0.63.0 version check reporting older version is available

[isuftin]

Description

Using 0.63.0, Trivy is reporting that v0.62.1 is no available

Desired Behavior

Trivy should be silent if version is current

Actual Behavior

Trivy reports that older version is available

Reproduction Steps

Download Trivy...


echo "FROM alpine:3.21" > Dockerfile

trivy config Dockerfile
2025-05-29T18:58:28Z    INFO    [misconfig] Misconfiguration scanning is enabled
2025-05-29T18:58:28Z    INFO    [misconfig] Need to update the checks bundle
2025-05-29T18:58:28Z    INFO    [misconfig] Downloading the checks bundle...
165.20 KiB / 165.20 KiB [----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 455.81 KiB p/s 600ms
2025-05-29T18:58:37Z    INFO    Detected config files   num=1

Report Summary

┌────────────┬────────────┬───────────────────┐
│   Target   │    Type    │ Misconfigurations │
├────────────┼────────────┼───────────────────┤
│ Dockerfile │ dockerfile │         2         │
└────────────┴────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


Dockerfile (dockerfile)

Tests: 27 (SUCCESSES: 25, FAILURES: 2)
Failures: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

AVD-DS-0002 (HIGH): Specify at least 1 USER command in Dockerfile with non-root user as argument
═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────


AVD-DS-0026 (LOW): Add HEALTHCHECK instruction in your Dockerfile
═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.

See https://avd.aquasec.com/misconfig/ds026
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────



📣 Notices:
  - Version v0.62.1 of Trivy is now available, current version is 0.63.0

To suppress version checks, run Trivy scans with the --skip-version-check flag

trivy --version
Version: 0.63.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-05-29 18:19:54.733149973 +0000 UTC
  NextUpdate: 2025-05-30 18:19:54.733149612 +0000 UTC
  DownloadedAt: 2025-05-29 18:39:34.656169777 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2025-05-29 02:55:53.03300355 +0000 UTC
  NextUpdate: 2025-06-01 02:55:53.03300344 +0000 UTC
  DownloadedAt: 2025-05-29 18:39:30.818979026 +0000 UTC
Check Bundle:
  Digest: sha256:3297649136fb7b3404a6c22622abdc09af26ff4ac21167d09087c32667e6b5e6
  DownloadedAt: 2025-05-29 18:58:30.49541463 +0000 UTC

Target

None

Scanner

Misconfiguration

Output Format

Table

Mode

Standalone

Debug Output

2025-05-29T19:01:33Z    DEBUG   No plugins loaded
2025-05-29T19:01:33Z    DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2025-05-29T19:01:33Z    DEBUG   Cache dir       dir="/home/trivy/.cache/trivy"
2025-05-29T19:01:33Z    DEBUG   Cache dir       dir="/home/trivy/.cache/trivy"
2025-05-29T19:01:33Z    DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-05-29T19:01:33Z    INFO    [misconfig] Misconfiguration scanning is enabled
2025-05-29T19:01:33Z    DEBUG   [notification] Running version check
2025-05-29T19:01:33Z    DEBUG   [misconfig] Checks successfully loaded from disk
2025-05-29T19:01:33Z    DEBUG   [notification] Version check completed  latest_version="v0.62.1"
2025-05-29T19:01:36Z    DEBUG   [rego] Overriding filesystem for checks
2025-05-29T19:01:36Z    DEBUG   [rego] Embedded libraries are loaded    count=17
2025-05-29T19:01:37Z    DEBUG   [rego] Embedded checks are loaded       count=519
2025-05-29T19:01:38Z    DEBUG   [rego] Checks from disk are loaded      count=536
2025-05-29T19:01:38Z    DEBUG   [rego] Overriding filesystem for data
2025-05-29T19:01:39Z    DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-05-29T19:01:39Z    DEBUG   Initializing scan cache...      type="memory"
2025-05-29T19:01:39Z    DEBUG   [fs] Analyzing...       root="Dockerfile"
2025-05-29T19:01:39Z    DEBUG   [fs] Random cache key will be used      err="failed to open git repository: stat /home/trivy/Dockerfile/.git: not a directory"
2025-05-29T19:01:39Z    DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Dockerfile"
2025-05-29T19:01:39Z    DEBUG   [dockerfile scanner] Scanning files...  count=1
2025-05-29T19:01:39Z    DEBUG   [rego] Scanning inputs  count=1
2025-05-29T19:01:40Z    DEBUG   OS is not detected.
2025-05-29T19:01:40Z    INFO    Detected config files   num=1
2025-05-29T19:01:40Z    DEBUG   Scanned config file     file_path="Dockerfile"
2025-05-29T19:01:40Z    DEBUG   Specified ignore file does not exist    file=".trivyignore"
2025-05-29T19:01:40Z    DEBUG   [vex] VEX filtering is disabled

Report Summary

┌────────────┬────────────┬───────────────────┐
│   Target   │    Type    │ Misconfigurations │
├────────────┼────────────┼───────────────────┤
│ Dockerfile │ dockerfile │         2         │
└────────────┴────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


Dockerfile (dockerfile)

Tests: 27 (SUCCESSES: 25, FAILURES: 2)
Failures: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

AVD-DS-0002 (HIGH): Specify at least 1 USER command in Dockerfile with non-root user as argument
═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────


AVD-DS-0026 (LOW): Add HEALTHCHECK instruction in your Dockerfile
═════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.

See https://avd.aquasec.com/misconfig/ds026
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────


2025-05-29T19:01:40Z    DEBUG   [notification] Printing notices

📣 Notices:
  - Version v0.62.1 of Trivy is now available, current version is 0.63.0

To suppress version checks, run Trivy scans with the --skip-version-check flag

Operating System

Alpine

Version

trivy --version
Version: 0.63.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-05-29 18:19:54.733149973 +0000 UTC
  NextUpdate: 2025-05-30 18:19:54.733149612 +0000 UTC
  DownloadedAt: 2025-05-29 18:39:34.656169777 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2025-05-29 02:55:53.03300355 +0000 UTC
  NextUpdate: 2025-06-01 02:55:53.03300344 +0000 UTC
  DownloadedAt: 2025-05-29 18:39:30.818979026 +0000 UTC
Check Bundle:
  Digest: sha256:3297649136fb7b3404a6c22622abdc09af26ff4ac21167d09087c32667e6b5e6
  DownloadedAt: 2025-05-29 18:58:30.49541463 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[isuftin]

I should also mention that the config command does not have the --skip-version-check flag available to it, so the output during the config command with the note to use the flag to squelch it doesn't make sense

[itaysk]

@owenrumney PTAL why config target is different.

[itaysk]

Sorry about that, temporary glitch that is fixed now. Won't happen next time. Thanks for reporting!