--skip-version-check appears not to work

[mtcolman]

Description

I've had a look, and whilst I can see #10623 I'm not sure if it's applicable or not to this specific finding.

We are running trivy config -d ... --skip-version-check and yet with the debug logs on, I see:

DEBUG  [notification] Running version check
DEBUG  [notification] Failed getting response from Trivy api   err=Get \"https://check.trivy.dev/updates\": read tcp ... connection reset by peer

Our FW won't let this flow out, so that is the cause of the failure. However, I have used the --skip-version-check flag, so surely this should not be happening in the first place?

Trivy version: 0.72.0

Desired Behavior

Respects --skip-version-check flag and doesn't attempt a connection

Actual Behavior

As per description

Reproduction Steps

As per description

Target

Filesystem

Scanner

Misconfiguration

Output Format

None

Mode

Standalone

Debug Output

See description

Operating System

Linux

Version

0.72.0

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @mtcolman, thanks for the report!

This is expected behavior, and #10623 is indeed applicable to your case.

--skip-version-check and telemetry are two independent features that happen to share the same endpoint (https://check.trivy.dev/updates).
The request is a single HTTP call that serves both purposes, so the flags work like this:

• --skip-version-check alone — the request is still sent (to deliver the anonymous telemetry headers), but the version/announcement output is suppressed.
• --disable-telemetry alone — the request is still sent, but without any telemetry identifiers.
• Both flags together — no request is made at all.

You can see this logic in pkg/notification/notice.go:

if v.cliOptions.SkipVersionCheck && v.cliOptions.DisableTelemetry {
	logger.Debug("Skipping update check and metric ping")
	return
}

So in your case:

trivy config -d ... --skip-version-check --disable-telemetry

This is documented in the air-gap guide, which was added by #10623.

Note that the failing request is harmless — it's non-blocking, has a 3-second timeout, and doesn't affect the scan results or the exit code.
The only real downside is the noise in the debug log.

[mtcolman]

Thanks @DmitriyLewen , but isn't the log message misleading:

Running version check

As this implies that despite using --skip-version-check it is still running a version check? Shouldn't I instead be informed version check is disabled, and then subsequently because of not disabling the telemetry, be informed that telemetry is being sent?

[DmitriyLewen]

Good point, and it's a fair one — let me explain what actually happens under the hood.

This is a design specific to how Trivy works: we have only one endpoint, which serves both purposes at once — it receives the telemetry and returns the version information.
There is no separate telemetry-only channel, and the telemetry is sent as headers on that very same request.

So when you disable the version check, you don't disable the request to the endpoint.
What happens is: the telemetry data is still sent, the version is still received and parsed — but afterwards it is simply not compared against your current CLI version, because of the flag.
In other words, --skip-version-check suppresses the version comparison, not the request itself.
That's why both flags are needed to stop the connection entirely.

But you're right that the log message is confusing here — I'll think about how to improve it.

[mtcolman]

Thanks

[DmitriyLewen]

Created #10984