feat(julia): enable vulnerability scanning for the Julia language ecosystem

[mbauman]

Description

This is the final step in supporting Julia vulnerability scanning (#9071). It requires the related PRs to first be merged.

Before

2025-08-22T17:22:07Z	INFO	[julia] Detecting vulnerabilities...
2025-08-22T17:22:07Z	WARN	Julia is supported for SBOM, not for vulnerability scanning

Report Summary

┌───────────────┬───────┬─────────────────┬─────────┐
│    Target     │ Type  │ Vulnerabilities │ Secrets │
├───────────────┼───────┼─────────────────┼─────────┤
│ Manifest.toml │ julia │        0        │    -    │
└───────────────┴───────┴─────────────────┴─────────┘

After

2025-11-13T17:04:35Z	INFO	[julia] Detecting vulnerabilities...
2025-11-13T17:04:35Z	WARN	Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/dev/docs/scanner/vulnerability#severity-selection for details.

Report Summary

┌───────────────┬───────┬─────────────────┬─────────┐
│    Target     │ Type  │ Vulnerabilities │ Secrets │
├───────────────┼───────┼─────────────────┼─────────┤
│ Manifest.toml │ julia │        2        │    -    │
└───────────────┴───────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


Manifest.toml (julia)

Total: 2 (UNKNOWN: 1, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│   Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├─────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ HTTP        │ CVE-2025-61689 │ UNKNOWN  │ fixed  │ 1.10.17           │ 1.10.19       │ Header injection/Response splitting via header construction. │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-61689                   │
├─────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ MbedTLS_jll │ CVE-2025-27810 │ MEDIUM   │        │ 2.28.6+0          │ 2.28.10+0     │ Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases  │
│             │                │          │        │                   │               │ of...                                                        │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-27810                   │
└─────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

Related issues

The discussion in #9071 has not been converted into an issue.

Related PRs

This depends upon:

• feat(julia): define the Julia ecosystem trivy-db#595
  • Replace commits f8f6f99 and e1e8221 (which enable using my fork's trivy-db) with the published upstream

Remove this section if you don't have related PRs.

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• (N/A) I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[mbauman]

This is now working 🎉

$ ./trivy fs --cache-dir ./cache --skip-db-update  ~/tmp
2025-11-13T17:04:35Z	INFO	[vuln] Vulnerability scanning is enabled
2025-11-13T17:04:35Z	INFO	[secret] Secret scanning is enabled
2025-11-13T17:04:35Z	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-11-13T17:04:35Z	INFO	[secret] Please see https://trivy.dev/dev/docs/scanner/secret#recommendation for faster secret detection
2025-11-13T17:04:35Z	INFO	Number of language-specific files	num=1
2025-11-13T17:04:35Z	INFO	[julia] Detecting vulnerabilities...
2025-11-13T17:04:35Z	WARN	Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/dev/docs/scanner/vulnerability#severity-selection for details.

Report Summary

┌───────────────┬───────┬─────────────────┬─────────┐
│    Target     │ Type  │ Vulnerabilities │ Secrets │
├───────────────┼───────┼─────────────────┼─────────┤
│ Manifest.toml │ julia │        2        │    -    │
└───────────────┴───────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


Manifest.toml (julia)

Total: 2 (UNKNOWN: 1, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│   Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├─────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ HTTP        │ CVE-2025-61689 │ UNKNOWN  │ fixed  │ 1.10.17           │ 1.10.19       │ Header injection/Response splitting via header construction. │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-61689                   │
├─────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ MbedTLS_jll │ CVE-2025-27810 │ MEDIUM   │        │ 2.28.6+0          │ 2.28.10+0     │ Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases  │
│             │                │          │        │                   │               │ of...                                                        │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-27810                   │
└─────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

[DmitriyLewen]

@mbauman Thanks for your contribution!

LGTM

@knqyf263 can you take a look?

[stemann]

@mbauman Thanks for this - excellent with Julia vuln. support in Trivy!

I gave a build of this PR a spin with just a Manifest.toml and was surprised that the Project.toml is also required?

[mbauman]

Yeah, Julia itself doesn't really do anything with just a bare Manifest. In fact, when you load such an environment, Julia reports an "empty Project" and you are unable to import any of the packages in the Manifest. You can take an extra step to instantiate such an environment, and it'll work backwards to create the corresponding Project.toml file with all the manifest dependencies recorded as top-level requirements. Only at that point will you be able to import any of the packages.

The moment you have Julia do any work with packages, you'll always have the pair of both files.

[knqyf263]

Similar to other package managers, the Julia package manager respects semantic versioning (semver)

https://pkgdocs.julialang.org/v1/compatibility/

Does the Julia package versioning not follow semver? In the examples, versions such as 1.6 or 0.5 are specified, which are not allowed under semver.

[mbauman]

Those are compat specifiers. The version numbers themselves are definitively semver syntax, and the Package manager applies semver's semantics to its upgrade/resolution behaviors. The compat specifiers are a more complicated version range syntax that allows folks to concisely describe ranges of real semver versions.

[stemann]

Yeah, Julia itself doesn't really do anything with just a bare Manifest. In fact, when you load such an environment, Julia reports an "empty Project" and you are unable to import any of the packages in the Manifest. You can take an extra step to instantiate such an environment, and it'll work backwards to create the corresponding Project.toml file with all the manifest dependencies recorded as top-level requirements. Only at that point will you be able to import any of the packages.

The moment you have Julia do any work with packages, you'll always have the pair of both files.

Yeah, I know. Just hit this when I lazily provided only the Manifest.toml for a corresponding custom sysimage.

And wondered whether the Project.toml was required for trivy to operate. Not sure if, e.g., the cargo or conan implementations require more than the lock file?

Edit: But this might also be unrelated to this PR.

[knqyf263]

LGTM!

[DmitriyLewen]

Thanks @mbauman for your perfect work!

[mbauman]

Thank you for getting it in! It's exciting to get this support here.