v0.64.0

[owenrumney]

Draft to collaborate on v0.64.0

📑 Table of Contents

• 🚀 What's new? 🚀

  • 🐆 Ubuntu 20.04-ESM and 25.04 support 🦡
  • 🛡️ Root.io support 💻

• 👷‍♂️ Notable Fixes 🛠️

🚀 What's new? 🚀

🐆 Ubuntu 20.04-ESM and 25.04 support 🦡

Trivy now supports detection vulnerabilities for Ubuntu 20.04-ESM and 25.04 support.

Thanks @yutatokoi

🛡️ Root.io support 💻

Trivy now supports images patched with root.io.
If Trivy finds a package with the root.io version suffix, it switches to a combined mode to select advisories from both the vendor and root.io sources.

See more here

👷‍♂️ Notable Fixes 🛠️

• fix(cli): Add missing version check flags #8951
• fix(cli): Correctly check for semver versions for trivy version check #8948
• fix(misconf): .Config.User always takes precedence over USER in .History #9050
• fix(misconf): correct Azure value-to-time conversion in AsTimeValue #9015
• fix(misconf): move disabled checks filtering after analyzer scan #9002
• fix(misconf): reduce log noise on incompatible check #9029
• Support environment variables in Maven settings.xml #9000
• Trivy shows warning about corrupted trivy-db for first run (after clean) #8990
• bug(bun): Trivy can't parse bun.lock unless package dependency is array element 3 #8995
• bug(report): Trivy panics when converting json report without Packages to table report with summary table #8622
• fix(sbom): remove unnecessary OS detection check in SBOM decoding #9034
• fix: ignore check compatibility warnings for dev releases #8944