v0.65.0

[aqua-bot]

📑 Table of Contents

• 🚀 What's new? 🚀

  • 🐧 AlmaLinux 10 Support 🔟
  • 📦 Package Type Filtering for License Scanning 🔍
  • 🐳 Automatic Docker Context Resolution 🔌
  • 🔖 Git Repository Metadata in Reports 📊
  • 🔐 SHA-512 Hash Support for CycloneDX SBOM 🛡️
  • 🪛 CVSS vectors for sarif report 📈
  • 🛑 Graceful Shutdown Support 🔄

• 👷‍♂️ Notable Fixes 🛠️

🚀 What's new? 🚀

🐧 AlmaLinux 10 Support 🔟

Trivy now supports vulnerability scanning for AlmaLinux 10 (latest major release)
Thanks to @wololowarrior

📦 Package Type Filtering for License Scanning 🔍

The --pkg-types flag now works for license scanning, allowing you to filter license detection by package type (os or library).

# Scan only OS package licenses (apk, apt, rpm, etc.)
$ trivy image --scanners license --pkg-types os alpine:3.19

# Scan only application dependency licenses (npm, pip, gem, go modules, etc.)
$ trivy image --scanners license --pkg-types library node:20

Thanks to @mastacheata

🐳 Automatic Docker Context Resolution 🔌

Trivy now automatically detects and uses your active Docker context when scanning images with the docker source. This enhancement ensures seamless integration with different Docker environments, including Docker Desktop, Colima, Podman, and other Docker-compatible runtimes. You can still use any of the exiting configuration options to override automatic context detection.

For more information see here.

🔖 Git Repository Metadata in Reports 📊

Trivy now automatically extracts and includes git repository metadata in JSON scan reports when scanning git repositories using the repo or fs subcommands. This provides valuable context about the codebase being scanned, including commit details, authorship, branch information, and tags.

Example snippet from JSON output:

{
  "Metadata": {
    "RepoURL": "https://github.com/aquasecurity/trivy-db",
    "Branch": "main",
    "Tags": ["v0.2.0", "latest"],
    "Commit": "378cf9606fe23bdb47639e29a4fb525ed7645e09",
    "CommitMsg": "Migrate logging to structured logging with slog...",
    "Author": "knqyf263 <[email protected]>",
    "Committer": "knqyf263 <[email protected]>"
  }
}

🔐 SHA-512 Hash Support for CycloneDX SBOM 🛡️

When generating or processing CycloneDX SBOMs, SHA-512 hashes are now automatically included and recognized.

Thanks to @attiand

🪛 CVSS vectors for sarif report 📈

Trivy now includes CVSS metrics in sarif reports.
You can see them in the property field:

"properties": {
  "cvss": {
    "cvssv2_vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
    "cvssv3_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
    "cvssv2_score": 5,
    "cvssv3_baseScore": 5.3
  },
  "precision": "very-high",
  "security-severity": "5.3",
  "tags": [
    "vulnerability",
    "security",
    "MEDIUM"
  ]
}

Thanks to @axidex

🛑 Graceful Shutdown Support 🔄

Trivy now handles interruption signals (SIGINT/SIGTERM) gracefully, allowing ongoing operations to complete before shutting down. Press Ctrl+C once to initiate graceful shutdown, or twice to force immediate termination.

$ trivy image alpine:3.19
^C
INFO    Attempting graceful shutdown... Press Ctrl+C again to force exit
INFO    Shutting down...

In server mode, active requests are given time to complete:

$ trivy server --listen localhost:8080
^C
INFO    Shutting down server...
INFO    Waiting for active requests to complete...
INFO    Server exited

👷‍♂️ Notable Fixes 🛠️

• Epochs never read from /var/lib/rpmmanifest/container-manifest-2. #9100 (Thanks to @tofay)
• fix: also check filepath when removing duplicate packages #9142
• fix(license): add missed GFDL-NIV-1.1 and GFDL-NIV-1.2 into Trivy mapping #9116
• bug(apk): Trivy incorrectly separates licenses that contain the WITH operator #9230
• feat(dpkg): check /var/lib/dpkg/*/<package>.md5sums to find list of system files #9046
• bug(npm): Trivy incorrect checks versions with pre-release suffix #9144
• bug(rootio): Trivy doesn't detect root.io provider when looking in dpkg #9118
• bug(rootio): Trivy doesn't use severity from BaseOS for vulnerabilities #9178
• Out-of-graph OS packages are excluded when mixed with in-graph packages in SBOM #9193
• bug(cyclonedx): incorrect field for licenses #9042
• Secret scanner fails with UTF-8 marshalling error when scanning files with invalid UTF-8 content #9254
• bug(secret): Trivy incurrect detects line numbers for multi-line secrets #9086
• bug(python): add support for .egg-info/METADATA #9171 (Thanks to @amitverse)
• fix(misconf): skip rewriting expr if attr is nil #9113
• refactor: remove aws flag helper message #9080
• fix(misconf): correctly adapt azure storage account #9138
• fix(misconf): correctly parse empty port ranges in google_compute_firewall #9237