bug: Sarif report results.message.text arguments are in the wrong order

[aroes]

Description

The problem is here:

trivy/pkg/report/sarif.go

Desired Behavior

Expected:

  "message": {
    "text": "Artifact: package-lock.json\nLicense MPL-2.0\nPkgName: ip6addr\n Classification: reciprocal\n Path: package-lock.json"
  },

Actual Behavior

Example:

  "message": {
    "text": "Artifact: package-lock.json\nLicense MPL-2.0\nPkgName: reciprocal\n Classification: ip6addr\n Path: package-lock.json"
  },

Reproduction Steps

trivy fs . --scanners license --format sarif -o license.sarif --severity CRITICAL,HIGH,UNKNOWN,MEDIUM --license-confidence-level 0.7 --ignorefile ../.trivyignore.yml

Target

Filesystem

Scanner

License

Output Format

SARIF

Mode

Standalone

Debug Output

N/A

Operating System

macOS 15

Version

Version: 0.67.2
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-10-23 06:37:24.52758705 +0000 UTC
  NextUpdate: 2025-10-24 06:37:24.527586829 +0000 UTC
  DownloadedAt: 2025-10-23 09:28:37.596566 +0000 UTC
Check Bundle:
  Digest: sha256:0491169789b867ae5a7353381220c1d4d97b3a0d6d9dfd84a25d06f0ba68aa93
  DownloadedAt: 2025-10-22 10:57:31.690509 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[nikpivkin]

Hi @aroes !

Thanks for the report. Track #9711