scan failed: failed analysis in Trivy 0.71.0

[stianst]

Description

There's a regression in Trivy 0.71.0 that results in a fatal error when scanning a larger code-base.

FATAL	Fatal error	run error: fs scan error: scan error: scan failed: failed analysis: analyze with traversal: walk dir error: unknown error with docs/maven-plugin/pom.xml: failed to analyze file: analyze file (docs/maven-plugin/pom.xml): semaphore acquire: context canceled

This happens at random points, so does not seem related to a specific module, but rather Trivy runs out of resources or something along those lines.

Older versions (0.70.0) does not have this issue.

Desired Behavior

No fatal error

Actual Behavior

Fatal error resulting in scan not working

Reproduction Steps

1. Clone https://github.com/keycloak/keycloak repository
2. Run `trivy fs --scanners vuln .` from the root of the repository

Target

Filesystem

Scanner

Vulnerability

Output Format

JSON

Mode

Standalone

Debug Output

...
2026-06-04T10:13:42+02:00	DEBUG	[pom] Exit parent	artifact="com.fasterxml.jackson:jackson-parent:2.21"
2026-06-04T10:13:42+02:00	DEBUG	[pom] Exit parent	artifact="com.fasterxml.jackson:jackson-bom:2.21.2"
2026-06-04T10:13:42+02:00	DEBUG	[pom] Exit parent	artifact="com.fasterxml.jackson:jackson-base:2.21.2"
2026-06-04T10:13:42+02:00	DEBUG	[pom] Exit parent	artifact="com.fasterxml.jackson.jakarta.rs:jackson-jakarta-rs-providers:2.21.2"
2026-06-04T10:13:42+02:00	DEBUG	[pom] Resolving...	group_id="org.keycloak" artifact_id="keycloak-distribution-licenses-common" version="999.0.0-SNAPSHOT"
2026-06-04T10:13:42+02:00	DEBUG	[pom] Repository error	err="org.keycloak:keycloak-distribution-licenses-common:999.0.0-SNAPSHOT was not found in local/remote repositories"
2026-06-04T10:13:42+02:00	DEBUG	[pom] Resolving...	group_id="org.codehaus.groovy" artifact_id="groovy-all" version="3.0.25"
2026-06-04T10:13:42+02:00	DEBUG	[pom] Failed to fetch	url="https://repo.maven.apache.org/maven2/org/codehaus/groovy/groovy-all/3.0.25/groovy-all-3.0.25.pom" err="Get \"https://repo.maven.apache.org/maven2/org/codehaus/groovy/groovy-all/3.0.25/groovy-all-3.0.25.pom\": context canceled"
2026-06-04T10:13:42+02:00	DEBUG	[pom] Repository error	err="org.codehaus.groovy:groovy-all:3.0.25 was not found in local/remote repositories"
2026-06-04T10:13:42+02:00	DEBUG	Cleaning up temp directory	path="/tmp/trivy-54410"
2026-06-04T10:13:42+02:00	FATAL	Fatal error
  - run error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:411
  - fs scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:452
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:304
  - scan failed:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:706
  - failed analysis:
    github.com/aquasecurity/trivy/pkg/scan.Service.ScanArtifact
        /home/runner/work/trivy/trivy/pkg/scan/service.go:54
  - analyze with traversal:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.Inspect
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/local/fs.go:224
  - walk dir error:
    github.com/aquasecurity/trivy/pkg/fanal/walker.(*FS).Walk
        /home/runner/work/trivy/trivy/pkg/fanal/walker/fs.go:35
  - unknown error with distribution/pom.xml:
    github.com/aquasecurity/trivy/pkg/fanal/walker.(*FS).Walk.(*FS).onError.func2
        /home/runner/work/trivy/trivy/pkg/fanal/walker/fs.go:92
  - failed to analyze file:
    github.com/aquasecurity/trivy/pkg/fanal/walker.(*FS).Walk.(*FS).WalkDirFunc.func1
        /home/runner/work/trivy/trivy/pkg/fanal/walker/fs.go:73
  - analyze file (distribution/pom.xml):
    github.com/aquasecurity/trivy/pkg/fanal/artifact/local.Artifact.analyzeWithTraversal.func1
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/local/fs.go:320
  - semaphore acquire:
    github.com/aquasecurity/trivy/pkg/fanal/analyzer.AnalyzerGroup.AnalyzeFile
        /home/runner/work/trivy/trivy/pkg/fanal/analyzer/analyzer.go:493
  - context canceled

### Operating System

Fedora 44

### Version

```bash
Version: 0.71.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2026-06-04 01:17:45.557812194 +0000 UTC
  NextUpdate: 2026-06-05 01:17:45.557811923 +0000 UTC
  DownloadedAt: 2026-06-04 06:44:23.826111263 +0000 UTC

### Checklist

- [X] Run `trivy clean --all`
- [X] Read [the troubleshooting](https://trivy.dev/docs/latest/references/troubleshooting/)

[DmitriyLewen]

Hello @stianst
This problem is related with 429 error for Maven central - #10691.

I am investigating why you see "context canceled" error.

[DmitriyLewen]

Track #10792