Trivy

No entries match these filters. Clear filters

1. changelog Oct 5, 2026 · issue 095

   Trivy adds a full cryptographic asset scanning subsystem to the image command with CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. output, ML-DSAML-DSANIST's main post-quantum digital signature standard (FIPS 204), formerly Dilithium. It is the planned replacement for RSA and ECDSA signatures on certificates and code. support, and client/server transfer.

   • Adds a cryptographic asset scanner to the image command, surfacing keys, certificates, and signature algorithms in scan results.
   • Outputs cryptographic assets in CycloneDX SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. format.
   • Supports ML-DSA keys and signature algorithms in the crypto analyzer.
   • Transfers cryptographic assets in client/server mode.
   • Allows disabling configuration files by setting their path to an empty string.

   +1 more show less

   • Reports unparsable license names with UNKNOWN severity instead of silently dropping them.

   6 details in Everything

   • New vulnerability check Vulnerability detection for Echo-patched Python packages
   • New supported platform Package classification for julia, bottlerocket, and centos stream
   • New supported platform uv workspace lockfile support
2. changelog Oct 4, 2026 · issue 094

   Trivy gains a cryptographic asset scanner with CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. output, ML-DSAML-DSANIST's main post-quantum digital signature standard (FIPS 204), formerly Dilithium. It is the planned replacement for RSA and ECDSA signatures on certificates and code. key support, and uv workspace lockfile parsing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds a cryptographic asset model, parser, and analyzer that scans images and passes discovered assets to the scan report via the image command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Outputs cryptographic assets in CycloneDX format and transfers them in client/server mode.
   • Supports ML-DSA keys and signature algorithms in cryptographic asset descriptions.
   • Adds vulnerability detection for Echo-patched Python packages.
   • Supports uv workspace lockfiles.

   +3 more show less

   • Allows disabling configuration files with empty paths.
   • Reports unparsable license names with UNKNOWN severity.
   • Classifies julia, bottlerocket, and centos stream packages.
   • Adds a cryptographic asset model, parser, and analyzer that scans images and passes discovered assets to the scan report via the image command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Outputs cryptographic assets in CycloneDX format and transfers them in client/server mode.
   • Supports ML-DSA keys and signature algorithms in cryptographic asset descriptions.
   • Supports uv workspace lockfiles.

   4 more in Everything

3. 0.75.0 Oct 1, 2026 · release notes

   Trivy 0.75.0 adds cryptographic asset scanning to image commands with CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. output support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.75.0 https://github.com/aquasecurity/trivy.git
   # already have the repo? check out this version:
   $ git checkout 0.75.0

   └──▷ TRY IT
   Scan an image for cryptographic assets like ML-DSAML-DSANIST's main post-quantum digital signature standard (FIPS 204), formerly Dilithium. It is the planned replacement for RSA and ECDSA signatures on certificates and code. keys and export the findings.
   copy

   $ trivy image --format cyclonedx --scan-crypto <image_name>

   Run a scan without loading any configuration files by specifying empty paths.
   copy

   $ trivy image --config "" --policy "" <image_name>

   • image command now scans for cryptographic assets using a new crypto scanner engine
   • Cryptographic assets are parsed and passed to the scan report
   • Cryptographic assets can be described as ML-DSA keys and signature algorithms
   • Cryptographic assets can be transferred in client/server mode
   • Output of cryptographic assets is now supported in CycloneDX format

   +1 more show less

   • Configuration files can be disabled by passing empty paths via CLI

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The getHostByName function has been removed from templates
4. v0.72.0 Jun 30, 2026 · issue 002

   Trivy v0.72.0 adds Bottlerocket scanning, OpenAI/GitHub App secret rules, .NET self-contained runtime detection, and JAR license extraction.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.72.0 https://github.com/aquasecurity/trivy.git
   # already have the repo? check out this version:
   $ git checkout v0.72.0

   └──▷ TRY IT
   Scan a Bottlerocket-based container image for OS-level CVEs — now matched against the Bottlerocket advisory database.
   copy

   $ trivy image --scanners vuln <bottlerocket-based-image>

   Audit a self-contained .NET binary or publish directory for vulnerabilities in the bundled runtime, not just your app dependencies.
   copy

   $ trivy fs --scanners vuln <path/to/self-contained-dotnet-publish/>

   Scan a codebase for leaked OpenAI API keys and the new stateless GitHub App installation token format alongside other secrets.
   copy

   $ trivy fs --scanners secret <your-repo-path/>

   • Adds vulnerability matching for Bottlerocket OS images.
   • Detects bundled .NET runtime in self-contained deployments, enabling CVE scanning of apps that ship their own runtime.
   • Adds OpenAI secret detection rules to the secrets scanner.
   • Adds detection of the new stateless format for GitHub App installation tokens in secrets scanning.
   • Extracts JAR licenses from embedded pom.xml files for more complete Java license inventory.

   +2 more show less

   • Extracts JAR licenses from packaged LICENSE files inside JARs.
   • Extends AVD-AWS-0010 misconfiguration check to cover CloudFront standard logging v2.

   7 details in Everything

5. advisory CVE-2026-55092 Jun 15, 2026 · issue 070
   • CVE-2026-55092: Path traversal via a crafted vulnerability database or other downloaded artifacts (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <0.71.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
6. v0.71.0 Jun 1, 2026 · issue 001

   Trivy v0.71.0 adds CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims., Azure secret rules, Maven secret detection, customizable secret scan skip lists, and Ubuntu 26.04 support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.71.0 https://github.com/aquasecurity/trivy.git
   # already have the repo? check out this version:
   $ git checkout v0.71.0

   └──▷ TRY IT
   Generate a CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.7 SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. from a container image to take advantage of the latest spec features.
   copy

   $ trivy image --format cyclonedx --output sbom.cdx.json python:3.12-slim

   Scan a project for secrets while skipping a custom secrets config file, vendor directories, and specific extensions you know are safe.
   copy

   $ trivy fs --scanners secret myproject/

   • Supports CycloneDX 1.7 SBOM format for both input and output.
   • Adds SHA-512 hash algorithm support to the SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. serializer.
   • New Azure secret detection rules covering Azure credentials and tokens.
   • New Maven secret detection rules for passwords and passphrases in settings.xml and settings-security.xml.
   • Enables customization of folders, files, and extensions skipped during secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it..

   +3 more show less

   • Supports Maven <mirrors> configuration from settings.xml when scanning pom.xml dependencies.
   • Detects Ubuntu 26.04 LTS as a recognized OS target.
   • Adds vendor directory support for language file detection in SEAL scanning.

   8 details in Everything

7. 0.71.0 Jun 1, 2026 · release notes

   Trivy 0.71.0 adds secret scan customization, CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims., Ubuntu 26.04 detection and language file seal support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.71.0 https://github.com/aquasecurity/trivy.git
   # already have the repo? check out this version:
   $ git checkout 0.71.0

   • Adds WithDriver and WithProvider options to the ospkg detector for custom operating system package sources
   • Supports <mirrors> directives from Maven settings.xml during Java dependency scanning
   • Enables CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.7 format output in SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation
   • Adds vendor support for language file detection within the seal subsystem
   • Allows customization of skipped folders, files, and extensions in secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. via new configuration options

   +4 more show less

   • Adds Azure-specific secret detection rules to the secret scanner engine
   • Adds Maven-specific rules to detect passwords and passphrases in settings.xml and settings-security.xml
   • Adds SHA-512 hash algorithm support to the SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. serializer output format
   • Adds detection capability for Ubuntu 26.04 LTS operating system

   9 details in Everything

8. 0.70.0 Apr 16, 2026 · release notes

   Trivy 0.70.0 adds pylock.toml parsing, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. K8s misconf support, and server version in JSON output

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.70.0 https://github.com/aquasecurity/trivy.git
   # already have the repo? check out this version:
   $ git checkout 0.70.0

   • Add pylock.toml (PEP 751PEP 751A draft Python packaging standard that defines a lock file format for recording exact dependency versions, giving cyber tools a reproducible, machine-readable way to pin their dependency trees.) parser for Python dependency resolution
   • Detect Go version from ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. symbol table for binaries built with -trimpath
   • Include server version info in JSON output for client/server mode
   • Support azurerm_network_interface_security_group_association in misconf scanning
   • Adapt misconf rules for ARM-based Kubernetes clusters

   5 details in Everything

9. 0.69.0 Jan 30, 2026 · release notes

   Trivy 0.69.0 adds Julia scanning, Ansible misconf support, AnalyzedBy JSON field, and more

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.69.0 https://github.com/aquasecurity/trivy.git
   # already have the repo? check out this version:
   $ git checkout 0.69.0

   • Adds initial ansible scanning support for infrastructure-as-code misconfigurations
   • Enables vulnerability scanning for the Julia language ecosystem
   • Adds support for ActiveState images
   • Adds AnalyzedBy field to track which analyzer detected packages
   • Adds JSON Schema for trivy.yaml configuration file via the flag feature

   +3 more show less

   • Adds sslCertDir parameter to helm subcommand for custom certificate directories
   • Enables modular package vulnerability detection for rocky Linux
   • Supports per-repo TLS configuration for VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. sources

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !misconf: providers mapping now uses ID instead of AVDID
10. 0.68.0 Dec 2, 2025 · release notes

    Trivy 0.68.0 adds trivy cloud subcommand, --cacert flag, and unique ID fields to scan targets and reports.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.68.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.68.0

    └──▷ TRY IT
    Use a custom CA certificate to scan an environment requiring trusted private CAs
    copy

    $ trivy image --cacert /path/to/custom-ca.pem myimage:tag

    • trivy cloud subcommand is available for scanning cloud environments
    • Add ArtifactID field to uniquely identify scan targets in reports
    • Add ReportID field to scan reports (switched from UUIDv4 to UUIDv7)
    • Add --cacert flag to configure custom CA certificates for TLS verification
    • Enable concurrent access to the vulnerability database for performance improvement

    5 details in Everything

11. 0.67.0 Sep 30, 2025 · release notes

    Trivy 0.67.0 adds seal support, OS-level vulnerability updates via OS release detection, and CoreOS SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.67.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.67.0

    • Adds seal support for cryptographically verifying the integrity of Trivy scan results
    • Adds os-release detection for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence.-based images in the vulnerability scanner to improve package identification accuracy
    • Adds CoreOS platform support in the SBOM generator via sbom subsystem
    • Changes default value of --list-all-pkgs CLI flag to true in cloudformation scanning mode
    • Preserves CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOM structure during vulnerability updates when scanning existing SBOM files

    5 details in Everything

12. 0.66.0 Sep 2, 2025 · release notes

    Trivy 0.66.0 adds streaming secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it., .terraform remote module caching, misconf audit configs, and cache timeouts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.66.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.66.0

    • misconf: added audit config attribute
    • use .terraform cache for remote modules in plan scanning
    • secret: implement streaming secret scanner with byte offset tracking
    • add timeout handling for cache database operations

    4 details in Everything

13. 0.65.0 Jul 30, 2025 · release notes

    Trivy v0.65.0 adds HTTP tracing, AlmaLinux 10 support, Git repo metadata in reports, and SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. vectors.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.65.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.65.0

    • image section gains Docker context resolution to handle image references via Docker context
    • license scanner observes pkg_type option to filter by package type
    • Git repository metadata is now included in Trivy scan reports
    • SARIF report output now includes CVSS vectors for findings
    • CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation supports SHA-512 hashes

    +2 more show less

    • misconf rules added for GCP private IP access attribute in subnetworks and GCS bucket logging/versioning
    • AlmaLinux 10 is supported as a new platform for vulnerability scanning

    7 details in Everything

14. 0.64.0 Jun 30, 2025 · release notes

    Trivy 0.64.0 adds Root.io container scanning, OpenTofu support, CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. metadata, and Terraform partial evaluation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.64.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.64.0

    • Add Root.io support for container image scanning
    • Add OpenTofu file extension support in misconf scanning
    • Add partial evaluation for policy templates in Terraform
    • Dereference all Maven settings.xml environment placeholders
    • Add manufacturer field to CycloneDX tools metadata in SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. output

    5 details in Everything

15. 0.63.0 May 29, 2025 · release notes

    Trivy 0.63.0 adds Bottlerocket and MinimOS support, bun.lock analysis, license scanning enhancements, and JUnit location exports.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.63.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.63.0

    • Add Bottlerocket OS package analyzer
    • Support license scanning in both GOPATH and vendor directories for Go projects
    • Add a Bun lock file analyzer for Node.js dependencies
    • Scan the vendor directory for licenses associated with go.mod files
    • Support compound licenses using SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. operators

    +5 more show less

    • Extract maintainer field for Alpine APK packages
    • Export raw Terraform data to Rego for misconfiguration scanning
    • Add minimum Trivy version requirement support for misconfiguration rules
    • Include misconfiguration location information in JUnit output templates
    • Set the current working directory for the Terraform parser

    10 details in Everything

16. 0.62.0 Apr 30, 2025 · release notes

    Trivy 0.62 adds layer metadata to image reports, custom Rego for misconfig scanning, and improved yarn/cargo workspace support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.62.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.62.0

    • image: saves layer metadata into the scan report (e.g., SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. or vulnerability output)
    • misconf: allows passing a custom Rego scanner instance to the IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scanner via the API/config
    • misconf: converts AWS managed policies directly into IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. documents for scanning
    • misconf: adds support for auto_provisioning_defaults in google_container_cluster misconfig checks
    • nodejs: recognizes root and workspace dependencies for yarn lockfiles

    +1 more show less

    • rust: recognizes root and workspace relationships/package metadata for cargo lockfiles

    6 details in Everything

17. 0.61.0 Mar 28, 2025 · release notes

    Trivy 0.61.0 adds k8s controller scanning, aws_ami misconf support, and WebAssemblyWebAssemblyA binary instruction format that runs in browsers and server runtimes at near-native speed, letting developers compile C, Rust, or other languages into a portable, sandboxed module any compliant host can execute. rebuild.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.61.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.61.0

    • k8s: add support for controllers

    1 detail in Everything

18. 0.60.0 Mar 5, 2025 · release notes

    Trivy 0.60.0 adds --vuln-severity-source CLI flag and external VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. file loading for CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.60.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.60.0

    • Adds --vuln-severity-source flag to control which vulnerability severity source is used in scans
    • Add initial support for loading external VEX files from SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. references in CycloneDX reports

    2 details in Everything

19. 0.59.0 Jan 30, 2025 · release notes

    Trivy 0.59.0 adds --distro flag, registry mirrors, and support for ignoring misconf violations in Dockerfile and Helm via inline comments.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.59.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.59.0

    └──▷ TRY IT
    Scan a container image while forcing the vulnerability database to treat it as Debian Bookworm, regardless of the base image metadata.
    copy

    $ trivy image --distro debian:bookworm myimage:latest

    Ignore specific misconfiguration warnings in a Dockerfile by adding inline comments.
    📍# Run trivy config on a Dockerfile # Inside the Dockerfile, add: RUN apt-get update # trivy:ignore=CVS-2024-XXXX
    Ignore specific misconfiguration warnings in a Helm chart by adding inline comments.
    📍# Run trivy config on a Helm chart # Inside values.yaml or templates, add: # trivy:ignore=CVS-2024-XXXX
    • Adds --distro flag to manually specify OS distribution for vulnerability scanning
    • Add a examples field to check metadata

    2 details in Everything

20. 0.58.0 Dec 2, 2024 · release notes

    Trivy 0.58.0 adds workspaceRelationship to scan responses, CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4 support, and Private Packagist secrets detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.58.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.58.0

    • Add workspaceRelationship to scan response JSON structure
    • Include CVSS v4 scores and vectors in scan results when available
    • Add built-in secrets detection rules for Private Packagist sources
    • Construct Go module dependencies directly in the parser for better accuracy

    4 details in Everything

21. 0.57.0 Oct 31, 2024 · release notes

    Trivy 0.57 adds trivy registry CLI command and misconfig reporting enhancements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.57.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.57.0

    • Adds trivy registry subcommand for managing cloud registry authentication profiles
    • Supports multi-container Kubernetes scans with accurate per-container misconfiguration reporting

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The trivy auth subcommand has been renamed to trivy registry.
22. 0.56.0 Oct 3, 2024 · release notes

    Trivy 0.56.0 adds support for multiple DB repositories, SUSE Linux Enterprise Micro, RPM archive scanning, and misconfig check disabling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.56.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.56.0

    • Adds support for multiple vulnerability and Java database repositories via --db-repo
    • Enables misconf checks to be disabled by ID using the new --skip-check flag
    • Extends --skip-* flags (e.g., --skip-vuln-db) to all included modules in misconfig scanning
    • Adds scanning support for RPM archives
    • Adds SUSE Linux Enterprise Micro as a supported platform for vulnerability detection

    5 details in Everything

23. 0.55.0 Sep 3, 2024 · release notes

    Trivy 0.55.0 adds --detection-priority tuning, --path-prefix for server mode, misconf scanning for YAML/JSON, and new VM filesystem support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.55.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.55.0

    └──▷ USE IT
    Scan a container image or filesystem while tuning false positive rates by setting detection priority.
    shell copy

    trivy --detection-priority high target-image

    Configure Trivy Server to run behind a reverse proxy with a path prefix.
    shell copy

    trivy server --path-prefix /trivy

    Scan a local YAML or JSON configuration file for misconfigurations.
    shell copy

    trivy config path/to/config.yaml

    • Adds --detection-priority flag to tune vulnerability detection accuracy
    • Adds internal --path-prefix flag for Trivy Server client/server mode
    • Adds Ext2/Ext3 filesystem support in VM scanning module
    • Adds direct filesystem support in VM scanning module
    • Adds test scope support for Java pom.xml files

    +10 more show less

    • Adds support for ignoring checks by nested attributes in misconf
    • Adds variable support for Terraform Plan in misconf
    • Adds support for policy and bucket grants in misconf
    • Adds iterator argument support for dynamic blocks in misconf
    • Adds port and protocol support for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. networks in misconf
    • Adds support for using spec from on-disk bundle in misconf
    • Exports modified findings in JSON reports
    • Uses toolchain as stdlib version for go.mod files
    • Sets User-Agent header on requests to Rekor for SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. module
    • Makes Trivy Server Multiplexer exported

    15 details in Everything

24. 0.54.0 Jul 30, 2024 · release notes

    Trivy 0.54.0 adds VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. Repository support, Azure Linux scanning, and --pkg-types/--pkg-relationships flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.54.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.54.0

    • log.FilePath() function for logger
    • openSUSE tumbleweed detection and scanning
    • --pkg-types flag (replaces --vuln-type) to control package types scanned
    • Azure Linux support in Mariner database
    • China configuration for ACRs misconf scanning

    +6 more show less

    • license parser to pnpm analyser for nodejs
    • image labels into SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. reports
    • vulnerability support for SPDX formats
    • --pkg-relationships flag to include package dependency relationships in vulnerability reports
    • share build-in rules
    • retrieve VEX attestations from OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registries

    11 details in Everything

25. 0.53.0 Jul 1, 2024 · release notes

    Trivy 0.53.0 adds clean subcommand, local ImageID in SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface., and memory cache backend. Removes aws subcommand.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.53.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.53.0

    └──▷ TRY IT
    Remove Trivy cache and temporary files to free disk space on CI/CD runners after scans.
    copy

    $ trivy clean --all

    Scan a container image and output SARIF results with local ImageID for tracking in vulnerability management tools.
    copy

    $ trivy image --format sarif --output result.sarif myimage:latest

    Configure Trivy to use memory-based caching for faster subsequent scans without disk I/O overhead.
    copy

    $ trivy image --cache-backend memory myimage:latest

    • Add clean subcommand to remove Trivy data files (cache, images, metadata) and free disk space
    • Add local ImageID to SARIF metadata for better correlation of scanned container images in SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment./SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. workflows
    • Add memory cache backend to improve performance and reduce disk I/O overhead during scans
    • Add conda license support for environment.yml files to detect dependencies licenses in Conda environments
    • Add Dart dependency resolution using first version of constraint for SDK version dependencies

    +10 more show less

    • Set User-Agent header for Trivy container registry requests to improve tracking and access control compliance
    • Add Java support for maven-metadata.xml files in remote snapshot repositories for accurate version resolution
    • Add sbt project support via sbt-dependency-lock for dependency lock file parsing in Scala projects
    • Add misconf metadata to Cloud schema for enhanced cloud security posture analysis details
    • Add AWS CloudFormationAWS CloudFormationAn AWS service for declaring cloud infrastructure as code in JSON or YAML templates, letting cyber tools provision and tear down entire environments reproducibly without manual console steps. support for AWS::EC2::SecurityGroupIngress/Egress resources in misconfiguration scanning
    • Add API Gateway V1 support for CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. templates in infrastructure-as-code scanning
    • Add Rego selector support for all providers to enable fine-grained policy application across cloud environments
    • Add PHP installed.json file support for dependency resolution in Composer-based projects
    • Add plugin nested archive support for handling complex plugin packaging structures
    • Migrate SBOM output format to CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. v1.6 standard for improved interoperability

    15 details in Everything

26. 0.52.0 Jun 3, 2024 · release notes

    Trivy v0.52.0 adds Julia analyzer, plugin index support, and misconfig check deprecation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.52.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout 0.52.0

    • Adds Julia language analyzer support
    • Adds support for a plugin index to discover and install plugins
    • Adds misconf capability to deprecate specific checks via Rego policy
    • Expands Terraform schema to recognize the removed block
    • Registers builtin Rego functions from the trivy-checks repository for custom policies

    +10 more show less

    • Enables resolving Terraform modules from OpenTofu compatible registries in misconfig scanning
    • Adds support for VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. resource types in inbound/outbound rule checks
    • Allows Trivy to follow symlinks inside Helm archives during scanning
    • Adds v9 pnpm lock file parser support for Node.js dependency analysis
    • Adds ability to specify a concrete version when installing or referencing plugins
    • Extracts license information from requirements.txt files in Python analyses
    • Extracts line number data for each entry in requirements.txt during Python scanning
    • Includes filtered licenses and secrets in the ModifiedFindings field of reports when Rego filtering is active
    • Improves CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale. VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. format support for dependency relationship modeling
    • Supports non-root components mapping to products in OpenVEXOpenVEXAn open specification and Go library, maintained by the OpenVEX community, for expressing VEX (Vulnerability Exploitability eXchange) statements in a standard JSON format so cyber tools can automate vulnerability triage. generation

    15 details in Everything

27. v0.26.0 Apr 15, 2022 · release notes

    Trivy v0.26.0 adds support for Alpine apk repositories and Go.mod in Go 1.17+

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.26.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.26.0

    • Adds feat(alpine): support apk repositories to allow scanning of packages from custom or version-mixed Alpine mirrors
    • Adds support for go.mod files generated by Go 1.17+ runtime environments

    2 details in Everything

28. v0.25.4 Apr 11, 2022 · release notes

    Trivy v0.25.4 adds PkgPath to table results and --db-repository flag for SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. database selection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.25.4 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.25.4

    • Adds PkgPath field to the --format table output
    • Introduces --db-repository flag for custom SBOM vulnerability database mirrors

    2 details in Everything

29. v0.25.3 Apr 6, 2022 · release notes

    v0.25.3: Allow setting Maven Central URL via environment variable for JAR scanning

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.25.3 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.25.3

    └──▷ USE IT
    Scan a JAR file using a custom or corporate Maven mirror instead of the default central repo.
    shell copy

    TRIVY_MAVEN_URL=https://internal-mirror.example.com/repository/maven-public trivy fs --image my-app.jar

    • TRIVY_MAVEN_URL (or similar env var context) enables configuring the Maven Central repository URL for JAR dependency scans

    1 detail in Everything

30. v0.25.1 Apr 4, 2022 · release notes

    Trivy v0.25.1 adds --db-repository flag to pull the advisory database directly from an OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registry.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.25.1 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.25.1

    └──▷ TRY IT
    Pull the latest vulnerability definitions from a private OCI registry instead of the default public one.
    copy

    $ trivy image --db-repository my-registry.internal/trivy-db alpine:latest

31. v0.25.0 Mar 31, 2022 · release notes

    Adds a dedicated sbom command for SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation and enhances cyclonedx export with vulnerability data.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.25.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.25.0

    • Adds the trivy sbom subcommand as a dedicated way to generate Software Bill of MaterialsSoftware Bill of MaterialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. outputs
    • Enables --format cyclonedx exports to include vulnerability details within the CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. JSON output
    • Allows misconfigurations to be included in GitLab Codequality report formats via template support
    • Extends trivy filesystem scan to operate in client/server mode for distributed scanning workflows

    4 details in Everything

32. v0.24.3 Mar 16, 2022 · release notes

    Trivy v0.24.3 adds configurable helm service name and server token support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.24.3 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.24.3

    └──▷ USE IT
    Deploy a custom Nginx service name for Trivy scanning in a Helm chart.
    shell copy

    trivy image --format table --helm.service-name "trivy-scanner" myapp:latest

    Scan a private Helm repository requiring authentication.
    shell copy

    trivy image --format json --helm.server-token "${HELM_SERVER_TOKEN}" oci://private-registry.io/chart-repo/mychart:1.0.0

    • Adds --helm.service-name flag to the Helm scan command to allow configuring the Trivy service name
    • Adds --helm.server-token flag to authenticate Helm repository access during scans

    2 details in Everything

33. v0.24.1 Feb 27, 2022 · release notes

    Trivy v0.24.1 adds support for custom labels in Helm chart scanning via --helm-set

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.24.1 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.24.1

34. v0.24.0 Feb 23, 2022 · release notes

    Trivy v0.24.0 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. and JUnit misconfig report formats, CBL-Mariner 2.0 support, TLS InsecureSkipVerify config, purl utilities, and s390x images.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.24.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.24.0

    └──▷ USE IT
    Export vulnerabilities in CycloneDX format for SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. integration
    shell copy

    trivy image --format cyclonedx --output sbom.json aquasec/your-image:tag

    Disable TLS verification when scanning against a local registry with a self-signed cert
    shell copy

    trivy image --tls-insecure-skip-verify localhost:5000/myimage:v1

    • Adds --format cyclonedx to export findings in CycloneDX format
    • Adds misconfigurations to JUnit XMLJUnit XMLA widely adopted test-report file format, originally from the Java JUnit framework, that records test suite results as XML; cyber tools emit it so their output plugs into CI systems like Jenkins or GitLab without custom parsers. report output (--format junit) with new <testcase> elements for each finding
    • Adds CBL-Mariner 2.0 support as a recognized OS type for vulnerability scanning
    • Adds --tls-insecure-skip-verify flag to the client/server connection to disable TLS certificate validation
    • Adds purl package utilities (generate purl package utilities) for converting packages to Package URLPackage URLA standardized string format for uniquely identifying software packages across ecosystems (npm, PyPI, Maven, etc.), letting cyber tools reference and correlate dependency data without ecosystem-specific logic. format

    +1 more show less

    • Adds s390x container images for scanning on IBM Z architecture

    6 details in Everything

35. v0.23.0 Jan 31, 2022 · release notes

    Trivy v0.23.0 adds ACR, single-file scanning, custom detectors, and TLS cache

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.23.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.23.0

    └──▷ USE IT
    Scan a single application binary file instead of a directory or image.
    shell copy

    trivy fs ./path/to/myapp.bin --security-checks vuln

    Enable TLS for the Trivy cache to connect to a secured Redis instance.
    shell copy

    export TRIVY_CACHE_REDIS_TLS_CERT=/path/to/cert.pem
    export TRIVY_CACHE_REDIS_TLS_KEY=/path/to/key.pem
    export TRIVY_CACHE_REDIS_TLS_CA=/path/to/ca.pem
    trivy image --cache-dir /tmp/trivy-cache myimage:latest

    • Supports scanning a single file via the filesystem target (fs subcommand with path argument).
    • Adds support for custom detectors via DetectorConfig struct and CustomDetectors field.
    • Enables Redis TLS for the cache backend by setting TRIVY_CACHE_REDIS_TLS_* environment variables.
    • Adds Azure ACR registry support (--security-checks config,secret,vuln with --remote flag pointing to an ACR image).
    • Adds data sources for operating system packages (OS-PKG) and language-specific packages (LANG-PKG).

    +7 more show less

    • Supports CBL-Mariner OS in vulnerability detection.
    • Adds support for building RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. images with build info.
    • Supports Rocky Linux OS in vulnerability detection.
    • Adds Photon OS EOL dates check in vulnerability detection.
    • Supports AlmaLinux OS in vulnerability detection.
    • Supports PAR files in Java language-specific package scanning.
    • Logs ignored vulnerabilities when debug logging is enabled.

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The root command was removed; you must now use subcommands like trivy image or trivy fs explicitly.
    • !The SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. template format changed from Rego-based to Go-code-based generation; existing custom SARIF templates will no longer work and must be rewritten for the new Go code structure.
    • !The Trivy DB is now fetched from GHCRGHCRGitHub Container Registry, GitHub's hosted service for storing and distributing OCI-compatible container images, giving cyber tools a versioned, access-controlled image store tied directly to a GitHub repository. (ghcr.io) by default instead of the previous source.
36. v0.22.0 Dec 24, 2021 · release notes

    Trivy v0.22.0 adds --offline-scan support, pom.xml scanning, and NDB rpm updates

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.22.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.22.0

    └──▷ USE IT
    Perform a fully offline scan on a local directory for air-gapped environments.
    shell copy

    trivy fs --offline-scan ./my-project

    • Adds the --offline-scan flag to enable scanning without network access.
    • Adds pom.xml file detection support for Java applications.
    • Adds NDB package database format support for RPM packages.
    • Adds a new misconfiguration field exposed in HTML report templates (html.tpl).

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !JAR detection is now disabled by default during filesystem and repository scanning.
37. v0.21.3 Dec 20, 2021 · release notes

    Trivy v0.21.3 adds plugin management subcommands and env var externalization for Helm.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.21.3 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.21.3

    └──▷ TRY IT
    List all currently installed Trivy plugins.
    copy

    $ trivy plugin list

    View detailed metadata for a specific installed plugin.
    copy

    $ trivy plugin info <plugin-name>

    • Adds plugin list and plugin info subcommands to manage installed plugins
    • Adds the ability to update installed plugins via a new option
    • Externalizes environment variables in Helm chart to ConfigMap

    3 details in Everything

38. v0.21.2 Dec 7, 2021 · release notes

    Trivy v0.21.2 adds support for Alpine Linux 3.15 in misconfiguration scanning

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.21.2 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.21.2

    • Adds alpine 3.15 version support for misconfiguration detection
    • Updates fanal dependency to include latest cfsec version updates

    2 details in Everything

39. v0.21.0 Nov 15, 2021 · release notes

    Trivy v0.21.0 adds IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. line numbers, cfsec engine support, and SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. identifier stability

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.21.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.21.0

    • feat(iac): Add line number information to IaC scan output for better remediation guidance.
    • feat(cloudformation): Add support for cfsec as an IaC scanning engine alongside existing backends.
    • SARIF identifiers are now generated using a stable algorithm rather than random strings, improving deduplication.

    3 details in Everything

40. v0.20.2 Oct 25, 2021 · release notes

    Trivy v0.20.2 adds new networking API features to Ingress support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.20.2 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.20.2

41. v0.20.1 Oct 16, 2021 · release notes

    Trivy v0.20.1 adds npm driver for JavaScript packages and extends custom-forward advisory data

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.20.1 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.20.1

    └──▷ USE IT
    Forward scan results to a custom endpoint while ensuring extended advisory data is included.
    shell copy

    trivy fs --format json --output - . | jq -c '.Results' | http POST https://example.com/webhook custom-forward

    • Adds javascript package type support via a new npm driver for scanning JavaScript dependencies
    • Enhances the custom-forward integration to include extended advisory data in forwarded outputs

    2 details in Everything

42. v0.20.0 Oct 6, 2021 · release notes

    Trivy v0.20.0 adds rootfs scanning, new package detection hooks, and improved reporting fields.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.20.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.20.0

    • Adds rootfs subcommand to scan a local filesystem directory directly
    • Migrates JSON report schema to the new format in --format json output
    • Adds OS metadata field EndOfServiceLife to report packages for EOL status
    • Adds image configuration details (tags, digests) to package scan reports
    • Adds support for scanning requirements.txt, gemspec, packages.config, and package.json files

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The JSON report schema has changed; existing parsers relying on the previous structure will break.
43. v0.19.0 Jul 12, 2021 · release notes

    Trivy v0.19.0 adds config scanning, Aqua plugin support, and Google Artifact Repository integration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.19.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.19.0

    └──▷ USE IT
    Enable verbose trace logging for debugging misconfiguration scans
    shell copy

    trivy config --trace ./path/to/configs

    Scan a local directory for IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. issues using the new config scanning capability
    shell copy

    trivy config ./infrastructure/terraform

    • Adds --trace flag to enable trace-level logging
    • Supports scanning configuration files (config scanning) in addition to containers
    • Adds new aqua plugin for extensible detection logic
    • Adds support for Google Artifact Repository as a remote registry source
    • Updates JSON report schema to include artifact metadata and version tracking

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The internal JSON schema structure has changed; existing parsers expecting the v0.18.x schema may fail or miss fields.
44. v0.18.0 May 12, 2021 · release notes

    Trivy v0.18.0 adds a gomod analyzer for Go dependencies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.18.0

45. v0.17.0 Apr 29, 2021 · release notes

    Trivy v0.17.0 adds binary and plugin support with versioned cache and disabled analyzers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.17.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.17.0

    • Adds feat(go): support binary scan to enable scanning of compiled Go binaries directly
    • Adds feat: support plugins to allow loading external Trivy plugins at runtime
    • Adds feat(cache): introduce versioned cache to manage cache versions explicitly
    • Adds feat: disable analyzers via flag or config to selectively turn off specific analyzers
    • Adds support for GitLab Advisory Database in Java scanning (feat(java): support GitLab Advisory Database) and jar/war/ear file types

    +1 more show less

    • Changes skip flags to use StringSliceFlag syntax: --skip-dirs and --skip-files now accept comma-separated lists

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !--skip-dirs and --skip-files flags now require a list format (comma-separated) instead of being repeatable flags
46. v0.16.0 Feb 8, 2021 · release notes

    Adds Podman image scanning support, Redis cache config options in Helm chart, and modular package scanning for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence./CentOS 8.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.16.0

    └──▷ USE IT
    Scan an image built with Podman locally.
    shell copy

    trivy image localhost/test:latest

    Configure Redis cache in a Helm chart values file for Trivy.
    yaml copy

    redis:
      enabled: true
      url: "redis://redis-master:6379"

    • Scan local Podman images (>=2.0) with trivy image
    • Add redis cache backend configuration options in the Helm chart
    • Support modular packages in RHEL 8/CentOS 8 for more accurate scanning

    3 details in Everything

47. v0.15.0 Dec 21, 2020 · release notes

    Trivy v0.15.0 adds NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. lock file scanning, Redis cache backend, HTML report templates, and a Helm chart.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.15.0

    └──▷ TRY IT
    Configure Trivy server to use a running Redis instance for faster cache lookups.
    copy

    $ trivy server --cache-backend redis://localhost:6379

    Generate an HTML vulnerability report from a Docker image scan.
    copy

    $ trivy image -f template --template '@contrib/html.tpl' -o report.html alpine:3.12

    • Adds support for scanning NuGet packages.lock.json files
    • Adds --cache-backend flag to configure Redis as the image/dictionary cache backend
    • Adds template output format via -f template with @contrib/html.tpl for HTML report generation
    • Releases Helm chart at helm/trivy for installing Trivy server mode

    4 details in Everything

48. v0.14.0 Dec 2, 2020 · release notes

    Trivy v0.14.0 adds PrimaryURL to JSON output and removes rpm dependency for scanning RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. images

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.14.0

    └──▷ USE IT
    Extract the direct advisory link for a specific CVE from Trivy's JSON scan results.
    shell copy

    trivy image --format json alpine:3.10 | jq -r '.[0].Vulnerabilities[].PrimaryURL'

    • Adds PrimaryURL field to the JSON output format for vulnerability entries

    1 detail in Everything

49. v0.13.0 Nov 23, 2020 · release notes

    Trivy v0.13.0 adds ppc64le and FreeBSD/OpenBSD binary support with a local DB download cache.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.13.0

    • Adds ppc64le architecture support via dedicated binaries

    1 detail in Everything

50. v0.12.0 Oct 21, 2020 · release notes

    Trivy v0.12.0 adds --skip-files, health endpoint, and CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-ID support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.12.0

    └──▷ USE IT
    Exclude specific lock files during image scanning to avoid false positives from unmanaged dependencies.
    shell copy

    trivy image --skip-files "/Gemfile.lock,/app/Pipfile.lock" quay.io/fluentd_elasticsearch/fluentd:v2.9.0

    Check the health status of a running Trivy server instance.
    shell copy

    curl http://127.0.0.1:4954/healthz

    Skip database updates during filesystem scanning for faster execution in offline or cached environments.
    shell copy

    trivy fs --skip-update /path/to/project

    • --skip-files flag added to trivy image to exclude specific lock files from traversal
    • Health check endpoint added to Trivy server at /healthz
    • --skip-update flag added to fs and repo subcommands to skip database updates
    • Official Docker images now published to GitHub Container Registry (ghcr.io/aquasecurity/trivy) alongside Docker Hub
    • Trivy server scan results now include CWE-ID field

    5 details in Everything

51. v0.11.0 Aug 30, 2020 · release notes

    Trivy v0.11.0 adds AWS Security Hub integration and --skip-dirs CLI flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.11.0

    • --skip-dirs flag on trivy image to exclude specific directories from vulnerability scanning traversal
    • AWS Security Hub integration via the security-hub output format for Trivy results

    2 details in Everything

52. v0.10.0 Jul 30, 2020 · release notes

    Trivy v0.10.0 adds OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic. filtering via --policy, CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-ID in JSON, --list-all-pkgs, and SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.10.0

    └──▷ USE IT
    Filter container image vulnerabilities using a custom OPA policy to ignore specific rules.
    shell copy

    trivy image --policy ./mypolicy.rego alpine:3.10

    Export all installed packages in SARIF format for integration with code scanning platforms.
    shell copy

    trivy image -f sarif --list-all-pkgs centos:7

    • --policy flag enables filtering vulnerabilities with an Open Policy Agent (OPA) Rego file
    • JSON output now includes CweIDs for each vulnerability entry
    • --list-all-pkgs option outputs all installed packages even if they have no vulnerabilities
    • SARIF output format is now supported via -f sarif

    4 details in Everything

53. v0.9.2 Jul 13, 2020 · release notes

    Trivy v0.9.2 adds JUnit XMLJUnit XMLA widely adopted test-report file format, originally from the Java JUnit framework, that records test suite results as XML; cyber tools emit it so their output plugs into CI systems like Jenkins or GitLab without custom parsers. output format and CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. score details in scan results

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.2 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.9.2

    • Adds junit-xml to supported --format values for CI dashboard compatibility
    • Includes CVSS vector strings and scores (NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization., RedHat) in JSON output

    2 details in Everything

54. v0.9.0 Jun 2, 2020 · release notes

    Trivy v0.9.0 adds fs and repo subcommands for scanning local filesystems and Git repositories.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.9.0

    └──▷ TRY IT
    Scan a local project directory for known vulnerabilities using lock files.
    copy

    $ trivy fs /path/to/my/project

    Check a public GitHub repository for dependencies with known vulnerabilities.
    copy

    $ trivy repo https://github.com/example-org/public-repo

    • Adds the fs subcommand to scan a local path (e.g., /path/to/project) by detecting vulnerabilities based on lock files like Gemfile.lock and package-lock.json
    • Adds the repo subcommand to scan remote public Git repositories (e.g., https://github.com/aquasecurity/trivy-ci-test")
    • Supports the GitHub Advisory Database as a data source to improve detection accuracy for programming language libraries

    3 details in Everything

55. v0.8.0 May 27, 2020 · release notes

    Trivy v0.8.0 adds image subcommand, CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. vectors in JSON output, and registry token auth

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.8.0

    └──▷ USE IT
    Scan a container image using the new explicit subcommand syntax.
    shell copy

    trivy image alpine:3.11

    • Adds image subcommand to explicitly scan container images (replaces deprecated direct IMAGE_NAME argument)
    • Adds VendorVectors field to JSON output containing raw CVSS v2/v3 strings for NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. and RedHat vendors
    • Supports TRIVY_REGISTRY_TOKEN environment variable for authenticating to private registries without username/password

    3 details in Everything

56. v0.7.0 May 12, 2020 · release notes

    Trivy v0.7.0 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. image layout support via --input and uses vendor severity by default

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.7.0

    └──▷ TRY IT
    Scan a local OCI image layout exported by Buildah or Skopeo
    copy

    $ trivy --input /path/to/oci/image/layout

    • Adds --input flag to scan an OCI Image Layout directory directly
    • Changes default severity source from NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. to vendor scores (e.g., Red Hat, Debian)

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Vulnerability severities now use vendor scores instead of NVD; filtering with --severity may yield different results than in previous versions
57. v0.5.3 Mar 24, 2020 · release notes

    Trivy v0.5.3 adds --version output, shows vulnerable layer origin, and fixes Windows path handling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.3 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.5.3

    • Add --version flag to display Trivy and VulnDB versions in the CLI output
    • Display the origin layer for each vulnerability in scan results

    2 details in Everything

58. v0.5.0 Mar 5, 2020 · release notes

    Trivy v0.5.0 adds LayerID to vulnerability detection and switches cache format to JSON

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.5.0

    • Adds LayerID field to vulnerability detection output for precise OS layer tracking
    • Changes internal cache storage to use a JSON-based format

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Dropped support for BSD platforms (temporarily removed)
59. v0.4.4 Feb 16, 2020 · release notes

    Trivy v0.4.4 adds a GitLab CI template for container scanning integration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.4 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.4.4

    └──▷ USE IT
    Use the new default Docker image which now includes the GitLab CI template to enable container scanning without manual artifact injection.
    shell copy

    docker pull docker.io/aquasec/trivy:0.4.4

60. v0.4.3 Jan 23, 2020 · release notes

    Trivy v0.4.3 adds a --template flag to render scan results using custom Go templates

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.3 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.4.3

    └──▷ USE IT
    Render vulnerability reports as HTML emails for automated notification pipelines.
    shell copy

    trivy --format template --template "@/path/to/template" golang:1.12-alpine

    • Adds --format template and --template flags to control result output via custom Go templates

    1 detail in Everything

61. v0.4.0 Dec 27, 2019 · release notes

    Trivy v0.4.0 adds Photon OS and SUSE support, configurable cache dir, custom token headers, and DB download progress.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.4.0

    └──▷ TRY IT
    Store the vulnerability database and image cache in a persistent or non-default location for faster subsequent scans.
    copy

    $ trivy --cache-dir /var/trivy/cache alpine:3.10

    Use a custom header name for token authentication when connecting to a Trivy server that expects a non-standard header.
    copy

    $ trivy server --token my-secret --token-header x-custom-token

    Scan a Photon OS container image for vulnerabilities.
    copy

    $ trivy photon:3.0

    Scan an openSUSE Leap container image for vulnerabilities.
    copy

    $ trivy opensuse/leap:15.0

    • --cache-dir flag to specify the directory for storing image cache
    • --token-header flag to customize the authentication header name (default is Trivy-Token)
    • --token flag for passing authentication tokens to server/client
    • Progress bar during vulnerability database download
    • Photon OS image scanning support (e.g., trivy photon:3.0)

    +1 more show less

    • SUSE Enterprise Linux and openSUSE image scanning support (e.g., trivy opensuse/leap:15.0)

    6 details in Everything

62. v0.3.0 Dec 13, 2019 · release notes

    Adds trivy server and trivy client commands to enable client/server architecture.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.3.0

    • trivy server is available as a new subcommand
    • trivy client is available as a new subcommand
    • Oracle Linux support added

    3 details in Everything

63. v0.2.1 Nov 15, 2019 · release notes

    Adds GITHUB_TOKEN support for rate limiting bypass

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.1 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.2.1

    • GITHUB_TOKEN environment variable is now respected to bypass GitHub API rate limits

    1 detail in Everything

64. v0.2.0 Nov 14, 2019 · release notes

    Trivy v0.2.0 adds --light and --download-db-only flags plus env var support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.0 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.2.0

    └──▷ USE IT
    Run a fast CI/CD scan where download speed matters more than detail granularity.
    shell copy

    trivy --light alpine:3.10

    Pre-download the DB to disk so scans can start immediately without waiting for network I/O.
    shell copy

    trivy --download-db-only

    Configure Trivy via environment variables to integrate with shell pipelines or CI configs.
    shell copy

    TRIVY_EXIT_CODE=1 trivy alpine:3.10

    • --light flag downloads a lightweight DB without vulnerability details for faster CI/CD scans
    • --download-db-only flag retrieves the vulnerability database without scanning any targets
    • Environment variables can now specify Trivy options (e.g. TRIVY_EXIT_CODE) alongside CLI flags

    3 details in Everything

65. v0.1.7 Oct 24, 2019 · release notes

    Trivy v0.1.7 adds Amazon Linux/Distroless support, Kaniko builds, and --ignorefile/--timeout/--template flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.7 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.1.7

    • Support for scanning Amazon Linux and Google Distroless OS images
    • Support for Kaniko build tool outputs
    • New --ignorefile flag to specify a .trivyignore path
    • New --timeout flag to set the scanning timeout duration
    • New --template flag to export results using a custom template

    5 details in Everything

66. v0.1.5 Aug 19, 2019 · release notes

    Trivy v0.1.5 adds OS EOL warnings, data source integration, and re-implements --cache-dir for configuration control.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.5 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.1.5

    └──▷ USE IT
    Store the vulnerability database in a specific local directory for faster subsequent scans.
    shell copy

    trivy image --cache-dir /tmp/trivy-cache alpine:latest

    • Displays a warning when scanning an OS that has reached End of Life (EOL)
    • Re-implements the --cache-dir flag to allow specifying a custom cache directory path

    2 details in Everything

67. v0.1.3 Jun 27, 2019 · release notes

    Trivy v0.1.3 adds vulnerability type filter via --skip-vulnerability-type flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.3 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.1.3

    • feat: add vulnerability type filter to get only os or packages vulnerabilities (--skip-vulnerability-type)

    1 detail in Everything

68. v0.1.2 May 28, 2019 · release notes

    Trivy v0.1.2 adds private Docker registry auth via ENV vars, alpine DB support, --only-update flag, and git clone depth option.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.2 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.1.2

    • --depth argument passed to git clone allows shallow clones for faster repository scanning.
    • Authentication for private Docker registries is supported using environment variables.
    • Alpine Linux packages are now available in the vulnerability database (dbnames).
    • --only-update flag added to update only the existing vulnerability database without running a scan.

    4 details in Everything

69. v0.0.14 May 19, 2019 · release notes

    Trivy v0.0.14 allows clearing cache and refreshing without specifying an image name.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.14 https://github.com/aquasecurity/trivy.git
    # already have the repo? check out this version:
    $ git checkout v0.0.14

    └──▷ TRY IT
    Clear the global Trivy cache without targeting a specific image.
    copy

    $ trivy --clear-cache

    Specify a custom directory for Trivy to store its scan cache data.
    copy

    $ trivy --cache-dir /tmp/trivy-cache ...

    • Enables --clear-cache and --refresh flags to be used without providing an image name
    • Allows user-specified cache directory via command-line option

    2 details in Everything