Prepare for v0.67.0

[knqyf263]

Draft to collaborate on v0.67.0

📑 Table of Contents

• 🚀 What's new? 🚀
  • 📦 Default --list-all-pkgs Enabled 🔄
  • 🌀 Preserve CycloneDX SBOM Structure 📑
  • ⛑️ Improved Red Hat based OS detection 🐧
  • ☁️ CoreOS package detection 🚢
  • 🦭 Vulnerability detection for Seal Security packages 🔒
  • ☁️ CloudFormation: Support default values & list results in Fn::FindInMap 🗺️
• 🏎️ Performance 🏎️
• 👷‍♂️ Notable Fixes 🛠️

🚀 What's new? 🚀

📦 Default --list-all-pkgs Enabled 🔄

The CLI flag --list-all-pkgs now defaults to true. This change ensures that Trivy includes all detected packages in scan results by default, making SBOM generation and supply chain analysis more intuitive. Users who prefer the old behavior can still set --list-all-pkgs=false.

Usage

# Now includes all packages by default
$ trivy image --format json -o result.json debian:11
$ trivy convert --format cyclonedx --output result.cdx result.json

# To exclude packages
$ trivy image --format json --list-all-pkgs=false -o result.json debian:11

🌀 Preserve CycloneDX SBOM Structure 📑

Trivy now supports scanning CycloneDX SBOM inputs while preserving their original structure when the output is also CycloneDX. Custom components, properties, and relationships remain intact, with only vulnerability data added.

• ✅ CycloneDX → CycloneDX: structure preserved
• ⚠️ --pkg-types and --pkg-relationship are not supported in CycloneDX → CycloneDX scans

Usage

# Preserve SBOM structure (CycloneDX in → CycloneDX out)
$ trivy sbom input.cdx.json --format cyclonedx --output result.cdx.json

# Not supported
$ trivy sbom input.cdx.json --format cyclonedx --output result.cdx.json --pkg-types os
WARN: '--pkg-types' and '--pkg-relationships' options will be ignored when scanning SBOM and outputting SBOM format.

⛑️ Improved Red Hat based OS detection 🐧

Trivy now also scans the /etc/os-release file to detect Red Hat–based operating systems.
This helps identify OS distributions that provide only this file (e.g., Calico images).

Thanks to @teddygood

☁️ Support CoreOS package detection 🚢

Trivy now detects CoreOS as well as its RPM packages.

• ✅ OS name and version detection
• ✅ rpm packages detection
• ⚠️Vulnerability scanning is not available for this OS.

See more here

Thanks to @amitverse

🦭 Vulnerability detection for Seal Security packages 🔒

Trivy now supports vulnerability detection for Seal Security packages.

See more here

☁️ CloudFormation: Support default values & list results in Fn::FindInMap 🗺️

Add support for Fn::FindInMap enhancements:

• Default values when a key is missing, e.g.

Fn::FindInMap:
  - MapName
  - TopLevelKey
  - SecondLevelKey
  - DefaultValue: DefaultValue

List results in Mappings (values can be String or List, per docs)

Mappings:
  MyMap:
    Key1:
      Values: [ "a", "b", "c" ]

🏎️ Performance 🏎️

👷‍♂️ Notable Fixes 🛠️

• Fix resource leaks: file descriptors and pipes not closed on error paths #9535
• fix(db): Dowload database when missing but metadata still exists #9393 Thanks to @tom1299
• bug(npm): Trivy returns error if packages[].workspaces is object for package-lock.json files #9517
• bug(pnpm): Trivy incorrect marks Dev packages #9263 Thanks to @amitverse
• bug(nuget): Trivy doesn’t detect vulns when the case of the found package differs from the package in the GitHub advisory database. #9451
• bug(misconf): ENV with extra spaces in image history causes parse error #9496
• bug(misconf): unmark cty values before processing #9343
• bug(misconf): Dockerfile scanner fails when image history contains build metadata #9485
• fix(misconf): handle tofu files in module detection #9486
• fix(k8s): disable parallel traversal with fs cache for k8s images #9534
• bug(aws): Trivy can't connect to IMDS to get credentials #9437
• bug(vex): Trivy incorrectly suppresses vulnerabilities if the report contains orphan packages. #9526