v0.73.0

[github-actions[bot]]

📑 Table of Contents

• 🚀 What's new? 🚀
  • JAR licenses from the Jenkins plugin manifest
  • Detection of Seal Security packages by version suffix
  • VEX attestation discovery for OCI images
  • User-defined Maven mirrors in trivy.yaml
• 👷‍♂️ Notable Fixes 🛠️

🚀 What's new? 🚀

JAR licenses from the Jenkins plugin manifest

Trivy now reads the Plugin-License-Name attribute from META-INF/MANIFEST.MF when detecting JAR licenses.
Jenkins plugins (HPI/JPI) declare their license there — it is written by maven-hpi-plugin from the <licenses> section of the plugin's pom, so it is a standardized source that works even when the embedded pom.xml is missing.
Suffixed variants (Plugin-License-Name-2, -3, …) are read as well, so multi-license plugins are fully covered.

The manifest is used as a fallback in the license source chain: licenses from the embedded pom.xml still take precedence, and packed LICENSE files remain the last resort.

Thanks to @0xTaoZ

Detection of Seal Security packages by version suffix

Trivy now detects not only Seal packages with a seal- style name prefix, but also packages that keep their original name and carry a special version suffix (+spN / -spN / .spN).

Thanks to @levpachmanov

VEX attestation discovery for OCI images

trivy image --vex oci now finds VEX attestations that were previously missed:

• attestations stored as OCI 1.1 referrers, including the Sigstore bundle that cosign attest produces by default since Cosign v3 (before, only the legacy .att tag from Cosign v2 was resolved);
• bare in-toto statements published under the generic application/vnd.in-toto+json artifact type, as used by Docker Scout and Docker Hardened Images.

Attestations that share the same media type but are not VEX (SBOM, SLSA provenance), as well as referrers that cannot be fetched or decoded, are now skipped instead of failing the scan.
The legacy .att tag is still supported as a fallback.

Thanks to @mvanhorn

User-defined Maven mirrors in trivy.yaml

Trivy can now resolve pom.xml dependencies through Maven repository mirrors configured directly in trivy.yaml, without touching the shared settings.xml.
This is handy in CI, where editing the global Maven configuration is often impossible or undesirable.

Each entry maps a source repository URL to an ordered list of targets that mirror it.
The targets are tried in order as fallbacks: if one doesn't have the artifact — or answers with 429 Too Many Requests — Trivy moves on to the next.
Mirrors from settings.xml still take priority and chain with the ones from trivy.yaml.

Usage

# trivy.yaml
scan:
  maven:
    mirrors:
      - source: https://repo.maven.apache.org/maven2/
        targets:
          - https://my-internal-mirror/maven2/
          - https://backup-mirror/maven2/

Note: mirrors is a config-file-only option (no CLI flag or env var), and it applies to filesystem/repository scans.

👷‍♂️ Notable Fixes 🛠️

• fix(misconf): guard nil Healthcheck when building Dockerfile from history #10899 Thanks to @Deamhan
• fix(nodejs): support pnpm workspaces with overlapping packages #10894 Thanks to @Riolku
• fix(conda): avoid panic on an all-operator dependency line #10955 Thanks to @arpitjain099
• dotnet: incorrect and non-deterministic root project selection for .deps.json with multiple type: project libraries #10960 Thanks to @jetersen
• bug(java): nested JARs get the digest of the enclosing archive instead of their own #10852
• fix(vex): handle 304 status code #10307 Thanks to @alegrey91
• fix(vex): reject non-local VEX repository names #10987
• bug: packages covered by curated advisory feeds (Seal, Echo) are skipped as third-party #10979