v0.74.0

[github-actions[bot]]

📑 Table of Contents

• 🚀 What's new? 🚀
  • Java license URLs resolved to SPDX IDs
  • RapidFort curated image support
• 👷‍♂️ Notable Fixes 🛠️

🚀 What's new? 🚀

Java license URLs resolved to SPDX IDs

There are cases where a Java package gives its license as nothing but a link — in the OSGi Bundle-License manifest header or in the pom.xml <license><url> element — with no name and no SPDX ID.
Trivy could not make use of such links before, so those packages were reported with no license at all.

Trivy now builds a reverse "license URL → SPDX ID" index from the seeAlso field of the SPDX license list and uses it to resolve these URLs.

For example, jackson-core declares its license only as a URL:

$ unzip -p jackson-core-2.9.10.jar META-INF/MANIFEST.MF | grep Bundle-License
Bundle-License: http://www.apache.org/licenses/LICENSE-2.0.txt

Previously no license was reported, now the URL resolves to its SPDX ID:

$ trivy rootfs --format json jackson-core-2.9.10.jar \
    | jq -c '.Results[].Packages[] | {Name, Licenses}'
{"Name":"com.fasterxml.jackson.core:jackson-core","Licenses":["Apache-2.0"]}

RapidFort curated image support

RapidFort publishes curated builds of Ubuntu-, Alpine- and Red Hat Enterprise Linux-based images together with its own security advisories.
Trivy now scans such images against the RapidFort feed.

RapidFort images are detected automatically — no extra flags are needed.

See the documentation for details.

Thanks to @vaibhav-rf and @rfJanit

👷‍♂️ Notable Fixes 🛠️

• fix(java): read artifact properties only from the MANIFEST.MF main section #11066
• fix(python): normalize dependency names in PEP 621 pyproject.toml #11050
• bug(misconf): check aliases are lost when misconfigurations are uploaded to the server #11079
• fix(terraform): avoid panic when for_each local has unknown object values #11019
• bug(terraform): parser fails on OpenTofu language block #10906
• misconf: Azure Flexible Server params are parsed with Single Server names #11068
• bug(terraform): panic when merging marked cty values #11077