{"id":"CVE-2025-21614","aliases":["ALSA-2025:0401","AZL-55063","AZL-55073","AZL-55079","AZL-55106","DEBIAN-CVE-2025-21614","EUVD-2025-0043","GHSA-r9px-m959-cxf4","GO-2025-3367","RHSA-2025:0401","RHSA-2025:0662","RLSA-2025:0401","SUSE-SU-2025:0060-1","UBUNTU-CVE-2025-21614","USN-8088-1","openSUSE-SU-2025:0056-1","openSUSE-SU-2025:14624-1","openSUSE-SU-2025:14634-1","openSUSE-SU-2025:15487-1","openSUSE-SU-2025:20117-1","openSUSE-SU-2025:20177-1","openSUSE-SU-2026:20798-1"],"status":"published","title":"go-git clients vulnerable to DoS via maliciously crafted Git server replies","description":"go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00717,"percentile":0.54247,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-400","CWE-770"],"published":"2025-01-06T16:20:16Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Go","package":"github.com/go-git/go-git/v5","fixed_in":["5.13.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"packer","fixed_in":["1.9.5-5"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"packer","fixed_in":["1.9.5-7"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"cri-o","fixed_in":["1.22.3-14"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-github-go-git-go-git","fixed_in":["5.13.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-go-git-go-git","fixed_in":["5.13.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-github-go-git-go-git","fixed_in":["5.4.2-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"golang-github-go-git-go-git","fixed_in":["5.4.2-4ubuntu0.24.04.3+esm2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"gopkg.in/src-d/go-git.v4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.13.1"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/go-git/go-git/v5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/go-git/go-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.13.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.10-21.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.10-21.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-14"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-go-git-go-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1","5.11.0-2","5.11.0-3","5.11.0-4","5.12.0-1","5.13.2-1","5.14.0-1","5.16.2-1","5.17.0-1","5.17.1-1","5.19.1-1","5.4.2-3","5.4.2-4"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-go-git-go-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-go-git-go-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.13.2-1"}]}]},{"source":"osv","ecosystem":"Go","package":"gopkg.in/src-d/go-git.v4","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"last_affected":"4.13.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-git/go-git/v5","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.13.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-git/go-git","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"last_affected":"4.13.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-git/go-git/v4","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/go-git/go-git/v5","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.13.0"}]}]},{"source":"osv","ecosystem":"Go","package":"gopkg.in/src-d/go-git.v4","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-21.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-21.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-21.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-21.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-21.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-21.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"grafana-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-21.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"grafana-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-21.el9_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.10-21.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250108T191942-150000.1.26.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250108T191942-150000.1.26.1"}]}],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-github-go-git-go-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-3ubuntu0.1~esm1"}]}],"versions":["5.4.2-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"golang-github-go-git-go-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-4ubuntu0.24.04.3+esm2"}]}],"versions":["5.4.2-3build1","5.4.2-4","5.4.2-4ubuntu0.24.04.1","5.4.2-4ubuntu0.24.04.2","5.4.2-4ubuntu0.24.04.2+esm1","5.4.2-4ubuntu0.24.04.3","5.4.2-4ubuntu0.24.04.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"golang-github-go-git-go-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-3ubuntu0.1~esm1"}]}],"versions":["5.4.2-3"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"golang-github-go-git-go-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.2-4ubuntu0.24.04.3+esm2"}]}],"versions":["5.4.2-3build1","5.4.2-4","5.4.2-4ubuntu0.24.04.1","5.4.2-4ubuntu0.24.04.2","5.4.2-4ubuntu0.24.04.2+esm1","5.4.2-4ubuntu0.24.04.3","5.4.2-4ubuntu0.24.04.3+esm1"],"bundled":5},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.58.2-bp156.2.6.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.58.2-bp156.2.6.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250108T191942-1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"operator-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cheat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"cheat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-bp160.2.1"}]}],"bundled":8}],"products":[{"vendor":"go-git","product":"go-git"},{"vendor":"go-git_project","product":"go-git"}],"references":[{"url":"https://github.com/go-git/go-git/security/advisories/GHSA-r9px-m959-cxf4","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21614","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-r9px-m959-cxf4"},{"url":"https://access.redhat.com/errata/RHSA-2025:0401","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21613","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21614","tags":["report"]},{"url":"https://bugzilla.redhat.com/2335888","tags":["report"]},{"url":"https://bugzilla.redhat.com/2335901","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-0401.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21614.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-21614","tags":["advisory"]},{"url":"https://github.com/go-git/go-git","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2335888","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2335901","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0401.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21613","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21613","tags":["advisory"]},{"url":"https://github.com/go-git/go-git/security/advisories/GHSA-v725-9546-7q7m","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3368","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21614","tags":["advisory","report"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3367","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0662","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0662.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:0401","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250060-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22130","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-21614","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8088-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-49568","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-49569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-21613","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-25934","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUNHR7ATZWEF5LQKUNEXKL22CUQAND3A/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227010","tags":["report"]},{"url":"https://bugzilla.suse.com/1234512","tags":["report"]},{"url":"https://bugzilla.suse.com/1235265","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UV63VQGB6Y3V7AIZHIKF3PMFVIHM32MI/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VCY3UOSZNLMH6IOLEYWFNO3UOF3DLF3P/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://bugzilla.suse.com/1232948","tags":["report"]},{"url":"https://bugzilla.suse.com/1237618","tags":["report"]},{"url":"https://bugzilla.suse.com/1239225","tags":["report"]},{"url":"https://bugzilla.suse.com/1239385","tags":["report"]},{"url":"https://bugzilla.suse.com/1240466","tags":["report"]},{"url":"https://bugzilla.suse.com/1241724","tags":["report"]},{"url":"https://bugzilla.suse.com/1243633","tags":["report"]},{"url":"https://bugzilla.suse.com/1246151","tags":["report"]},{"url":"https://bugzilla.suse.com/1246730","tags":["report"]},{"url":"https://bugzilla.suse.com/1248897","tags":["report"]},{"url":"https://bugzilla.suse.com/1248937","tags":["report"]},{"url":"https://bugzilla.suse.com/1250625","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58058","tags":["web"]},{"url":"https://bugzilla.suse.com/1247629","tags":["report"]},{"url":"https://bugzilla.suse.com/1253593","tags":["report"]},{"url":"https://bugzilla.suse.com/1253922","tags":["report"]},{"url":"https://bugzilla.suse.com/1254051","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58181","tags":["web"]},{"url":"https://bugzilla.suse.com/1251363","tags":["report"]},{"url":"https://bugzilla.suse.com/1251547","tags":["report"]},{"url":"https://bugzilla.suse.com/1253512","tags":["report"]},{"url":"https://bugzilla.suse.com/1253786","tags":["report"]},{"url":"https://bugzilla.suse.com/1253977","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-21614","title":"go-git clients vulnerable to DoS via maliciously crafted Git server replies","description":"go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.","status":"published","published":"2025-01-06T16:20:16.14Z","modified":"2025-08-26T19:48:04.692Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:32:32.702673Z"}],"euvd":[{"id":"EUVD-2025-0043","description":"go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.","status":"published","published":"2025-01-06T16:20:16Z","modified":"2025-08-26T19:48:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:31:52.651465Z"}],"ghsa":[{"id":"GHSA-r9px-m959-cxf4","title":"go-git clients vulnerable to DoS via maliciously crafted Git server replies","description":"### Impact\nA denial of service (DoS) vulnerability was discovered in go-git versions prior to `v5.13`. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in `go-git` clients. \n\nThis is a `go-git` implementation issue and does not affect the upstream `git` cli.\n\n### Patches\nUsers running versions of `go-git` from `v4` and above are recommended to upgrade to `v5.13` in order to mitigate this vulnerability.\n\n### Workarounds\nIn cases where a bump to the latest version of `go-git` is not possible, we recommend limiting its use to only trust-worthy Git servers.\n\n## Credit\nThanks to Ionut Lalu for responsibly disclosing this vulnerability to us.","status":"published","published":"2025-01-06T16:20:28Z","modified":"2025-08-27T14:24:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-400","CWE-770"],"updated_at":"2026-11-02T14:38:54.795089Z"}],"nvd":[{"id":"CVE-2025-21614","description":"go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.","status":"published","published":"2025-01-06T17:15:47.31Z","modified":"2026-06-17T08:43:51.603Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:10:48.373347Z"}],"osv":[{"id":"CVE-2025-21614","title":"go-git clients vulnerable to DoS via maliciously crafted Git server replies","description":"go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.","status":"published","published":"2025-01-06T16:20:16.14Z","modified":"2026-10-28T02:30:38.951182482Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:46.665428Z"},{"id":"DEBIAN-CVE-2025-21614","description":"go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.","status":"published","published":"2025-01-06T17:15:47.31Z","modified":"2026-09-01T20:05:41.775646835Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"GHSA-r9px-m959-cxf4","title":"go-git clients vulnerable to DoS via maliciously crafted Git server replies","description":"### Impact\nA denial of service (DoS) vulnerability was discovered in go-git versions prior to `v5.13`. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in `go-git` clients. \n\nThis is a `go-git` implementation issue and does not affect the upstream `git` cli.\n\n### Patches\nUsers running versions of `go-git` from `v4` and above are recommended to upgrade to `v5.13` in order to mitigate this vulnerability.\n\n### Workarounds\nIn cases where a bump to the latest version of `go-git` is not possible, we recommend limiting its use to only trust-worthy Git servers.\n\n## Credit\nThanks to Ionut Lalu for responsibly disclosing this vulnerability to us.","status":"published","published":"2025-01-06T16:20:28Z","modified":"2026-09-10T03:50:22.178489689Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"RHSA-2025:0401","title":"Red Hat Security Advisory: grafana security update","status":"published","published":"2025-01-21T10:10:07Z","modified":"2026-10-17T10:04:33Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:0662","title":"Red Hat Security Advisory: grafana security update","status":"published","published":"2025-01-24T10:02:22Z","modified":"2026-10-17T10:04:33Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"UBUNTU-CVE-2025-21614","description":"go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.","status":"published","published":"2025-01-06T17:15:00Z","modified":"2026-03-14T09:02:03.531834Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:22.579335Z"},{"id":"ALSA-2025:0401","title":"Important: grafana security update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB.   \n\nSecurity Fix(es):  \n\n  * go-git: argument injection via the URL field (CVE-2025-21613)\n  * go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies (CVE-2025-21614)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-01-20T00:00:00Z","modified":"2026-10-29T11:02:21.989051011Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"AZL-55063","title":"CVE-2025-21614 affecting package packer for versions less than 1.9.5-5","description":"go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.","status":"published","published":"2025-01-06T17:15:47Z","modified":"2026-04-21T04:56:02.734137Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-55073","title":"CVE-2025-21614 affecting package cri-o 1.30.1-1","description":"go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.","status":"published","published":"2025-01-06T17:15:47Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:20.996398Z"},{"id":"AZL-55079","title":"CVE-2025-21614 affecting package packer for versions less than 1.9.5-7","description":"go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.","status":"published","published":"2025-01-06T17:15:47Z","modified":"2026-04-21T04:29:38.052038Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-55106","title":"CVE-2025-21614 affecting package cri-o for versions less than 1.22.3-14","description":"go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.","status":"published","published":"2025-01-06T17:15:47Z","modified":"2026-04-21T04:35:48.047236Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"GO-2025-3367","title":"Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git","description":"Clients vulnerable to DoS via maliciously crafted Git server replies in github.com/go-git/go-git","status":"published","published":"2025-01-07T16:03:20Z","modified":"2026-02-04T02:33:58.878534Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:0056-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\nUpdate to version 0.58.2 (\n\n      boo#1234512, CVE-2024-45337,\n      boo#1235265, CVE-2024-45338):\n\n  * fix(misconf): allow null values only for tf variables [backport: release/v0.58] (#8238)\n  * fix(suse): SUSE - update OSType constants and references for compatility [backport: release/v0.58] (#8237)\n  * fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field [backport: release/v0.58] (#8215)\n  * fix(sbom): attach nested packages to Application [backport: release/v0.58] (#8168)\n  * fix(python): skip dev group's deps for poetry [backport: release/v0.58] (#8158)\n  * fix(sbom): use root package for `unknown` dependencies (if exists) [backport: release/v0.58] (#8156)\n  * chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` [backport: release/v0.58] (#8142)\n  * chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` [backport: release/v0.58] (#8136)\n  * fix(redhat): correct rewriting of recommendations for the same vulnerability [backport: release/v0.58] (#8135)\n  * fix(oracle): add architectures support for advisories [backport: release/v0.58] (#8125)\n  * fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type [backport: release/v0.58] (#8124)\n  * chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 [backport: release/v0.58] (#8122)\n  * fix: handle `BLOW_UNKNOWN` error to download DBs [backport: release/v0.58] (#8121)\n  * fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props [backport: release/v0.58] (#8119)\n  * release: v0.58.0 [main] (#7874)\n  * fix(misconf): wrap AWS EnvVar to iac types (#7407)\n  * chore(deps): Upgrade trivy-checks (#8018)\n  * refactor(misconf): Remove unused options (#7896)\n  * docs: add terminology page to explain Trivy concepts (#7996)\n  * feat: add `workspaceRelationship` (#7889)\n  * refactor(sbom): simplify relationship generation (#7985)\n  * docs: improve databases documentation (#7732)\n  * refactor: remove support for custom Terraform checks (#7901)\n  * docs: drop AWS account scanning (#7997)\n  * fix(aws): change CPU and Memory type of ContainerDefinition to a string (#7995)\n  * fix(cli): Handle empty ignore files more gracefully (#7962)\n  * fix(misconf): load full Terraform module (#7925)\n  * fix(misconf): properly resolve local Terraform cache (#7983)\n  * refactor(k8s): add v prefix for Go packages (#7839)\n  * test: replace Go checks with Rego (#7867)\n  * feat(misconf): log causes of HCL file parsing errors (#7634)\n  * chore(deps): bump the aws group across 1 directory with 7 updates (#7991)\n  * chore(deps): bump github.com/moby/buildkit from 0.17.0 to 0.17.2 in the docker group across 1 directory (#7990)\n  * chore(deps): update csaf module dependency from csaf-poc to gocsaf (#7992)\n  * chore: downgrade the failed block expand message to debug (#7964)\n  * fix(misconf): do not erase variable type for child modules (#7941)\n  * feat(go): construct dependencies of `go.mod` main module in the parser (#7977)\n  * feat(go): construct dependencies in the parser (#7973)\n  * feat: add cvss v4 score and vector in scan response (#7968)\n  * docs: add `overview` page for `others` (#7972)\n  * fix(sbom): Fixes for Programming Language Vulnerabilities and SBOM Package Maintainer Details (#7871)\n  * feat(suse): Align SUSE/OpenSUSE OS Identifiers (#7965)\n  * chore(deps): bump the common group with 4 updates (#7949)\n  * feat(oracle): add `flavors` support (#7858)\n  * fix(misconf): Update trivy-checks default repo to `mirror.gcr.io` (#7953)\n  * chore(deps): Bump up trivy-checks to v1.3.0 (#7959)\n  * fix(k8s): check all results for vulnerabilities (#7946)\n  * ci(helm): bump Trivy version to 0.57.1 for Trivy Helm Chart 0.9.0 (#7945)\n  * feat(secret): Add built-in secrets rules for Private Packagist (#7826)\n  * docs: Fix broken links (#7900)\n  * docs: fix mistakes/typos (#7942)\n  * feat: Update registry fallbacks (#7679)\n  * fix(alpine): add `UID` for removed packages (#7887)\n  * chore(deps): bump the aws group with 6 updates (#7902)\n  * chore(deps): bump the common group with 6 updates (#7904)\n  * fix(debian): infinite loop (#7928)\n  * fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files (#7912)\n  * docs: add note about temporary podman socket (#7921)\n  * docs: combine trivy.dev into trivy docs (#7884)\n  * test: change branch in spdx schema link to check in integration tests (#7935)\n  * docs: add Headlamp to the Trivy Ecosystem page (#7916)\n  * fix(report): handle `git@github.com` schema for misconfigs in `sarif` report (#7898)\n  * chore(k8s): enhance k8s scan log (#6997)\n  * fix(terraform): set null value as fallback for missing variables (#7669)\n  * fix(misconf): handle null properties in CloudFormation templates (#7813)\n  * fix(fs): add missing defered Cleanup() call to post analyzer fs (#7882)\n  * chore(deps): bump the common group across 1 directory with 20 updates (#7876)\n  * chore: bump containerd to v2.0.0 (#7875)\n  * fix: Improve version comparisons when build identifiers are present (#7873)\n  * feat(k8s): add default commands for unknown platform (#7863)\n  * chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#7868)\n  * refactor(secret): optimize performance by moving ToLower operation outside loop (#7862)\n  * test: save `containerd` image into archive and use in tests (#7816)\n  * chore(deps): bump the github-actions group across 1 directory with 2 updates (#7854)\n  * chore: bump golangci-lint to v1.61.0 (#7853)\n\n- Update to version 0.57.1:\n  * release: v0.57.1 [release/v0.57] (#7943)\n  * feat: Update registry fallbacks [backport: release/v0.57] (#7944)\n  * fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files [backport: release/v0.57] (#7939)\n  * test: change branch in spdx schema link to check in integration tests [backport: release/v0.57] (#7940)\n  * release: v0.57.0 [main] (#7710)\n  * chore: lint `errors.Join` (#7845)\n  * feat(db): append errors (#7843)\n  * docs(java): add info about supported scopes (#7842)\n  * docs: add example of creating whitelist of checks (#7821)\n  * chore(deps): Bump trivy-checks (#7819)\n  * fix(go): Do not trim v prefix from versions in Go Mod Analyzer (#7733)\n  * fix(k8s): skip resources without misconfigs (#7797)\n  * fix(sbom):  use `Annotation` instead of `AttributionTexts` for `SPDX` formats (#7811)\n  * fix(cli): add config name to skip-policy-update alias (#7820)\n  * fix(helm): properly handle multiple archived dependencies (#7782)\n  * refactor(misconf): Deprecate `EXCEPTIONS` for misconfiguration scanning (#7776)\n  * fix(k8s)!: support k8s multi container (#7444)\n  * fix(k8s): support kubernetes v1.31 (#7810)\n  * docs: add Windows install instructions (#7800)\n  * ci(helm): auto public Helm chart after PR merged (#7526)\n  * feat: add end of life date for Ubuntu 24.10 (#7787)\n  * feat(report): update gitlab template to populate operating_system value (#7735)\n  * feat(misconf): Show misconfig ID in output (#7762)\n  * feat(misconf): export unresolvable field of IaC types to Rego (#7765)\n  * refactor(k8s): scan config files as a folder (#7690)\n  * fix(license): fix license normalization for Universal Permissive License (#7766)\n  * fix: enable usestdlibvars linter (#7770)\n  * fix(misconf): properly expand dynamic blocks (#7612)\n  * feat(cyclonedx): add file checksums to `CycloneDX` reports (#7507)\n  * fix(misconf): fix for Azure Storage Account network acls adaptation (#7602)\n  * refactor(misconf): simplify k8s scanner (#7717)\n  * feat(parser): ignore white space in pom.xml files (#7747)\n  * test: use forked images (#7755)\n  * fix(java): correctly inherit `version` and `scope` from upper/root `depManagement` and `dependencies` into parents (#7541)\n  * fix(misconf): check if property is not nil before conversion (#7578)\n  * fix(misconf): change default ACL of digitalocean_spaces_bucket to private (#7577)\n  * feat(misconf): ssl_mode support for GCP SQL DB instance (#7564)\n  * test: define constants for test images (#7739)\n  * docs: add note about disabled DS016 check (#7724)\n  * feat(misconf): public network support for Azure Storage Account (#7601)\n  * feat(cli): rename `trivy auth` to `trivy registry` (#7727)\n  * docs: apt-transport-https is a transitional package (#7678)\n  * refactor(misconf): introduce generic scanner (#7515)\n  * fix(cli): `clean --all` deletes only relevant dirs (#7704)\n  * feat(cli): add `trivy auth` (#7664)\n  * fix(sbom): add options for DBs in private registries (#7660)\n  * docs(report): fix reporting doc format (#7671)\n  * fix(repo): `git clone` output to Stderr (#7561)\n  * fix(redhat): include arch in PURL qualifiers (#7654)\n  * fix(report): Fix invalid URI in SARIF report (#7645)\n  * docs(report): Improve SARIF reporting doc (#7655)\n  * fix(db): fix javadb downloading error handling (#7642)\n  * feat(cli): error out when ignore file cannot be found (#7624)\n\n- Update to version 0.56.2:\n  * release: v0.56.2 [release/v0.56] (#7694)\n  * fix(redhat): include arch in PURL qualifiers [backport: release/v0.56] (#7702)\n  * fix(sbom): add options for DBs in private registries [backport: release/v0.56] (#7691)\n\n- Update to version 0.56.1:\n  * release: v0.56.1 [release/v0.56] (#7648)\n  * fix(db): fix javadb downloading error handling [backport: release/v0.56] (#7646)\n  * release: v0.56.0 [main] (#7447)\n  * fix(misconf): not to warn about missing selectors of libraries (#7638)\n  * feat: support RPM archives (#7628)\n  * fix(secret): change grafana token regex to find them without unquoted (#7627)\n  * fix(misconf): Disable deprecated checks by default (#7632)\n  * chore: add prefixes to log messages (#7625)\n  * feat(misconf): Support `--skip-*` for all included modules  (#7579)\n  * feat: support multiple DB repositories for vulnerability and Java DB (#7605)\n  * ci: don't use cache for `setup-go` (#7622)\n  * test: use loaded image names (#7617)\n  * feat(java): add empty versions if `pom.xml` dependency versions can't be detected (#7520)\n  * feat(secret): enhance secret scanning for python binary files (#7223)\n  * refactor: fix auth error handling (#7615)\n  * ci: split `save` and `restore` cache actions (#7614)\n  * fix(misconf): disable DS016 check for image history analyzer (#7540)\n  * feat(suse): added SUSE Linux Enterprise Micro support (#7294)\n  * feat(misconf): add ability to disable checks by ID (#7536)\n  * fix(misconf): escape all special sequences (#7558)\n  * test: use a local registry for remote scanning (#7607)\n  * fix: allow access to '..' in mapfs (#7575)\n  * fix(db): check `DownloadedAt` for `trivy-java-db` (#7592)\n  * chore(deps): bump the common group across 1 directory with 20 updates (#7604)\n  * ci: add `workflow_dispatch` trigger for test workflow. (#7606)\n  * ci: cache test images for `integration`, `VM` and `module` tests (#7599)\n  * chore(deps): remove broken replaces for opa and discovery (#7600)\n  * docs(misconf): Add more info on how to use arbitrary JSON/YAML scan feat (#7458)\n  * fix(misconf): Fixed scope for China Cloud (#7560)\n  * perf(misconf): use port ranges instead of enumeration (#7549)\n  * fix(sbom): export bom-ref when converting a package to a component (#7340)\n  * refactor(misconf): pass options to Rego scanner as is (#7529)\n  * fix(sbom): parse type `framework` as `library` when unmarshalling `CycloneDX` files (#7527)\n  * chore(deps): bump go-ebs-file (#7513)\n  * fix(misconf): Fix logging typo (#7473)\n  * feat(misconf): Register checks only when needed (#7435)\n  * refactor: split `.egg` and `packaging` analyzers (#7514)\n  * fix(java): use `dependencyManagement` from root/child pom's for dependencies from parents (#7497)\n  * chore(vex): add `CVE-2024-34155`, `CVE-2024-34156` and `CVE-2024-34158` in `trivy.openvex.json` (#7510)\n  * chore(deps): bump alpine from 3.20.0 to 3.20.3 (#7508)\n  * chore(vex): suppress openssl vulnerabilities (#7500)\n  * revert(java): stop supporting of `test` scope for `pom.xml` files (#7488)\n  * docs(db): add a manifest example (#7485)\n  * feat(license): improve license normalization (#7131)\n  * docs(oci): Add a note About the expected Media Type for the Trivy-DB OCI Artifact (#7449)\n  * fix(report): fix error with unmarshal of `ExperimentalModifiedFindings` (#7463)\n  * fix(report): change a receiver of MarshalJSON (#7483)\n  * fix(oracle): Update EOL date for Oracle 7 (#7480)\n  * chore(deps): bump the aws group with 6 updates (#7468)\n  * chore(deps): bump the common group across 1 directory with 19 updates (#7436)\n  * chore(helm): bump up Trivy Helm chart (#7441)\n  * refactor(java): add error/statusCode for logs when we can't get pom.xml/maven-metadata.xml from remote repo (#7451)\n  * fix(license): stop spliting a long license text (#7336)\n  * release: v0.55.0 [main] (#7271)\n  * feat(go): use `toolchain` as `stdlib` version for `go.mod` files (#7163)\n  * fix(license): add license handling to JUnit template (#7409)\n  * feat(java): add `test` scope support for `pom.xml` files (#7414)\n  * chore(deps): Bump trivy-checks and pin OPA (#7427)\n  * fix(helm): explicitly define `kind` and `apiVersion` of `volumeClaimTemplate` element (#7362)\n  * feat(sbom): set User-Agent header on requests to Rekor (#7396)\n  * test: add integration plugin tests (#7299)\n  * fix(nodejs): check all `importers` to detect dev deps from pnpm-lock.yaml file (#7387)\n  * fix: logger initialization before flags parsing (#7372)\n  * fix(aws): handle ECR repositories in different regions (#6217)\n  * fix(misconf): fix infer type for null value (#7424)\n  * fix(secret): use `.eyJ` keyword for JWT secret (#7410)\n  * fix(misconf): do not recreate filesystem map (#7416)\n  * chore(deps): Bump trivy-checks (#7417)\n  * fix(misconf): do not register Rego libs in checks registry (#7420)\n  * fix(sbom): use `NOASSERTION` for licenses fields in SPDX formats (#7403)\n  * feat(report): export modified findings in JSON (#7383)\n  * feat(server): Make Trivy Server Multiplexer Exported (#7389)\n  * chore: update CODEOWNERS (#7398)\n  * fix(secret): use only line with secret for long secret lines (#7412)\n  * chore: fix allow rule of ignoring test files to make it case insensitive (#7415)\n  * feat(misconf): port and protocol support for EC2 networks (#7146)\n  * fix(misconf): do not filter Terraform plan JSON by name (#7406)\n  * feat(misconf): support for ignore by nested attributes (#7205)\n  * fix(misconf): use module to log when metadata retrieval fails (#7405)\n  * fix(report): escape `Message` field in `asff.tpl` template (#7401)\n  * feat(misconf): Add support for using spec from on-disk bundle (#7179)\n  * docs: add pkg flags to config file page (#7370)\n  * feat(python): use minimum version for pip packages (#7348)\n  * fix(misconf): support deprecating for Go checks (#7377)\n  * fix(misconf): init frameworks before updating them (#7376)\n  * feat(misconf): ignore duplicate checks (#7317)\n  * refactor(misconf): use slog (#7295)\n  * chore(deps): bump trivy-checks (#7350)\n  * feat(server): add internal `--path-prefix` flag for client/server mode (#7321)\n  * chore(deps): bump the aws group across 1 directory with 7 updates (#7358)\n  * fix: safely check if the directory exists (#7353)\n  * feat(misconf): variable support for Terraform Plan (#7228)\n  * feat(misconf): scanning support for YAML and JSON (#7311)\n  * fix(misconf): wrap Azure PortRange in iac types (#7357)\n  * refactor(misconf): highlight only affected rows (#7310)\n  * fix(misconf): change default TLS values for the Azure storage account (#7345)\n  * chore(deps): bump the common group with 9 updates (#7333)\n  * docs(misconf): Update callsites to use correct naming (#7335)\n  * docs: update air-gapped docs (#7160)\n  * refactor: replace ftypes.Gradle with packageurl.TypeGradle (#7323)\n  * perf(misconf): optimize work with context (#6968)\n  * docs: update links to packaging.python.org (#7318)\n  * docs: update client/server docs for misconf and license scanning (#7277)\n  * chore(deps): bump the common group across 1 directory with 7 updates (#7305)\n  * feat(misconf): iterator argument support for dynamic blocks (#7236)\n  * fix(misconf): do not set default value for default_cache_behavior (#7234)\n  * feat(misconf): support for policy and bucket grants (#7284)\n  * fix(misconf): load only submodule if it is specified in source (#7112)\n  * perf(misconf): use json.Valid to check validity of JSON (#7308)\n  * refactor(misconf): remove unused universal scanner (#7293)\n  * perf(misconf): do not convert contents of a YAML file to string (#7292)\n  * fix(terraform): add aws_region name to presets (#7184)\n  * docs: add auto-generated config (#7261)\n  * feat(vuln): Add `--detection-priority` flag for accuracy tuning (#7288)\n  * refactor(misconf): remove file filtering from parsers (#7289)\n  * fix(flag): incorrect behavior for deprected flag `--clear-cache` (#7281)\n  * fix(java): Return error when trying to find a remote pom to avoid segfault (#7275)\n  * fix(plugin): do not call GitHub content API for releases and tags (#7274)\n  * feat(vm): support the Ext2/Ext3 filesystems (#6983)\n  * feat(cli)!: delete deprecated SBOM flags (#7266)\n  * feat(vm): Support direct filesystem (#7058)\n\n- Update to version 0.51.1 (boo#1227010, CVE-2024-3817):","status":"published","published":"2025-02-07T11:01:31Z","modified":"2026-02-04T03:23:30.049073Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:14624-1","title":"govulncheck-vulndb-0.0.20250108T191942-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250108T191942-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-09T00:00:00Z","modified":"2026-02-04T03:30:26.791709Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:14634-1","title":"operator-sdk-1.39.0-1.1 on GA media","description":"These are all security issues fixed in the operator-sdk-1.39.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-12T00:00:00Z","modified":"2026-02-04T04:36:55.880352Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:15487-1","title":"cheat-4.4.2-2.1 on GA media","description":"These are all security issues fixed in the cheat-4.4.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-25T00:00:00Z","modified":"2026-03-23T04:53:50.558551Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:20117-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\nChanges in trivy:\n\nUpdate to version 0.67.2 (bsc#1250625, CVE-2025-11065, bsc#1248897, CVE-2025-58058):\n\n  * fix: Use `fetch-level: 1` to check out trivy-repo in the release workflow [backport: release/v0.67] (#9638)\n  * fix: restore compatibility for google.protobuf.Value [backport: release/v0.67] (#9631)\n  * fix: using SrcVersion instead of Version for echo detector [backport: release/v0.67] (#9629)\n  * fix: add `buildInfo` for `BlobInfo` in `rpc` package [backport: release/v0.67] (#9615)\n  * fix(vex): don't use reused BOM [backport: release/v0.67] (#9612)\n  * fix(vex): don't  suppress vulns for packages with infinity loop (#9465)\n  * fix(aws): use `BuildableClient` insead of `xhttp.Client` (#9436)\n  * refactor(misconf): replace github.com/liamg/memoryfs with internal mapfs and testing/fstest (#9282)\n  * docs: clarify inline ignore limitations for resource-less checks (#9537)\n  * fix(k8s): disable parallel traversal with fs cache for k8s images (#9534)\n  * fix(misconf): handle tofu files in module detection (#9486)\n  * feat(seal): add seal support (#9370)\n  * docs: fix modules path and update code example (#9539)\n  * fix: close file descriptors and pipes on error paths (#9536)\n  * feat: add documentation URL for database lock errors (#9531)\n  * fix(db): Dowload database when missing but metadata still exists (#9393)\n  * feat(cloudformation): support default values and list results in Fn::FindInMap (#9515)\n  * fix(misconf): unmark cty values before access (#9495)\n  * feat(cli): change --list-all-pkgs default to true (#9510)\n  * fix(nodejs): parse workspaces as objects for package-lock.json files (#9518)\n  * refactor(fs): use underlyingPath to determine virtual files more reliably (#9302)\n  * refactor: remove google/wire dependency and implement manual DI (#9509)\n  * chore(deps): bump the aws group with 6 updates (#9481)\n  * chore(deps): bump the common group across 1 directory with 24 updates (#9507)\n  * fix(misconf): wrap legacy ENV values in quotes to preserve spaces (#9497)\n  * docs: move info about `detection priority` into coverage section (#9469)\n  * feat(sbom): added support for CoreOS (#9448)\n  * fix(misconf): strip build metadata suffixes from image history (#9498)\n  * feat(cyclonedx): preserve SBOM structure when scanning SBOM files with vulnerability updates (#9439)\n  * docs: Fix typo in terraform docs (#9492)\n  * feat(redhat): add os-release detection for RHEL-based images (#9458)\n  * ci(deps): add 3-day cooldown period for Dependabot updates (#9475)\n  * refactor: migrate from go-json-experiment to encoding/json/v2 (#9422)\n  * fix(vuln): compare `nuget` package names in lower case (#9456)\n  * chore: Update release flow to include chocolatey (#9460)\n  * docs: document eol supportability (#9434)\n  * docs(report): add nuanses about secret/license scanner in summary table (#9442)\n  * ci: use environment variables in GitHub Actions for improved security (#9433)\n  * chore: bump Go to 1.24.7 (#9435)\n  * fix(nodejs): use snapshot string as `Package.ID` for pnpm packages (#9330)\n  * ci(helm): bump Trivy version to 0.66.0 for Trivy Helm Chart 0.18.0 (#9425)\n\nUpdate to version 0.66.0 (bsc#1248937, CVE-2025-58058):\n\n  * chore(deps): bump the aws group with 7 updates (#9419)\n  * refactor(secret): clarify secret scanner messages (#9409)\n  * fix(cyclonedx): handle multiple license types (#9378)\n  * fix(repo): sanitize git repo URL before inserting into report metadata (#9391)\n  * test: add HTTP basic authentication to git test server (#9407)\n  * fix(sbom): add support for `file` component type of `CycloneDX` (#9372)\n  * fix(misconf): ensure module source is known (#9404)\n  * ci: migrate GitHub Actions from version tags to SHA pinning (#9405)\n  * fix: create temp file under composite fs dir (#9387)\n  * chore(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#9403)\n  * refactor: switch to stable azcontainerregistry SDK package (#9319)\n  * chore(deps): bump the common group with 7 updates (#9382)\n  * refactor(misconf): migrate from custom Azure JSON parser (#9222)\n  * fix(repo): preserve RepoMetadata on FS cache hit (#9389)\n  * refactor(misconf): use atomic.Int32 (#9385)\n  * chore(deps): bump the aws group with 6 updates (#9383)\n  * docs: Fix broken link to \"Built-in Checks\" (#9375)\n  * fix(plugin): don't remove plugins when updating index.yaml file (#9358)\n  * fix: persistent flag option typo (#9374)\n  * chore(deps): bump the common group across 1 directory with 26 updates (#9347)\n  * fix(image): use standardized HTTP client for ECR authentication (#9322)\n  * refactor: export `systemFileFiltering` Post Handler (#9359)\n  * docs: update links to Semaphore pages (#9352)\n  * fix(conda): memory leak by adding closure method for `package.json` file (#9349)\n  * feat: add timeout handling for cache database operations (#9307)\n  * fix(misconf): use correct field log_bucket instead of target_bucket in gcp bucket (#9296)\n  * fix(misconf): ensure ignore rules respect subdirectory chart paths (#9324)\n  * chore(deps): bump alpine from 3.21.4 to 3.22.1 (#9301)\n  * feat(terraform): use .terraform cache for remote modules in plan scanning (#9277)\n  * chore: fix some function names in comment (#9314)\n  * chore(deps): bump the aws group with 7 updates (#9311)\n  * docs: add explanation for how to use non-system certificates (#9081)\n  * chore(deps): bump the github-actions group across 1 directory with 2 updates (#8962)\n  * fix(misconf): preserve original paths of remote submodules from .terraform (#9294)\n  * refactor(terraform): make Scan method of Terraform plan scanner private (#9272)\n  * fix: suppress debug log for context cancellation errors (#9298)\n  * feat(secret): implement streaming secret scanner with byte offset tracking (#9264)\n  * fix(python): impove package name normalization  (#9290)\n  * feat(misconf): added audit config attribute (#9249)\n  * refactor(misconf): decouple input fs and track extracted files with fs references (#9281)\n  * test(misconf): remove BenchmarkCalculate using outdated check metadata (#9291)\n  * refactor: simplify Detect function signature (#9280)\n  * ci(helm): bump Trivy version to 0.65.0 for Trivy Helm Chart 0.17.0 (#9288)\n  * fix(fs): avoid shadowing errors in file.glob (#9286)\n  * test(misconf): move terraform scan tests to integration tests (#9271)\n  * test(misconf): drop gcp iam test covered by another case (#9285)\n  * chore(deps): bump to alpine from `3.21.3` to `3.21.4` (#9283)\n\nUpdate to version 0.65.0:\n\n  * fix(cli): ensure correct command is picked by telemetry (#9260)\n  * feat(flag): add schema validation for `--server` flag (#9270)\n  * chore(deps): bump github.com/docker/docker from 28.3.2+incompatible to 28.3.3+incompatible (#9274)\n  * ci: skip undefined labels in discussion triage action (#9175)\n  * feat(repo): add git repository metadata to reports (#9252)\n  * fix(license): handle WITH operator for `LaxSplitLicenses` (#9232)\n  * chore: add modernize tool integration for code modernization (#9251)\n  * fix(secret): add UTF-8 validation in secret scanner to prevent protobuf marshalling errors (#9253)\n  * chore: implement process-safe temp file cleanup (#9241)\n  * fix: prevent graceful shutdown message on normal exit (#9244)\n  * fix(misconf): correctly parse empty port ranges in google_compute_firewall (#9237)\n  * feat: add graceful shutdown with signal handling (#9242)\n  * chore: update template URL for brew formula (#9221)\n  * test: add end-to-end testing framework with image scan and proxy tests (#9231)\n  * refactor(db): use `Getter` interface with `GetParams` for trivy-db sources (#9239)\n  * ci: specify repository for `gh cache delete` in canary worklfow (#9240)\n  * ci: remove invalid `--confirm` flag from `gh cache delete` command in canary builds (#9236)\n  * fix(misconf): fix log bucket in schema (#9235)\n  * chore(deps): bump the common group across 1 directory with 24 updates (#9228)\n  * ci: move runner.os context from job-level env to step-level in canary workflow (#9233)\n  * chore(deps): bump up Trivy-kubernetes to v0.9.1 (#9214)\n  * feat(misconf): added logging and versioning to the gcp storage bucket (#9226)\n  * fix(server): add HTTP transport setup to server mode (#9217)\n  * chore: update the rpm download Update (#9202)\n  * feat(alma): add AlmaLinux 10 support (#9207)\n  * fix(nodejs): don't use prerelease logic for compare npm constraints  (#9208)\n  * fix(rootio): fix severity selection (#9181)\n  * fix(sbom): merge in-graph and out-of-graph OS packages in scan results (#9194)\n  * fix(cli): panic: attempt to get os.Args[1] when len(os.Args) \u003c 2 (#9206)\n  * fix(misconf): correctly adapt azure storage account (#9138)\n  * feat(misconf): add private ip google access attribute to subnetwork (#9199)\n  * feat(report): add CVSS vectors in sarif report (#9157)\n  * fix(terraform): `for_each` on a map returns a resource for every key (#9156)\n  * fix: supporting .egg-info/METADATA in python.Packaging analyzer (#9151)\n  * chore: migrate protoc setup from Docker to buf CLI (#9184)\n  * ci: delete cache after artifacts upload in canary workflow (#9177)\n  * refactor: remove aws flag helper message (#9080)\n  * ci: use gh pr view to get PR number for forked repositories in auto-ready workflow (#9183)\n  * ci: add auto-ready-for-review workflow (#9179)\n  * feat(image): add Docker context resolution (#9166)\n  * ci: optimize golangci-lint performance with cache-based strategy (#9173)\n  * feat: add HTTP request/response tracing support (#9125)\n  * fix(aws): update amazon linux 2 EOL date (#9176)\n  * chore: Update release workflow to trigger version updates (#9162)\n  * chore(deps): bump helm.sh/helm/v3 from 3.18.3 to 3.18.4 (#9164)\n  * fix: also check `filepath` when removing duplicate packages (#9142)\n  * chore: add debug log to show image source location (#9163)\n  * docs: add section on customizing default check data (#9114)\n  * chore(deps): bump the common group across 1 directory with 9 updates (#9153)\n  * docs: partners page content updates (#9149)\n  * chore(license): add missed spdx exceptions: (#9147)\n  * docs: trivy partners page updates (#9133)\n  * fix: migrate from `*.list` to `*.md5sums` files for `dpkg` (#9131)\n  * ci(helm): bump Trivy version to 0.64.1 for Trivy Helm Chart 0.16.1 (#9135)\n  * feat(sbom): add SHA-512 hash support for CycloneDX SBOM (#9126)\n  * fix(misconf): skip rewriting expr if attr is nil (#9113)\n  * fix(license): add missed `GFDL-NIV-1.1` and `GFDL-NIV-1.2` into Trivy mapping (#9116)\n  * fix(cli): Add more non-sensitive flags to telemetry (#9110)\n  * fix(alma): parse epochs from rpmqa file (#9101)\n  * fix(rootio): check full version to detect `root.io` packages (#9117)\n  * chore: drop FreeBSD 32-bit support (#9102)\n  * fix(sbom): use correct field for licenses in CycloneDX reports (#9057)\n  * fix(secret): fix line numbers for multiple-line secrets (#9104)\n  * feat(license): observe pkg types option in license scanner (#9091)\n  * ci(helm): bump Trivy version to 0.64.0 for Trivy Helm Chart 0.16.0 (#9107)\n- (CVE-2025-53547, bsc#1246151)\n\n- Update to version 0.64.1 (bsc#1243633, CVE-2025-47291,\n                           (bsc#1246730, CVE-2025-46569):\n\n  * fix(misconf): skip rewriting expr if attr is nil [backport: release/v0.64] (#9127)\n  * fix(cli): Add more non-sensitive flags to telemetry [backport: release/v0.64] (#9124)\n  * fix(rootio): check full version to detect `root.io` packages [backport: release/v0.64] (#9120)\n  * fix(alma): parse epochs from rpmqa file [backport: release/v0.64] (#9119)\n  * docs(python): fix type with METADATA file name (#9090)\n  * feat: reject unsupported artifact types in remote image retrieval (#9052)\n  * chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 (#9088)\n  * refactor(misconf): rewrite Rego module filtering using functional filters (#9061)\n  * feat(terraform): add partial evaluation for policy templates (#8967)\n  * feat(vuln): add Root.io support for container image scanning (#9073)\n  * feat(sbom): add manufacturer field to CycloneDX tools metadata (#9019)\n  * fix(cli): add some values to the telemetry call (#9056)\n  * feat(ubuntu): add end of life date for Ubuntu 25.04 (#9077)\n  * refactor: centralize HTTP transport configuration (#9058)\n  * test: include integration tests in linting and fix all issues (#9060)\n  * chore(deps): bump the common group across 1 directory with 26 updates (#9063)\n  * feat(java): dereference all maven settings.xml env placeholders (#9024)\n  * fix(misconf): reduce log noise on incompatible check (#9029)\n  * fix(misconf): .Config.User always takes precedence over USER in .History (#9050)\n  * chore(deps): update Docker to v28.2.2 and fix compatibility issues (#9037)\n  * docs(misconf): simplify misconfiguration docs (#9030)\n  * fix(misconf): move disabled checks filtering after analyzer scan (#9002)\n  * docs: add PR review policy for maintainers (#9032)\n  * fix(sbom): remove unnecessary OS detection check in SBOM decoding (#9034)\n  * test: improve and extend tests for iac/adapters/arm (#9028)\n  * chore: bump up Go version to 1.24.4 (#9031)\n  * feat(cli): add version constraints to annoucements (#9023)\n  * fix(misconf): correct Azure value-to-time conversion in AsTimeValue (#9015)\n  * feat(ubuntu): add eol date for 20.04-ESM (#8981)\n  * fix(report): don't panic when report contains vulns, but doesn't contain packages for `table` format (#8549)\n  * fix(nodejs): correctly parse `packages` array of `bun.lock` file (#8998)\n  * refactor: use strings.SplitSeq instead of strings.Split in for-loop (#8983)\n  * docs: change --disable-metrics to --disable-telemetry in example (#8999) (#9003)\n  * feat(misconf): add OpenTofu file extension support (#8747)\n  * refactor(misconf): set Trivy version by default in Rego scanner (#9001)\n  * docs: fix assets with versioning (#8996)\n  * docs: add partners page (#8988)\n  * chore(alpine): add EOL date for Alpine 3.22 (#8992)\n  * fix: don't show corrupted trivy-db warning for first run (#8991)\n  * Update installation.md (#8979)\n  * feat(misconf): normalize CreatedBy for buildah and legacy docker builder (#8953)\n  * chore(k8s): update comments with deprecated command format (#8964)\n  * chore: fix errors and typos in docs (#8963)\n  * fix: Add missing version check flags (#8951)\n  * feat(redhat): Add EOL date for RHEL 10. (#8910)\n  * fix: Correctly check for semver versions for trivy version check (#8948)\n  * refactor(server): change custom advisory and vulnerability data types fr… (#8923)\n  * ci(helm): bump Trivy version to 0.63.0 for Trivy Helm Chart 0.15.0 (#8946)\n  * fix(misconf): use argument value in WithIncludeDeprecatedChecks (#8942)\n  * chore(deps): Bump trivy-checks (#8934)\n  * fix(julia): add `Relationship` field support (#8939)\n  * feat(minimos): Add support for MinimOS (#8792)\n  * feat(alpine): add maintainer field extraction for APK packages (#8930)\n  * feat(echo): Add Echo Support (#8833)\n  * fix(redhat): Also try to find buildinfo in root layer (layer 0) (#8924)\n  * fix(wolfi): support new APK database location (#8937)\n  * feat(k8s): get components from namespaced resources (#8918)\n  * refactor(cloudformation): remove unused ScanFile method from Scanner (#8927)\n  * refactor(terraform): remove result sorting from scanner (#8928)\n  * feat(misconf): Add support for `Minimum Trivy Version` (#8880)\n  * docs: improve skipping files documentation (#8749)\n  * feat(cli): Add available version checking (#8553)\n  * feat(nodejs): add a bun.lock analyzer (#8897)\n  * feat: terraform parser option to set current working directory (#8909)\n  * perf(secret): only match secrets of meaningful length, allow example strings to not be matched (#8602)\n  * feat(misconf): export raw Terraform data to Rego (#8741)\n  * refactor(terraform): simplify AllReferences method signature in Attribute (#8906)\n  * fix: check post-analyzers for StaticPaths (#8904)\n  * feat: add Bottlerocket OS package analyzer (#8653)\n  * feat(license): improve work text licenses with custom classification (#8888)\n  * chore(deps): bump github.com/containerd/containerd/v2 from 2.1.0 to 2.1.1 (#8901)\n  * chore(deps): bump the common group across 1 directory with 9 updates (#8887)\n  * refactor(license): simplify compound license scanning (#8896)\n  * feat(license): Support compound licenses (licenses using SPDX operators) (#8816)\n  * fix(k8s): use in-memory cache backend during misconfig scanning (#8873)\n  * feat(nodejs): add bun.lock parser (#8851)\n  * feat(license): improve work with custom classification of licenses from config file (#8861)\n  * fix(cli): disable `--skip-dir` and `--skip-files` flags for `sbom` command (#8886)\n  * fix: julia parser panicing (#8883)\n  * refactor(db): change logic to detect wrong DB (#8864)\n  * fix(cli): don't use allow values for `--compliance` flag (#8881)\n  * docs(misconf): Reorganize misconfiguration scan pages (#8206)\n  * fix(server): add missed Relationship field for `rpc` (#8872)\n  * feat: add JSONC support for comments and trailing commas (#8862)\n  * fix(vex): use `lo.IsNil` to check `VEX` from OCI artifact (#8858)\n  * feat(go): support license scanning in both GOPATH and vendor (#8843)\n  * fix(redhat): save contentSets for OS packages in fs/vm modes (#8820)\n  * fix: filter all files when processing files installed from package managers (#8842)\n  * feat(misconf): add misconfiguration location to junit template (#8793)\n  * docs(vuln): remove OSV for Python from data sources (#8841)\n  * chore: add an issue template for maintainers (#8838)\n  * chore: enable staticcheck (#8815)\n  * ci(helm): bump Trivy version to 0.62.1 for Trivy Helm Chart 0.14.1 (#8836)\n  * feat(license): scan vendor directory for license for go.mod files (#8689)\n  * docs(java):  Update info about dev deps in gradle lock (#8830)\n  * chore(deps): bump golang.org/x/sync from 0.13.0 to 0.14.0 in the common group (#8822)\n  * fix(java): exclude dev dependencies in gradle lockfile (#8803)\n  * fix: octalLiteral from go-critic (#8811)\n  * fix(redhat): trim invalid suffix from content_sets in manifest parsing (#8818)\n  * chore(deps): bump the common group across 1 directory with 10 updates (#8817)\n  * fix: use-any from revive (#8810)\n  * fix: more revive rules (#8814)\n  * docs: change in java.md: fix the Trity -to-\u003e Trivy typo (#8813)\n  * fix(misconf): check if for-each is known when expanding dyn block (#8808)\n  * ci(helm): bump Trivy version to 0.62.0 for Trivy Helm Chart 0.14.0 (#8802)\n\n- Update to version 0.62.1 (bsc#1239225, CVE-2025-22868,\n                            bsc#1241724, CVE-2025-22872):\n\n  * chore(deps): bump the common group across 1 directory with 10 updates [backport: release/v0.62] (#8831)\n  * fix(misconf): check if for-each is known when expanding dyn block [backport: release/v0.62] (#8826)\n  * fix(redhat): trim invalid suffix from content_sets in manifest parsing [backport: release/v0.62] (#8824)\n  * feat(nodejs): add root and workspace for `yarn` packages (#8535)\n  * fix: unused-parameter rule from revive (#8794)\n  * chore(deps): Update trivy-checks (#8798)\n  * fix: early-return, indent-error-flow and superfluous-else rules from revive  (#8796)\n  * fix(k8s): remove using `last-applied-configuration` (#8791)\n  * refactor(misconf): remove unused methods from providers (#8781)\n  * refactor(misconf): remove unused methods from iac types (#8782)\n  * fix(misconf): filter null nodes when parsing json manifest (#8785)\n  * fix: testifylint last issues (#8768)\n  * fix(misconf): perform operations on attribute safely (#8774)\n  * refactor(ubuntu): update time handling for fixing time (#8780)\n  * chore(deps): bump golangci-lint to v2.1.2 (#8766)\n  * feat(image): save layers metadata into report (#8394)\n  * feat(misconf): convert AWS managed policy to document (#8757)\n  * chore(deps): bump the docker group across 1 directory with 3 updates (#8762)\n  * ci(helm): bump Trivy version to 0.61.1 for Trivy Helm Chart 0.13.1 (#8753)\n  * ci(helm): create a helm branch for patches from main (#8673)\n  * fix(terraform): hcl object expressions to return references (#8271)\n  * chore(terraform): option to pass in instanced logger  (#8738)\n  * ci: use `Skitionek/notify-microsoft-teams` instead of `aquasecurity` fork (#8740)\n  * chore(terraform): remove os.OpenPath call from terraform file functions (#8737)\n  * chore(deps): bump the common group across 1 directory with 23 updates (#8733)\n  * feat(rust): add root and workspace relationships/package for `cargo` lock files (#8676)\n  * refactor(misconf): remove module outputs from parser.EvaluateAll (#8587)\n  * fix(misconf): populate context correctly for module instances (#8656)\n  * fix(misconf): check if metadata is not nil (#8647)\n  * refactor(misconf): switch to x/json  (#8719)\n  * fix(report): clean buffer after flushing (#8725)\n  * ci: improve PR title validation workflow (#8720)\n  * refactor(flag): improve flag system architecture and extensibility (#8718)\n  * fix(terraform): `evaluateStep` to correctly set `EvalContext` for multiple instances of blocks (#8555)\n  * refactor: migrate from `github.com/aquasecurity/jfather` to `github.com/go-json-experiment/json` (#8591)\n  * feat(misconf): support auto_provisioning_defaults in google_container_cluster (#8705)\n  * ci: use `github.event.pull_request.user.login` for release PR check workflow (#8702)\n  * refactor: add hook interface for extended functionality (#8585)\n  * fix(misconf): add missing variable as unknown (#8683)\n  * docs: Update maintainer docs (#8674)\n  * ci(vuln): reduce github action script injection attack risk (#8610)\n  * fix(secret): ignore .dist-info directories during secret scanning (#8646)\n  * fix(server): fix redis key when trying to delete blob (#8649)\n  * chore(deps): bump the testcontainers group with 2 updates (#8650)\n  * test: use `aquasecurity` repository for test images (#8677)\n  * chore(deps): bump the aws group across 1 directory with 5 updates (#8652)\n  * fix(k8s): skip passed misconfigs for the summary report (#8684)\n  * fix(k8s): correct compare artifact versions (#8682)\n  * chore: update Docker lib (#8681)\n  * refactor(misconf): remove unused terraform attribute methods (#8657)\n  * feat(misconf): add option to pass Rego scanner to IaC scanner (#8369)\n  * chore: typo fix to replace `rego` with `repo` on the RepoFlagGroup options error output (#8643)\n  * docs: Add info about helm charts release (#8640)\n  * ci(helm): bump Trivy version to 0.61.0 for Trivy Helm Chart 0.13.0 (#8638)\n\nUpdate to version 0.61.1 (bsc#1239385, CVE-2025-22869, bsc#1240466, CVE-2025-30204):\n\n  * fix(k8s): skip passed misconfigs for the summary report [backport: release/v0.61] (#8748)\n  * fix(k8s): correct compare artifact versions [backport: release/v0.61] (#8699)\n  * test: use `aquasecurity` repository for test images [backport: release/v0.61] (#8698)\n  * fix(misconf): Improve logging for unsupported checks (#8634)\n  * feat(k8s): add support for controllers (#8614)\n  * fix(debian): don't include empty licenses for `dpkgs` (#8623)\n  * fix(misconf): Check values wholly prior to evalution (#8604)\n  * chore(deps): Bump trivy-checks (#8619)\n  * fix(k8s): show report for `--report all` (#8613)\n  * chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 (#8597)\n  * refactor: rename scanner to service (#8584)\n  * fix(misconf): do not skip loading documents from subdirectories (#8526)\n  * refactor(misconf): get a block or attribute without calling HasChild (#8586)\n  * fix(misconf): identify the chart file exactly by name (#8590)\n  * test: use table-driven tests in Helm scanner tests (#8592)\n  * refactor(misconf): Simplify misconfig checks bundle parsing (#8533)\n  * chore(deps): bump the common group across 1 directory with 10 updates (#8566)\n  * fix(misconf): do not use cty.NilVal for non-nil values (#8567)\n  * docs(cli): improve flag value display format (#8560)\n  * fix(misconf): set default values for AWS::EKS::Cluster.ResourcesVpcConfig (#8548)\n  * docs: remove slack (#8565)\n  * fix: use `--file-patterns` flag for all post analyzers (#7365)\n  * docs(python): Mention pip-compile (#8484)\n  * feat(misconf): adapt aws_opensearch_domain (#8550)\n  * feat(misconf): adapt AWS::EC2::VPC (#8534)\n  * docs: fix a broken link (#8546)\n  * fix(fs): check postAnalyzers for StaticPaths (#8543)\n  * refactor(misconf): remove unused methods for ec2.Instance (#8536)\n  * feat(misconf): adapt aws_default_security_group (#8538)\n  * feat(fs): optimize scanning performance by direct file access for known paths (#8525)\n  * feat(misconf): adapt AWS::DynamoDB::Table (#8529)\n  * style: Fix MD syntax in self-hosting.md (#8523)\n  * perf(misconf): retrieve check metadata from annotations once (#8478)\n  * feat(misconf): Add support for aws_ami (#8499)\n  * fix(misconf): skip Azure CreateUiDefinition (#8503)\n  * refactor(misconf): use OPA v1 (#8518)\n  * fix(misconf): add ephemeral block type to config schema (#8513)\n  * perf(misconf): parse input for Rego once (#8483)\n  * feat: replace TinyGo with standard Go for WebAssembly modules (#8496)\n  * chore: replace deprecated tenv linter with usetesting (#8504)\n  * fix(spdx): save text licenses into `otherLicenses` without normalize (#8502)\n  * chore(deps): bump the common group across 1 directory with 13 updates (#8491)\n  * chore: use go.mod for managing Go tools (#8493)\n  * ci(helm): bump Trivy version to 0.60.0 for Trivy Helm Chart 0.12.0 (#8494)\n  * fix(sbom): improve logic for binding direct dependency to parent component (#8489)\n  * chore(deps): remove missed replace of `trivy-db` (#8492)\n  * chore(deps): bump alpine from 3.21.0 to 3.21.3 in the docker group across 1 directory (#8490)\n  * chore(deps): update Go to 1.24 and switch to go-version-file (#8388)\n  * docs: add abbreviation list (#8453)\n  * chore(terraform): assign *terraform.Module 'parent' field (#8444)\n  * feat: add report summary table (#8177)\n  * chore(deps): bump the github-actions group with 3 updates (#8473)\n  * refactor(vex): improve SBOM reference handling with project standards (#8457)\n  * ci: update GitHub Actions cache to v4 (#8475)\n  * feat: add `--vuln-severity-source` flag (#8269)\n  * fix(os): add mapping OS aliases (#8466)\n  * chore(deps): bump the aws group across 1 directory with 7 updates (#8468)\n  * chore(deps): Bump trivy-checks to v1.7.1 (#8467)\n  * refactor(report): write tables after rendering all results (#8357)\n  * docs: update VEX documentation index page (#8458)\n  * fix(db): fix case when 2 trivy-db were copied at the same time (#8452)\n  * feat(misconf): render causes for Terraform (#8360)\n  * fix(misconf): fix incorrect k8s locations due to JSON to YAML conversion (#8073)\n  * feat(cyclonedx): Add initial support for loading external VEX files from SBOM references (#8254)\n  * chore(deps): update go-rustaudit location (#8450)\n  * fix: update all documentation links (#8045)\n  * chore(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 (#8443)\n  * chore(deps): bump the common group with 6 updates (#8411)\n  * fix(k8s): add missed option `PkgRelationships` (#8442)\n  * fix(sbom): add SBOM file's filePath as Application FilePath if we can't detect its path (#8346)\n  * feat(go): fix parsing main module version for go \u003e= 1.24 (#8433)\n  * refactor(misconf): make Rego scanner independent of config type (#7517)\n  * fix(image): disable AVD-DS-0007 for history scanning (#8366)\n  * fix(server): secrets inspectation for the config analyzer in client server mode (#8418)\n  * chore: remove mockery (#8417)\n  * test(server): replace mock driver with memory cache in server tests (#8416)\n  * test: replace mock with memory cache and fix non-deterministic tests (#8410)\n  * test: replace mock with memory cache in scanner tests (#8413)\n  * test: use memory cache (#8403)\n  * fix(spdx): init `pkgFilePaths` map for all formats (#8380)\n  * chore(deps): bump the common group across 1 directory with 11 updates (#8381)\n  * docs: correct Ruby documentation (#8402)\n  * chore: bump `mockery` to update v2.52.2 version and rebuild mock files (#8390)\n  * fix: don't use `scope` for `trivy registry login` command (#8393)\n  * fix(go): merge nested flags into string for ldflags for Go binaries (#8368)\n  * chore(terraform): export module path on terraform modules (#8374)\n  * fix(terraform): apply parser options to submodule parsing (#8377)\n  * docs: Fix typos in documentation (#8361)\n  * docs: fix navigate links (#8336)\n  * ci(helm): bump Trivy version to 0.59.1 for Trivy Helm Chart 0.11.1 (#8354)\n  * ci(spdx): add `aqua-installer` step to fix `mage` error (#8353)\n  * chore: remove debug prints (#8347)\n  * fix(misconf): do not log scanners when misconfig scanning is disabled (#8345)\n  * fix(report): remove html escaping for `shortDescription` and `fullDescription` fields for sarif reports (#8344)\n  * chore(deps): bump Go to `v1.23.5` (#8341)\n  * fix(python): add `poetry` v2 support (#8323)\n  * chore(deps): bump the github-actions group across 1 directory with 4 updates (#8331)\n  * fix(misconf): ecs include enhanced for container insights (#8326)\n  * fix(sbom): preserve OS packages from multiple SBOMs (#8325)\n  * ci(helm): bump Trivy version to 0.59.0 for Trivy Helm Chart 0.11.0 (#8311)\n  *  (bsc#1237618, CVE-2025-27144)\n\nUpdate to version 0.59.1:\n\n  * fix(misconf): do not log scanners when misconfig scanning is disabled [backport: release/v0.59] (#8349)\n  * chore(deps): bump Go to `v1.23.5` [backport: release/v0.59] (#8343)\n  * fix(python): add `poetry` v2 support [backport: release/v0.59] (#8335)\n  * fix(sbom): preserve OS packages from multiple SBOMs [backport: release/v0.59] (#8333)\n\nUpdate to version 0.59.0:\n\n  * feat(image): return error early if total size of layers exceeds limit (#8294)\n  * chore(deps): Bump trivy-checks (#8310)\n  * chore(terraform): add accessors to underlying raw hcl values (#8306)\n  * fix: improve conversion of image config to Dockerfile (#8308)\n  * docs: replace short codes with Unicode emojis (#8296)\n  * feat(k8s): improve artifact selections for specific namespaces (#8248)\n  * chore: update code owners (#8303)\n  * fix(misconf): handle heredocs in dockerfile instructions (#8284)\n  * fix: de-duplicate same `dpkg` packages with different filePaths from different layers (#8298)\n  * chore(deps): bump the aws group with 7 updates (#8299)\n  * chore(deps): bump the common group with 12 updates (#8301)\n  * chore: enable int-conversion from perfsprint (#8194)\n  * feat(fs): use git commit hash as cache key for clean repositories (#8278)\n  * fix(spdx): use the `hasExtractedLicensingInfos` field for licenses that are not listed in the SPDX (#8077)\n  * chore: use require.ErrorContains when possible (#8291)\n  * feat(image): prevent scanning oversized container images (#8178)\n  * chore(deps): use aqua forks for `github.com/liamg/jfather` and `github.com/liamg/iamgo` (#8289)\n  * fix(fs): fix cache key generation to use UUID (#8275)\n  * fix(misconf): correctly handle all YAML tags in K8S templates (#8259)\n  * feat: add support for registry mirrors (#8244)\n  * chore(deps): bump the common group across 1 directory with 29 updates (#8261)\n  * refactor(license): improve license expression normalization (#8257)\n  * feat(misconf): support for ignoring by inline comments for Dockerfile (#8115)\n  * feat: add a examples field to check metadata (#8068)\n  * chore(deps): bump alpine from 3.20.0 to 3.21.0 in the docker group across 1 directory (#8196)\n  * ci: add workflow to restrict direct PRs to release branches (#8240)\n  * fix(suse): SUSE - update OSType constants and references for compatility (#8236)\n  * ci: fix path to main dir for canary builds (#8231)\n  * chore(secret): add reported issues related to secrets in junit template (#8193)\n  * refactor: use trivy-checks/pkg/specs package (#8226)\n  * ci(helm): bump Trivy version to 0.58.1 for Trivy Helm Chart 0.10.0 (#8170)\n  * fix(misconf): allow null values only for tf variables (#8112)\n  * feat(misconf): support for ignoring by inline comments for Helm (#8138)\n  * fix(redhat): check `usr/share/buildinfo/` dir to detect content sets (#8222)\n  * chore(alpine): add EOL date for Alpine 3.21 (#8221)\n  * fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field (#8207)\n  * fix(misconf): disable git terminal prompt on tf module load (#8026)\n  * chore: remove aws iam related scripts (#8179)\n  * docs: Updated JSON schema version 2 in the trivy documentation (#8188)\n  * refactor(python): use once + debug for `License acquired from METADATA...` logs (#8175)\n  * refactor: use slices package instead of custom function (#8172)\n  * chore(deps): bump the common group with 6 updates (#8162)\n  * feat(python): add support for uv dev and optional dependencies (#8134)\n  * feat(python): add support for poetry dev dependencies (#8152)\n  * fix(sbom): attach nested packages to Application (#8144)\n  * docs(vex): use debian minor version in examples (#8166)\n  * refactor: add generic Set implementation (#8149)\n  * chore(deps): bump the aws group across 1 directory with 6 updates (#8163)\n  * fix(python): skip dev group's deps for poetry (#8106)\n  * fix(sbom): use root package for `unknown` dependencies (if exists) (#8104)\n  * chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` (#8140)\n  * chore(vex): suppress CVE-2024-45338 (#8137)\n  * feat(python): add support for uv (#8080)\n  * chore(deps): bump the docker group across 1 directory with 3 updates (#8127)\n  * chore(deps): bump the common group across 1 directory with 14 updates (#8126)\n  * chore: bump go to 1.23.4 (#8123)\n  * test: set dummy value for NUGET_PACKAGES (#8107)\n  * chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` (#8105)\n  * chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 (#8103)\n  * fix: wasm module test (#8099)\n  * fix: CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass (#8088)\n  * chore(vex): suppress CVE-2024-45337 (#8101)\n  * fix(license): always trim leading and trailing spaces for licenses (#8095)\n  * fix(sbom): scan results of SBOMs generated from container images are missing layers (#7635)\n  * fix(redhat): correct rewriting of recommendations for the same vulnerability (#8063)\n  * fix: enable err-error and errorf rules from perfsprint linter (#7859)\n  * chore(deps): bump the aws group across 1 directory with 6 updates (#8074)\n  * perf: avoid heap allocation in applier findPackage (#7883)\n  * fix: Updated twitter icon (#7772)\n  * docs(k8s): add a note about multi-container pods (#7815)\n  * feat: add `--distro` flag to manually specify OS distribution for vulnerability scanning (#8070)\n  * fix(oracle): add architectures support for advisories (#4809)\n  * fix: handle `BLOW_UNKNOWN` error to download DBs (#8060)\n  * feat(misconf): generate placeholders for random provider resources (#8051)\n  * fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type (#8052)\n  * fix(flag): skip hidden flags for `--generate-default-config` command (#8046)\n  * fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props (#8050)\n  * feat(nodejs): respect peer dependencies for dependency tree (#7989)\n  * ci(helm): bump Trivy version to 0.58.0 for Trivy Helm Chart 0.10.0 (#8038)\n  * fix: respect GITHUB_TOKEN to download artifacts from GHCR (#7580)\n  * chore(deps): bump github.com/moby/buildkit from 0.17.2 to 0.18.0 in the docker group (#8029)\n  * fix(misconf): use log instead of fmt for logging (#8033)\n  * docs: add commercial content (#8030)\n\n- Update to version 0.58.2 (\n      bsc#1234512, CVE-2024-45337,\n      bsc#1235265, CVE-2024-45338,\n      bsc#1232948, CVE-2024-51744):\n\n  * fix(misconf): allow null values only for tf variables [backport: release/v0.58] (#8238)\n  * fix(suse): SUSE - update OSType constants and references for compatility [backport: release/v0.58] (#8237)\n  * fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field [backport: release/v0.58] (#8215)\n  * fix(sbom): attach nested packages to Application [backport: release/v0.58] (#8168)\n  * fix(python): skip dev group's deps for poetry [backport: release/v0.58] (#8158)\n  * fix(sbom): use root package for `unknown` dependencies (if exists) [backport: release/v0.58] (#8156)\n  * chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` [backport: release/v0.58] (#8142)\n  * chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` [backport: release/v0.58] (#8136)\n  * fix(redhat): correct rewriting of recommendations for the same vulnerability [backport: release/v0.58] (#8135)\n  * fix(oracle): add architectures support for advisories [backport: release/v0.58] (#8125)\n  * fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type [backport: release/v0.58] (#8124)\n  * chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 [backport: release/v0.58] (#8122)\n  * fix: handle `BLOW_UNKNOWN` error to download DBs [backport: release/v0.58] (#8121)\n  * fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props [backport: release/v0.58] (#8119)\n  * fix(misconf): wrap AWS EnvVar to iac types (#7407)\n  * chore(deps): Upgrade trivy-checks (#8018)\n  * refactor(misconf): Remove unused options (#7896)\n  * docs: add terminology page to explain Trivy concepts (#7996)\n  * feat: add `workspaceRelationship` (#7889)\n  * refactor(sbom): simplify relationship generation (#7985)\n  * chore: remove Go checks (#7907)\n  * docs: improve databases documentation (#7732)\n  * refactor: remove support for custom Terraform checks (#7901)\n  * docs: fix dead links (#7998)\n  * docs: drop AWS account scanning (#7997)\n  * fix(aws): change CPU and Memory type of ContainerDefinition to a string (#7995)\n  * fix(cli): Handle empty ignore files more gracefully (#7962)\n  * fix(misconf): load full Terraform module (#7925)\n  * fix(misconf): properly resolve local Terraform cache (#7983)\n  * refactor(k8s): add v prefix for Go packages (#7839)\n  * test: replace Go checks with Rego (#7867)\n  * feat(misconf): log causes of HCL file parsing errors (#7634)\n  * chore(deps): bump the aws group across 1 directory with 7 updates (#7991)\n  * chore(deps): bump github.com/moby/buildkit from 0.17.0 to 0.17.2 in the docker group across 1 directory (#7990)\n  * chore(deps): update csaf module dependency from csaf-poc to gocsaf (#7992)\n  * chore: downgrade the failed block expand message to debug (#7964)\n  * fix(misconf): do not erase variable type for child modules (#7941)\n  * feat(go): construct dependencies of `go.mod` main module in the parser (#7977)\n  * feat(go): construct dependencies in the parser (#7973)\n  * feat: add cvss v4 score and vector in scan response (#7968)\n  * docs: add `overview` page for `others` (#7972)\n  * fix(sbom): Fixes for Programming Language Vulnerabilities and SBOM Package Maintainer Details (#7871)\n  * feat(suse): Align SUSE/OpenSUSE OS Identifiers (#7965)\n  * chore(deps): bump the common group with 4 updates (#7949)\n  * feat(oracle): add `flavors` support (#7858)\n  * fix(misconf): Update trivy-checks default repo to `mirror.gcr.io` (#7953)\n  * chore(deps): Bump up trivy-checks to v1.3.0 (#7959)\n  * fix(k8s): check all results for vulnerabilities (#7946)\n  * ci(helm): bump Trivy version to 0.57.1 for Trivy Helm Chart 0.9.0 (#7945)\n  * feat(secret): Add built-in secrets rules for Private Packagist (#7826)\n  * docs: Fix broken links (#7900)\n  * docs: fix mistakes/typos (#7942)\n  * feat: Update registry fallbacks (#7679)\n  * fix(alpine): add `UID` for removed packages (#7887)\n  * chore(deps): bump the aws group with 6 updates (#7902)\n  * chore(deps): bump the common group with 6 updates (#7904)\n  * fix(debian): infinite loop (#7928)\n  * fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files (#7912)\n  * docs: add note about temporary podman socket (#7921)\n  * docs: combine trivy.dev into trivy docs (#7884)\n  * test: change branch in spdx schema link to check in integration tests (#7935)\n  * docs: add Headlamp to the Trivy Ecosystem page (#7916)\n  * fix(report): handle `git@github.com` schema for misconfigs in `sarif` report (#7898)\n  * chore(k8s): enhance k8s scan log (#6997)\n  * fix(terraform): set null value as fallback for missing variables (#7669)\n  * fix(misconf): handle null properties in CloudFormation templates (#7813)\n  * fix(fs): add missing defered Cleanup() call to post analyzer fs (#7882)\n  * chore(deps): bump the common group across 1 directory with 20 updates (#7876)\n  * chore: bump containerd to v2.0.0 (#7875)\n  * fix: Improve version comparisons when build identifiers are present (#7873)\n  * feat(k8s): add default commands for unknown platform (#7863)\n  * chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#7868)\n  * refactor(secret): optimize performance by moving ToLower operation outside loop (#7862)\n  * test: save `containerd` image into archive and use in tests (#7816)\n  * chore(deps): bump the github-actions group across 1 directory with 2 updates (#7854)\n  * chore: bump golangci-lint to v1.61.0 (#7853)\n\nUpdate to version 0.57.1:\n\n  * feat: Update registry fallbacks [backport: release/v0.57] (#7944)\n  * fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files [backport: release/v0.57] (#7939)\n  * test: change branch in spdx schema link to check in integration tests [backport: release/v0.57] (#7940)\n  * release: v0.57.0 [main] (#7710)\n  * chore: lint `errors.Join` (#7845)\n  * feat(db): append errors (#7843)\n  * docs(java): add info about supported scopes (#7842)\n  * docs: add example of creating whitelist of checks (#7821)\n  * chore(deps): Bump trivy-checks (#7819)\n  * fix(go): Do not trim v prefix from versions in Go Mod Analyzer (#7733)\n  * fix(k8s): skip resources without misconfigs (#7797)\n  * fix(sbom):  use `Annotation` instead of `AttributionTexts` for `SPDX` formats (#7811)\n  * fix(cli): add config name to skip-policy-update alias (#7820)\n  * fix(helm): properly handle multiple archived dependencies (#7782)\n  * refactor(misconf): Deprecate `EXCEPTIONS` for misconfiguration scanning (#7776)\n  * fix(k8s)!: support k8s multi container (#7444)\n  * fix(k8s): support kubernetes v1.31 (#7810)\n  * docs: add Windows install instructions (#7800)\n  * ci(helm): auto public Helm chart after PR merged (#7526)\n  * feat: add end of life date for Ubuntu 24.10 (#7787)\n  * feat(report): update gitlab template to populate operating_system value (#7735)\n  * feat(misconf): Show misconfig ID in output (#7762)\n  * feat(misconf): export unresolvable field of IaC types to Rego (#7765)\n  * refactor(k8s): scan config files as a folder (#7690)\n  * fix(license): fix license normalization for Universal Permissive License (#7766)\n  * fix: enable usestdlibvars linter (#7770)\n  * fix(misconf): properly expand dynamic blocks (#7612)\n  * feat(cyclonedx): add file checksums to `CycloneDX` reports (#7507)\n  * fix(misconf): fix for Azure Storage Account network acls adaptation (#7602)\n  * refactor(misconf): simplify k8s scanner (#7717)\n  * feat(parser): ignore white space in pom.xml files (#7747)\n  * test: use forked images (#7755)\n  * fix(java): correctly inherit `version` and `scope` from upper/root `depManagement` and `dependencies` into parents (#7541)\n  * fix(misconf): check if property is not nil before conversion (#7578)\n  * fix(misconf): change default ACL of digitalocean_spaces_bucket to private (#7577)\n  * feat(misconf): ssl_mode support for GCP SQL DB instance (#7564)\n  * test: define constants for test images (#7739)\n  * docs: add note about disabled DS016 check (#7724)\n  * feat(misconf): public network support for Azure Storage Account (#7601)\n  * feat(cli): rename `trivy auth` to `trivy registry` (#7727)\n  * docs: apt-transport-https is a transitional package (#7678)\n  * refactor(misconf): introduce generic scanner (#7515)\n  * fix(cli): `clean --all` deletes only relevant dirs (#7704)\n  * feat(cli): add `trivy auth` (#7664)\n  * fix(sbom): add options for DBs in private registries (#7660)\n  * docs(report): fix reporting doc format (#7671)\n  * fix(repo): `git clone` output to Stderr (#7561)\n  * fix(redhat): include arch in PURL qualifiers (#7654)\n  * fix(report): Fix invalid URI in SARIF report (#7645)\n  * docs(report): Improve SARIF reporting doc (#7655)\n  * fix(db): fix javadb downloading error handling (#7642)\n  * feat(cli): error out when ignore file cannot be found (#7624)\n\nUpdate to version 0.56.2:\n\n  * fix(redhat): include arch in PURL qualifiers [backport: release/v0.56] (#7702)\n  * fix(sbom): add options for DBs in private registries [backport: release/v0.56] (#7691)\n\n- Update to version 0.51.1 (bsc#1227010, CVE-2024-3817):\n","status":"withdrawn","published":"2025-11-27T12:27:44Z","modified":"2026-06-24T14:04:22.238238822Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2025:20177-1","title":"Security update for cheat","description":"This update for cheat fixes the following issues:\n\n- Security:\n  * CVE-2025-47913: Fix client process termination (bsc#1253593)\n  * CVE-2025-58181: Fix potential unbounded memory consumption (bsc#1253922)\n  * CVE-2025-47914: Fix panic due to an out of bounds read (bsc#1254051)\n  * Replace golang.org/x/crypto=golang.org/x/crypto@v0.45.0\n  * Replace golang.org/x/net=golang.org/x/net@v0.47.0\n  * Replace golang.org/x/sys=golang.org/x/sys@v0.38.0\n\n- Packaging improvements:\n  * Drop Requires: golang-packaging. The recommended Go toolchain\n    dependency expression is BuildRequires: golang(API) \u003e= 1.x or\n    optionally the metapackage BuildRequires: go\n  * Use BuildRequires: golang(API) \u003e= 1.19 matching go.mod\n  * Build PIE with pattern that may become recommended procedure:\n    %%ifnarch ppc64 GOFLAGS=\"-buildmode=pie\" %%endif go build\n    A go toolchain buildmode default config would be preferable\n    but none exist at this time.\n  * Drop mod=vendor, go1.14+ will detect vendor dir and auto-enable\n  * Remove go build -o output binary location and name. Default\n    binary has the same name as package of func main() and is\n    placed in the top level of the build directory.\n  * Add basic %check to execute binary --help\n\n- Packaging improvements:\n  * Service go_modules replace dependencies with CVEs\n  * Replace github.com/cloudflare/circl=github.com/cloudflare/circl@v1.6.1\n    Fix GO-2025-3754 GHSA-2x5j-vhc8-9cwm\n  * Replace golang.org/x/net=golang.org/x/net@v0.36.0\n    Fixes GO-2025-3503 CVE-2025-22870\n  * Replace golang.org/x/crypto=golang.org/x/crypto@v0.35.0\n    Fixes GO-2023-2402 CVE-2023-48795 GHSA-45x7-px36-x8w8\n    Fixes GO-2025-3487 CVE-2025-22869\n  * Replace github.com/go-git/go-git/v5=github.com/go-git/go-git/v5@v5.13.0\n    Fixes GO-2025-3367 CVE-2025-21614 GHSA-r9px-m959-cxf4\n    Fixes GO-2025-3368 CVE-2025-21613 GHSA-v725-9546-7q7m\n  * Service tar_scm set mode manual from disabled\n  * Service tar_scm create archive from git so we can exclude\n    vendor directory upstream committed to git. Committed vendor\n    directory contents have build issues even after go mod tidy.\n  * Service tar_scm exclude dir vendor\n  * Service set_version set mode manual from disabled\n  * Service set_version remove param basename not needed\n","status":"published","published":"2025-12-18T00:17:52Z","modified":"2026-03-23T04:54:19.442051Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20798-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\nUpdate to version 0.68.2:\n\nSecurity fixes:\n\n - CVE-2024-3817: hashicorp/go-getter: argument injection when fetching remote default git branches (bsc#1227010).\n - CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (bsc#1234512).\n - CVE-2024-45338: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content (bsc#1235265).\n - CVE-2024-51744: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (bsc#1232948).\n - CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250625).\n - CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239225).\n - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239385).\n - CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241724).\n - CVE-2025-27144: gopkg.in/go-jose/go-jose.v2: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237618).\n - CVE-2025-30204: github.com/golang-jwt/jwt/v4,github.com/golang-jwt/jwt/v5: jwt-go allows excessive memory allocation during header parsing (bsc#1240466).\n - CVE-2025-46569: github.com/open-policy-agent/opa: HTTP request path can be crafted to inject Rego code into a constructed query when a virtual document is requested through the Data API (bsc#1246730).\n - CVE-2025-47291: github.com/containerd/containerd/v2: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. (bsc#1243633).\n - CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251363).\n - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253512).\n - CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253977).\n - CVE-2025-53547: helm.sh/helm/v3: Helm Chart Code Execution (bsc#1246151).\n - CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248937, bsc#1248897).\n - CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253786).\n - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially crafted input (bsc#1251547).\n\nOther fixes:\n\n - Update installation.md (#8979)\n - chore(alpine): add EOL date for Alpine 3.21 (#8221)\n - chore(alpine): add EOL date for Alpine 3.22 (#8992)\n - chore(cli): Remove Trivy Cloud (#9847)\n - chore(deps): Bump trivy-checks (#7819)\n - chore(deps): Bump trivy-checks (#8310)\n - chore(deps): Bump trivy-checks (#8619)\n - chore(deps): Bump trivy-checks (#8934)\n - chore(deps): Bump trivy-checks to v1.7.1 (#8467)\n - chore(deps): Bump up trivy-checks to v1.3.0 (#7959)\n - chore(deps): Switch to go-viper/mapstructure (#9579)\n - chore(deps): Update trivy-checks (#8798)\n - chore(deps): Upgrade trivy-checks (#8018)\n - chore(deps): bump Go to `v1.23.5` (#8341)\n - chore(deps): bump Go to `v1.23.5` [backport: release/v0.59] (#8343)\n - chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` (#8105)\n - chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` [backport: release/v0.58] (#8136)\n - chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` (#8140)\n - chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` [backport: release/v0.58] (#8142)\n - chore(deps): bump alpine from 3.20.0 to 3.21.0 in the docker group across 1 directory (#8196)\n - chore(deps): bump alpine from 3.21.0 to 3.21.3 in the docker group across 1 directory (#8490)\n - chore(deps): bump alpine from 3.21.4 to 3.22.1 (#9301)\n - chore(deps): bump github.com/containerd/containerd from 1.7.28 to 1.7.29 (#9764)\n - chore(deps): bump github.com/containerd/containerd/v2 from 2.1.0 to 2.1.1 (#8901)\n - chore(deps): bump github.com/containerd/containerd/v2 from 2.1.4 to 2.1.5 (#9763)\n - chore(deps): bump github.com/docker/docker from 28.3.2+incompatible to 28.3.3+incompatible (#9274)\n - chore(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 (#8443)\n - chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 (#9088)\n - chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#7868)\n - chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 (#8597)\n - chore(deps): bump github.com/moby/buildkit from 0.17.0 to 0.17.2 in the docker group across 1 directory (#7990)\n - chore(deps): bump github.com/moby/buildkit from 0.17.2 to 0.18.0 in the docker group (#8029)\n - chore(deps): bump github.com/opencontainers/selinux from 1.12.0 to 1.13.0 (#9778)\n - chore(deps): bump github.com/quic-go/quic-go from 0.52.0 to 0.54.1 (#9694)\n - chore(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#9403)\n - chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 (#8103)\n - chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 [backport: release/v0.58] (#8122)\n - chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#9827)\n - chore(deps): bump golang.org/x/sync from 0.13.0 to 0.14.0 in the common group (#8822)\n - chore(deps): bump golangci-lint to v2.1.2 (#8766)\n - chore(deps): bump helm.sh/helm/v3 from 3.18.3 to 3.18.4 (#9164)\n - chore(deps): bump the aws group across 1 directory with 5 updates (#8652)\n - chore(deps): bump the aws group across 1 directory with 6 updates (#8074)\n - chore(deps): bump the aws group across 1 directory with 6 updates (#8163)\n - chore(deps): bump the aws group across 1 directory with 7 updates (#7991)\n - chore(deps): bump the aws group across 1 directory with 7 updates (#8468)\n - chore(deps): bump the aws group with 6 updates (#7902)\n - chore(deps): bump the aws group with 6 updates (#9383)\n - chore(deps): bump the aws group with 6 updates (#9481)\n - chore(deps): bump the aws group with 6 updates (#9547)\n - chore(deps): bump the aws group with 7 updates (#8299)\n - chore(deps): bump the aws group with 7 updates (#9311)\n - chore(deps): bump the aws group with 7 updates (#9419)\n - chore(deps): bump the aws group with 7 updates (#9691)\n - chore(deps): bump the common group across 1 directory with 10 updates (#8566)\n - chore(deps): bump the common group across 1 directory with 10 updates (#8817)\n - chore(deps): bump the common group across 1 directory with 10 updates [backport: release/v0.62] (#8831)\n - chore(deps): bump the common group across 1 directory with 11 updates (#8381)\n - chore(deps): bump the common group across 1 directory with 13 updates (#8491)\n - chore(deps): bump the common group across 1 directory with 14 updates (#8126)\n - chore(deps): bump the common group across 1 directory with 20 updates (#7876)\n - chore(deps): bump the common group across 1 directory with 20 updates (#9840)\n - chore(deps): bump the common group across 1 directory with 23 updates (#8733)\n - chore(deps): bump the common group across 1 directory with 24 updates (#9228)\n - chore(deps): bump the common group across 1 directory with 24 updates (#9507)\n - chore(deps): bump the common group across 1 directory with 26 updates (#9063)\n - chore(deps): bump the common group across 1 directory with 26 updates (#9347)\n - chore(deps): bump the common group across 1 directory with 29 updates (#8261)\n - chore(deps): bump the common group across 1 directory with 7 updates (#9590)\n - chore(deps): bump the common group across 1 directory with 9 updates (#8887)\n - chore(deps): bump the common group across 1 directory with 9 updates (#9153)\n - chore(deps): bump the common group with 12 updates (#8301)\n - chore(deps): bump the common group with 4 updates (#7949)\n - chore(deps): bump the common group with 6 updates (#7904)\n - chore(deps): bump the common group with 6 updates (#8162)\n - chore(deps): bump the common group with 6 updates (#8411)\n - chore(deps): bump the common group with 7 updates (#9382)\n - chore(deps): bump the docker group across 1 directory with 3 updates (#8127)\n - chore(deps): bump the docker group across 1 directory with 3 updates (#8762)\n - chore(deps): bump the docker group with 3 updates (#9545)\n - chore(deps): bump the docker group with 3 updates (#9776)\n - chore(deps): bump the github-actions group across 1 directory with 2 updates (#7854)\n - chore(deps): bump the github-actions group across 1 directory with 2 updates (#8962)\n - chore(deps): bump the github-actions group across 1 directory with 4 updates (#8331)\n - chore(deps): bump the github-actions group across 1 directory with 9 updates (#9563)\n - chore(deps): bump the github-actions group with 3 updates (#8473)\n - chore(deps): bump the github-actions group with 4 updates (#9739)\n - chore(deps): bump the testcontainers group with 2 updates (#8650)\n - chore(deps): bump the testcontainers group with 2 updates (#9506)\n - chore(deps): bump to alpine from `3.21.3` to `3.21.4` (#9283)\n - chore(deps): bump up Trivy-kubernetes to v0.9.1 (#9214)\n - chore(deps): remove missed replace of `trivy-db` (#8492)\n - chore(deps): update Docker to v28.2.2 and fix compatibility issues (#9037)\n - chore(deps): update Go to 1.24 and switch to go-version-file (#8388)\n - chore(deps): update csaf module dependency from csaf-poc to gocsaf (#7992)\n - chore(deps): update go-rustaudit location (#8450)\n - chore(deps): update to module-compatible docker-credential-gcr/v2 (#9591)\n - chore(deps): use aqua forks for `github.com/liamg/jfather` and `github.com/liamg/iamgo` (#8289)\n - chore(k8s): enhance k8s scan log (#6997)\n - chore(k8s): update comments with deprecated command format (#8964)\n - chore(license): add missed spdx exceptions: (#9147)\n - chore(secret): add reported issues related to secrets in junit template (#8193)\n - chore(terraform): add accessors to underlying raw hcl values (#8306)\n - chore(terraform): assign *terraform.Module 'parent' field (#8444)\n - chore(terraform): export module path on terraform modules (#8374)\n - chore(terraform): option to pass in instanced logger  (#8738)\n - chore(terraform): remove os.OpenPath call from terraform file functions (#8737)\n - chore(vex): suppress CVE-2024-45337 (#8101)\n - chore(vex): suppress CVE-2024-45338 (#8137)\n - chore: Update release flow to include chocolatey (#9460)\n - chore: Update release workflow to trigger version updates (#9162)\n - chore: add an issue template for maintainers (#8838)\n - chore: add context to the cache interface (#9565)\n - chore: add debug log to show image source location (#9163)\n - chore: add modernize tool integration for code modernization (#9251)\n - chore: bump Go to 1.24.7 (#9435)\n - chore: bump `mockery` to update v2.52.2 version and rebuild mock files (#8390)\n - chore: bump containerd to v2.0.0 (#7875)\n - chore: bump go to 1.23.4 (#8123)\n - chore: bump golangci-lint to v1.61.0 (#7853)\n - chore: bump up Go version to 1.24.4 (#9031)\n - chore: downgrade the failed block expand message to debug (#7964)\n - chore: drop FreeBSD 32-bit support (#9102)\n - chore: enable int-conversion from perfsprint (#8194)\n - chore: enable staticcheck (#8815)\n - chore: fix errors and typos in docs (#8963)\n - chore: fix some function names in comment (#9314)\n - chore: implement process-safe temp file cleanup (#9241)\n - chore: lint `errors.Join` (#7845)\n - chore: migrate protoc setup from Docker to buf CLI (#9184)\n - chore: remove Go checks (#7907)\n - chore: remove aws iam related scripts (#8179)\n - chore: remove debug prints (#8347)\n - chore: remove mockery (#8417)\n - chore: replace deprecated tenv linter with usetesting (#8504)\n - chore: trigger the trivy-www workflow (#9737)\n - chore: typo fix to replace `rego` with `repo` on the RepoFlagGroup options error output (#8643)\n - chore: update Docker lib (#8681)\n - chore: update code owners (#8303)\n - chore: update template URL for brew formula (#9221)\n - chore: update the rpm download Update (#9202)\n - chore: use go.mod for managing Go tools (#8493)\n - chore: use require.ErrorContains when possible (#8291)\n - ci(deps): add 3-day cooldown period for Dependabot updates (#9475)\n - ci(helm): auto public Helm chart after PR merged (#7526)\n - ci(helm): bump Trivy version to 0.57.1 for Trivy Helm Chart 0.9.0 (#7945)\n - ci(helm): bump Trivy version to 0.58.0 for Trivy Helm Chart 0.10.0 (#8038)\n - ci(helm): bump Trivy version to 0.58.1 for Trivy Helm Chart 0.10.0 (#8170)\n - ci(helm): bump Trivy version to 0.59.0 for Trivy Helm Chart 0.11.0 (#8311)\n - ci(helm): bump Trivy version to 0.59.1 for Trivy Helm Chart 0.11.1 (#8354)\n - ci(helm): bump Trivy version to 0.60.0 for Trivy Helm Chart 0.12.0 (#8494)\n - ci(helm): bump Trivy version to 0.61.0 for Trivy Helm Chart 0.13.0 (#8638)\n - ci(helm): bump Trivy version to 0.61.1 for Trivy Helm Chart 0.13.1 (#8753)\n - ci(helm): bump Trivy version to 0.62.0 for Trivy Helm Chart 0.14.0 (#8802)\n - ci(helm): bump Trivy version to 0.62.1 for Trivy Helm Chart 0.14.1 (#8836)\n - ci(helm): bump Trivy version to 0.63.0 for Trivy Helm Chart 0.15.0 (#8946)\n - ci(helm): bump Trivy version to 0.64.0 for Trivy Helm Chart 0.16.0 (#9107)\n - ci(helm): bump Trivy version to 0.64.1 for Trivy Helm Chart 0.16.1 (#9135)\n - ci(helm): bump Trivy version to 0.65.0 for Trivy Helm Chart 0.17.0 (#9288)\n - ci(helm): bump Trivy version to 0.66.0 for Trivy Helm Chart 0.18.0 (#9425)\n - ci(helm): bump Trivy version to 0.67.0 for Trivy Helm Chart 0.19.0 (#9554)\n - ci(helm): bump Trivy version to 0.67.2 for Trivy Helm Chart 0.19.1 (#9641)\n - ci(helm): create a helm branch for patches from main (#8673)\n - ci(spdx): add `aqua-installer` step to fix `mage` error (#8353)\n - ci(vuln): reduce github action script injection attack risk (#8610)\n - ci: add API diff workflow (#9600)\n - ci: add auto-ready-for-review workflow (#9179)\n - ci: add workflow to restrict direct PRs to release branches (#8240)\n - ci: delete cache after artifacts upload in canary workflow (#9177)\n - ci: enable `check-latest` for `setup-go` [backport: release/v0.68] (#9946)\n - ci: fix path to main dir for canary builds (#8231)\n - ci: get base_sha using base.ref (#9704)\n - ci: improve PR title validation workflow (#8720)\n - ci: migrate GitHub Actions from version tags to SHA pinning (#9405)\n - ci: move runner.os context from job-level env to step-level in canary workflow (#9233)\n - ci: optimize golangci-lint performance with cache-based strategy (#9173)\n - ci: remove invalid `--confirm` flag from `gh cache delete` command in canary builds (#9236)\n - ci: remove unused preinstalled software/images for build tests to free up disk space. (#9814)\n - ci: skip undefined labels in discussion triage action (#9175)\n - ci: specify repository for `gh cache delete` in canary worklfow (#9240)\n - ci: update GitHub Actions cache to v4 (#8475)\n - ci: use `Skitionek/notify-microsoft-teams` instead of `aquasecurity` fork (#8740)\n - ci: use `github.event.pull_request.user.login` for release PR check workflow (#8702)\n - ci: use environment variables in GitHub Actions for improved security (#9433)\n - ci: use gh pr view to get PR number for forked repositories in auto-ready workflow (#9183)\n - ci: use merge commit for apidiff to avoid false positives (#9622)\n - ci: use pull_request_target for apidiff workflow to support fork PRs (#9605)\n - docs(cli): improve flag value display format (#8560)\n - docs(java):  Update info about dev deps in gradle lock (#8830)\n - docs(java): add info about supported scopes (#7842)\n - docs(k8s): add a note about multi-container pods (#7815)\n - docs(misconf): Remove duplicate sections (#9819)\n - docs(misconf): Reorganize misconfiguration scan pages (#8206)\n - docs(misconf): simplify misconfiguration docs (#9030)\n - docs(python): Mention pip-compile (#8484)\n - docs(python): fix type with METADATA file name (#9090)\n - docs(report): Improve SARIF reporting doc (#7655)\n - docs(report): add nuanses about secret/license scanner in summary table (#9442)\n - docs(report): fix reporting doc format (#7671)\n - docs(server): fix info about scanning licenses on the client side. (#9805)\n - docs(vex): use debian minor version in examples (#8166)\n - docs(vuln): remove OSV for Python from data sources (#8841)\n - docs: Add info about helm charts release (#8640)\n - docs: Fix broken link to \"Built-in Checks\" (#9375)\n - docs: Fix broken links (#7900)\n - docs: Fix typo in terraform docs (#9492)\n - docs: Fix typos and linguistic errors in documentation / hacktoberfest (#9586)\n - docs: Fix typos in documentation (#8361)\n - docs: Update maintainer docs (#8674)\n - docs: Updated JSON schema version 2 in the trivy documentation (#8188)\n - docs: add Headlamp to the Trivy Ecosystem page (#7916)\n - docs: add PR review policy for maintainers (#9032)\n - docs: add Windows install instructions (#7800)\n - docs: add `overview` page for `others` (#7972)\n - docs: add abbreviation list (#8453)\n - docs: add commercial content (#8030)\n - docs: add example of creating whitelist of checks (#7821)\n - docs: add explanation for how to use non-system certificates (#9081)\n - docs: add info about `java-db` subdir (#9706)\n - docs: add info that `SSL_CERT_FILE` works on `Unix systems other than macOS` only (#9772)\n - docs: add note about disabled DS016 check (#7724)\n - docs: add note about temporary podman socket (#7921)\n - docs: add partners page (#8988)\n - docs: add section on customizing default check data (#9114)\n - docs: add terminology page to explain Trivy concepts (#7996)\n - docs: add vulnerability database contribution guide (#9667)\n - docs: apt-transport-https is a transitional package (#7678)\n - docs: bump pygments from 2.18.0 to 2.19.2 (#9596)\n - docs: catch some missed docs -\u003e guide (#9850)\n - docs: change --disable-metrics to --disable-telemetry in example (#8999) (#9003)\n - docs: change SecObserve URLs in documentatio (#9771)\n - docs: change in java.md: fix the Trity -to-\u003e Trivy typo (#8813)\n - docs: clarify inline ignore limitations for resource-less checks (#9537)\n - docs: combine trivy.dev into trivy docs (#7884)\n - docs: correct Ruby documentation (#8402)\n - docs: document eol supportability (#9434)\n - docs: drop AWS account scanning (#7997)\n - docs: fix a broken link (#8546)\n - docs: fix assets with versioning (#8996)\n - docs: fix dead links (#7998)\n - docs: fix mistakes/typos (#7942)\n - docs: fix modules path and update code example (#9539)\n - docs: fix navigate links (#8336)\n - docs: improve databases documentation (#7732)\n - docs: improve documentation for scanning raw IaC configurations (#9571)\n - docs: improve skipping files documentation (#8749)\n - docs: move info about `detection priority` into coverage section (#9469)\n - docs: partners page content updates (#9149)\n - docs: remove slack (#8565)\n - docs: replace short codes with Unicode emojis (#8296)\n - docs: restructure docs for new hosting (#9799)\n - docs: trivy partners page updates (#9133)\n - docs: update VEX documentation index page (#8458)\n - docs: update links to Semaphore pages (#9352)\n - docs: update vulnerability reporting guidelines in SECURITY.md (#9395)\n - feat(alma): add AlmaLinux 10 support (#9207)\n - feat(alpine): add maintainer field extraction for APK packages (#8930)\n - feat(aws): Add support for dualstack ECR endpoints (#9862)\n - feat(cli): Add available version checking (#8553)\n - feat(cli): Add trivy cloud suppport (#9637)\n - feat(cli): add `trivy auth` (#7664)\n - feat(cli): add version constraints to annoucements (#9023)\n - feat(cli): change --list-all-pkgs default to true (#9510)\n - feat(cli): error out when ignore file cannot be found (#7624)\n - feat(cli): rename `trivy auth` to `trivy registry` (#7727)\n - feat(cloudformation): support default values and list results in Fn::FindInMap (#9515)\n - feat(cyclonedx): Add initial support for loading external VEX files from SBOM references (#8254)\n - feat(cyclonedx): add file checksums to `CycloneDX` reports (#7507)\n - feat(cyclonedx): preserve SBOM structure when scanning SBOM files with vulnerability updates (#9439)\n - feat(db): append errors (#7843)\n - feat(db): enable concurrent access to vulnerability database (#9750)\n - feat(dotnet): add dependency graph support for .deps.json files (#9726)\n - feat(echo): Add Echo Support (#8833)\n - feat(flag): add `--cacert` flag (#9781)\n - feat(flag): add schema validation for `--server` flag (#9270)\n - feat(fs): change artifact type to repository when git info is detected (#9613)\n - feat(fs): optimize scanning performance by direct file access for known paths (#8525)\n - feat(fs): use git commit hash as cache key for clean repositories (#8278)\n - feat(go): construct dependencies in the parser (#7973)\n - feat(go): construct dependencies of `go.mod` main module in the parser (#7977)\n - feat(go): fix parsing main module version for go \u003e= 1.24 (#8433)\n - feat(go): support license scanning in both GOPATH and vendor (#8843)\n - feat(image): add Docker context resolution (#9166)\n - feat(image): add RepoTags support for Docker archives (#9690)\n - feat(image): add Sigstore bundle SBOM support (#9516)\n - feat(image): pass global context to docker/podman image save func (#9733)\n - feat(image): prevent scanning oversized container images (#8178)\n - feat(image): return error early if total size of layers exceeds limit (#8294)\n - feat(image): save layers metadata into report (#8394)\n - feat(java): add support remote repositories from settings.xml files (#9708)\n - feat(java): dereference all maven settings.xml env placeholders (#9024)\n - feat(k8s): add default commands for unknown platform (#7863)\n - feat(k8s): add support for controllers (#8614)\n - feat(k8s): get components from namespaced resources (#8918)\n - feat(k8s): improve artifact selections for specific namespaces (#8248)\n - feat(license): Support compound licenses (licenses using SPDX operators) (#8816)\n - feat(license): improve work text licenses with custom classification (#8888)\n - feat(license): improve work with custom classification of licenses from config file (#8861)\n - feat(license): observe pkg types option in license scanner (#9091)\n - feat(license): scan vendor directory for license for go.mod files (#8689)\n - feat(license): use separate SPDX ids to ignore SPDX expressions (#9087)\n - feat(minimos): Add support for MinimOS (#8792)\n - feat(misconf): Add RoleAssignments attribute (#9396)\n - feat(misconf): Add support for `Minimum Trivy Version` (#8880)\n - feat(misconf): Add support for aws_ami (#8499)\n - feat(misconf): Add support for configurable Rego error limit (#9657)\n - feat(misconf): Show misconfig ID in output (#7762)\n - feat(misconf): Update AppService schema (#9792)\n - feat(misconf): Update Azure Compute schema (#9675)\n - feat(misconf): Update Azure Container Schema (#9673)\n - feat(misconf): Update Azure network schema for new checks (#9791)\n - feat(misconf): Update SecurityCenter schema (#9674)\n - feat(misconf): Update azure storage schema (#9728)\n - feat(misconf): adapt AWS::DynamoDB::Table (#8529)\n - feat(misconf): adapt AWS::EC2::VPC (#8534)\n - feat(misconf): adapt aws_default_security_group (#8538)\n - feat(misconf): adapt aws_opensearch_domain (#8550)\n - feat(misconf): add OpenTofu file extension support (#8747)\n - feat(misconf): add agentpools to azure container schema (#9714)\n - feat(misconf): add misconfiguration location to junit template (#8793)\n - feat(misconf): add option to pass Rego scanner to IaC scanner (#8369)\n - feat(misconf): add private ip google access attribute to subnetwork (#9199)\n - feat(misconf): added audit config attribute (#9249)\n - feat(misconf): added logging and versioning to the gcp storage bucket (#9226)\n - feat(misconf): convert AWS managed policy to document (#8757)\n - feat(misconf): export raw Terraform data to Rego (#8741)\n - feat(misconf): export unresolvable field of IaC types to Rego (#7765)\n - feat(misconf): generate placeholders for random provider resources (#8051)\n - feat(misconf): include map key in manifest snippet for diagnostics (#9681)\n - feat(misconf): log causes of HCL file parsing errors (#7634)\n - feat(misconf): normalize CreatedBy for buildah and legacy docker builder (#8953)\n - feat(misconf): public network support for Azure Storage Account (#7601)\n - feat(misconf): render causes for Terraform (#8360)\n - feat(misconf): ssl_mode support for GCP SQL DB instance (#7564)\n - feat(misconf): support auto_provisioning_defaults in google_container_cluster (#8705)\n - feat(misconf): support for ignoring by inline comments for Dockerfile (#8115)\n - feat(misconf): support for ignoring by inline comments for Helm (#8138)\n - feat(misconf): support https_traffic_only_enabled in Az storage account (#9784)\n - feat(nodejs): add a bun.lock analyzer (#8897)\n - feat(nodejs): add bun.lock parser (#8851)\n - feat(nodejs): add root and workspace for `yarn` packages (#8535)\n - feat(nodejs): respect peer dependencies for dependency tree (#7989)\n - feat(oracle): add `flavors` support (#7858)\n - feat(parser): ignore white space in pom.xml files (#7747)\n - feat(python): add support for poetry dev dependencies (#8152)\n - feat(python): add support for uv (#8080)\n - feat(python): add support for uv dev and optional dependencies (#8134)\n - feat(redhat): Add EOL date for RHEL 10. (#8910)\n - feat(redhat): add os-release detection for RHEL-based images (#9458)\n - feat(repo): add git repository metadata to reports (#9252)\n - feat(report): add CVSS vectors in sarif report (#9157)\n - feat(report): add fingerprint generation for vulnerabilities (#9794)\n - feat(report): add image reference to report metadata (#9729)\n - feat(report): switch ReportID from UUIDv4 to UUIDv7 (#9749)\n - feat(report): update gitlab template to populate operating_system value (#7735)\n - feat(rust): add root and workspace relationships/package for `cargo` lock files (#8676)\n - feat(sbom): add SHA-512 hash support for CycloneDX SBOM (#9126)\n - feat(sbom): add manufacturer field to CycloneDX tools metadata (#9019)\n - feat(sbom): add support for SPDX attestations (#9829)\n - feat(sbom): added support for CoreOS (#9448)\n - feat(sbom): use SPDX license IDs list to validate SPDX IDs  (#9569)\n - feat(seal): add seal support (#9370)\n - feat(secret): Add built-in secrets rules for Private Packagist (#7826)\n - feat(secret): implement streaming secret scanner with byte offset tracking (#9264)\n - feat(suse): Add new openSUSE, Micro and SLES releases end of life dates (#9788)\n - feat(suse): Align SUSE/OpenSUSE OS Identifiers (#7965)\n - feat(terraform): add partial evaluation for policy templates (#8967)\n - feat(terraform): use .terraform cache for remote modules in plan scanning (#9277)\n - feat(ubuntu): add end of life date for Ubuntu 25.04 (#9077)\n - feat(ubuntu): add eol date for 20.04-ESM (#8981)\n - feat(vuln): add Root.io support for container image scanning (#9073)\n - feat: Update registry fallbacks (#7679)\n - feat: Update registry fallbacks [backport: release/v0.57] (#7944)\n - feat: add ArtifactID field to uniquely identify scan targets (#9663)\n - feat: add Bottlerocket OS package analyzer (#8653)\n - feat: add HTTP request/response tracing support (#9125)\n - feat: add JSONC support for comments and trailing commas (#8862)\n - feat: add ReportID field to scan reports (#9670)\n - feat: add `--distro` flag to manually specify OS distribution for vulnerability scanning (#8070)\n - feat: add `--vuln-severity-source` flag (#8269)\n - feat: add `workspaceRelationship` (#7889)\n - feat: add a examples field to check metadata (#8068)\n - feat: add cvss v4 score and vector in scan response (#7968)\n - feat: add documentation URL for database lock errors (#9531)\n - feat: add end of life date for Ubuntu 24.10 (#7787)\n - feat: add graceful shutdown with signal handling (#9242)\n - feat: add report summary table (#8177)\n - feat: add support for registry mirrors (#8244)\n - feat: add timeout handling for cache database operations (#9307)\n - feat: allow ignoring findings by type in Rego (#9578)\n - feat: include registry and repository in artifact ID calculation (#9689)\n - feat: reject unsupported artifact types in remote image retrieval (#9052)\n - feat: replace TinyGo with standard Go for WebAssembly modules (#8496)\n - feat: terraform parser option to set current working directory (#8909)\n - fix(alma): parse epochs from rpmqa file (#9101)\n - fix(alma): parse epochs from rpmqa file [backport: release/v0.64] (#9119)\n - fix(alpine): add `UID` for removed packages (#7887)\n - fix(aws): change CPU and Memory type of ContainerDefinition to a string (#7995)\n - fix(aws): update amazon linux 2 EOL date (#9176)\n - fix(aws): use `BuildableClient` insead of `xhttp.Client` (#9436)\n - fix(cli): Add more non-sensitive flags to telemetry (#9110)\n - fix(cli): Add more non-sensitive flags to telemetry [backport: release/v0.64] (#9124)\n - fix(cli): Handle empty ignore files more gracefully (#7962)\n - fix(cli): `clean --all` deletes only relevant dirs (#7704)\n - fix(cli): add config name to skip-policy-update alias (#7820)\n - fix(cli): add some values to the telemetry call (#9056)\n - fix(cli): disable `--skip-dir` and `--skip-files` flags for `sbom` command (#8886)\n - fix(cli): don't use allow values for `--compliance` flag (#8881)\n - fix(cli): ensure correct command is picked by telemetry (#9260)\n - fix(cli): panic: attempt to get os.Args[1] when len(os.Args) \u003c 2 (#9206)\n - fix(conda): memory leak by adding closure method for `package.json` file (#9349)\n - fix(cyclonedx): handle multiple license types (#9378)\n - fix(db): Dowload database when missing but metadata still exists (#9393)\n - fix(db): fix case when 2 trivy-db were copied at the same time (#8452)\n - fix(db): fix javadb downloading error handling (#7642)\n - fix(debian): don't include empty licenses for `dpkgs` (#8623)\n - fix(debian): infinite loop (#7928)\n - fix(deps): bump alpine from `3.22.1` to `3.23.0` [backport: release/v0.68] (#9949)\n - fix(flag): remove viper.SetDefault to fix IsSet() for config-only flags (#9732)\n - fix(flag): skip hidden flags for `--generate-default-config` command (#8046)\n - fix(fs): add missing defered Cleanup() call to post analyzer fs (#7882)\n - fix(fs): avoid shadowing errors in file.glob (#9286)\n - fix(fs): check postAnalyzers for StaticPaths (#8543)\n - fix(fs): fix cache key generation to use UUID (#8275)\n - fix(go): Do not trim v prefix from versions in Go Mod Analyzer (#7733)\n - fix(go): merge nested flags into string for ldflags for Go binaries (#8368)\n - fix(helm): properly handle multiple archived dependencies (#7782)\n - fix(image): disable AVD-DS-0007 for history scanning (#8366)\n - fix(image): use standardized HTTP client for ECR authentication (#9322)\n - fix(java): correctly inherit `version` and `scope` from upper/root `depManagement` and `dependencies` into parents (#7541)\n - fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props (#8050)\n - fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props [backport: release/v0.58] (#8119)\n - fix(java): exclude dev dependencies in gradle lockfile (#8803)\n - fix(java): update order for resolving package fields from multiple demManagement (#9575)\n - fix(java): use `true` as default value for Repository Release|Snapshot Enabled in pom.xml and settings.xml files (#9751)\n - fix(julia): add `Relationship` field support (#8939)\n - fix(k8s)!: support k8s multi container (#7444)\n - fix(k8s): add missed option `PkgRelationships` (#8442)\n - fix(k8s): check all results for vulnerabilities (#7946)\n - fix(k8s): correct compare artifact versions (#8682)\n - fix(k8s): correct compare artifact versions [backport: release/v0.61] (#8699)\n - fix(k8s): disable parallel traversal with fs cache for k8s images (#9534)\n - fix(k8s): remove using `last-applied-configuration` (#8791)\n - fix(k8s): show report for `--report all` (#8613)\n - fix(k8s): skip passed misconfigs for the summary report (#8684)\n - fix(k8s): skip passed misconfigs for the summary report [backport: release/v0.61] (#8748)\n - fix(k8s): skip resources without misconfigs (#7797)\n - fix(k8s): support kubernetes v1.31 (#7810)\n - fix(k8s): use in-memory cache backend during misconfig scanning (#8873)\n - fix(license): add missed `GFDL-NIV-1.1` and `GFDL-NIV-1.2` into Trivy mapping (#9116)\n - fix(license): always trim leading and trailing spaces for licenses (#8095)\n - fix(license): don't normalize `unlicensed` licenses into `unlicense` (#9611)\n - fix(license): fix license normalization for Universal Permissive License (#7766)\n - fix(license): handle SPDX WITH exceptions as single license in category detection (#9380)\n - fix(license): handle WITH operator for `LaxSplitLicenses` (#9232)\n - fix(misconf): .Config.User always takes precedence over USER in .History (#9050)\n - fix(misconf): Check values wholly prior to evalution (#8604)\n - fix(misconf): Improve logging for unsupported checks (#8634)\n - fix(misconf): Update trivy-checks default repo to `mirror.gcr.io` (#7953)\n - fix(misconf): add ephemeral block type to config schema (#8513)\n - fix(misconf): add missing variable as unknown (#8683)\n - fix(misconf): allow null values only for tf variables (#8112)\n - fix(misconf): allow null values only for tf variables [backport: release/v0.58] (#8238)\n - fix(misconf): change default ACL of digitalocean_spaces_bucket to private (#7577)\n - fix(misconf): check if for-each is known when expanding dyn block (#8808)\n - fix(misconf): check if for-each is known when expanding dyn block [backport: release/v0.62] (#8826)\n - fix(misconf): check if metadata is not nil (#8647)\n - fix(misconf): check if property is not nil before conversion (#7578)\n - fix(misconf): correct Azure value-to-time conversion in AsTimeValue (#9015)\n - fix(misconf): correctly adapt azure storage account (#9138)\n - fix(misconf): correctly handle all YAML tags in K8S templates (#8259)\n - fix(misconf): correctly parse empty port ranges in google_compute_firewall (#9237)\n - fix(misconf): disable git terminal prompt on tf module load (#8026)\n - fix(misconf): do not erase variable type for child modules (#7941)\n - fix(misconf): do not log scanners when misconfig scanning is disabled (#8345)\n - fix(misconf): do not log scanners when misconfig scanning is disabled [backport: release/v0.59] (#8349)\n - fix(misconf): do not skip loading documents from subdirectories (#8526)\n - fix(misconf): do not use cty.NilVal for non-nil values (#8567)\n - fix(misconf): ecs include enhanced for container insights (#8326)\n - fix(misconf): ensure boolean metadata values are correctly interpreted (#9770)\n - fix(misconf): ensure ignore rules respect subdirectory chart paths (#9324)\n - fix(misconf): ensure module source is known (#9404)\n - fix(misconf): ensure value used as ignore marker is non-null and known (#9835)\n - fix(misconf): filter null nodes when parsing json manifest (#8785)\n - fix(misconf): fix for Azure Storage Account network acls adaptation (#7602)\n - fix(misconf): fix incorrect k8s locations due to JSON to YAML conversion (#8073)\n - fix(misconf): fix log bucket in schema (#9235)\n - fix(misconf): handle heredocs in dockerfile instructions (#8284)\n - fix(misconf): handle null properties in CloudFormation templates (#7813)\n - fix(misconf): handle tofu files in module detection (#9486)\n - fix(misconf): handle unsupported experimental flags in Dockerfile (#9769)\n - fix(misconf): identify the chart file exactly by name (#8590)\n - fix(misconf): load full Terraform module (#7925)\n - fix(misconf): map healthcheck start period flag to --start-period instead of --startPeriod (#9837)\n - fix(misconf): move disabled checks filtering after analyzer scan (#9002)\n - fix(misconf): perform operations on attribute safely (#8774)\n - fix(misconf): populate context correctly for module instances (#8656)\n - fix(misconf): preserve original paths of remote submodules from .terraform (#9294)\n - fix(misconf): properly expand dynamic blocks (#7612)\n - fix(misconf): properly resolve local Terraform cache (#7983)\n - fix(misconf): reduce log noise on incompatible check (#9029)\n - fix(misconf): set default values for AWS::EKS::Cluster.ResourcesVpcConfig (#8548)\n - fix(misconf): skip Azure CreateUiDefinition (#8503)\n - fix(misconf): skip rewriting expr if attr is nil (#9113)\n - fix(misconf): skip rewriting expr if attr is nil [backport: release/v0.64] (#9127)\n - fix(misconf): strip build metadata suffixes from image history (#9498)\n - fix(misconf): unmark cty values before access (#9495)\n - fix(misconf): use argument value in WithIncludeDeprecatedChecks (#8942)\n - fix(misconf): use correct field log_bucket instead of target_bucket in gcp bucket (#9296)\n - fix(misconf): use log instead of fmt for logging (#8033)\n - fix(misconf): wrap AWS EnvVar to iac types (#7407)\n - fix(misconf): wrap legacy ENV values in quotes to preserve spaces (#9497)\n - fix(nodejs): correctly parse `packages` array of `bun.lock` file (#8998)\n - fix(nodejs): don't use prerelease logic for compare npm constraints  (#9208)\n - fix(nodejs): fix npmjs parser.pkgNameFromPath() panic issue (#9688)\n - fix(nodejs): parse workspaces as objects for package-lock.json files (#9518)\n - fix(nodejs): use snapshot string as `Package.ID` for pnpm packages (#9330)\n - fix(nodejs): use the default ID format to match licenses in pnpm packages. (#9661)\n - fix(oracle): add architectures support for advisories (#4809)\n - fix(oracle): add architectures support for advisories [backport: release/v0.58] (#8125)\n - fix(os): Add photon 5.0 in supported OS (#9724)\n - fix(os): add mapping OS aliases (#8466)\n - fix(plugin): don't remove plugins when updating index.yaml file (#9358)\n - fix(python): add `poetry` v2 support (#8323)\n - fix(python): add `poetry` v2 support [backport: release/v0.59] (#8335)\n - fix(python): impove package name normalization  (#9290)\n - fix(python): skip dev group's deps for poetry (#8106)\n - fix(python): skip dev group's deps for poetry [backport: release/v0.58] (#8158)\n - fix(redhat): Also try to find buildinfo in root layer (layer 0) (#8924)\n - fix(redhat): check `usr/share/buildinfo/` dir to detect content sets (#8222)\n - fix(redhat): correct rewriting of recommendations for the same vulnerability (#8063)\n - fix(redhat): correct rewriting of recommendations for the same vulnerability [backport: release/v0.58] (#8135)\n - fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files (#7912)\n - fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files [backport: release/v0.57] (#7939)\n - fix(redhat): include arch in PURL qualifiers (#7654)\n - fix(redhat): include arch in PURL qualifiers [backport: release/v0.56] (#7702)\n - fix(redhat): save contentSets for OS packages in fs/vm modes (#8820)\n - fix(redhat): trim invalid suffix from content_sets in manifest parsing (#8818)\n - fix(redhat): trim invalid suffix from content_sets in manifest parsing [backport: release/v0.62] (#8824)\n - fix(repo): `git clone` output to Stderr (#7561)\n - fix(repo): preserve RepoMetadata on FS cache hit (#9389)\n - fix(repo): sanitize git repo URL before inserting into report metadata (#9391)\n - fix(report): Fix invalid URI in SARIF report (#7645)\n - fix(report): clean buffer after flushing (#8725)\n - fix(report): correct field order in SARIF license results (#9712)\n - fix(report): don't panic when report contains vulns, but doesn't contain packages for `table` format (#8549)\n - fix(report): handle `git@github.com` schema for misconfigs in `sarif` report (#7898)\n - fix(report): remove html escaping for `shortDescription` and `fullDescription` fields for sarif reports (#8344)\n - fix(rootio): check full version to detect `root.io` packages (#9117)\n - fix(rootio): check full version to detect `root.io` packages [backport: release/v0.64] (#9120)\n - fix(rootio): fix severity selection (#9181)\n - fix(sbom):  use `Annotation` instead of `AttributionTexts` for `SPDX` formats (#7811)\n - fix(sbom): Fixes for Programming Language Vulnerabilities and SBOM Package Maintainer Details (#7871)\n - fix(sbom): add SBOM file's filePath as Application FilePath if we can't detect its path (#8346)\n - fix(sbom): add `buildInfo` info as properties (#9683)\n - fix(sbom): add options for DBs in private registries (#7660)\n - fix(sbom): add options for DBs in private registries [backport: release/v0.56] (#7691)\n - fix(sbom): add support for `file` component type of `CycloneDX` (#9372)\n - fix(sbom): attach nested packages to Application (#8144)\n - fix(sbom): attach nested packages to Application [backport: release/v0.58] (#8168)\n - fix(sbom): don’t panic on SBOM format if scanned CycloneDX file has empty metadata (#9562)\n - fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type (#8052)\n - fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type [backport: release/v0.58] (#8124)\n - fix(sbom): improve logic for binding direct dependency to parent component (#8489)\n - fix(sbom): merge in-graph and out-of-graph OS packages in scan results (#9194)\n - fix(sbom): preserve OS packages from multiple SBOMs (#8325)\n - fix(sbom): preserve OS packages from multiple SBOMs [backport: release/v0.59] (#8333)\n - fix(sbom): remove unnecessary OS detection check in SBOM decoding (#9034)\n - fix(sbom): scan results of SBOMs generated from container images are missing layers (#7635)\n - fix(sbom): use correct field for licenses in CycloneDX reports (#9057)\n - fix(sbom): use root package for `unknown` dependencies (if exists) (#8104)\n - fix(sbom): use root package for `unknown` dependencies (if exists) [backport: release/v0.58] (#8156)\n - fix(secret): add UTF-8 validation in secret scanner to prevent protobuf marshalling errors (#9253)\n - fix(secret): fix line numbers for multiple-line secrets (#9104)\n - fix(secret): ignore .dist-info directories during secret scanning (#8646)\n - fix(server): add HTTP transport setup to server mode (#9217)\n - fix(server): add missed Relationship field for `rpc` (#8872)\n - fix(server): fix redis key when trying to delete blob (#8649)\n - fix(server): secrets inspectation for the config analyzer in client server mode (#8418)\n - fix(spdx): init `pkgFilePaths` map for all formats (#8380)\n - fix(spdx): save text licenses into `otherLicenses` without normalize (#8502)\n - fix(spdx): use the `hasExtractedLicensingInfos` field for licenses that are not listed in the SPDX (#8077)\n - fix(suse): SUSE - update OSType constants and references for compatility (#8236)\n - fix(suse): SUSE - update OSType constants and references for compatility [backport: release/v0.58] (#8237)\n - fix(terraform): `evaluateStep` to correctly set `EvalContext` for multiple instances of blocks (#8555)\n - fix(terraform): `for_each` on a map returns a resource for every key (#9156)\n - fix(terraform): apply parser options to submodule parsing (#8377)\n - fix(terraform): hcl object expressions to return references (#8271)\n - fix(terraform): set null value as fallback for missing variables (#7669)\n - fix(vex): don't  suppress vulns for packages with infinity loop (#9465)\n - fix(vex): don't use reused BOM (#9604)\n - fix(vex): don't use reused BOM [backport: release/v0.67] (#9612)\n - fix(vex): use `lo.IsNil` to check `VEX` from OCI artifact (#8858)\n - fix(vex): use a separate `visited` set for each DFS path (#9760)\n - fix(vuln): compare `nuget` package names in lower case (#9456)\n - fix(wolfi): support new APK database location (#8937)\n - fix: Add missing version check flags (#8951)\n - fix: CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass (#8088)\n - fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field (#8207)\n - fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field [backport: release/v0.58] (#8215)\n - fix: Correctly check for semver versions for trivy version check (#8948)\n - fix: Improve version comparisons when build identifiers are present (#7873)\n - fix: Trim the end-of-range suffix (#9618)\n - fix: Updated twitter icon (#7772)\n - fix: Use `fetch-level: 1` to check out trivy-repo in the release workflow (#9636)\n - fix: Use `fetch-level: 1` to check out trivy-repo in the release workflow [backport: release/v0.67] (#9638)\n - fix: add `buildInfo` for `BlobInfo` in `rpc` package (#9608)\n - fix: add `buildInfo` for `BlobInfo` in `rpc` package [backport: release/v0.67] (#9615)\n - fix: also check `filepath` when removing duplicate packages (#9142)\n - fix: check post-analyzers for StaticPaths (#8904)\n - fix: close all opened resources if an error occurs (#9665)\n - fix: close file descriptors and pipes on error paths (#9536)\n - fix: create temp file under composite fs dir (#9387)\n - fix: de-duplicate same `dpkg` packages with different filePaths from different layers (#8298)\n - fix: don't show corrupted trivy-db warning for first run (#8991)\n - fix: don't use `scope` for `trivy registry login` command (#8393)\n - fix: early-return, indent-error-flow and superfluous-else rules from revive  (#8796)\n - fix: enable err-error and errorf rules from perfsprint linter (#7859)\n - fix: enable usestdlibvars linter (#7770)\n - fix: filter all files when processing files installed from package managers (#8842)\n - fix: handle `BLOW_UNKNOWN` error to download DBs (#8060)\n - fix: handle `BLOW_UNKNOWN` error to download DBs [backport: release/v0.58] (#8121)\n - fix: improve conversion of image config to Dockerfile (#8308)\n - fix: julia parser panicing (#8883)\n - fix: migrate from `*.list` to `*.md5sums` files for `dpkg` (#9131)\n - fix: more revive rules (#8814)\n - fix: octalLiteral from go-critic (#8811)\n - fix: persistent flag option typo (#9374)\n - fix: prevent graceful shutdown message on normal exit (#9244)\n - fix: respect GITHUB_TOKEN to download artifacts from GHCR (#7580)\n - fix: restore compatibility for google.protobuf.Value (#9559)\n - fix: restore compatibility for google.protobuf.Value [backport: release/v0.67] (#9631)\n - fix: supporting .egg-info/METADATA in python.Packaging analyzer (#9151)\n - fix: suppress debug log for context cancellation errors (#9298)\n - fix: testifylint last issues (#8768)\n - fix: unused-parameter rule from revive (#8794)\n - fix: update all documentation links (#8045)\n - fix: update all documentation links (#9777)\n - fix: update cosing settings for GoReleaser after bumping cosing to v3 (#9863)\n - fix: use `--file-patterns` flag for all post analyzers (#7365)\n - fix: use context for analyzers (#9538)\n - fix: use-any from revive (#8810)\n - fix: using SrcVersion instead of Version for echo detector (#9552)\n - fix: using SrcVersion instead of Version for echo detector [backport: release/v0.67] (#9629)\n - fix: validate backport branch name (#9548)\n - fix: wasm module test (#8099)\n - perf(misconf): parse input for Rego once (#8483)\n - perf(misconf): retrieve check metadata from annotations once (#8478)\n - perf(secret): only match secrets of meaningful length, allow example strings to not be matched (#8602)\n - perf: avoid heap allocation in applier findPackage (#7883)\n - refactor(cli): Update the cloud config command (#9676)\n - refactor(cloudformation): remove unused ScanFile method from Scanner (#8927)\n - refactor(db): change logic to detect wrong DB (#8864)\n - refactor(db): use `Getter` interface with `GetParams` for trivy-db sources (#9239)\n - refactor(flag): improve flag system architecture and extensibility (#8718)\n - refactor(fs): use underlyingPath to determine virtual files more reliably (#9302)\n - refactor(k8s): add v prefix for Go packages (#7839)\n - refactor(k8s): scan config files as a folder (#7690)\n - refactor(license): improve license expression normalization (#8257)\n - refactor(license): simplify compound license scanning (#8896)\n - refactor(misconf): Deprecate `EXCEPTIONS` for misconfiguration scanning (#7776)\n - refactor(misconf): Remove unused options (#7896)\n - refactor(misconf): Simplify misconfig checks bundle parsing (#8533)\n - refactor(misconf): add ID to scan.Rule (#9573)\n - refactor(misconf): add ManifestFromYAML for unified manifest parsing (#9680)\n - refactor(misconf): decouple input fs and track extracted files with fs references (#9281)\n - refactor(misconf): get a block or attribute without calling HasChild (#8586)\n - refactor(misconf): introduce generic scanner (#7515)\n - refactor(misconf): make Rego scanner independent of config type (#7517)\n - refactor(misconf): mark AVDID fields as deprecated and use ID internally (#9576)\n - refactor(misconf): migrate from custom Azure JSON parser (#9222)\n - refactor(misconf): parse azure_policy_enabled to addonprofile.azurepolicy.enabled (#9851)\n - refactor(misconf): remove module outputs from parser.EvaluateAll (#8587)\n - refactor(misconf): remove unused methods for ec2.Instance (#8536)\n - refactor(misconf): remove unused methods from iac types (#8782)\n - refactor(misconf): remove unused methods from providers (#8781)\n - refactor(misconf): remove unused terraform attribute methods (#8657)\n - refactor(misconf): replace github.com/liamg/memoryfs with internal mapfs and testing/fstest (#9282)\n - refactor(misconf): rewrite Rego module filtering using functional filters (#9061)\n - refactor(misconf): set Trivy version by default in Rego scanner (#9001)\n - refactor(misconf): simplify k8s scanner (#7717)\n - refactor(misconf): switch to x/json  (#8719)\n - refactor(misconf): type-safe parser results in generic scanner (#9685)\n - refactor(misconf): use OPA v1 (#8518)\n - refactor(misconf): use atomic.Int32 (#9385)\n - refactor(python): use once + debug for `License acquired from METADATA...` logs (#8175)\n - refactor(report): write tables after rendering all results (#8357)\n - refactor(sbom): simplify relationship generation (#7985)\n - refactor(secret): clarify secret scanner messages (#9409)\n - refactor(secret): optimize performance by moving ToLower operation outside loop (#7862)\n - refactor(server): change custom advisory and vulnerability data types fr… (#8923)\n - refactor(terraform): make Scan method of Terraform plan scanner private (#9272)\n - refactor(terraform): remove result sorting from scanner (#8928)\n - refactor(terraform): simplify AllReferences method signature in Attribute (#8906)\n - refactor(ubuntu): update time handling for fixing time (#8780)\n - refactor(vex): improve SBOM reference handling with project standards (#8457)\n - refactor: add case-insensitive string set implementation (#9720)\n - refactor: add generic Set implementation (#8149)\n - refactor: add hook interface for extended functionality (#8585)\n - refactor: centralize HTTP transport configuration (#9058)\n - refactor: export `systemFileFiltering` Post Handler (#9359)\n - refactor: migrate from `github.com/aquasecurity/jfather` to `github.com/go-json-experiment/json` (#8591)\n - refactor: migrate from go-json-experiment to encoding/json/v2 (#9422)\n - refactor: move the aws config (#9617)\n - refactor: remove aws flag helper message (#9080)\n - refactor: remove google/wire dependency and implement manual DI (#9509)\n - refactor: remove support for custom Terraform checks (#7901)\n - refactor: rename scanner to service (#8584)\n - refactor: simplify Detect function signature (#9280)\n - refactor: switch to stable azcontainerregistry SDK package (#9319)\n - refactor: use slices package instead of custom function (#8172)\n - refactor: use strings.SplitSeq instead of strings.Split in for-loop (#8983)\n - refactor: use trivy-checks/pkg/specs package (#8226)\n - release: v0.56.2 [release/v0.56] (#7694)\n - release: v0.57.0 [main] (#7710)\n - release: v0.57.1 [release/v0.57] (#7943)\n - release: v0.58.0 [main] (#7874)\n - release: v0.58.1 [release/v0.58] (#8120)\n - release: v0.58.2 [release/v0.58] (#8216)\n - release: v0.59.0 [main] (#8041)\n - release: v0.59.1 [release/v0.59] (#8334)\n - release: v0.60.0 [main] (#8327)\n - release: v0.61.0 [main] (#8507)\n - release: v0.61.1 [release/v0.61] (#8704)\n - release: v0.62.0 [main] (#8669)\n - release: v0.62.1 [release/v0.62] (#8825)\n - release: v0.63.0 [main] (#8809)\n - release: v0.64.0 [main] (#8955)\n - release: v0.64.1 [release/v0.64] (#9122)\n - release: v0.65.0 [main] (#9108)\n - release: v0.66.0 [main] (#9289)\n - release: v0.67.0 [main] (#9432)\n - release: v0.67.1 [release/v0.67] (#9614)\n - release: v0.67.2 [release/v0.67] (#9639)\n - release: v0.68.0 [main] (#9549)\n - release: v0.68.1 [main] (#9867)\n - release: v0.68.2 [release/v0.68] (#9950)\n - style: Fix MD syntax in self-hosting.md (#8523)\n - test(go): refactor mod_test.go to use txtar format (#9775)\n - test(go): set `GOPATH` for tests (#9785)\n - test(helm): bump up Yamale dependency for Helm chart-testing-action (#9653)\n - test(k8s): update k8s integrtion test (#9725)\n - test(k8s): use a specific bundle for k8s misconfig scan (#9633)\n - test(misconf): drop gcp iam test covered by another case (#9285)\n - test(misconf): move terraform scan tests to integration tests (#9271)\n - test(misconf): remove BenchmarkCalculate using outdated check metadata (#9291)\n - test(server): replace mock driver with memory cache in server tests (#8416)\n - test: add HTTP basic authentication to git test server (#9407)\n - test: add end-to-end testing framework with image scan and proxy tests (#9231)\n - test: change branch in spdx schema link to check in integration tests (#7935)\n - test: change branch in spdx schema link to check in integration tests [backport: release/v0.57] (#7940)\n - test: define constants for test images (#7739)\n - test: improve and extend tests for iac/adapters/arm (#9028)\n - test: improve golden file management in integration tests (#9699)\n - test: include integration tests in linting and fix all issues (#9060)\n - test: replace Go checks with Rego (#7867)\n - test: replace mock with memory cache and fix non-deterministic tests (#8410)\n - test: replace mock with memory cache in scanner tests (#8413)\n - test: save `containerd` image into archive and use in tests (#7816)\n - test: set dummy value for NUGET_PACKAGES (#8107)\n - test: update golden files for TestRepository* integration tests (#9684)\n - test: use `aquasecurity` repository for test images (#8677)\n - test: use `aquasecurity` repository for test images [backport: release/v0.61] (#8698)\n - test: use forked images (#7755)\n - test: use memory cache (#8403)\n - test: use table-driven tests in Helm scanner tests (#8592)\n","status":"published","published":"2026-02-13T16:33:52Z","modified":"2026-05-29T18:24:10.235720339Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"RLSA-2025:0401","title":"Important: grafana security update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* go-git: argument injection via the URL field (CVE-2025-21613)\n\n* go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies (CVE-2025-21614)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-02-13T20:34:26.141542Z","modified":"2026-02-05T05:15:11.208254Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2025:0060-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20250108T191942 2025-01-08T19:19:42Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3371 GHSA-2r2v-9pf8-6342\n  * GO-2025-3374 CVE-2025-22130 GHSA-j4jw-m6xr-fv6c\n\n- Update to version 0.0.20250107T160406 2025-01-07T16:04:06Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3363 GO-2025-3364 GO-2025-3367 GO-2025-3368\n  * GO-2024-3355 CVE-2024-54148 GHSA-r7j8-5h9c-f6fx\n  * GO-2024-3356 CVE-2024-55947 GHSA-qf5v-rp47-55gg\n  * GO-2024-3357 CVE-2024-56362 GHSA-xwx7-p63r-2rj8\n  * GO-2024-3358 CVE-2024-45387 GHSA-vq94-9pfv-ccqr\n  * GO-2024-3359 CVE-2024-28892 GHSA-5qww-56gc-f66c\n  * GO-2024-3360 CVE-2024-25133 GHSA-wgqq-9qh8-wvqv\n  * GO-2025-3361 CVE-2024-55196 GHSA-rv83-h68q-c4wq\n  * GO-2025-3362 CVE-2025-21609 GHSA-8fx8-pffw-w498\n  * GO-2025-3363 CVE-2024-56514 GHSA-cwrh-575j-8vr3\n  * GO-2025-3364 CVE-2024-56513 GHSA-mg7w-c9x2-xh7r\n  * GO-2025-3367 CVE-2025-21614 GHSA-r9px-m959-cxf4\n  * GO-2025-3368 CVE-2025-21613 GHSA-v725-9546-7q7m\n\n- Update to version 0.0.20241220T214820 2024-12-20T21:48:20Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3101 GHSA-75qh-gg76-p2w4\n  * GO-2024-3339 GHSA-8wcc-m6j2-qxvm\n\n- Update to version 0.0.20241220T203729 2024-12-20T20:37:29Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-3101 GHSA-75qh-gg76-p2w4\n  * GO-2024-3109 CVE-2024-43803 GHSA-pqfh-xh7w-7h3p\n  * GO-2024-3333 CVE-2024-45338 GHSA-w32m-9786-jp63\n  * GO-2024-3342 GHSA-hxr6-2p24-hf98\n  * GO-2024-3343 CVE-2024-9779 GHSA-jhh6-6fhp-q2xp\n  * GO-2024-3344 GHSA-32gq-x56h-299c\n  * GO-2024-3349 CVE-2024-25131 GHSA-77c2-c35q-254w\n  * GO-2024-3350 GHSA-5pf6-cq2v-23ww\n  * GO-2024-3354 CVE-2024-12678 GHSA-hr68-hvgv-xxqf\n","status":"published","published":"2025-01-10T11:33:29Z","modified":"2026-02-05T02:50:12.74079Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"USN-8088-1","title":"golang-github-go-git-go-git vulnerabilities","description":"Ionut Lalu discovered that go-git incorrectly handled certain specially\ncrafted Git server responses. An attacker could possibly use this issue to\ncause a denial of service. (CVE-2023-49568, CVE-2025-21614)\n\nIonut Lalu discovered that go-git incorrectly handled file system paths\nwhen using the ChrootOS implementation. A remote attacker could possibly\nuse this issue to perform a path traversal and create or modify arbitrary\nfiles, leading to remote code execution. (CVE-2023-49569)\n\nIt was discovered that go-git did not properly sanitize arguments when\ninvoking git-upload-pack using the file transport protocol. An attacker\ncould possibly use this issue to inject arbitrary flag values when\ninteracting with local Git repositories. (CVE-2025-21613)\n\nIt was discovered that go-git did not properly verify integrity checks for\npack and index files. An attacker could possibly use this issue to cause\ngo-git to process corrupted repository data, resulting in unexpected errors\nor an incorrect repository state. (CVE-2026-25934)","status":"published","published":"2026-03-12T15:53:02Z","modified":"2026-04-27T18:41:29.619775Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}