github.com/aquasecurity/trivy
v0.74.0
#44 most downloaded on Go modules
aquasecurity/trivy
What this package is like to depend on
Last release 3 days ago
21 Aug 2026
Ships on a steady schedule
a new release about every 8 days
Rarely documented
notes for 29 of 170 stable releases
Nothing withdrawn
no release was ever pulled
7 years old
1107 releases · first in 2019
157 releases in the last 12 months
see the full history below
Release timeline
1107 releases · Aug 2019 to Aug 2026Releases
latest 60 of 1107-
v0.74.1-0.20260821131025-dc3c56eed58a21 Aug 2026 pre-releaseNothing published for this version
-
v0.74.1-0.20260820070628-c99f2517bdb820 Aug 2026 pre-releaseNothing published for this version
-
v0.74.1-0.20260817122156-dcbadb7b150717 Aug 2026 pre-releaseNothing published for this version
-
v0.74.1-0.20260817110535-64e17158b83817 Aug 2026 pre-releaseNothing published for this version
-
v0.74.1-0.20260814115616-d98911ea338b14 Aug 2026 pre-releaseNothing published for this version
-
v0.74.014 Aug 2026Release notes
Open source →⚡ Highlights ⚡
👉 https://github.com/aquasecurity/trivy/discussions/11096
Changelog
https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0740-2026-08-14
Release notes
Open source →Features
- add RapidFort curated image scanner (#10452) (2c3b86c)
- java: resolve JAR license URLs to SPDX IDs (Bundle-License, pom <url>) (#10948) (171e391)
Bug Fixes
- java: read artifact properties only from the MANIFEST.MF main section (#11066) (018bfbf)
- misconf: parse Azure flexible server parameters under their own names (#11072) (d59f0f8)
- misconf: unmark cty values outside the evaluation context (#11078) (9e85b6b)
- python: normalize dependency names in PEP 621 pyproject.toml (#11050) (0012281)
- server: preserve check aliases and query in uploaded blobs (#11080) (0512d6d)
- terraform: avoid panic when for_each local has unknown object values (#11019) (199a126)
- terraform: support OpenTofu language block (#10923) (bacf17f)
-
v0.73.1-0.20260813135328-b307b12a3c1513 Aug 2026 pre-releaseNothing published for this version
-
v0.73.1-0.20260813124211-d1985da4939613 Aug 2026 pre-releaseNothing published for this version
-
v0.73.1-0.20260812132126-171e39168b1a12 Aug 2026 pre-releaseNothing published for this version
-
v0.73.1-0.20260812120110-333ec808397812 Aug 2026 pre-releaseNothing published for this version
-
v0.73.1-0.20260812092607-018bfbff1c3712 Aug 2026 pre-releaseNothing published for this version
-
v0.73.1-0.20260812054205-bacf17fe52a412 Aug 2026 pre-releaseNothing published for this version
-
v0.73.1-0.20260810053041-a2edba9a039810 Aug 2026 pre-releaseNothing published for this version
-
v0.73.1-0.20260806121726-780e90eed95706 Aug 2026 pre-releaseNothing published for this version
-
v0.73.1-0.20260805115716-748a639b1d4305 Aug 2026 pre-releaseNothing published for this version
-
v0.73.1-0.20260805105333-4897d2673ea005 Aug 2026 pre-releaseNothing published for this version
-
v0.73.1-0.20260804092507-199a12624b8404 Aug 2026 pre-releaseNothing published for this version
-
v0.73.1-0.20260803152810-a63431e6ebde03 Aug 2026 pre-releaseNothing published for this version
-
v0.73.1-0.20260803110446-06cf9fdace4603 Aug 2026 pre-releaseNothing published for this version
-
v0.73.003 Aug 2026Release notes
Open source →⚡ Highlights ⚡
👉 https://github.com/aquasecurity/trivy/discussions/11033
Changelog
https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0730-2026-08-03
Release notes
Open source →Features
- add bounded read helpers (#10974) (35384b4)
- java: read Jenkins plugin manifest licenses (#10939) (f065203)
- java: support user-defined Maven mirrors in trivy.yaml (#11006) (8e5509c)
- seal: detect no-prefix packages by version suffix (#10911) (69da733)
- vex: discover OpenVEX in generic in-toto OCI referrers (#10986) (990d765)
- vex: native discovery of VEX documents stored as OCI artifacts (#10932) (38d5dbd)
Bug Fixes
- conda: avoid panic on an all-operator dependency line (#10955) (f964fa2)
- dotnet: identify deps.json root project from dependency graph (#10954) (3c6a1a2)
- java: set per-file digest for nested JARs (#10855) (c3c7d17)
- misconf: guard nil Healthcheck when building Dockerfile from history (#10899) (824e2ed)
- nodejs: support pnpm workspaces with overlapping packages (#10894) (19f2ddc)
- vex: handle 304 status code (#10307) (e73c76d)
- vex: reject non-local VEX repository names (#10987) (2c64b8f)
- vuln: don't skip packages covered by a driver's own advisory feed (#10980) (86acabe)
-
v0.72.1-0.20260731113726-a525f55d359f31 Jul 2026 pre-releaseNothing published for this version
-
v0.72.1-0.20260730140509-9321f902784330 Jul 2026 pre-releaseNothing published for this version
-
v0.72.1-0.20260730074743-6740bb8563c530 Jul 2026 pre-releaseNothing published for this version
-
v0.72.1-0.20260729102500-990d76568eca29 Jul 2026 pre-releaseNothing published for this version
-
v0.72.1-0.20260729021255-ce8cb97205c529 Jul 2026 pre-releaseNothing published for this version
-
v0.72.1-0.20260722144858-2c64b8f58b6322 Jul 2026 pre-releaseNothing published for this version
-
v0.72.1-0.20260721125841-3dc5f8768b3421 Jul 2026 pre-releaseNothing published for this version
-
v0.72.1-0.20260721123349-38d5dbd226d221 Jul 2026 pre-releaseNothing published for this version
-
v0.72.1-0.20260720122936-35384b44ef8720 Jul 2026 pre-releaseNothing published for this version
-
v0.72.1-0.20260716111054-3c6a1a2aca3316 Jul 2026 pre-releaseNothing published for this version
-
v0.72.1-0.20260710084728-f06520353fc610 Jul 2026 pre-releaseNothing published for this version
-
v0.72.1-0.20260708074924-bc614b39de3b08 Jul 2026 pre-releaseNothing published for this version
-
v0.72.1-0.20260706093833-69da7331bb1106 Jul 2026 pre-releaseNothing published for this version
-
v0.72.1-0.20260703115052-878fdb461b7e03 Jul 2026 pre-releaseNothing published for this version
-
v0.72.1-0.20260702101042-c3c7d174f94602 Jul 2026 pre-releaseNothing published for this version
-
v0.72.1-0.20260702051143-824e2ed2a45e02 Jul 2026 pre-releaseNothing published for this version
-
v0.72.1-0.20260701104814-4541d9af587701 Jul 2026 pre-releaseNothing published for this version
-
v0.72.030 Jun 2026Release notes
Open source →⚡ Highlights ⚡
👉 https://github.com/aquasecurity/trivy/discussions/10907
Changelog
https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0720-2026-06-30
Release notes
Open source →⚠ BREAKING CHANGES
- migrate docker config to dockers_v2 (#10783)
Features
- bottlerocket: add vulnerability matching for Bottlerocket OS (#10893) (246ee3c)
- dotnet: detect bundled runtime in self-contained deployments (#10786) (bd78842)
- java: detect JAR licenses from packaged LICENSE files (#10856) (b8a1ccd)
- java: detect JAR licenses from the embedded pom.xml (#10851) (0a166c3)
- misconf: Adds CloudFront standard logging v2 support to AVD-AWS-0010 (#10848) (a848925)
- secret: add OpenAI secret detection rules (#10798) (65e5128)
- secret: support new stateless format for GitHub App installation tokens (#10826) (e68f3d2)
Bug Fixes
- correct format verbs in diagnostic messages (#10805) (859a933)
- forward ospkg detector options through ospkg.NewScanner (#10811) (28d44d3)
- image: deterministic OS package deduplication for images with embedded SBOMs (#10777) (888911b)
- image: lookup origin layer for custom resources in merged layers (#10788) (dccb128)
- misconf: support github_repository_vulnerability_alerts resource (#10680) (abb5174)
- nodejs: parse project dependencies from multi-document pnpm-lock.yaml (#10861) (a10291b)
- server: propagate package repository class in client/server mode (#10874) (a2777ae)
- spdx: guard against nil root component in SPDX marshaler (#10771) (c0654e1)
- surface the original analysis error instead of context cancellation (#10793) (3054b3b)
- terraform: avoid data race on global getter.Getters in remote module resolver (#10843) (0aff3fd)
- use random suffix for process temp directory instead of PID (#10431) (c8d1d0d)
- vex: load VEX documents from within the repository directory (#10820) (1f56a34)
- vuln: fall back to UNKNOWN severity when vulnerability details are missing (#10795) (dfd53cf)
Continuous Integration
-
v0.71.219 Jun 2026 -
v0.71.110 Jun 2026Release notes
Open source →Changelog
- 164b383 release: v0.71.1 [release/v0.71] (#10818)
- a72d9a4 fix(oci): validate artifact filename
- 3dd9847 fix: forward ospkg detector options through ospkg.NewScanner [backport: release/v0.71] (#10825)
- a62cbe4 fix(vex): load VEX documents from within the repository directory [backport: release/v0.71] (#10821)
- 43d1d26 fix: surface the original analysis error instead of context cancellation [backport: release/v0.71] (#10812)
- ac7696c ci: expect GitHub App bot as backport PR author [backport: release/v0.71] (#10815)
-
v0.71.1-0.20260629113854-246ee3ca56b629 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260625142734-b8a1ccd68a6e25 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260624114608-a10291be6f4424 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260623105516-a2777aed340e23 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260623092659-6e37acf1b5a523 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260622113422-dfd53cfcb68822 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260620123341-0a166c3fd42e20 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260619132527-7a69b8fb406019 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260619081957-49299df02a6419 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260617064359-0aff3fdf3b8917 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260615092747-47b7ba48662615 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260611123701-3960fac99b9b11 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260610110223-39e0b132260c10 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260609124200-5619ae1d9c7f09 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260608135520-bd788423970f08 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260608122247-65e51285de5308 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260605140331-15bdd2c1926305 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260604104857-9032dcbb897f04 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260603113400-b3d7be53e92a03 Jun 2026 pre-releaseNothing published for this version
-
v0.71.1-0.20260601155109-7ca5a6b38b7c01 Jun 2026 pre-releaseNothing published for this version