{"full_name":"aquasecurity/trivy","owner":"aquasecurity","name":"trivy","url":"https://github.com/aquasecurity/trivy","description":"Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more","homepage":"https://trivy.dev","topics":[],"language":"Go","license":"Apache-2.0","avatar":"https://avatars.githubusercontent.com/u/12783832?v=4","created_at":"2019-04-11T01:01:07Z","pushed_at":"2026-11-10T08:29:37Z","metrics":{"stars":39188,"forks":846,"watchers":228,"issues":317,"prs":5146,"releases":96,"issues_open":null,"issues_closed":null,"prs_open":null,"prs_closed":null,"prs_merged":null,"discussions":2952},"growth":{"day":{"stars":41,"forks":6,"base_day":"2026-11-09"},"week":{"stars":274,"forks":28,"base_day":"2026-11-03"},"month":{"stars":944,"forks":117,"base_day":"2026-10-11"}},"history":{"dates":["2026-09-06","2026-09-07","2026-09-08","2026-09-09","2026-09-10","2026-09-11","2026-09-12","2026-09-13","2026-09-14","2026-09-15","2026-09-16","2026-09-17","2026-09-18","2026-09-19","2026-09-20","2026-09-21","2026-09-22","2026-09-23","2026-09-24","2026-09-25","2026-09-26","2026-09-27","2026-09-28","2026-09-29","2026-09-30","2026-10-01","2026-10-02","2026-10-03","2026-10-04","2026-10-05","2026-10-06","2026-10-07","2026-10-08","2026-10-09","2026-10-10","2026-10-11","2026-10-12","2026-10-13","2026-10-14","2026-10-15","2026-10-16","2026-10-17","2026-10-18","2026-10-19","2026-10-20","2026-10-21","2026-10-22","2026-10-23","2026-10-24","2026-10-25","2026-10-26","2026-10-27","2026-10-28","2026-10-29","2026-10-30","2026-10-31","2026-11-01","2026-11-02","2026-11-03","2026-11-04","2026-11-09","2026-11-10"],"stars":[37589,37607,37628,37653,37669,37676,37689,37733,37746,37768,37780,37792,37827,37838,37848,37858,37872,37882,37913,37926,37949,37961,37973,37983,38001,38011,38047,38062,38073,38085,38113,38136,38170,38195,38208,38244,38269,38286,38296,38311,38335,38369,38393,38417,38441,38459,38481,38515,38547,38575,38618,38670,38690,38736,38774,38815,38836,38864,38914,38939,39147,39188],"forks":[623,629,635,636,636,635,639,649,652,654,656,660,662,667,672,675,677,678,683,686,688,691,696,695,702,706,709,711,711,713,712,718,721,724,724,729,736,741,746,748,752,757,761,763,764,765,768,774,777,783,792,794,796,800,803,806,809,810,818,819,840,846],"watchers":[218,218,218,218,218,218,220,223,223,223,223,223,224,224,224,224,224,224,224,223,223,223,223,223,225,226,226,225,225,225,225,225,225,225,225,227,227,228,228,228,229,230,231,231,231,231,231,232,232,232,232,232,227,227,227,226,226,226,226,226,228,228],"issues_open":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null],"prs_open":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null]},"boards":{},"same_owner":[],"issues":[{"number":1091,"title":"--no-color option","comments":21,"created_at":"2021-06-29T13:20:22Z"},{"number":121,"title":"Support Fedora","comments":21,"created_at":"2019-08-19T13:56:06Z"},{"number":3987,"title":"Add ability to disable specific analyzers","comments":18,"created_at":"2023-04-04T23:47:48Z"},{"number":3302,"title":"WASM modules to skip PostScan Action and carry results back","comments":18,"created_at":"2022-12-14T10:08:11Z"},{"number":783,"title":"Not able to scan image in Google Artifact Registry","comments":17,"created_at":"2020-12-22T13:43:11Z"},{"number":1856,"title":"Add support to conda lock files","comments":16,"created_at":"2022-03-18T16:39:10Z"},{"number":2839,"title":"Scan manifest for self-packaged software","comments":15,"created_at":"2022-09-07T09:01:03Z"},{"number":828,"title":"--vuln-type library returning null in JSON when no vulnerabilites are found","comments":15,"created_at":"2021-02-01T18:32:23Z"}],"discussions":[{"number":11591,"title":"Terraform: concurrent scans race on the module cache, so a module can be dropped or read half-written","comments":0,"category":"Bugs","created_at":"2026-11-08T21:24:17Z"},{"number":11590,"title":"False positive on openSUSE Tumbleweed `tack`: SUSE CVRF fixed version belongs to a different source package (CVE-2022-29458)","comments":0,"category":"False Detection","created_at":"2026-11-08T18:25:26Z"},{"number":11581,"title":"ACR auth requests the ARM audience; fails on registries with azureADAuthenticationAsArmPolicy disabled","comments":2,"category":"Bugs","created_at":"2026-11-07T07:25:50Z"},{"number":11579,"title":"Swift: a Package.resolved location with a trailing slash gives a PURL with no name, and `trivy convert` fails","comments":0,"category":"Bugs","created_at":"2026-11-07T02:09:30Z"},{"number":11578,"title":"False Positive: misconfig DS-0001 triggered on dynamic multi-stage FROM statement using local alias","comments":0,"category":"False Detection","created_at":"2026-11-06T23:35:45Z"},{"number":11577,"title":"Debian 13 zlib: CVE-2026-76844 title collision and CVE-2026-85091 affected-range discrepancy","comments":0,"category":"False Detection","created_at":"2026-11-06T17:15:44Z"},{"number":11562,"title":"KSV-0109 misses literal secret when colon and equals cause an evaluation conflict","comments":1,"category":"False Detection","created_at":"2026-11-05T21:01:03Z"},{"number":11559,"title":"bug(misconf): AZU-0056 false positive when blob soft delete is configured as a nested ARM blobServices resource","comments":1,"category":"Bugs","created_at":"2026-11-05T13:17:19Z"}],"latest_release":{"name":"v0.76.2","tag":"v0.76.2","published_at":"2026-11-05T12:50:25Z","body":"## 🔐 Security update 🛡️\n\nTrivy v0.76.2 bundles several security fixes:\n\n- Official container images are rebuilt on Alpine 3.24.3, which fixes `musl`/`musl-utils` (CVE-2026-107891), and the build picks up fixed `libcurl` (24 CVEs, including HIGH CVE-2026-92392) and `brotli-libs` (CVE-2026-111497) from the `v3.24` package repository.\n- `golang.org/x/net` is bumped to v0.62.0, fixing two vulnerabilities in `golang.org/x/net/html`: CVE-2026-78661 (quadratic complexity when coalescing text nodes) and CVE-2026-97045 (missing ancestor namespace check when rendering raw text).\n- `github.com/go-jose/go-jose/v4` is bumped to v4.1.6, fixing [GHSA-mgcc-cww5-fp2q](https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q).\n\nWe recommend upgrading to v0.76.2 and redeploying container images to apply these updates.\n\n## Changelog\n* 3f6334d223b52188324af3b9923b4249cd206652 release: v0.76.2 [release/v0.76] (#11552)\n* 1cabe83c11ffed6e984ab46be8886e1e01516ead fix(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 [backport: release/v0.76] (#11554)\n* be08de47d0d76fca7e992c0f47fbcf7853f8a713 chore(deps): bump the common group across 1 directory with 14 updates [backport: release/v0.76] (#11555)\n* a8537d389cbd0fa215eddfddc27150fc7bc82a6c fix(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 [backport: release/v0.76] (#11553)\n* ae26b88c3b3c380808e767dfb63f9b8dcd5f64fd fix(deps): bump alpine to 3.24.3 in container images [backport: release/v0.76] (#11551)\n"},"readme":true,"readme_zh":false,"news":[],"stale":false,"snapshot_at":"2026-11-10T09:35:25Z","history_start":"2026-09-06"}