Issues

• bug(python): pylock.toml dependencies without a version are dropped from the dependency graph

  good first issuehelp wantedkind/bugscan/vulnerability
  aquasecurity/trivy#11411 · Filter by author DmitriyLewen opened on Oct 14, 2026
  1

• bug(cloudformation): API Gateway v1 adapter keeps only one stage and one resource per REST API

  kind/bugscan/misconfiguration
  Bug

  aquasecurity/trivy#11406 · Filter by author nikpivkin opened on Oct 14, 2026
  

• CycloneDX VEX: only the last vulnerability object is used when several share the same ID

  component/vexkind/bugscan/sbom
  aquasecurity/trivy#11396 · Filter by author DmitriyLewen opened on Oct 13, 2026
  1

  

• bug(pnpm): direct dependencies with an aliased version in importers are marked as dev

  good first issuehelp wantedkind/bugscan/vulnerability
  Bug

  aquasecurity/trivy#11389 · Filter by author DmitriyLewen opened on Oct 12, 2026 · v0.77.0
  6

  

• bug(alpine): apk dependencies that use the ~ version operator are dropped from the dependency graph

  good first issuehelp wantedkind/bug
  Bug

  aquasecurity/trivy#11383 · Filter by author DmitriyLewen opened on Oct 12, 2026 · v0.77.0
  2

  

• bug(nodejs): yarn analyzer reports devDependencies of a workspace as production when another workspace depends on it

  kind/bugscan/vulnerabilitytarget/filesystemtarget/repository
  Bug

  aquasecurity/trivy#11360 · Filter by author DmitriyLewen opened on Oct 6, 2026
  1

• bug(nodejs): yarn analyzer misreads protocols in package.json dependency ranges

  kind/bugscan/vulnerabilitytarget/filesystemtarget/repository
  Bug

  aquasecurity/trivy#11357 · Filter by author DmitriyLewen opened on Oct 6, 2026
  2

• bug(sbom): vulnerabilities are attached to a random package when scanning an SPDX SBOM with SBOM output

  kind/bugscan/sbom
  Bug

  aquasecurity/trivy#11327 · Filter by author DmitriyLewen opened on Sep 29, 2026
  3

  

• fix(alpine): false positives for apk packages without an origin (o:) field

  help wantedkind/bugscan/vulnerability
  Bug

  aquasecurity/trivy#11322 · Filter by author DmitriyLewen opened on Sep 28, 2026
  3

  

• fix(dpkg): build the dependency graph for packages from /var/lib/dpkg/status.d

  kind/bug
  Bug

  aquasecurity/trivy#11264 · Filter by author DmitriyLewen opened on Sep 17, 2026
  3

• Cargo analyzer drops direct dependencies declared without version

  kind/bugscan/sbomscan/vulnerability
  aquasecurity/trivy#11247 · Filter by author DmitriyLewen opened on Sep 14, 2026

• bug(misconf): numbers in Terraform list attributes are not converted to strings

  kind/bugscan/misconfiguration
  aquasecurity/trivy#11222 · Filter by author nikpivkin opened on Sep 10, 2026
  1

  

• feat: support multiple package digests with acquisition sources

  kind/feature
  Feature

  aquasecurity/trivy#11215 · Filter by author DmitriyLewen opened on Sep 9, 2026
  

• bug(redhat): picking the highest fixed version across minor releases reports already-patched packages

  kind/bugscan/vulnerability
  Bug

  aquasecurity/trivy#11199 · Filter by author DmitriyLewen opened on Sep 7, 2026
  5

  

• bug(terraform): both .tf and .tofu files with the same name are scanned

  kind/bugscan/misconfiguration
  Bug

  aquasecurity/trivy#11192 · Filter by author nikpivkin opened on Sep 4, 2026

• bug(misconf): AWS-0047 misses ELB security policies that allow TLS 1.0 and 1.1

  kind/bugscan/misconfiguration
  Bug

  aquasecurity/trivy#11121 · Filter by author nikpivkin opened on Aug 18, 2026
  2

• bug(misconf): false positive in AWS-0126 when the TLS policy is Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08

  kind/bugscan/misconfiguration
  Bug

  aquasecurity/trivy#11118 · Filter by author nikpivkin opened on Aug 18, 2026
  3

• bug(misconf): AWS-0112 only accepts TLS_1_2 and rejects the newer secure policies

  kind/bugscan/misconfiguration
  Bug

  aquasecurity/trivy#11117 · Filter by author nikpivkin opened on Aug 18, 2026
  2

• bug(terraform): GIT_TERMINAL_PROMPT save/restore race in remote module resolver

  kind/bugscan/misconfiguration
  Bug

  aquasecurity/trivy#10833 · Filter by author nikpivkin opened on Jun 11, 2026
  5

• test(misconf): add test coverage for Helm Charts v3

  kind/testingscan/misconfiguration
  Feature

  aquasecurity/trivy#10604 · Filter by author nikpivkin opened on May 1, 2026
  3

• Migrate to Helm v4

  kind/featurescan/misconfiguration
  aquasecurity/trivy#10601 · Filter by author nikpivkin opened on May 1, 2026

• feat(install): support passing expected checksum to contrib/install.sh

  kind/featurekind/security
  aquasecurity/trivy#10589 · Filter by author knqyf263 opened on Apr 28, 2026
  1

• feat(ignore): make id optional in .trivyignore.yaml to ignore all findings for a PURL/path

  kind/featurescan/vulnerability
  aquasecurity/trivy#10583 · Filter by author knqyf263 opened on Apr 24, 2026
  2

• bug: SeveritySource is empty when severity falls back to top-level Severity field from trivy-db

  kind/bugscan/vulnerability
  Bug

  aquasecurity/trivy#10409 · Filter by author DmitriyLewen opened on Mar 19, 2026
  2

  

• feat(misconf): Add Dockerfile check for RUN with pipe missing pipefail

  kind/featurescan/misconfiguration
  aquasecurity/trivy#10401 · Filter by author nikpivkin opened on Mar 18, 2026
  3