include only root dependencies in result

[DmitriyLewen]

Description

Trivy includes all indirect dependencies for pom.xml files.
But some users asked about report only direct dependencies (See #4840)

I suggest discuss this options:

• how to correctly exclude indirect dependencies
• how many people need this option
• etc...

Target

Container Image

Scanner

Vulnerability

[knqyf263]

I guess the dependency graph for POM addresses this confusion. They get to know how transitive dependencies are introduced.

[ba1ma0]

We need it ! Strong support this option !!!! Thank you ~👍🏻👍🏻👍🏻👍🏻

[zangcc]

I hope Trivy can add an option to report only direct dependencies. Thank you~❤️ @DmitriyLewen

[kkmantianxing]

Hello, I think the original Trivy function can be retained, but I think it is necessary to add this option to scan direct dependencies. From a security point of view, the previous scan results are obviously more comprehensive, but the attack and exploitation chain for dependencies is very complicated, let alone indirect dependencies. Based on the above, I would prefer to add this option. Thanks.

[RexHarrr]

Hi, I hope this option can be added, I use trivy a lot at work, thanks.

[ivdr7873843]

Hello, I think it is good to add this option, I hope to add it as soon as possible, after all, I have encountered the same problem when scanning.

[glebignatieff]

+1

[DmitriyLewen]

Hi all, we added --pkg-relationships flag.
It may help you.