DockerScan v2.0.6

What's New

Features

• Docker credential helpers support — Full support for credHelpers (per-registry) and credsStore (global) via docker-credential-osxkeychain, docker-credential-pass, docker-credential-wincred, etc. No more "not supported yet" warning on macOS with Docker Desktop.
• --verbose / -v flag — Shows scan progress: which scanner is running, image pull status, findings count per scanner. Output goes to stderr.
• --debug flag — Includes everything in verbose mode plus previously-silenced internal errors (failed sub-checks, non-fatal errors in CIS, supply chain, and runtime scanners).

Security

• Path traversal protection — credStoreName validated against [a-zA-Z0-9_-]+ before binary execution.
• Credential helper timeout — 5-second timeout per helper call prevents process hangs.
• Docker Hub URL normalization — Credential helpers now receive https://index.docker.io/v1/ as required by the protocol.
• Dependency updates — go.opentelemetry.io/otel and related packages updated to v1.43.0 (fixes CVE in baggage header parsing and unbounded HTTP response bodies).

Tests

• 67 new unit tests: internal/logger (7), internal/scanner/runtime (30), internal/scanner/supplychain (37), pkg/auth credential helpers (23).
• All tests run without a Docker daemon.

CVE Database

• Updated through 2026-06-11.