v0.67.0

[aqua-bot]

📑 Table of Contents

• 🚀 What's new? 🚀
  • 📦 Show all pacakge information by default 🔄
  • 🌀 Preserve CycloneDX SBOM Structure 📑
  • ⛑️ Improved Red Hat based OS detection 🐧
  • ☁️ CoreOS package detection 🚢
  • 🦭 Vulnerability detection for Seal Security packages 🔒
  • ☁️ CloudFormation: Support Fn::FindInMap Enhancements 🗺️
• 🏎️ Performance 🏎️
• 👷‍♂️ Notable Fixes 🛠️

🚀 What's new? 🚀

📦 Show all pacakge information by default 🔄

The --list-all-pkgs flag is now turned on by default. This ensures that Trivy includes all detected packages in JSON scan results by default. Users who prefer the old behavior can still set --list-all-pkgs=false.

🌀 Preserve CycloneDX SBOM Structure 📑

When scanning CycloneDX SBOM for vulnerabilities and generating the results as CycloneDX SBOM with vulnerabilities, Trivy now preserves the original structure of the input SBOM (previously the some small differences could be observed).
Note that --pkg-types and --pkg-relationship are not supported in CycloneDX to CycloneDX scans.

⛑️ Improved Red Hat based OS detection 🐧

Trivy now also scans the /etc/os-release file to detect Red Hat–based operating systems.
This helps identify OS distributions that provide only this file (e.g. Calico images).

Thanks to @teddygood

☁️ Support CoreOS package detection 🚢

Trivy now detects CoreOS as well as its RPM packages.
Note that Vulnerability scanning is not available for this OS.

See more here

Thanks to @amitverse

🦭 Vulnerability detection for Seal Security packages 🔒

Trivy now supports vulnerability detection for Seal Security packages.

See more here

☁️ CloudFormation: Support Fn::FindInMap Enhancements 🗺️

Add support for Fn::FindInMap enhancements when scanning Cloud Formation templates for IaC misconfigurations.

🏎️ Performance 🏎️

👷‍♂️ Notable Fixes 🛠️

• Fix resource leaks: file descriptors and pipes not closed on error paths #9535
• fix(db): Dowload database when missing but metadata still exists #9393 Thanks to @tom1299
• bug(npm): Trivy returns error if packages[].workspaces is object for package-lock.json files #9517
• bug(pnpm): Trivy incorrect marks Dev packages #9263 Thanks to @amitverse
• bug(nuget): Trivy doesn’t detect vulns when the case of the found package differs from the package in the GitHub advisory database. #9451
• bug(misconf): ENV with extra spaces in image history causes parse error #9496
• bug(misconf): unmark cty values before processing #9343
• bug(misconf): Dockerfile scanner fails when image history contains build metadata #9485
• fix(misconf): handle tofu files in module detection #9486
• fix(k8s): disable parallel traversal with fs cache for k8s images #9534
• bug(aws): Trivy can't connect to IMDS to get credentials #9437
• bug(vex): Trivy incorrectly suppresses vulnerabilities if the report contains orphan packages. #9526