v0.64.0

[aqua-bot]

📑 Table of Contents

• 🚀 What's new? 🚀

  • 🐆 Ubuntu 20.04-ESM and 25.04 support 🦡
  • 🛡️ Root.io support 💻
  • 📦 OpenTofu file extension support 🍜
  • 🧩 Partial evaluation for AWS policy templates in Terraform 🔐

• 👷‍♂️ Notable Fixes 🛠️

🚀 What's new? 🚀

🐆 Ubuntu 20.04-ESM and 25.04 support 🦡

Trivy now supports detecting vulnerabilities for Ubuntu 20.04-ESM and 25.04.

Thanks @yutatokoi

🛡️ Root.io support 💻

Trivy now supports scanning container images patched with root.io.
See more here

📦 OpenTofu file extension support 🍜

Trivy now supports scanning OpenTofu files with .tofu and .tofu.json extensions.
These files are functionally equivalent to Terraform and are now properly recognized as IaC files.

Thanks @jswank

🧩 Partial evaluation for AWS policy templates in Terraform 🔐

Trivy now supports partial evaluation of AWS IAM policies written with HCL template expressions.
When a value in the template can’t be resolved (e.g. var.foo is unknown), it’s replaced with a special marker: __UNRESOLVED__.
This makes it possible to scan incomplete configurations without losing structure.

👷‍♂️ Notable Fixes 🛠️

• fix(cli): Add missing version check flags #8951
• fix(cli): Correctly check for semver versions for trivy version check #8948
• fix(misconf): .Config.User always takes precedence over USER in .History #9050
• fix(misconf): correct Azure value-to-time conversion in AsTimeValue #9015
• fix(misconf): move disabled checks filtering after analyzer scan #9002
• fix(misconf): reduce log noise on incompatible check #9029
• Support environment variables in Maven settings.xml #9000
• Trivy shows warning about corrupted trivy-db for first run (after clean) #8990
• bug(bun): Trivy can't parse bun.lock unless package dependency is array element 3 #8995
• bug(report): Trivy panics when converting json report without Packages to table report with summary table #8622
• fix(sbom): remove unnecessary OS detection check in SBOM decoding #9034
• fix: ignore check compatibility warnings for dev releases #8944