v0.72.0

Compare Source

Changelog

• 8a32853 release: v0.72.0 [main] (#​10782)
• 4295ac0 test: close plugin manager in tests cleanup (#​10904)
• d4213d7 Merge commit from fork
• 246ee3c feat(bottlerocket): add vulnerability matching for Bottlerocket OS (#​10893)
• abb5174 fix(misconf): support github_repository_vulnerability_alerts resource (#​10680)
• b8a1ccd feat(java): detect JAR licenses from packaged LICENSE files (#​10856)
• a10291b fix(nodejs): parse project dependencies from multi-document pnpm-lock.yaml (#​10861)
• a2777ae fix(server): propagate package repository class in client/server mode (#​10874)
• 6e37acf chore(deps): bump github.com/containerd/containerd/v2 from 2.3.1 to 2.3.2 (#​10888)
• dfd53cf fix(vuln): fall back to UNKNOWN severity when vulnerability details are missing (#​10795)
• 0a166c3 feat(java): detect JAR licenses from the embedded pom.xml (#​10851)
• 7a69b8f chore(deps): Upgrade github.com/cenkalti/backoff to v6 (#​10863)
• 1df6ca3 ci(helm): bump Trivy version to 0.71.2 for Trivy Helm Chart 0.23.2 (#​10873)
• 49299df chore(deps): bump alpine to 3.24.1 (#​10868)
• 13de603 docs: fix article typo in plugin developer guide (#​10860)
• a848925 feat(misconf): Adds CloudFront standard logging v2 support to AVD-AWS-0010 (#​10848)
• c1ad0e0 docs: fix typos (#​10857)
• 0aff3fd fix(terraform): avoid data race on global getter.Getters in remote module resolver (#​10843)
• e68f3d2 feat(secret): support new stateless format for GitHub App installation tokens (#​10826)
• 859a933 fix: correct format verbs in diagnostic messages (#​10805)
• 47b7ba4 ci(helm): bump Trivy version to 0.71.1 for Trivy Helm Chart 0.23.1 (#​10845)
• 3960fac refactor: use ParseErrorsAllowlist instead of ParseErrorsWhitelist (#​10830)
• 469d4fb docs: fix repository scan heading typo (#​10828)
• 39e0b13 Merge commit from fork
• 28d44d3 fix: forward ospkg detector options through ospkg.NewScanner (#​10811)
• 5619ae1 chore(deps): bump github.com/bufbuild/buf to v1.70.0 (#​10801)
• 1f56a34 fix(vex): load VEX documents from within the repository directory (#​10820)
• 848d135 ci!: migrate docker config to dockers_v2 (#​10783)
• bd78842 feat(dotnet): detect bundled runtime in self-contained deployments (#​10786)
• 65e5128 feat(secret): add OpenAI secret detection rules (#​10798)
• c613b5d ci: expect GitHub App bot as backport PR author (#​10813)
• 3054b3b fix: surface the original analysis error instead of context cancellation (#​10793)
• 15bdd2c chore(deps): bump the github-actions group across 1 directory with 11 updates (#​10803)
• 576b093 chore(deps): bump the common group with 4 updates (#​10797)
• 92b4a05 chore(deps): bump the aws group with 4 updates (#​10796)
• c8d1d0d fix: use random suffix for process temp directory instead of PID (#​10431)
• 3851371 docs: update signature verification for deb and rpm packages (#​10784)
• dccb128 fix(image): lookup origin layer for custom resources in merged layers (#​10788)
• 9032dcb test: fix flaky containerd integration test (#​10760)
• f00ee41 ci: bump GoReleaser to v2.16.0 (#​10774)
• 48af854 docs: fix broken nixpkgs reference link in installation guide (#​10776)
• b3d7be5 test(java): force offline-scan for client/server integration tests (#​10721)
• 888911b fix(image): deterministic OS package deduplication for images with embedded SBOMs (#​10777)
• c0654e1 fix(spdx): guard against nil root component in SPDX marshaler (#​10771)
• 7ca5a6b ci(helm): bump Trivy version to 0.71.0 for Trivy Helm Chart 0.23.0 (#​10768)

v0.71.2

Compare Source

Changelog

• 055a5c8 release: v0.71.2 [release/v0.71] (#​10871)
• 875328a fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#​10870)
• 998f7b3 chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#​10867)

v0.71.1

Compare Source

Changelog

• 164b383 release: v0.71.1 [release/v0.71] (#​10818)
• a72d9a4 fix(oci): validate artifact filename
• 3dd9847 fix: forward ospkg detector options through ospkg.NewScanner [backport: release/v0.71] (#​10825)
• a62cbe4 fix(vex): load VEX documents from within the repository directory [backport: release/v0.71] (#​10821)
• 43d1d26 fix: surface the original analysis error instead of context cancellation [backport: release/v0.71] (#​10812)
• ac7696c ci: expect GitHub App bot as backport PR author [backport: release/v0.71] (#​10815)

v0.71.0

Compare Source

⚡ Highlights ⚡

👉 https://redirect.github.com/aquasecurity/trivy/discussions/10767

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0710-2026-06-01

v0.70.0

Compare Source

⚡ Highlights ⚡

👉 https://redirect.github.com/aquasecurity/trivy/discussions/10546

Changelog

https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0700-2026-04-16

v0.69.3

Compare Source

Changelog

• 6fb20c8 release: v0.69.3 [release/v0.69] (#​10293)
• dabefec fix(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 [backport: release/v0.69] (#​10291)