v0.66.0

[aqua-bot]

📑 Table of Contents

• 🚀 What's new? 🚀
  • 📡 Scan larger files for secrets 🎯
  • ⏱️ Timeout Handling for Cache Database 🔒
  • 🛰️ Leverage local Terraform cache 🛋️
• 👷‍♂️ Notable Fixes 🛠️

🚀 What's new? 🚀

📡 Scan larger files for secrets 🎯

Previously, Trivy struggled with scanning very large files for secrets (which needs to read through the entire file content). The secret scanner now operates in streaming mode, reducing memory usage on large files while preserving detection accuracy. Internal optimizations also cut memory allocations and speed up keyword matching. In project benchmarks (300 MB file), we observed ~94% lower peak memory (2.17 GB → 133 MB) and ~86% faster scans (101 s → 14 s).

⏱️ Timeout Handling for Cache Database 🔒

Trivy now enforces a timeout on cache database (BoltDB) operations to prevent indefinite hangs when the cache is locked by another process. Timeout is set to 5 seconds and clearer error message is displayed (e.g., “cache may be in use by another process”).

See here for details.

🛰️ Leverage local Terraform cache 🛋️

In this version we've enabled the Terraform scanner to load modules from the local .terraform directory instead of downloading them from external sources like the Terraform Registry or GitHub. This makes scanning more reliable and independent of network availability.

👷‍♂️ Notable Fixes 🛠️

• fix(conda): memory leak by adding closure method for package.json file #9349
• bug(image): --insecure flag has no effect when scanning images from ECR registry #9323
• bug(plugin): trivy plugin update command removes installed plugins. #9357
• bug(python): Trivy uses non-normalized pkg name in *.dist-info dir name #9279
• bug(repo): Trivy doesn't show repository metadata if the scan cache contains this scan. #9388
• bug(repo): Trivy shows Git credentials in the Metadata.RepoURL field. #9390
• bug(cyclonedx): Trivy adds license ID/name and SPDX expression simultaneously for one component #9300
• bug(cyclonedx): CycloneDX report includes empty license #9376
• bug(cyclonedx): Error while SBOM's parsing of file MetadataComponent #9416

[itaysk]

The Trivy documentation under https://trivy.dev has not been updated with the updated of this release. We are investigating the issue.