Prepare for v0.61.0

[simar7]

Draft to collaborate on v0.61.0

📑 Table of Contents

• 🚀 What's new? 🚀

  • 📶 Optimize scanning performance by direct file access for known paths 👣
  • 🧩 Migrate from TinyGo to standard Go for WebAssembly modules 🔲
  • 👛 Added support Kubernetes controller components 🧦
  • 🪖Added support for scanning Amazon AMIs in misconfiguration scans 🪼

• 👷‍♂️ Notable Fixes 🛠️

• 🐟 Ecosystem Updates 🌳

🚀 What's new? 🚀

📶 Optimize scanning performance by direct file access for known paths 👣

Trivy now doesn't check every file found if the file paths are known for all enabled analyzers.
For example it works for --pkg-types os --scanners vuln.

See #8481 for more details.

🧩 Migrate from TinyGo to standard Go for WebAssembly modules 🔲

Go 1.24 improved Wasm support - https://go.dev/blog/wasmexport.
So Trivy migrated from TinyGo to Go WebAssembly modules.

👛 Added support Kubernetes controller components 🧦

Trivy is now able to scan resources from Kubernetes that are marked as controller components.

$ trivy k8s --report summary --scanners vuln

Summary Report for minikube
Workload Assessment
┌────────────────────┬─────────────────────────────────────────────┬──────────────────────┐
│     Namespace      │                  Resource                   │   Vulnerabilities    │
│                    │                                             ├───┬────┬────┬────┬───┤
│                    │                                             │ C │ H  │ M  │ L  │ U │
├────────────────────┼─────────────────────────────────────────────┼───┼────┼────┼────┼───┤
│ local-path-storage │ Deployment/local-path-provisioner           │ 1 │    │ 14 │ 11 │ 2 │
│ ingress-nginx      │ Job/ingress-nginx-admission-create          │ 1 │ 2  │ 9  │    │ 2 │
│ ingress-nginx      │ Job/ingress-nginx-admission-patch           │ 1 │ 2  │ 9  │    │ 2 │
│ ingress-nginx      │ Deployment/ingress-nginx-controller         │   │ 11 │ 38 │ 7  │ 2 │
│ ingress-nginx      │ ControlPlaneComponents/k8s.io/ingress-nginx │ 1 │ 4  │ 1  │    │   │
└────────────────────┴─────────────────────────────────────────────┴───┴────┴────┴────┴───┘
Severities: C=CRITICAL H=HIGH M=MEDIUM L=LOW U=UNKNOWN

🪖Added support for scanning Amazon AMIs in misconfiguration scans 🪼

Trivy now supports scanning for misconfigurations in AMI resources.

AVD-AWS-0344 (LOW): AWS AMI data source should specify owners to ensure AMIs come from trusted sources
═══════════════════════════════════════════════════════════════════════════════════════
AWS AMI data source should specify owners to avoid using unverified AMIs.
The owners field helps ensure you're using AMIs from known and trusted sources.


See https://avd.aquasec.com/misconfig/avd-aws-0344
───────────────────────────────────────────────────────────────────────────────────────
 bad.tf:6-12
───────────────────────────────────────────────────────────────────────────────────────
   6 ┌ data "aws_ami" "example_ami" {
   7 │   most_recent = true
   8 │   filter {
   9 │     name   = "name"
  10 │     values = ["my-custom-ami"] 
  11 │   }
  12 └ }
─────────

👷‍♂️ Notable Fixes 🛠️

• bug(spdx): Trivy can't parse text licenses with 2 consecutive tokens #8465
• bug(scan): --file-patterns doesn't work for some post-analyzers #6962
• bug(k8s): --report=all yields no results even when results are present #8616
• bug(dpkg): packages may include empty license strings #8621
• fix(fs): check postAnalyzers for StaticPaths #8543
• fix(misconf): resolve unknown values without panic  #8603
• fix(misconf): handle Terraform blocks and attributes safely #8589
• fix(misconf): skip Azure CreateUiDefinition #8500

🐟 Ecosystem Updates 🌳

VSCode Extension Updates

The Aqua Trivy extension has been updated, notable updates;

• Support for Aqua Platform
• Easier configuration of Trivy
• Option to use built-in Trivy version

For more information check the Trivy page on the VSCode Marketplace

JetBrains Plugin Updates

The Aqua Trivy plugin has been updated; notable updates

• Support for Aqua Platform
• Easier configuration of Trivy

For more information check the Trivy page on the JetBrains Marketplace

Azure Pipeline Task

• Tasks are now easier to configure with clearer options for inputs.
• The UI has been updated to allow for switching between Trivy runs and download reports in different formats

For more information, check the Trivy page on the Azure Pipelines Marketplace