Issues

CycloneDX: scan fails entirely when orphan OS packages belong to more than one type (e.g. `deb` and `apk`)

aquasecurity/trivy#11572 · opened

on Nov 6, 2026

1

CycloneDX: scan fails entirely when `metadata.component` has an unsupported type (e.g. `firmware`)

aquasecurity/trivy#11569 · opened

on Nov 6, 2026

1

bug(yarn): packages pinned by `resolutions` are marked as production dependencies

aquasecurity/trivy#11568 · opened

on Nov 6, 2026

bug(misconf): ARM adapter does not read blob soft delete policy from nested blobServices resource

aquasecurity/trivy#11566 · opened

on Nov 6, 2026

bug(misconf): KSV-0109 fails with an evaluation conflict when a line has both ':' and '='

Bug

aquasecurity/trivy#11565 · opened

on Nov 6, 2026

fix(nodejs): yarn.lock parser takes the package name from dependenciesMeta keys

Bug

aquasecurity/trivy#11550 · opened

on Nov 5, 2026

1

fix(nodejs): npm link matches packages of another workspace with the same path prefix

Bug

aquasecurity/trivy#11549 · opened

on Nov 5, 2026

feat(go): collect module h1 checksums as package digests

Feature

aquasecurity/trivy#11548 · opened

on Nov 5, 2026

bug(misconf): network checks miss rules whose CIDRs together cover all addresses

Bug

aquasecurity/trivy#11512 · opened

on Oct 30, 2026

1

fix(nodejs): bun.lock with 4-element git entries fails to parse

Bug

aquasecurity/trivy#11502 · opened

on Oct 29, 2026

bug(kubernetes): checks with a `kind` selector run on all Kubernetes objects once one object matches

aquasecurity/trivy#11499 · opened

on Oct 29, 2026

fix(nuget): handle exact-version ranges ([x]) in *Packages.props

aquasecurity/trivy#11447 · opened

on Oct 21, 2026

4

fix(java): use repositories from pom.xml when resolving BOMs imported with scope=import

Bug

aquasecurity/trivy#11436 · opened

on Oct 20, 2026

· v0.77.0

bug(pnpm): direct optionalDependencies in importers are marked as dev

Bug

aquasecurity/trivy#11434 · opened

on Oct 19, 2026

3

bug(arm): Key Vault network ACL default action is never read

Bug

aquasecurity/trivy#11423 · opened

on Oct 16, 2026

bug(misconf): API Gateway v1 adapters skip methods on the REST API root resource

Bug

aquasecurity/trivy#11420 · opened

on Oct 16, 2026

bug(python): pylock.toml dependencies without a version are dropped from the dependency graph

aquasecurity/trivy#11411 · opened

on Oct 14, 2026

2

bug(cloudformation): API Gateway v1 adapter keeps only one stage and one resource per REST API

Bug

aquasecurity/trivy#11406 · opened

on Oct 14, 2026

CycloneDX VEX: only the last vulnerability object is used when several share the same ID

aquasecurity/trivy#11396 · opened

on Oct 13, 2026

1

bug(pnpm): direct dependencies with an aliased version in importers are marked as dev

Bug

aquasecurity/trivy#11389 · opened

on Oct 12, 2026

· v0.77.0

8

bug(alpine): apk dependencies that use the `~` version operator are dropped from the dependency graph

Bug

aquasecurity/trivy#11383 · opened

on Oct 12, 2026

· v0.77.0

2

bug(nodejs): yarn analyzer reports devDependencies of a workspace as production when another workspace depends on it

Bug

aquasecurity/trivy#11360 · opened

on Oct 6, 2026

4

bug(nodejs): yarn analyzer misreads protocols in package.json dependency ranges

Bug

aquasecurity/trivy#11357 · opened

on Oct 6, 2026

9

bug(sbom): vulnerabilities are attached to a random package when scanning an SPDX SBOM with SBOM output

Bug

aquasecurity/trivy#11327 · opened

on Sep 29, 2026

3

fix(alpine): false positives for apk packages without an origin (o:) field

Bug

aquasecurity/trivy#11322 · opened

on Sep 28, 2026

3

Navigation Menu

Repository navigation

Issues

CycloneDX: scan fails entirely when orphan OS packages belong to more than one type (e.g. `deb` and `apk`)

CycloneDX: scan fails entirely when `metadata.component` has an unsupported type (e.g. `firmware`)

bug(yarn): packages pinned by `resolutions` are marked as production dependencies

bug(misconf): ARM adapter does not read blob soft delete policy from nested blobServices resource

bug(misconf): KSV-0109 fails with an evaluation conflict when a line has both ':' and '='

fix(nodejs): yarn.lock parser takes the package name from dependenciesMeta keys

fix(nodejs): npm link matches packages of another workspace with the same path prefix

feat(go): collect module h1 checksums as package digests

bug(misconf): network checks miss rules whose CIDRs together cover all addresses

fix(nodejs): bun.lock with 4-element git entries fails to parse

bug(kubernetes): checks with a `kind` selector run on all Kubernetes objects once one object matches

fix(nuget): handle exact-version ranges ([x]) in *Packages.props

fix(java): use repositories from pom.xml when resolving BOMs imported with scope=import

bug(pnpm): direct optionalDependencies in importers are marked as dev

bug(arm): Key Vault network ACL default action is never read

bug(misconf): API Gateway v1 adapters skip methods on the REST API root resource

bug(python): pylock.toml dependencies without a version are dropped from the dependency graph

bug(cloudformation): API Gateway v1 adapter keeps only one stage and one resource per REST API

CycloneDX VEX: only the last vulnerability object is used when several share the same ID

bug(pnpm): direct dependencies with an aliased version in importers are marked as dev

bug(alpine): apk dependencies that use the `~` version operator are dropped from the dependency graph

bug(nodejs): yarn analyzer reports devDependencies of a workspace as production when another workspace depends on it

bug(nodejs): yarn analyzer misreads protocols in package.json dependency ranges

bug(sbom): vulnerabilities are attached to a random package when scanning an SPDX SBOM with SBOM output

fix(alpine): false positives for apk packages without an origin (o:) field