Issues

• fix(nuget): handle exact-version ranges ([x]) in *Packages.props

  good first issuehelp wantedkind/bugscan/vulnerability
  aquasecurity/trivy#11447 · Filter by author DmitriyLewen opened on Oct 21, 2026
  4

  

• fix(java): use repositories from pom.xml when resolving BOMs imported with scope=import

  kind/bugscan/vulnerability
  Bug

  aquasecurity/trivy#11436 · Filter by author DmitriyLewen opened on Oct 20, 2026 · v0.77.0
  

• bug(pnpm): direct optionalDependencies in importers are marked as dev

  kind/bug
  Bug

  aquasecurity/trivy#11434 · Filter by author nikpivkin opened on Oct 19, 2026
  3

• bug(arm): Key Vault network ACL default action is never read

  kind/bugscan/misconfiguration
  Bug

  aquasecurity/trivy#11423 · Filter by author nikpivkin opened on Oct 16, 2026
  

• bug(misconf): API Gateway v1 adapters skip methods on the REST API root resource

  kind/bugscan/misconfiguration
  Bug

  aquasecurity/trivy#11420 · Filter by author nikpivkin opened on Oct 16, 2026
  

• bug(python): pylock.toml dependencies without a version are dropped from the dependency graph

  good first issuehelp wantedkind/bugscan/vulnerability
  aquasecurity/trivy#11411 · Filter by author DmitriyLewen opened on Oct 14, 2026
  2

  

• bug(cloudformation): API Gateway v1 adapter keeps only one stage and one resource per REST API

  kind/bugscan/misconfiguration
  Bug

  aquasecurity/trivy#11406 · Filter by author nikpivkin opened on Oct 14, 2026
  

• CycloneDX VEX: only the last vulnerability object is used when several share the same ID

  component/vexkind/bugscan/sbom
  aquasecurity/trivy#11396 · Filter by author DmitriyLewen opened on Oct 13, 2026
  1

  

• bug(pnpm): direct dependencies with an aliased version in importers are marked as dev

  good first issuehelp wantedkind/bugscan/vulnerability
  Bug

  aquasecurity/trivy#11389 · Filter by author DmitriyLewen opened on Oct 12, 2026 · v0.77.0
  8

  

• bug(alpine): apk dependencies that use the ~ version operator are dropped from the dependency graph

  good first issuehelp wantedkind/bug
  Bug

  aquasecurity/trivy#11383 · Filter by author DmitriyLewen opened on Oct 12, 2026 · v0.77.0
  2

  

• bug(nodejs): yarn analyzer reports devDependencies of a workspace as production when another workspace depends on it

  kind/bugscan/vulnerabilitytarget/filesystemtarget/repository
  Bug

  aquasecurity/trivy#11360 · Filter by author DmitriyLewen opened on Oct 6, 2026
  4

  

• bug(nodejs): yarn analyzer misreads protocols in package.json dependency ranges

  kind/bugscan/vulnerabilitytarget/filesystemtarget/repository
  Bug

  aquasecurity/trivy#11357 · Filter by author DmitriyLewen opened on Oct 6, 2026
  8

  

• bug(sbom): vulnerabilities are attached to a random package when scanning an SPDX SBOM with SBOM output

  kind/bugscan/sbom
  Bug

  aquasecurity/trivy#11327 · Filter by author DmitriyLewen opened on Sep 29, 2026
  3

  

• fix(alpine): false positives for apk packages without an origin (o:) field

  help wantedkind/bugscan/vulnerability
  Bug

  aquasecurity/trivy#11322 · Filter by author DmitriyLewen opened on Sep 28, 2026
  3

  

• fix(dpkg): build the dependency graph for packages from /var/lib/dpkg/status.d

  kind/bug
  Bug

  aquasecurity/trivy#11264 · Filter by author DmitriyLewen opened on Sep 17, 2026
  3

• Cargo analyzer drops direct dependencies declared without version

  kind/bugscan/sbomscan/vulnerability
  aquasecurity/trivy#11247 · Filter by author DmitriyLewen opened on Sep 14, 2026

• feat: support multiple package digests with acquisition sources

  kind/feature
  Feature

  aquasecurity/trivy#11215 · Filter by author DmitriyLewen opened on Sep 9, 2026
  

• bug(redhat): picking the highest fixed version across minor releases reports already-patched packages

  kind/bugscan/vulnerability
  Bug

  aquasecurity/trivy#11199 · Filter by author DmitriyLewen opened on Sep 7, 2026
  5

  

• bug(terraform): both .tf and .tofu files with the same name are scanned

  kind/bugscan/misconfiguration
  Bug

  aquasecurity/trivy#11192 · Filter by author nikpivkin opened on Sep 4, 2026
  1

• bug(misconf): AWS-0047 misses ELB security policies that allow TLS 1.0 and 1.1

  kind/bugscan/misconfiguration
  Bug

  aquasecurity/trivy#11121 · Filter by author nikpivkin opened on Aug 18, 2026
  2

• bug(misconf): false positive in AWS-0126 when the TLS policy is Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08

  kind/bugscan/misconfiguration
  Bug

  aquasecurity/trivy#11118 · Filter by author nikpivkin opened on Aug 18, 2026
  3

• bug(misconf): AWS-0112 only accepts TLS_1_2 and rejects the newer secure policies

  kind/bugscan/misconfiguration
  Bug

  aquasecurity/trivy#11117 · Filter by author nikpivkin opened on Aug 18, 2026
  2

• bug(terraform): GIT_TERMINAL_PROMPT save/restore race in remote module resolver

  kind/bugscan/misconfiguration
  Bug

  aquasecurity/trivy#10833 · Filter by author nikpivkin opened on Jun 11, 2026
  5

• test(misconf): add test coverage for Helm Charts v3

  kind/testingscan/misconfiguration
  Feature

  aquasecurity/trivy#10604 · Filter by author nikpivkin opened on May 1, 2026
  3

• Migrate to Helm v4

  kind/featurescan/misconfiguration
  aquasecurity/trivy#10601 · Filter by author nikpivkin opened on May 1, 2026