https://cybertoolchain.io/tools/trivy New releases and features in Trivy, tracked by The Cyber Toolchain. en Mon, 05 Oct 2026 07:55:16 GMT https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Mon, 05 Oct 2026 07:55:16 GMT Trivy: Adds a cryptographic asset scanner to the `image` command, surfacing keys, certificates, and signature algorithms in scan results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Sun, 04 Oct 2026 07:48:47 GMT Trivy gains a cryptographic asset scanner with CycloneDX output, ML-DSA key support, and uv workspace lockfile parsing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a cryptographic asset model, parser, and analyzer that scans images and passes discovered assets to the scan report via the `image` command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Outputs cryptographic assets in CycloneDX format and transfers them in client/server mode. • Supports ML-DSA keys and signature algorithms in cryptographic asset descriptions. • Adds vulnerability detection for Echo-patched Python packages. • Supports `uv` workspace lockfiles. • Allows disabling configuration files with empty paths. • Reports unparsable license names with `UNKNOWN` severity. • Classifies julia, bottlerocket, and centos stream packages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/releases/tag/v0.72.0 https://github.com/aquasecurity/trivy/releases/tag/v0.72.0 Tue, 30 Jun 2026 09:34:06 GMT Trivy v0.72.0 adds Bottlerocket scanning, OpenAI/GitHub App secret rules, .NET self-contained runtime detection, and JAR license extraction. • Adds vulnerability matching for Bottlerocket OS images. • Detects bundled .NET runtime in self-contained deployments, enabling CVE scanning of apps that ship their own runtime. • Adds OpenAI secret detection rules to the secrets scanner. • Adds detection of the new stateless format for GitHub App installation tokens in secrets scanning. • Extracts JAR licenses from embedded pom.xml files for more complete Java license inventory. • Extracts JAR licenses from packaged LICENSE files inside JARs. • Extends AVD-AWS-0010 misconfiguration check to cover CloudFront standard logging v2. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/releases/tag/v0.71.0 https://github.com/aquasecurity/trivy/releases/tag/v0.71.0 Mon, 01 Jun 2026 13:49:26 GMT Trivy v0.71.0 adds CycloneDX 1.7, Azure secret rules, Maven secret detection, customizable secret scan skip lists, and Ubuntu 26.04 support. • Supports CycloneDX 1.7 SBOM format for both input and output. • Adds SHA-512 hash algorithm support to the SPDX serializer. • New Azure secret detection rules covering Azure credentials and tokens. • New Maven secret detection rules for passwords and passphrases in settings.xml and settings-security.xml. • Enables customization of folders, files, and extensions skipped during secret scanning. • Supports Maven <mirrors> configuration from settings.xml when scanning pom.xml dependencies. • Detects Ubuntu 26.04 LTS as a recognized OS target. • Adds vendor directory support for language file detection in SEAL scanning. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Mon, 01 Jun 2026 00:00:00 GMT Trivy 0.71.0 adds secret scan customization, CycloneDX 1.7, Ubuntu 26.04 detection and language file seal support • Adds `WithDriver` and `WithProvider` options to the `ospkg` detector for custom operating system package sources • Supports `<mirrors>` directives from Maven `settings.xml` during Java dependency scanning • Enables CycloneDX 1.7 format output in SBOM generation • Adds vendor support for language file detection within the seal subsystem • Allows customization of skipped folders, files, and extensions in secret scanning via new configuration options • Adds Azure-specific secret detection rules to the secret scanner engine • Adds Maven-specific rules to detect passwords and passphrases in `settings.xml` and `settings-security.xml` • Adds SHA-512 hash algorithm support to the SPDX serializer output format • Adds detection capability for Ubuntu 26.04 LTS operating system Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Thu, 16 Apr 2026 00:00:00 GMT Trivy 0.70.0 adds pylock.toml parsing, ARM K8s misconf support, and server version in JSON output • Add pylock.toml (PEP 751) parser for Python dependency resolution • Detect Go version from ELF symbol table for binaries built with -trimpath • Include server version info in JSON output for client/server mode • Support azurerm_network_interface_security_group_association in misconf scanning • Adapt misconf rules for ARM-based Kubernetes clusters Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Fri, 30 Jan 2026 00:00:00 GMT Trivy 0.69.0 adds Julia scanning, Ansible misconf support, `AnalyzedBy` JSON field, and more • Adds initial **ansible** scanning support for infrastructure-as-code misconfigurations • Enables vulnerability scanning for the **Julia** language ecosystem • Adds support for **ActiveState** images • Adds **AnalyzedBy** field to track which analyzer detected packages • Adds JSON Schema for `trivy.yaml` configuration file via the **flag** feature • Adds **sslCertDir** parameter to **helm** subcommand for custom certificate directories • Enables modular package vulnerability detection for **rocky** Linux • Supports per-repo TLS configuration for **VEX** sources Breaking changes: • **misconf:** providers mapping now uses `ID` instead of `AVDID` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Tue, 02 Dec 2025 00:00:00 GMT Trivy 0.68.0 adds `trivy cloud` subcommand, `--cacert` flag, and unique ID fields to scan targets and reports. • `trivy cloud` subcommand is available for scanning cloud environments • Add `ArtifactID` field to uniquely identify scan targets in reports • Add `ReportID` field to scan reports (switched from UUIDv4 to UUIDv7) • Add `--cacert` flag to configure custom CA certificates for TLS verification • Enable concurrent access to the vulnerability database for performance improvement Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Tue, 30 Sep 2025 00:00:00 GMT Trivy 0.67.0 adds seal support, OS-level vulnerability updates via OS release detection, and CoreOS SBOM support • Adds `seal` support for cryptographically verifying the integrity of Trivy scan results • Adds os-release detection for RHEL-based images in the vulnerability scanner to improve package identification accuracy • Adds CoreOS platform support in the SBOM generator via `sbom` subsystem • Changes default value of `--list-all-pkgs` CLI flag to `true` in cloudformation scanning mode • Preserves CycloneDX SBOM structure during vulnerability updates when scanning existing SBOM files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Tue, 02 Sep 2025 00:00:00 GMT Trivy 0.66.0 adds streaming secret scanning, .terraform remote module caching, misconf audit configs, and cache timeouts. • `misconf`: added `audit` config attribute • use `.terraform` cache for remote modules in plan scanning • secret: implement streaming secret scanner with byte offset tracking • add timeout handling for cache database operations Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Wed, 30 Jul 2025 00:00:00 GMT Trivy v0.65.0 adds HTTP tracing, AlmaLinux 10 support, Git repo metadata in reports, and SARIF CVSS vectors. • `image` section gains Docker context resolution to handle image references via Docker context • `license` scanner observes `pkg_type` option to filter by package type • Git repository metadata is now included in Trivy scan reports • SARIF report output now includes CVSS vectors for findings • CycloneDX SBOM generation supports SHA-512 hashes • `misconf` rules added for GCP private IP access attribute in subnetworks and GCS bucket logging/versioning • AlmaLinux 10 is supported as a new platform for vulnerability scanning Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Mon, 30 Jun 2025 00:00:00 GMT Trivy 0.64.0 adds Root.io container scanning, OpenTofu support, CycloneDX metadata, and Terraform partial evaluation • Add `Root.io` support for container image scanning • Add OpenTofu file extension support in misconf scanning • Add partial evaluation for policy templates in Terraform • Dereference all Maven `settings.xml` environment placeholders • Add `manufacturer` field to CycloneDX tools metadata in SBOM output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Thu, 29 May 2025 00:00:00 GMT Trivy 0.63.0 adds Bottlerocket and MinimOS support, bun.lock analysis, license scanning enhancements, and JUnit location exports. • Add Bottlerocket OS package analyzer • Support license scanning in both GOPATH and vendor directories for Go projects • Add a Bun lock file analyzer for Node.js dependencies • Scan the `vendor` directory for licenses associated with `go.mod` files • Support compound licenses using SPDX operators • Extract maintainer field for Alpine APK packages • Export raw Terraform data to Rego for misconfiguration scanning • Add minimum Trivy version requirement support for misconfiguration rules • Include misconfiguration location information in JUnit output templates • Set the current working directory for the Terraform parser Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Wed, 30 Apr 2025 00:00:00 GMT Trivy 0.62 adds layer metadata to image reports, custom Rego for misconfig scanning, and improved yarn/cargo workspace support • `image`: saves layer metadata into the scan report (e.g., SBOM or vulnerability output) • `misconf`: allows passing a custom Rego scanner instance to the IaC scanner via the API/config • `misconf`: converts AWS managed policies directly into IAM documents for scanning • `misconf`: adds support for `auto_provisioning_defaults` in `google_container_cluster` misconfig checks • `nodejs`: recognizes root and workspace dependencies for `yarn` lockfiles • `rust`: recognizes root and workspace relationships/package metadata for `cargo` lockfiles Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Fri, 28 Mar 2025 00:00:00 GMT Trivy 0.61.0 adds k8s controller scanning, aws_ami misconf support, and WebAssembly rebuild. • `k8s`: add support for controllers Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Wed, 05 Mar 2025 00:00:00 GMT Trivy 0.60.0 adds `--vuln-severity-source` CLI flag and external VEX file loading for CycloneDX SBOMs. • Adds `--vuln-severity-source` flag to control which vulnerability severity source is used in scans • Add initial support for loading external VEX files from SBOM references in CycloneDX reports Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Thu, 30 Jan 2025 00:00:00 GMT Trivy 0.59.0 adds --distro flag, registry mirrors, and support for ignoring misconf violations in Dockerfile and Helm via inline comments. • Adds `--distro` flag to manually specify OS distribution for vulnerability scanning • Add a examples field to check metadata Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Mon, 02 Dec 2024 00:00:00 GMT Trivy 0.58.0 adds `workspaceRelationship` to scan responses, CVSS v4 support, and Private Packagist secrets detection. • Add `workspaceRelationship` to scan response JSON structure • Include CVSS v4 scores and vectors in scan results when available • Add built-in secrets detection rules for Private Packagist sources • Construct Go module dependencies directly in the parser for better accuracy Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Thu, 31 Oct 2024 00:00:00 GMT Trivy 0.57 adds `trivy registry` CLI command and misconfig reporting enhancements • Adds `trivy registry` subcommand for managing cloud registry authentication profiles • Supports multi-container Kubernetes scans with accurate per-container misconfiguration reporting Breaking changes: • The `trivy auth` subcommand has been renamed to `trivy registry`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Thu, 03 Oct 2024 00:00:00 GMT Trivy 0.56.0 adds support for multiple DB repositories, SUSE Linux Enterprise Micro, RPM archive scanning, and misconfig check disabling. • Adds support for multiple vulnerability and Java database repositories via `--db-repo` • Enables `misconf` checks to be disabled by ID using the new `--skip-check` flag • Extends `--skip-*` flags (e.g., `--skip-vuln-db`) to all included modules in misconfig scanning • Adds scanning support for RPM archives • Adds SUSE Linux Enterprise Micro as a supported platform for vulnerability detection Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Tue, 03 Sep 2024 00:00:00 GMT Trivy 0.55.0 adds --detection-priority tuning, --path-prefix for server mode, misconf scanning for YAML/JSON, and new VM filesystem support. • Adds `--detection-priority` flag to tune vulnerability detection accuracy • Adds internal `--path-prefix` flag for Trivy Server client/server mode • Adds Ext2/Ext3 filesystem support in VM scanning module • Adds direct filesystem support in VM scanning module • Adds `test` scope support for Java `pom.xml` files • Adds support for ignoring checks by nested attributes in misconf • Adds variable support for Terraform Plan in misconf • Adds support for policy and bucket grants in misconf • Adds iterator argument support for dynamic blocks in misconf • Adds port and protocol support for EC2 networks in misconf • Adds support for using spec from on-disk bundle in misconf • Exports modified findings in JSON reports • Uses `toolchain` as `stdlib` version for `go.mod` files • Sets User-Agent header on requests to Rekor for SBOM module • Makes Trivy Server Multiplexer exported Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Tue, 30 Jul 2024 00:00:00 GMT Trivy 0.54.0 adds VEX Repository support, Azure Linux scanning, and `--pkg-types`/`--pkg-relationships` flags. • log.FilePath() function for logger • openSUSE tumbleweed detection and scanning • `--pkg-types` flag (replaces `--vuln-type`) to control package types scanned • Azure Linux support in Mariner database • China configuration for ACRs misconf scanning • license parser to pnpm analyser for nodejs • image labels into `SPDX` and `CycloneDX` reports • vulnerability support for SPDX formats • `--pkg-relationships` flag to include package dependency relationships in vulnerability reports • share build-in rules • retrieve VEX attestations from OCI registries Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Mon, 01 Jul 2024 00:00:00 GMT Trivy 0.53.0 adds clean subcommand, local ImageID in SARIF, and memory cache backend. Removes aws subcommand. • Add `clean` subcommand to remove Trivy data files (cache, images, metadata) and free disk space • Add local ImageID to SARIF metadata for better correlation of scanned container images in SAST/SBOM workflows • Add memory cache backend to improve performance and reduce disk I/O overhead during scans • Add `conda` license support for `environment.yml` files to detect dependencies licenses in Conda environments • Add Dart dependency resolution using first version of constraint for SDK version dependencies • Set User-Agent header for Trivy container registry requests to improve tracking and access control compliance • Add Java support for `maven-metadata.xml` files in remote snapshot repositories for accurate version resolution • Add sbt project support via `sbt-dependency-lock` for dependency lock file parsing in Scala projects • Add `misconf` metadata to Cloud schema for enhanced cloud security posture analysis details • Add AWS CloudFormation support for `AWS::EC2::SecurityGroupIngress/Egress` resources in misconfiguration scanning • Add API Gateway V1 support for CloudFormation templates in infrastructure-as-code scanning • Add Rego selector support for all providers to enable fine-grained policy application across cloud environments • Add PHP `installed.json` file support for dependency resolution in Composer-based projects • Add plugin nested archive support for handling complex plugin packaging structures • Migrate SBOM output format to CycloneDX v1.6 standard for improved interoperability Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md Mon, 03 Jun 2024 00:00:00 GMT Trivy v0.52.0 adds Julia analyzer, plugin index support, and misconfig check deprecation. • Adds `Julia` language analyzer support • Adds support for a `plugin index` to discover and install plugins • Adds `misconf` capability to deprecate specific checks via Rego policy • Expands Terraform schema to recognize the `removed` block • Registers builtin Rego functions from the `trivy-checks` repository for custom policies • Enables resolving Terraform modules from OpenTofu compatible registries in misconfig scanning • Adds support for VPC resource types in inbound/outbound rule checks • Allows Trivy to follow symlinks inside Helm archives during scanning • Adds `v9` pnpm lock file parser support for Node.js dependency analysis • Adds ability to specify a concrete version when installing or referencing plugins • Extracts `license` information from `requirements.txt` files in Python analyses • Extracts `line number` data for each entry in `requirements.txt` during Python scanning • Includes filtered licenses and secrets in the `ModifiedFindings` field of reports when Rego filtering is active • Improves CSAF VEX format support for dependency relationship modeling • Supports non-root components mapping to products in OpenVEX generation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/releases/tag/v0.26.0 https://github.com/aquasecurity/trivy/releases/tag/v0.26.0 Fri, 15 Apr 2022 21:41:49 GMT Trivy v0.26.0 adds support for Alpine apk repositories and Go.mod in Go 1.17+ • Adds `feat(alpine): support apk repositories` to allow scanning of packages from custom or version-mixed Alpine mirrors • Adds support for `go.mod` files generated by Go 1.17+ runtime environments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/releases/tag/v0.25.4 https://github.com/aquasecurity/trivy/releases/tag/v0.25.4 Mon, 11 Apr 2022 16:29:57 GMT Trivy v0.25.4 adds PkgPath to table results and --db-repository flag for SBOM database selection. • Adds `PkgPath` field to the `--format table` output • Introduces `--db-repository` flag for custom SBOM vulnerability database mirrors Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/releases/tag/v0.25.3 https://github.com/aquasecurity/trivy/releases/tag/v0.25.3 Wed, 06 Apr 2022 07:16:49 GMT v0.25.3: Allow setting Maven Central URL via environment variable for JAR scanning • `TRIVY_MAVEN_URL` (or similar env var context) enables configuring the Maven Central repository URL for JAR dependency scans Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/releases/tag/v0.25.1 https://github.com/aquasecurity/trivy/releases/tag/v0.25.1 Mon, 04 Apr 2022 21:55:13 GMT Trivy v0.25.1 adds `--db-repository` flag to pull the advisory database directly from an OCI registry. • Adds `--db-repository` flag to specify an OCI registry URL for fetching the vulnerability database Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/releases/tag/v0.25.0 https://github.com/aquasecurity/trivy/releases/tag/v0.25.0 Thu, 31 Mar 2022 11:39:16 GMT Adds a dedicated `sbom` command for SBOM generation and enhances cyclonedx export with vulnerability data. • Adds the `trivy sbom` subcommand as a dedicated way to generate Software Bill of Materials outputs • Enables `--format cyclonedx` exports to include vulnerability details within the CycloneDX JSON output • Allows misconfigurations to be included in GitLab Codequality report formats via template support • Extends `trivy filesystem scan` to operate in client/server mode for distributed scanning workflows Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/releases/tag/v0.24.3 https://github.com/aquasecurity/trivy/releases/tag/v0.24.3 Wed, 16 Mar 2022 13:29:58 GMT Trivy v0.24.3 adds configurable helm service name and server token support • Adds `--helm.service-name` flag to the Helm scan command to allow configuring the Trivy service name • Adds `--helm.server-token` flag to authenticate Helm repository access during scans Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/releases/tag/v0.24.1 https://github.com/aquasecurity/trivy/releases/tag/v0.24.1 Sun, 27 Feb 2022 16:04:56 GMT Trivy v0.24.1 adds support for custom labels in Helm chart scanning via `--helm-set` • Adds custom label support to Helm chart scanning Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/releases/tag/v0.24.0 https://github.com/aquasecurity/trivy/releases/tag/v0.24.0 Wed, 23 Feb 2022 12:43:55 GMT Trivy v0.24.0 adds CycloneDX and JUnit misconfig report formats, CBL-Mariner 2.0 support, TLS InsecureSkipVerify config, purl utilities, and s390x images. • Adds `--format cyclonedx` to export findings in CycloneDX format • Adds misconfigurations to JUnit XML report output (`--format junit`) with new `<testcase>` elements for each finding • Adds `CBL-Mariner 2.0` support as a recognized OS type for vulnerability scanning • Adds `--tls-insecure-skip-verify` flag to the client/server connection to disable TLS certificate validation • Adds `purl` package utilities (generate purl package utilities) for converting packages to Package URL format • Adds s390x container images for scanning on IBM Z architecture Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/releases/tag/v0.23.0 https://github.com/aquasecurity/trivy/releases/tag/v0.23.0 Mon, 31 Jan 2022 14:47:54 GMT Trivy v0.23.0 adds ACR, single-file scanning, custom detectors, and TLS cache • Supports scanning a single file via the filesystem target (`fs` subcommand with path argument). • Adds support for custom detectors via `DetectorConfig` struct and `CustomDetectors` field. • Enables Redis TLS for the cache backend by setting `TRIVY_CACHE_REDIS_TLS_*` environment variables. • Adds Azure ACR registry support (`--security-checks config,secret,vuln` with `--remote` flag pointing to an ACR image). • Adds data sources for operating system packages (OS-PKG) and language-specific packages (LANG-PKG). • Supports CBL-Mariner OS in vulnerability detection. • Adds support for building RHEL images with build info. • Supports Rocky Linux OS in vulnerability detection. • Adds Photon OS EOL dates check in vulnerability detection. • Supports AlmaLinux OS in vulnerability detection. • Supports PAR files in Java language-specific package scanning. • Logs ignored vulnerabilities when debug logging is enabled. Breaking changes: • The root command was removed; you must now use subcommands like `trivy image` or `trivy fs` explicitly. • The SARIF template format changed from Rego-based to Go-code-based generation; existing custom SARIF templates will no longer work and must be rewritten for the new Go code structure. • The Trivy DB is now fetched from GHCR (`ghcr.io`) by default instead of the previous source. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/releases/tag/v0.22.0 https://github.com/aquasecurity/trivy/releases/tag/v0.22.0 Fri, 24 Dec 2021 22:44:13 GMT Trivy v0.22.0 adds --offline-scan support, pom.xml scanning, and NDB rpm updates • Adds the `--offline-scan` flag to enable scanning without network access. • Adds `pom.xml` file detection support for Java applications. • Adds NDB package database format support for RPM packages. • Adds a new misconfiguration field exposed in HTML report templates (`html.tpl`). Breaking changes: • JAR detection is now disabled by default during filesystem and repository scanning. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/releases/tag/v0.21.3 https://github.com/aquasecurity/trivy/releases/tag/v0.21.3 Mon, 20 Dec 2021 09:12:59 GMT Trivy v0.21.3 adds plugin management subcommands and env var externalization for Helm. • Adds `plugin list` and `plugin info` subcommands to manage installed plugins • Adds the ability to update installed plugins via a new option • Externalizes environment variables in Helm chart to ConfigMap Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/releases/tag/v0.21.2 https://github.com/aquasecurity/trivy/releases/tag/v0.21.2 Tue, 07 Dec 2021 02:17:23 GMT Trivy v0.21.2 adds support for Alpine Linux 3.15 in misconfiguration scanning • Adds `alpine` 3.15 version support for misconfiguration detection • Updates fanal dependency to include latest cfsec version updates Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/releases/tag/v0.21.0 https://github.com/aquasecurity/trivy/releases/tag/v0.21.0 Mon, 15 Nov 2021 15:18:58 GMT Trivy v0.21.0 adds IaC line numbers, cfsec engine support, and SARIF identifier stability • feat(iac): Add line number information to IaC scan output for better remediation guidance. • feat(cloudformation): Add support for `cfsec` as an IaC scanning engine alongside existing backends. • SARIF identifiers are now generated using a stable algorithm rather than random strings, improving deduplication. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy https://github.com/aquasecurity/trivy/releases/tag/v0.20.2 https://github.com/aquasecurity/trivy/releases/tag/v0.20.2 Mon, 25 Oct 2021 18:46:54 GMT Trivy v0.20.2 adds new networking API features to Ingress support. • Adds new networking API features to Ingress Full history on Cyber Toolchain: https://cybertoolchain.io/tools/trivy