Fix(server): relationship field is missing on pacakge metadata on client/server

[sagic-orca]

Description

Missing relationship Field in Package Result

The relationship field is absent in the package result when running Trivy in client-server mode.

Reference: relevant code

Observed Behavior:

In client-server mode, the package information retrieved lacks the relationship field:

{
          "ID": "[email protected]",
          "Name": "wasm-bindgen-macro",
          "Identifier": {
            "PURL": "pkg:cargo/[email protected]",
            "UID": "ec6485484b07eaa7"
          },
          "Version": "0.2.95",
          "Indirect": true,
          "DependsOn": [
            "[email protected]",
            "[email protected]"
          ],
          "Layer": {},
          "Locations": [
            {
              "StartLine": 1795,
              "EndLine": 1803
            }
          ]
        }

Expected Behavior:

In regular mode (non-client-server), the package information includes the relationship field:

{
          "ID": "[email protected]",
          "Name": "wasm-bindgen-macro",
          "Identifier": {
            "PURL": "pkg:cargo/[email protected]",
            "UID": "30576f607fdacd3d"
          },
          "Version": "0.2.95",
          "Indirect": true,
          "Relationship": "indirect",
          "DependsOn": [
            "[email protected]",
            "[email protected]"
          ],
          "Layer": {},
          "Locations": [
            {
              "StartLine": 1795,
              "EndLine": 1803
            }
          ]
        }

Impact:
This discrepancy leads to inconsistent package information between modes, which may affect dependency resolution and analysis.

Desired Behavior

The relationship field should be retrieved in a client-server mode

Actual Behavior

Trivy in client/server mode doesn't have the relationship field in the output

Reproduction Steps

trivy fs --scanners vuln . --list-all-pkgs  -f json -o vulns.json --no-progress  --server http://127.0.0.1:6400 --token xxx --token-header yyy

Target

Filesystem

Scanner

Vulnerability

Output Format

JSON

Mode

Client/Server

Debug Output

2025-05-14T12:26:19+03:00	DEBUG	No plugins loaded
2025-05-14T12:26:19+03:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-05-14T12:26:19+03:00	DEBUG	Cache dir	dir="/Caches/trivy"
2025-05-14T12:26:19+03:00	DEBUG	Cache dir	dir="/Caches/trivy"
2025-05-14T12:26:19+03:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-05-14T12:26:19+03:00	DEBUG	Ignore statuses	statuses=[]
2025-05-14T12:26:19+03:00	DEBUG	[pkg] Package types	types=[os library]
2025-05-14T12:26:19+03:00	DEBUG	[pkg] Package relationships	relationships=[unknown root workspace direct indirect]
2025-05-14T12:26:19+03:00	INFO	[vuln] Vulnerability scanning is enabled
2025-05-14T12:26:19+03:00	DEBUG	[fs] Analyzing...	root="."
2025-05-14T12:26:19+03:00	DEBUG	[fs] Using the latest commit hash for calculating cache key	commit_hash="ef5c8cd984d971e63514a1a92eca2576410ef1e0"
2025-05-14T12:26:19+03:00	DEBUG	[fs] Cache hit	key="sha256:d708597a001808b86caebcf4049e87c125ad6d4a107fcb00481b8885c4310367"
2025-05-14T12:26:19+03:00	DEBUG	Specified ignore file does not exist	file=".trivyignore"
2025-05-14T12:26:19+03:00	DEBUG	[vex] VEX filtering is disabled

Operating System

macOS Sequoia

Version

Version: 0.61.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-05-14 06:20:58.608662601 +0000 UTC
  NextUpdate: 2025-05-15 06:20:58.608662351 +0000 UTC
  DownloadedAt: 2025-05-14 09:19:46.665216 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2025-02-11 02:54:15.168803466 +0000 UTC
  NextUpdate: 2025-02-14 02:54:15.168803346 +0000 UTC
  DownloadedAt: 2025-02-11 15:36:34.093134 +0000 UTC
Check Bundle:
  Digest: sha256:e13d31ec41e7a61a0eeb42afccd73a8e2802244c5c772764a5e2ffb30cab727c
  DownloadedAt: 2025-05-04 12:21:51.471301 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @sagic-orca
Thanks for your report!

Created #8871

Regards, Dmitriy