release: v0.68.0 [main]

[aqua-bot]

🤖 I have created a release beep boop

0.68.0 (2025-11-06)

Features

• add ArtifactID field to uniquely identify scan targets (#9663) (84a7d9a)
• add ReportID field to scan reports (#9670) (fc976be)
• allow ignoring findings by type in Rego (#9578) (c638fc6)
• cli: Add trivy cloud suppport (#9637) (8e6a7ff)
• db: enable concurrent access to vulnerability database (#9750) (d70d994)
• dotnet: add dependency graph support for .deps.json files (#9726) (18c0ee8)
• fs: change artifact type to repository when git info is detected (#9613) (cff91ac)
• image: add RepoTags support for Docker archives (#9690) (a9a3031)
• image: pass global context to docker/podman image save func (#9733) (2690ac9)
• include registry and repository in artifact ID calculation (#9689) (758f271)
• java: add support remote repositories from settings.xml files (#9708) (eff52eb)
• license: use separate SPDX ids to ignore SPDX expressions (#9087) (012f3d7)
• misconf: add agentpools to azure container schema (#9714) (69f400c)
• misconf: Add RoleAssignments attribute (#9396) (3fb8703)
• misconf: Add support for configurable Rego error limit (#9657) (445cd2b)
• misconf: include map key in manifest snippet for diagnostics (#9681) (197c9e1)
• misconf: Update Azure Compute schema (#9675) (cb58bf6)
• misconf: Update Azure Container Schema (#9673) (43a7546)
• misconf: Update azure storage schema (#9728) (c3bfecf)
• misconf: Update SecurityCenter schema (#9674) (58819c5)
• report: add image reference to report metadata (#9729) (d020f26)
• report: switch ReportID from UUIDv4 to UUIDv7 (#9749) (6fb3fde)
• sbom: use SPDX license IDs list to validate SPDX IDs (#9569) (35db88c)

Bug Fixes

• add buildInfo for BlobInfo in rpc package (#9608) (6def66e)
• close all opened resources if an error occurs (#9665) (fa6f779)
• flag: remove viper.SetDefault to fix IsSet() for config-only flags (#9732) (bf43629)
• java: update order for resolving package fields from multiple demManagement (#9575) (e286c5e)
• license: don't normalize unlicensed licenses into unlicense (#9611) (09162e5)
• license: handle SPDX WITH exceptions as single license in category detection (#9380) (212f078)
• nodejs: fix npmjs parser.pkgNameFromPath() panic issue (#9688) (231492d)
• nodejs: use the default ID format to match licenses in pnpm packages. (#9661) (804ea4a)
• os: Add photon 5.0 in supported OS (#9724) (29f0347)
• report: correct field order in SARIF license results (#9712) (d20216e)
• restore compatibility for google.protobuf.Value (#9559) (aeeb2a1)
• sbom: add buildInfo info as properties (#9683) (2c43425)
• sbom: don’t panic on SBOM format if scanned CycloneDX file has empty metadata (#9562) (fb0593b)
• Trim the end-of-range suffix (#9618) (e18b038)
• Use fetch-level: 1 to check out trivy-repo in the release workflow (#9636) (6e53686)
• use context for analyzers (#9538) (b885d3a)
• using SrcVersion instead of Version for echo detector (#9552) (66479f0)
• validate backport branch name (#9548) (f0fd432)
• vex: don't use reused BOM (#9604) (7422cc7)

---

This PR was generated with Release Please. See documentation.