v0.71.0

[github-actions[bot]]

📑 Table of Contents

• 🚀 What's new? 🚀
  • CycloneDX 1.7 Support
  • Azure Secret Detection Rules
  • Maven <mirrors> support from settings.xml
  • Seal Security vendor support
  • Customizable skip patterns for secret scanning
  • Maven secret detection rules
  • SHA-512 checksums in SPDX SBOMs
  • Ubuntu 26.04 LTS support
• 👷‍♂️ Notable Fixes 🛠️

🚀 What's new? 🚀

CycloneDX 1.7 Support

Trivy now supports CycloneDX 1.7 and use this version for SBOM generation and ingestion.

Azure Secret Detection Rules

Trivy now ships with built-in secret detection rules for the following Azure services:

• Storage Account Key
• Shared Access Signature (SAS) Token
• DevOps Personal Access Token
• Entra ID Client Secret
• Container Registry Credential / Password
• App Configuration Connection String
• AI Services Key

Maven <mirrors> support from settings.xml

Trivy now honors the <mirrors> section in Maven settings.xml when resolving POMs for Java scans. Mirrors are read from both user (~/.m2/settings.xml) and global ($MAVEN_HOME/conf/settings.xml) settings, with user settings taking precedence on duplicate <id>.

This includes full Maven mirrorOf matching — *, external:*, external:http:*, comma-separated repository ids, and !id exclusions — plus ${env.X} placeholder expansion. Credentials are resolved against the mirror's <server> id (the canonical Maven behavior), and all remote POM fetches (settings repositories, pom-declared repositories, and the default Maven Central) are routed through the matching mirror.

Usage

~/.m2/settings.xml:

<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0">
  <mirrors>
    <mirror>
      <id>google-central</id>
      <name>Google's Maven Central mirror</name>
      <url>https://maven-central.storage-download.googleapis.com/maven2/</url>
      <mirrorOf>central</mirrorOf>
    </mirror>
  </mirrors>
</settings>

# POM resolution (including transitive parents) now goes through the configured mirror
trivy fs --scanners vuln /path/to/project

Seal Security vendor support

Trivy can now detect vulnerabilities in packages provided by Seal Security.

Seal Security packages are recognized by their naming patterns, and Trivy queries the vendor-specific advisory bucket instead of the standard ecosystem bucket for them. Supported ecosystems:

• Python (pip)
• Node (npm)
• Go
• Java (Maven)
• Ruby (RubyGems)

Customizable skip patterns for secret scanning

The secret scanner's previously hardcoded skip lists (files, directories, and extensions) can now be customized via a skip-patterns field in the secret config file. Patterns use glob syntax and default to the same paths that were skipped before.

You can also disable skipping entirely by setting skip-patterns: [].

Usage

# trivy-secret.yaml
skip-patterns:
  - "**/vendor/**"
  - "**/testdata/**"
  - "**/*.xyz"

# Disable all skipping
skip-patterns: []

trivy fs --secret-config trivy-secret.yaml /path/to/project

Maven secret detection rules

Trivy now ships with built-in secret detection rules for Maven configuration files (new Maven category, all HIGH):

• maven-settings-password — plaintext <password> values in settings.xml
• maven-settings-passphrase — plaintext <passphrase> values in settings.xml
• maven-settings-security-master — <master> values in settings-security.xml (any value, including encrypted)

Only the value inside the XML tags is censored in findings — the tags themselves stay visible.

To reduce false positives, the password and passphrase rules skip Maven-encrypted values ({...}), property substitutions (${env.X}, ${prop.Y}), and empty values. The master rule stays broad, since leaking the master defeats the encryption regardless of format.

SHA-512 checksums in SPDX SBOMs

Trivy now includes SHA-512 checksums in SPDX SBOM output when they are available.

Thanks to @DicksenT

Ubuntu 26.04 LTS support

Trivy now detects and scans Ubuntu 26.04 LTS (Resolute Raccoon).

Thanks to @chrisnovakovic

👷‍♂️ Notable Fixes 🛠️

• fix(misconf): fix rendering of nested values in terraform plan lists #10746
• fix(misconf): make identifiers in ignore rules case-insensitive #10375
• fix(misconf): prevent path traversal in Terraform filesystem functions #10664
• fix(misconf): reject nil plays during playbook parsing #10273
• fix(misconf): skip null cty values in AsMapValue to prevent panic #10723
• fix(misconf): skip resources with no after changes #10352
• fix(cloudformation): propagate AWS::EC2::Instance MetadataOptions #10731 Thanks to @Jokester761
• fix(image): correctly reconstruct RUN instructions built without BuildKit #10714
• fix(report): don't produce trailing comma in gitlab.tpl links array #10728
• fix(nodejs): silently skip subdirectory package.json files with invalid names #10609 Thanks to @ChrisJr404
• bug(pom): 429 from remote Maven repository is silently swallowed, producing incomplete scan results #10691
• fix(nodejs): handle legacy license formats in npm lockfile parser #10684
• bug: Trivy should overwrite the namespace and distro qualifier for PURLs when the --distro flag is used. #9796
• bug(secret): config file at non-root path is scanned for secrets #10665

[classicjunior60-max]

Good