ecr.aws/aquasecurity/trivy:0.19.2` - `docker pull aquasec/trivy:latest` - `docker pull ghcr.io/aquasecurity/trivy:latest` - `docker pull public.ecr.aws/aquasecurity/trivy:latest` ### [`v0.19.1`](https://github.com/aquasecurity/trivy/releases/tag/v0.19.1) #### Changelog [`cea9b0b`](https://github.com/aquasecurity/trivy/commit/cea9b0b) fix(policy): fix panic on the first run ([#1116](https://github.com/aquasecurity/trivy/issues/1116)) #### Docker images - `docker pull aquasec/trivy:0.19.1` - `docker pull ghcr.io/aquasecurity/trivy:0.19.1` - `docker pull public.ecr.aws/aquasecurity/trivy:0.19.1` - `docker pull aquasec/trivy:latest` - `docker pull ghcr.io/aquasecurity/trivy:latest` - `docker pull public.ecr.aws/aquasecurity/trivy:latest` ### [`v0.18.3`](https://github.com/aquasecurity/trivy/releases/tag/v0.18.3) #### Changelog [`85e45ca`](https://github.com/aquasecurity/trivy/commit/85e45ca) chore(ci): change to more granular tokens ([#1014](https://github.com/aquasecurity/trivy/issues/1014)) [`9fa512a`](https://github.com/aquasecurity/trivy/commit/9fa512a) chore(ci): add Go scanning and update dependencies ([#1001](https://github.com/aquasecurity/trivy/issues/1001)) [`349371b`](https://github.com/aquasecurity/trivy/commit/349371b) docs: Add HIGH severity to Trivy command in GitLab CI example to match comment ([#1013](https://github.com/aquasecurity/trivy/issues/1013)) #### Docker images - `docker pull aquasec/trivy:0.18.3` - `docker pull ghcr.io/aquasecurity/trivy:0.18.3` - `docker pull public.ecr.aws/aquasecurity/trivy:0.18.3` - `docker pull aquasec/trivy:latest` - `docker pull ghcr.io/aquasecurity/trivy:latest` - `docker pull public.ecr.aws/aquasecurity/trivy:latest` ### [`v0.18.2`](https://github.com/aquasecurity/trivy/releases/tag/v0.18.2) #### Changelog [`4446961`](https://github.com/aquasecurity/trivy/commit/4446961) fix(image): disable go.sum scanning ([#1007](https://github.com/aquasecurity/trivy/issues/1007)) [`04473ad`](https://github.com/aquasecurity/trivy/commit/04473ad) fix(gomod): handle go.sum with an empty line ([#1006](https://github.com/aquasecurity/trivy/issues/1006)) [`1b66b77`](https://github.com/aquasecurity/trivy/commit/1b66b77) feat: prepare for config scanning ([#1005](https://github.com/aquasecurity/trivy/issues/1005)) [`8fc6ea6`](https://github.com/aquasecurity/trivy/commit/8fc6ea6) Clarify that dev dependencies are excluded ([#986](https://github.com/aquasecurity/trivy/issues/986)) #### Docker images - `docker pull aquasec/trivy:0.18.2` - `docker pull ghcr.io/aquasecurity/trivy:0.18.2` - `docker pull public.ecr.aws/aquasecurity/trivy:0.18.2` - `docker pull aquasec/trivy:latest` - `docker pull ghcr.io/aquasecurity/trivy:latest` - `docker pull public.ecr.aws/aquasecurity/trivy:latest` ### [`v0.18.1`](https://github.com/aquasecurity/trivy/releases/tag/v0.18.1) #### Changelog [`eaf2da2`](https://github.com/aquasecurity/trivy/commit/eaf2da2) Include target value in Sarif template ruleID ([#991](https://github.com/aquasecurity/trivy/issues/991)) [`083c157`](https://github.com/aquasecurity/trivy/commit/083c157) chore(mkdocs): allow workflow\_dispatch ([#989](https://github.com/aquasecurity/trivy/issues/989)) #### Docker images - `docker pull aquasec/trivy:0.18.1` - `docker pull ghcr.io/aquasecurity/trivy:0.18.1` - `docker pull public.ecr.aws/aquasecurity/trivy:0.18.1` - `docker pull aquasec/trivy:latest` - `docker pull ghcr.io/aquasecurity/trivy:latest` - `docker pull public.ecr.aws/aquasecurity/trivy:latest` ### [`v0.18.0`](https://github.com/aquasecurity/trivy/releases/tag/v0.18.0) #### Release Note <https://github.com/aquasecurity/trivy/discussions/990> #### Changelog [`e26e39a`](https://github.com/aquasecurity/trivy/commit/e26e39a) fix(vuln) unique vulnerabilities from different data sources ([#984](https://github.com/aquasecurity/trivy/issues/984)) [`04e7cca`](https://github.com/aquasecurity/trivy/commit/04e7cca) feat(go): added support of gomod analyzer ([#978](https://github.com/aquasecurity/trivy/issues/978)) #### Docker images - `docker pull aquasec/trivy:0.18.0` - `docker pull ghcr.io/aquasecurity/trivy:0.18.0` - `docker pull public.ecr.aws/aquasecurity/trivy:0.18.0` - `docker pull aquasec/trivy:latest` - `docker pull ghcr.io/aquasecurity/trivy:latest` - `docker pull public.ecr.aws/aquasecurity/trivy:latest` ### [`v0.17.2`](https://github.com/aquasecurity/trivy/releases/tag/v0.17.2) #### Changelog [`415e1d8`](https://github.com/aquasecurity/trivy/commit/415e1d8) fix: scan only regular files ([#976](https://github.com/aquasecurity/trivy/issues/976)) [`3bb8852`](https://github.com/aquasecurity/trivy/commit/3bb8852) docs: mention upx binaries ([#974](https://github.com/aquasecurity/trivy/issues/974)) [`c0fddd9`](https://github.com/aquasecurity/trivy/commit/c0fddd9) chore: upgrade alpine to fix git and libcurl vulnerabilities in trivy docker image scan ([#971](https://github.com/aquasecurity/trivy/issues/971)) #### Docker images - `docker pull aquasec/trivy:0.17.2` - `docker pull ghcr.io/aquasecurity/trivy:0.17.2` - `docker pull public.ecr.aws/aquasecurity/trivy:0.17.2` - `docker pull aquasec/trivy:latest` - `docker pull ghcr.io/aquasecurity/trivy:latest` - `docker pull public.ecr.aws/aquasecurity/trivy:latest` ### [`v0.17.1`](https://github.com/aquasecurity/trivy/releases/tag/v0.17.1) #### Changelog [`41c066d`](https://github.com/aquasecurity/trivy/commit/41c066d) fix(fs): skip dirs ([#969](https://github.com/aquasecurity/trivy/issues/969)) #### Docker images - `docker pull aquasec/trivy:0.17.1` - `docker pull ghcr.io/aquasecurity/trivy:0.17.1` - `docker pull public.ecr.aws/aquasecurity/trivy:0.17.1` - `docker pull aquasec/trivy:latest` - `docker pull ghcr.io/aquasecurity/trivy:latest` - `docker pull public.ecr.aws/aquasecurity/trivy:latest` ### [`v0.16.0`](https://github.com/aquasecurity/trivy/releases/tag/v0.16.0) #### Features ##### Support Podman ([#825](https://github.com/aquasecurity/trivy/issues/825)) \[EXPERIMENTAL] This feature might change without preserving backwards compatibility. Scan your image in Podman (>=2.0) running locally. The remote Podman is not supported. Before performing Trivy commands, you must enable the podman.sock systemd service on your machine. For more details, see here ``` $ systemctl --user enable --now podman.socket ``` Then, you can scan your image in Podman. ``` $ cat Dockerfile FROM alpine:3.12 RUN apk add --no-cache bash $ podman build -t test . $ podman images REPOSITORY TAG IMAGE ID CREATED SIZE localhost/test latest efc372d4e0de About a minute ago 7.94 MB $ trivy image test ``` ##### Support modular packages in RHEL 8/CentOS 8 ([#790](https://github.com/aquasecurity/trivy/issues/790)) Trivy is able to scan RHEL 8/CentOS 8 more accurately now. ##### Add redis cache backend configuration options in the Helm chart ([#784](https://github.com/aquasecurity/trivy/issues/784)) Trivy can be deployed to Kubernetes with Redis cache. Thanks, [@czunker](https://github.com/czunker)! ##### Support PEP 440 ([#816](https://github.com/aquasecurity/trivy/issues/816)) Trivy is able to scan Python vulnerabilities more accurately now. ##### Support alpine 3.13 ([#819](https://github.com/aquasecurity/trivy/issues/819)) Trivy is able to scan Alpine Linux 3.13 now. #### Fixes - Fix compatibility for Jenkins xunit plugin ([#820](https://github.com/aquasecurity/trivy/issues/820)) - Update EOL dates ([#824](https://github.com/aquasecurity/trivy/issues/824)) - Parse redis backend url ([#804](https://github.com/aquasecurity/trivy/issues/804)) - Fix errors in SARIF format ([#801](https://github.com/aquasecurity/trivy/issues/801)) - Fix env variable for github token ([#796](https://github.com/aquasecurity/trivy/issues/796)) - Set unknown severity for empty values ([#793](https://github.com/aquasecurity/trivy/issues/793)) - Remove global flags from filesystem command ([#772](https://github.com/aquasecurity/trivy/issues/772)) - Fix formatting of log message ([#785](https://github.com/aquasecurity/trivy/issues/785)) #### Changelog [`cdabe7f`](https://github.com/aquasecurity/trivy/commit/cdabe7f) Fix compatibility for Jenkins xunit plugin ([#820](https://github.com/aquasecurity/trivy/issues/820)) [`b0fe439`](https://github.com/aquasecurity/trivy/commit/b0fe439) README: add Gitlab job that uses a container with trivy ([#823](https://github.com/aquasecurity/trivy/issues/823)) [`6685cd4`](https://github.com/aquasecurity/trivy/commit/6685cd4) feat: support Podman ([#825](https://github.com/aquasecurity/trivy/issues/825)) [`7a683bd`](https://github.com/aquasecurity/trivy/commit/7a683bd) fix(eol): update EOL dates ([#824](https://github.com/aquasecurity/trivy/issues/824)) [`6ed03a8`](https://github.com/aquasecurity/trivy/commit/6ed03a8) fix(python): follow PEP 440 ([#816](https://github.com/aquasecurity/trivy/issues/816)) [`182cb80`](https://github.com/aquasecurity/trivy/commit/182cb80) Support alpine 3.13 ([#819](https://github.com/aquasecurity/trivy/issues/819)) [`2acd1ca`](https://github.com/aquasecurity/trivy/commit/2acd1ca) Changed the output string to "Using your github token". ([#814](https://github.com/aquasecurity/trivy/issues/814)) [`dd35bfd`](https://github.com/aquasecurity/trivy/commit/dd35bfd) Align comment with code ([#812](https://github.com/aquasecurity/trivy/issues/812)) [`1f17e71`](https://github.com/aquasecurity/trivy/commit/1f17e71) Parse redis backend url ([#804](https://github.com/aquasecurity/trivy/issues/804)) [`0954f6b`](https://github.com/aquasecurity/trivy/commit/0954f6b) Update README.md ([#810](https://github.com/aquasecurity/trivy/issues/810)) [`6b29bf1`](https://github.com/aquasecurity/trivy/commit/6b29bf1) Added nodeSelector, affinity and tolerations to helm chart ([#803](https://github.com/aquasecurity/trivy/issues/803)) [`f6afdf0`](https://github.com/aquasecurity/trivy/commit/f6afdf0) Fix readme typo in policy flag ([#805](https://github.com/aquasecurity/trivy/issues/805)) [`412847d`](https://github.com/aquasecurity/trivy/commit/412847d) Fix errors in SARIF format ([#801](https://github.com/aquasecurity/trivy/issues/801)) [`5b27862`](https://github.com/aquasecurity/trivy/commit/5b27862) Fix env variable for github token ([#796](https://github.com/aquasecurity/trivy/issues/796)) [`6ed25c1`](https://github.com/aquasecurity/trivy/commit/6ed25c1) fix(vulnerability): set unknown severity for empty values ([#793](https://github.com/aquasecurity/trivy/issues/793)) [`e2c483f`](https://github.com/aquasecurity/trivy/commit/e2c483f) Remove global flags from filesystem command ([#772](https://github.com/aquasecurity/trivy/issues/772)) [`5c5e0cb`](https://github.com/aquasecurity/trivy/commit/5c5e0cb) Add imagePullSecrets to helm Chart ([#789](https://github.com/aquasecurity/trivy/issues/789)) [`b9b84cd`](https://github.com/aquasecurity/trivy/commit/b9b84cd) Add redis cache backend configuration options ([#784](https://github.com/aquasecurity/trivy/issues/784)) [`e517bcc`](https://github.com/aquasecurity/trivy/commit/e517bcc) Update README.md ([#735](https://github.com/aquasecurity/trivy/issues/735)) [`7f5a6d4`](https://github.com/aquasecurity/trivy/commit/7f5a6d4) feat(redhat): support modular packages ([#790](https://github.com/aquasecurity/trivy/issues/790)) [`8de09dd`](https://github.com/aquasecurity/trivy/commit/8de09dd) Fix formatting of log message ([#785](https://github.com/aquasecurity/trivy/issues/785)) [`e08ae8d`](https://github.com/aquasecurity/trivy/commit/e08ae8d) chore(ci): migrate unit tests to GitHub Actions ([#779](https://github.com/aquasecurity/trivy/issues/779)) [`a00d719`](https://github.com/aquasecurity/trivy/commit/a00d719) shifted: brews.github to brews.tap ([#780](https://github.com/aquasecurity/trivy/issues/780)) #### Docker images - `docker pull docker.io/aquasec/trivy:0.16.0` - `docker pull docker.io/aquasec/trivy:latest` - `docker pull ghcr.io/aquasecurity/trivy:0.16.0` - `docker pull ghcr.io/aquasecurity/trivy:latest` ### [`v0.15.0`](https://github.com/aquasecurity/trivy/releases/tag/v0.15.0) #### Features ##### NuGet Scanner ([#686](https://github.com/aquasecurity/trivy/issues/686)) Trivy now supports a lock file `packages.lock.json` of NuGet. ``` packages.lock.json ================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0) +-------------+------------------+----------+-------------------+----------------+--------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +-------------+------------------+----------+-------------------+----------------+--------------------------------------+ | MessagePack | CVE-2020-5234 | MEDIUM | 1.9.10 | 2.1.90, 1.9.11 | Untrusted data can lead to DoS | | | | | | | attack due to hash collisions and... | | | | | | | -->avd.aquasec.com/nvd/cve-2020-5234 | +-------------+------------------+----------+-------------------+----------------+--------------------------------------+ ``` Thanks to [@Johannestegner](https://github.com/Johannestegner) ##### Redis support as the cache backend ([#770](https://github.com/aquasecurity/trivy/issues/770)) For the detail, see [here](https://github.com/aquasecurity/trivy#specify-cache-backend) ``` $ docker run -d --name redis -p 6379:6379 redis:5.0 $ trivy server --cache-backend redis://localhost:6379 ``` ``` $ trivy client alpine:3.11 ``` ##### HTML template ([#567](https://github.com/aquasecurity/trivy/issues/567)) ``` $ trivy image -f template --template "@contrib/html.tpl" -o report.html alpine:3.12 ``` Thanks to [@irrandon](https://github.com/irrandon) ##### Helm chart ([#751](https://github.com/aquasecurity/trivy/issues/751), [#769](https://github.com/aquasecurity/trivy/issues/769)) For the detail, see [here](https://github.com/aquasecurity/trivy/tree/main/helm/trivy) ``` $ cd helm/trivy $ helm install my-release . ``` Thanks to [@czunker](https://github.com/czunker) #### Fixes ##### redhat: skip modular packages ([#776](https://github.com/aquasecurity/trivy/issues/776)) Close [#771](https://github.com/aquasecurity/trivy/issues/771) and [#741](https://github.com/aquasecurity/trivy/issues/741) Thanks to [@masahiro331](https://github.com/masahiro331) ##### Make the table output less wide. ([#763](https://github.com/aquasecurity/trivy/issues/763)) ``` alpine:3.10 (alpine 3.10.5) =========================== Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 0, CRITICAL: 0) +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ | libcrypto1.1 | CVE-2020-1971 | MEDIUM | 1.1.1g-r0 | 1.1.1i-r0 | openssl: EDIPARTYNAME | | | | | | | NULL pointer de-reference | | | | | | | -->avd.aquasec.com/nvd/cve-2020-1971 | +--------------+ + + + + + | libssl1.1 | | | | | | | | | | | | | | | | | | | | +--------------+------------------+ +-------------------+---------------+---------------------------------------+ | musl | CVE-2020-28928 | | 1.1.22-r3 | 1.1.22-r4 | In musl libc through 1.2.1, | | | | | | | wcsnrtombs mishandles particular | | | | | | | combinations of destination buffer... | | | | | | | -->avd.aquasec.com/nvd/cve-2020-28928 | +--------------+ + + + + + | musl-utils | | | | | | | | | | | | | | | | | | | | | | | | | | | +--------------+------------------+----------+-------------------+---------------+---------------------------------------+ ``` #### Changelog [`08ca1b0`](https://github.com/aquasecurity/trivy/commit/08ca1b0) Feat: NuGet Scanner ([#686](https://github.com/aquasecurity/trivy/issues/686)) [`7b86f81`](https://github.com/aquasecurity/trivy/commit/7b86f81) feat(cache): support Redis ([#770](https://github.com/aquasecurity/trivy/issues/770)) [`8cd4afe`](https://github.com/aquasecurity/trivy/commit/8cd4afe) fix(redhat): skip module packages ([#776](https://github.com/aquasecurity/trivy/issues/776)) [`b606b62`](https://github.com/aquasecurity/trivy/commit/b606b62) chore: migrate from master to main ([#778](https://github.com/aquasecurity/trivy/issues/778)) [`5c2b14b`](https://github.com/aquasecurity/trivy/commit/5c2b14b) chore(circleci): remove gofmt ([#777](https://github.com/aquasecurity/trivy/issues/777)) [`a19a023`](https://github.com/aquasecurity/trivy/commit/a19a023) chore(README): remove experimental ([#775](https://github.com/aquasecurity/trivy/issues/775)) [`e6cef75`](https://github.com/aquasecurity/trivy/commit/e6cef75) NVD: Add timestamps. ([#761](https://github.com/aquasecurity/trivy/issues/761)) [`1371f72`](https://github.com/aquasecurity/trivy/commit/1371f72) (fix): Make the table output less wide. ([#763](https://github.com/aquasecurity/trivy/issues/763)) [`8ecaa2f`](https://github.com/aquasecurity/trivy/commit/8ecaa2f) Add gitHubToken to prevent rate limit problems ([#769](https://github.com/aquasecurity/trivy/issues/769)) [`8132174`](https://github.com/aquasecurity/trivy/commit/8132174) Add helm chart to install trivy in server mode. ([#751](https://github.com/aquasecurity/trivy/issues/751)) [`bcc2850`](https://github.com/aquasecurity/trivy/commit/bcc2850) chore(docs): add nix install ([#762](https://github.com/aquasecurity/trivy/issues/762)) [`cb36972`](https://github.com/aquasecurity/trivy/commit/cb36972) HTML template ([#567](https://github.com/aquasecurity/trivy/issues/567)) #### Docker images - `docker pull docker.io/aquasec/trivy:0.15.0` - `docker pull docker.io/aquasec/trivy:latest` - `docker pull ghcr.io/aquasecurity/trivy:0.15.0` - `docker pull ghcr.io/aquasecurity/trivy:latest` ### [`v0.14.0`](https://github.com/aquasecurity/trivy/releases/tag/v0.14.0) #### Features ##### Add primary URLs ([#752](https://github.com/aquasecurity/trivy/issues/752)) Trivy shows a primary URL in the result as follows. ``` alpine:3.10 (alpine 3.10.5) =========================== Total: 2 (UNKNOWN: 2, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0) +------------+------------------+----------+-------------------+---------------+--------------------------------+------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | URL | +------------+------------------+----------+-------------------+---------------+--------------------------------+------------------------------------+ | musl | CVE-2020-28928 | UNKNOWN | 1.1.22-r3 | 1.1.22-r4 | In musl libc through 1.2.1, | avd.aquasec.com/nvd/cve-2020-28928 | | | | | | | wcsnrtombs mishandles | | | | | | | | particular combinations of | | | | | | | | destination buffer... | | +------------+ + + + + + + | musl-utils | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +------------+------------------+----------+-------------------+---------------+--------------------------------+------------------------------------+ ``` ``` [ { "Target": "alpine:3.10 (alpine 3.10.5)", "Type": "alpine", "Vulnerabilities": [ { "VulnerabilityID": "CVE-2020-28928", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2020-28928", ... } ] } ] ``` In these cases, you can see `https://avd.aquasec.com/nvd/cve-2020-28928` as a primary URL. ##### Remove rpm dependency ([#753](https://github.com/aquasecurity/trivy/issues/753)) Trivy no longer requires the `rpm` command on the host. You can scan a RHEL-based image without rpm. ``` $ rpm bash: rpm: command not found $ trivy image -o /dev/null centos:7 centos:7 (centos 7.9.2009) ========================== Total: 601 (UNKNOWN: 0, LOW: 358, MEDIUM: 240, HIGH: 3, CRITICAL: 0) ``` #### Bug fixes ##### --light shows less results ([#755](https://github.com/aquasecurity/trivy/issues/755)) There was a bug where vulnerabilities with unknown severity do not appear in the result when using the `--light` option. #### Changelog [`9bdbeab`](https://github.com/aquasecurity/trivy/commit/9bdbeab) feat: remove rpm dependency ([#753](https://github.com/aquasecurity/trivy/issues/753)) [`d85cb77`](https://github.com/aquasecurity/trivy/commit/d85cb77) fix(vulnerability): make an empty severity UNKNOWN ([#759](https://github.com/aquasecurity/trivy/issues/759)) [`1bee83c`](https://github.com/aquasecurity/trivy/commit/1bee83c) chore(README): add TRIVY\_INSECURE ([#760](https://github.com/aquasecurity/trivy/issues/760)) [`4d18943`](https://github.com/aquasecurity/trivy/commit/4d18943) feat(vulnerability): add primary URLs ([#752](https://github.com/aquasecurity/trivy/issues/752)) #### Docker images - `docker pull docker.io/aquasec/trivy:0.14.0` - `docker pull docker.io/aquasec/trivy:latest` - `docker pull ghcr.io/aquasecurity/trivy:0.14.0` - `docker pull ghcr.io/aquasecurity/trivy:latest` ### [`v0.13.0`](https://github.com/aquasecurity/trivy/releases/tag/v0.13.0) #### Important change ##### Support npm and RubyGems versioning semantics ([#740](https://github.com/aquasecurity/trivy/issues/740)) npm and RubyGems have different versioning/constraint semantics from other languages, so we developed libraries for them. In the future, we will probably develop libraries for other languages such as Python. #### New features ##### Skip downloading DB if a remote DB is not updated ([#717](https://github.com/aquasecurity/trivy/issues/717)) Once the vulnerability DB is downloaded, it will not be updated within one hour so that Trivy will not download the same DB many times by mistake. #### Support ##### Add back support for FreeBSD & OpenBSD ([#728](https://github.com/aquasecurity/trivy/issues/728)) Provide binaries for FreeBSD & OpenBSD ##### Add support for ppc64le architecture ([#724](https://github.com/aquasecurity/trivy/issues/724)) Provide binaries for the ppc64le (Power) architecture. #### Bug fixes ##### Handle ksplice advisories of Oracle Linux([#745](https://github.com/aquasecurity/trivy/issues/745)) Skip ksplice advisories when the installed package is not a ksplice package during Oracle Linux scanning. Also, if the package is a ksplice one, we should not use the normal advisories. ##### Skip packages from unsupported repository (remi) ([#695](https://github.com/aquasecurity/trivy/issues/695)) Skip scanning RPM packages installed from the remi repository #### Changelog [`1391b3b`](https://github.com/aquasecurity/trivy/commit/1391b3b) fix(oracle): handle ksplice advisories ([#745](https://github.com/aquasecurity/trivy/issues/745)) [`b6d5b82`](https://github.com/aquasecurity/trivy/commit/b6d5b82) fix: version comparison ([#740](https://github.com/aquasecurity/trivy/issues/740)) [`9dfb0fe`](https://github.com/aquasecurity/trivy/commit/9dfb0fe) updated Readme.md ([#737](https://github.com/aquasecurity/trivy/issues/737)) [`4555469`](https://github.com/aquasecurity/trivy/commit/4555469) Add suse sles 15.2 to the EOL list as well ([#734](https://github.com/aquasecurity/trivy/issues/734)) [`c189aa6`](https://github.com/aquasecurity/trivy/commit/c189aa6) Update README.md ([#731](https://github.com/aquasecurity/trivy/issues/731)) [`8442528`](https://github.com/aquasecurity/trivy/commit/8442528) Warn when a user attempts to use trivy without a detectable lockfile ([#729](https://github.com/aquasecurity/trivy/issues/729)) [`d09787e`](https://github.com/aquasecurity/trivy/commit/d09787e) Add back support for FreeBSD & OpenBSD ([#728](https://github.com/aquasecurity/trivy/issues/728)) [`0285a89`](https://github.com/aquasecurity/trivy/commit/0285a89) Add support for ppc64le architecture ([#724](https://github.com/aquasecurity/trivy/issues/724)) [`7d7784f`](https://github.com/aquasecurity/trivy/commit/7d7784f) Skip packages from unsupported repository (remi) ([#695](https://github.com/aquasecurity/trivy/issues/695)) [`ca6f196`](https://github.com/aquasecurity/trivy/commit/ca6f196) Skip downloading DB if a remote DB is not updated ([#717](https://github.com/aquasecurity/trivy/issues/717)) [`e621cf2`](https://github.com/aquasecurity/trivy/commit/e621cf2) Sunsetting VendorVectors ([#718](https://github.com/aquasecurity/trivy/issues/718)) [`906ab54`](https://github.com/aquasecurity/trivy/commit/906ab54) Add GitHub Container Registry to README ([#712](https://github.com/aquasecurity/trivy/issues/712)) [`1549c25`](https://github.com/aquasecurity/trivy/commit/1549c25) update BUG\_REPORT.md using H2 instead of bold formatting ([#714](https://github.com/aquasecurity/trivy/issues/714)) [`fe1d07e`](https://github.com/aquasecurity/trivy/commit/fe1d07e) fix(ci/deb): do not remove old packages for EOL versions ([#706](https://github.com/aquasecurity/trivy/issues/706)) [`793a1aa`](https://github.com/aquasecurity/trivy/commit/793a1aa) Add linter check support ([#679](https://github.com/aquasecurity/trivy/issues/679)) [`4a94477`](https://github.com/aquasecurity/trivy/commit/4a94477) Optimize images ([#696](https://github.com/aquasecurity/trivy/issues/696)) [`9bc2b19`](https://github.com/aquasecurity/trivy/commit/9bc2b19) Update triage.md ([#701](https://github.com/aquasecurity/trivy/issues/701)) #### Docker images - `docker pull docker.io/aquasec/trivy:0.13.0` - `docker pull docker.io/aquasec/trivy:latest` - `docker pull ghcr.io/aquasecurity/trivy:0.13.0` - `docker pull ghcr.io/aquasecurity/trivy:latest` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

opencode added 1 commit

2026-09-01 04:01:46 +00:00

chore(deps): update dependency trivy to v0.74.0

Prek checks / prek (push) Successful in 1m10s

Details

21d6c9e67e

opencode force-pushed renovate/trivy-0.x from 21d6c9e67e

Prek checks / prek (push) Successful in 1m10s

Details

to 73d09bf735

Prek checks / prek (push) Successful in 1m6s

Details

2026-09-16 04:01:08 +00:00

Compare

Prek checks / prek (push) Successful in 1m6s

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/trivy-0.x:renovate/trivy-0.x

git switch renovate/trivy-0.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/trivy-0.x

git switch renovate/trivy-0.x

git rebase main

git switch main

git merge --ff-only renovate/trivy-0.x

git switch renovate/trivy-0.x

git rebase main

git switch main

git merge --no-ff renovate/trivy-0.x

git switch main

git merge --squash renovate/trivy-0.x

git switch main

git merge --ff-only renovate/trivy-0.x

git switch main

git merge renovate/trivy-0.x

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

cayne/image-factory!7

No description provided.

Rows
Columns