What aquasecurity/trivy shipped
Written by FoxPlug from the repository's own releases; not affiliated with Aqua Security. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/aquasecurity/trivy; Aqua Security did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of September 28, 2026
What shipped
- Trivy v0.75.0 released with multiple scanner and parsing improvements. Release
- Crypto scanner added to the image command as an experimental feature enabled with --scanners crypto and CycloneDX format. Pull request #11144
- Cryptographic assets now output in CycloneDX reports as cryptographic-asset components. Pull request #11125
- Cryptographic assets transferred in client/server mode with blob and scan results. Pull request #11141
- Vulnerability detection added for Echo-patched Python packages with +echo.N version segments using Echo OSV feed. Pull request #10555
- Python uv workspace lockfile support added to handle virtual workspaces and multiple root packages. Pull request #10553
- OS version merging improved to keep the fullest version when multiple analyzers report different granularity. Pull request #11039
- PURLs for julia, bottlerocket and centos-stream packages now classified correctly instead of dropped. Pull request #11326
- RSA private key reading optimized to skip expensive math validation since only public key is needed. Pull request #11319
- Kubernetes scanning documentation corrected to use plural flag --exclude-namespaces matching the actual implementation. Pull request #10935
Why it matters
This week ships experimental cryptographic asset scanning capabilities integrated into reports and client/server mode, alongside improvements to Python dependency parsing for emerging package managers and workspace configurations. Bug fixes improve OS version detection accuracy and reduce unnecessary validation overhead on large key files.
Changelog entry
- Feat(crypto): add the crypto scanner to the image command (experimental, --scanners crypto, CycloneDX only) Pull request #11144
- Feat(crypto): output cryptographic assets in CycloneDX as cryptographic-asset components Pull request #11125
- Feat(crypto): transfer cryptographic assets in client/server mode Pull request #11141
- Feat(echo): add vulnerability detection for Echo-patched Python packages with +echo.N segments Pull request #10555
- Fix(python): support uv workspace lockfiles Pull request #10553
- Fix(os): keep the fullest OS version when merging analyzer results Pull request #11039
- Fix(crypto): read RSA private keys without validating their math Pull request #11319
- Fix(purl): classify julia, bottlerocket and centos stream packages Pull request #11326
- Chore: bump SPDX license IDs and exceptions to v3.29.0 Pull request #11284
- Chore(alpine): add EOL date for Alpine 3.24 and fix 3.21/3.22 dates Pull request #11308
- Fix: correct grammar and typos in user-facing error messages and CLI flags Pull request #11281
- Docs(kubernetes): fix --exclude-namespace flag name in scan example Pull request #10935
V0.75.0 shipped: crypto scanner for images, cryptographic assets in CycloneDX, uv workspace support, improved OS version handling, and better PURLs for julia/bottlerocket packages.
Trivy v0.75.0 is out. This release adds experimental cryptographic asset scanning to the image command with CycloneDX output, extends Python dependency parsing to handle uv workspaces, improves operating system version detection when multiple sources report different granularity, optimizes RSA key processing, and fixes package URL classification for julia, bottlerocket, and centos-stream packages.
Week of September 21, 2026
What shipped
- Secret scanning now uses a single Aho-Corasick pass instead of per-rule keyword searches across 105 built-in rules. Pull request #11179
- Crypto scanning reports repeated x509 material once per file instead of once per copy, reducing memory usage by ~14x for files with certificate repetition. Pull request #11263
- Crypto scanning now describes ML-DSA keys and signature algorithms from Go 1.27's crypto/mldsa. Pull request #11137
- Fixed a panic when scanning CSAF VEX documents with relationships lacking a sub-component. Pull request #11067
- Fixed a panic when scanning SPDX JSON SBOMs containing null entries in file and package arrays. Pull request #11101
- JSON line numbers are now derived from decoder offsets instead of buffer positions for correctness with json/v2. Pull request #11233
- MANIFEST.MF parsing now splits lines into key-value pairs once and switches on the key instead of matching prefixes per attribute. Pull request #11022
- License scanning now reports unparsable license names with UNKNOWN severity instead of empty severity. Pull request #11254
- Documentation clarified that custom Rego checks must come from trusted sources and can access environment variables and make HTTP requests. Pull request #11278
- Documentation added PerspectiveGraph to community reporting integrations. Pull request #11255
Why it matters
Performance improvements in secret scanning and crypto handling reduce resource consumption on large scans, while fixes to VEX and SBOM parsing prevent crashes on malformed documents. Better support for modern cryptography and clearer security guidance for custom checks strengthen the project's reliability and safety.
Changelog entry
- Perf(secret): replace per-rule keyword search with one Aho-Corasick pass Pull request #11179
- Perf(crypto): report repeated x509 material once per file Pull request #11263
- Feat(crypto): describe ML-DSA keys and signature algorithms Pull request #11137
- Fix(vex): avoid panic on CSAF relationships without a sub-component Pull request #11067
- Fix(sbom): skip null entries in SPDX file and package arrays Pull request #11101
- Perf: take JSON line numbers from decoder offsets Pull request #11233
- Refactor(java): parse MANIFEST.MF attributes by key Pull request #11022
- Fix(license): report unparsable license names with UNKNOWN severity Pull request #11254
- Docs(misconf): clarify custom check security considerations Pull request #11278
- Docs: link security reporting guidance to relevant documentation Pull request #11235
- Docs: add PerspectiveGraph to reporting integrations Pull request #11255
- Docs: clarify community integration listing disclaimer Pull request #11283
This week: optimized secret scanning with Aho-Corasick, 14x memory reduction for repeated crypto material, ML-DSA support. Fixed panics in VEX and SBOM parsing.
Trivy's latest release brings significant performance improvements and stability fixes. Secret scanning now consolidates keyword searching into a single pass, while crypto scanning reduces memory usage up to 14x for files with repeated certificates. We've added support for ML-DSA keys from Go 1.27 and fixed crashes when processing malformed VEX and SBOM documents. Additional improvements include better JSON line number handling, streamlined MANIFEST.MF parsing, and clearer security documentation for custom checks.