Skip to content

feat(julia): enable vulnerability scanning for the Julia language ecosystem #9800

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DmitriyLewen merged 16 commits into from
Dec 5, 2025
Merged

feat(julia): enable vulnerability scanning for the Julia language ecosystem #9800

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
fd1e97d
add support for Julia vulnerabilities
mbauman Oct 17, 2025
e1e8221
TEMP: use local trivy-db
mbauman Nov 12, 2025
3b92d37
add langpkg def
mbauman Nov 13, 2025
9480c8f
document vuln scanner support for Julia
mbauman Nov 13, 2025
41399c5
Remove unnecessary PkgTargets entry
mbauman Nov 19, 2025
f8f6f99
TEMP: use my github fork for trivy-db
mbauman Nov 19, 2025
133cfca
Merge remote-tracking branch 'origin/main' into jlsec
mbauman Nov 19, 2025
940535a
add julia tests
mbauman Nov 19, 2025
93f1cda
chore(deps): bump trivy-db fork
DmitriyLewen Nov 25, 2025
89df061
Merge branch 'main' into 'jlsec'
DmitriyLewen Nov 25, 2025
96f931a
fix: save VendorIDs in detected vulns
DmitriyLewen Nov 25, 2025
19176ef
mage docs:generate
DmitriyLewen Nov 25, 2025
13e22c6
test: remove extra vendorIDs
DmitriyLewen Nov 25, 2025
dbe4745
chore(deps): bump fork version
DmitriyLewen Nov 25, 2025
576b7b4
docs: sort the language pages in alphabetical order
DmitriyLewen Dec 2, 2025
4b1b359
chore(deps): use upstream trivy-db
DmitriyLewen Dec 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/guide/coverage/language/julia.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ The following scanners are supported.

| Package manager | SBOM | Vulnerability | License |
|-----------------|:----:|:-------------:|:-------:|
| Pkg.jl | ✓ | - | - |
| Pkg.jl | ✓ | ✓ | - |

The following table provides an outline of the features Trivy offers.

Expand Down
1 change: 1 addition & 0 deletions docs/guide/references/configuration/cli/trivy_filesystem.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,6 +168,7 @@ trivy filesystem [flags] PATH
- chainguard
- bitnami
- govulndb
- julia
- echo
- minimos
- rootio
Expand Down
1 change: 1 addition & 0 deletions docs/guide/references/configuration/cli/trivy_image.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,6 +189,7 @@ trivy image [flags] IMAGE_NAME
- chainguard
- bitnami
- govulndb
- julia
- echo
- minimos
- rootio
Expand Down
1 change: 1 addition & 0 deletions docs/guide/references/configuration/cli/trivy_kubernetes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,6 +177,7 @@ trivy kubernetes [flags] [CONTEXT]
- chainguard
- bitnami
- govulndb
- julia
- echo
- minimos
- rootio
Expand Down
1 change: 1 addition & 0 deletions docs/guide/references/configuration/cli/trivy_repository.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,6 +167,7 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
- chainguard
- bitnami
- govulndb
- julia
- echo
- minimos
- rootio
Expand Down
1 change: 1 addition & 0 deletions docs/guide/references/configuration/cli/trivy_rootfs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,7 @@ trivy rootfs [flags] ROOTDIR
- chainguard
- bitnami
- govulndb
- julia
- echo
- minimos
- rootio
Expand Down
1 change: 1 addition & 0 deletions docs/guide/references/configuration/cli/trivy_sbom.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,7 @@ trivy sbom [flags] SBOM_PATH
- chainguard
- bitnami
- govulndb
- julia
- echo
- minimos
- rootio
Expand Down
1 change: 1 addition & 0 deletions docs/guide/references/configuration/cli/trivy_vm.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,6 +153,7 @@ trivy vm [flags] VM_IMAGE
- chainguard
- bitnami
- govulndb
- julia
- echo
- minimos
- rootio
Expand Down
4 changes: 3 additions & 1 deletion docs/guide/scanner/vulnerability.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,7 @@ See [here](../coverage/language/index.md#supported-languages) for the supported
| Dart | [GitHub Advisory Database (Pub)][pub-ghsa] | ✅ | - |
| Elixir | [GitHub Advisory Database (Erlang)][erlang-ghsa] | ✅ | - |
| Swift | [GitHub Advisory Database (Swift)][swift-ghsa] | ✅ | - |
| Julia | [Open Source Vulnerabilities (Julia)][julia-osv] | ✅ | - |

[^1]: Intentional delay between vulnerability disclosure and registration in the DB

Expand Down Expand Up @@ -426,13 +427,14 @@ Example logic for the following vendor severity levels when scanning an Alpine i

[python-osv]: https://osv.dev/list?q=&ecosystem=PyPI
[rust-osv]: https://osv.dev/list?q=&ecosystem=crates.io
[julia-osv]: https://osv.dev/list?q=&ecosystem=Julia

[nvd]: https://nvd.nist.gov/vuln

[k8s-cve]: https://kubernetes.io/docs/reference/issues-security/official-cve-feed/

[CVE-2023-32681]: https://nvd.nist.gov/vuln/detail/CVE-2023-32681
[RHSA-2023:4520]: https://access.redhat.com/errata/RHSA-2023:4520
[RHSA-2023:4520]: https://access.redhat.com/errata/RHSA-2023:4520
[ghsa]: https://github.com/advisories
[requests]: https://pypi.org/project/requests/
[precision-recall]: https://developers.google.com/machine-learning/crash-course/classification/precision-and-recall
3 changes: 1 addition & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ require (
github.com/aquasecurity/testdocker v0.0.0-20250616060700-ba6845ac6d17
github.com/aquasecurity/tml v0.6.1
github.com/aquasecurity/trivy-checks v1.11.3-0.20250604022615-9a7efa7c9169
github.com/aquasecurity/trivy-db v0.0.0-20250929072116-eba1ced2340a
github.com/aquasecurity/trivy-db v0.0.0-20251205093947-925515d35727
github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48
github.com/aquasecurity/trivy-kubernetes v0.9.1
github.com/aws/aws-sdk-go-v2 v1.40.0
Expand Down Expand Up @@ -476,7 +476,6 @@ require (
google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20251022142026-3a174f9686a8 // indirect
google.golang.org/grpc v1.76.0 // indirect
gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/warnings.v0 v0.1.2 // indirect
Expand Down
6 changes: 2 additions & 4 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,8 +222,8 @@ github.com/aquasecurity/tml v0.6.1 h1:y2ZlGSfrhnn7t4ZJ/0rotuH+v5Jgv6BDDO5jB6A9gw
github.com/aquasecurity/tml v0.6.1/go.mod h1:OnYMWY5lvI9ejU7yH9LCberWaaTBW7hBFsITiIMY2yY=
github.com/aquasecurity/trivy-checks v1.11.3-0.20250604022615-9a7efa7c9169 h1:TckzIxUX7lZaU9f2lNxCN0noYYP8fzmSQf6a4JdV83w=
github.com/aquasecurity/trivy-checks v1.11.3-0.20250604022615-9a7efa7c9169/go.mod h1:nT69xgRcBD4NlHwTBpWMYirpK5/Zpl8M+XDOgmjMn2k=
github.com/aquasecurity/trivy-db v0.0.0-20250929072116-eba1ced2340a h1:Wmvjq3zQGsZ8Wlqh75zvujh7LZNTXU4YoEf8tyL1LoM=
github.com/aquasecurity/trivy-db v0.0.0-20250929072116-eba1ced2340a/go.mod h1:upAJqDQkN5FdIJbtJMpokncGNhYAPGkpoCbaGciWPt4=
github.com/aquasecurity/trivy-db v0.0.0-20251205093947-925515d35727 h1:LawBOgOh1qrwcVTPPfZPwZkuRBIfl4IyCitnmdAjwe8=
github.com/aquasecurity/trivy-db v0.0.0-20251205093947-925515d35727/go.mod h1:KL/C38wFKTREFgKSShT3DEmjNYSNXoYQ96wtQXRbnM8=
github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48 h1:JVgBIuIYbwG+ekC5lUHUpGJboPYiCcxiz06RCtz8neI=
github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48/go.mod h1:Ldya37FLi0e/5Cjq2T5Bty7cFkzUDwTcPeQua+2M8i8=
github.com/aquasecurity/trivy-kubernetes v0.9.1 h1:bSErQcavKXDh7XMwbGX7Vy//jR5+xhe/bOgfn9G+9lQ=
Expand Down Expand Up @@ -1520,8 +1520,6 @@ gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8
gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
gopkg.in/cheggaaa/pb.v1 v1.0.28 h1:n1tBJnnK2r7g9OW2btFH91V92STTUevLXYFb8gy9EMk=
gopkg.in/cheggaaa/pb.v1 v1.0.28/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
Expand Down
2 changes: 1 addition & 1 deletion mkdocs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,13 +99,13 @@ nav:
- Elixir: guide/coverage/language/elixir.md
- Go: guide/coverage/language/golang.md
- Java: guide/coverage/language/java.md
- Julia: guide/coverage/language/julia.md
- Node.js: guide/coverage/language/nodejs.md
- PHP: guide/coverage/language/php.md
- Python: guide/coverage/language/python.md
- Ruby: guide/coverage/language/ruby.md
- Rust: guide/coverage/language/rust.md
- Swift: guide/coverage/language/swift.md
- Julia: guide/coverage/language/julia.md
- IaC:
- Overview: guide/coverage/iac/index.md
- Azure ARM Template: guide/coverage/iac/azure-arm.md
Expand Down
5 changes: 3 additions & 2 deletions pkg/detector/library/driver.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,8 +83,8 @@ func NewDriver(libType ftypes.LangType) (Driver, bool) {
eco = ecosystem.Kubernetes
comparer = compare.GenericComparer{}
case ftypes.Julia:
log.Warn("Julia is supported for SBOM, not for vulnerability scanning")
return Driver{}, false
eco = ecosystem.Julia
comparer = compare.GenericComparer{}
Copy link
Collaborator

@knqyf263 knqyf263 Dec 3, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similar to other package managers, the Julia package manager respects semantic versioning (semver)

https://pkgdocs.julialang.org/v1/compatibility/

Does the Julia package versioning not follow semver? In the examples, versions such as 1.6 or 0.5 are specified, which are not allowed under semver.

Copy link
Contributor Author

@mbauman mbauman Dec 3, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Those are compat specifiers. The version numbers themselves are definitively semver syntax, and the Package manager applies semver's semantics to its upgrade/resolution behaviors. The compat specifiers are a more complicated version range syntax that allows folks to concisely describe ranges of real semver versions.

default:
log.Warn("The library type is not supported for vulnerability scanning",
log.String("type", string(libType)))
Expand Down Expand Up @@ -129,6 +129,7 @@ func (d *Driver) DetectVulnerabilities(pkgID, pkgName, pkgVer string) ([]types.D

vuln := types.DetectedVulnerability{
VulnerabilityID: adv.VulnerabilityID,
VendorIDs: adv.VendorIDs, // Any vendors have specific IDs, e.g. GHSA, JLSEC
PkgID: pkgID,
PkgName: pkgName,
InstalledVersion: pkgVer,
Expand Down
33 changes: 32 additions & 1 deletion pkg/detector/library/driver_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,10 @@ func TestDriver_Detect(t *testing.T) {
},
want: []types.DetectedVulnerability{
{
VulnerabilityID: "CVE-2022-21235",
VulnerabilityID: "CVE-2022-21235",
VendorIDs: []string{
"GHSA-6635-c626-vj4r",
},
PkgName: "github.com/Masterminds/vcs",
InstalledVersion: "v1.13.1",
FixedVersion: "v1.13.2",
Expand All @@ -78,6 +81,34 @@ func TestDriver_Detect(t *testing.T) {
},
},
},
{
name: "julia package",
fixtures: []string{
"testdata/fixtures/julia.yaml",
"testdata/fixtures/data-source.yaml",
},
libType: ftypes.Julia,
args: args{
pkgName: "HTTP",
pkgVer: "1.10.16",
},
want: []types.DetectedVulnerability{
{
VulnerabilityID: "CVE-2025-52479",
PkgName: "HTTP",
InstalledVersion: "1.10.16",
FixedVersion: "1.10.17",
DataSource: &dbTypes.DataSource{
ID: vulnerability.Julia,
Name: "Julia Ecosystem Security Advisories",
URL: "https://github.com/JuliaLang/SecurityAdvisories.jl",
},
VendorIDs: []string{
"JLSEC-2025-1",
},
},
},
},
{
name: "non-prefixed buckets",
fixtures: []string{"testdata/fixtures/php-without-prefix.yaml"},
Expand Down
5 changes: 5 additions & 0 deletions pkg/detector/library/testdata/fixtures/data-source.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,3 +30,8 @@
ID: "ghsa"
Name: "GitHub Security Advisory Go"
URL: "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago"
- key: "julia::Julia Ecosystem Security Advisories"
value:
ID: "julia"
Name: "Julia Ecosystem Security Advisories"
URL: "https://github.com/JuliaLang/SecurityAdvisories.jl"
2 changes: 2 additions & 0 deletions pkg/detector/library/testdata/fixtures/go.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,3 +8,5 @@
- v1.13.2
VulnerableVersions:
- "<v1.13.2"
VendorIDs:
- "GHSA-6635-c626-vj4r"
12 changes: 12 additions & 0 deletions pkg/detector/library/testdata/fixtures/julia.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
- bucket: "julia::Julia Ecosystem Security Advisories"
pairs:
- bucket: HTTP
pairs:
- key: CVE-2025-52479
value:
PatchedVersions:
- 1.10.17
VulnerableVersions:
- "<1.10.17"
VendorIDs:
- "JLSEC-2025-1"