release: v0.68.0 [main]

[aqua-bot]

🤖 I have created a release beep boop

0.68.0 (2025-10-27)

Features

• add ArtifactID field to uniquely identify scan targets (#9663) (84a7d9a)
• add ReportID field to scan reports (#9670) (fc976be)
• allow ignoring findings by type in Rego (#9578) (c638fc6)
• cli: Add trivy cloud suppport (#9637) (8e6a7ff)
• fs: change artifact type to repository when git info is detected (#9613) (cff91ac)
• image: add RepoTags support for Docker archives (#9690) (a9a3031)
• misconf: include map key in manifest snippet for diagnostics (#9681) (197c9e1)
• misconf: Update Azure Container Schema (#9673) (43a7546)
• sbom: use SPDX license IDs list to validate SPDX IDs (#9569) (35db88c)

Bug Fixes

• add buildInfo for BlobInfo in rpc package (#9608) (6def66e)
• close all opened resources if an error occurs (#9665) (fa6f779)
• java: update order for resolving package fields from multiple demManagement (#9575) (e286c5e)
• license: don't normalize unlicensed licenses into unlicense (#9611) (09162e5)
• nodejs: fix npmjs parser.pkgNameFromPath() panic issue (#9688) (231492d)
• nodejs: use the default ID format to match licenses in pnpm packages. (#9661) (804ea4a)
• report: correct field order in SARIF license results (#9712) (d20216e)
• restore compatibility for google.protobuf.Value (#9559) (aeeb2a1)
• sbom: add buildInfo info as properties (#9683) (2c43425)
• Trim the end-of-range suffix (#9618) (e18b038)
• Use fetch-level: 1 to check out trivy-repo in the release workflow (#9636) (6e53686)
• use context for analyzers (#9538) (b885d3a)
• using SrcVersion instead of Version for echo detector (#9552) (66479f0)
• validate backport branch name (#9548) (f0fd432)
• vex: don't use reused BOM (#9604) (7422cc7)

---

This PR was generated with Release Please. See documentation.