Trivy v0.17.0 — Release Notes & Engineering Impact

Source available — automated, not human-reviewed

Component: trivy · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Compatibility not verified — check source notes

📄 .MD

⚡ Executive Summary (TL;DR)

Trivy v0.17.0. Source highlight: 2316931 chore(ci): replace GITHUB_TOKEN with ORG_GITHUB_TOKEN (#965)

Visit Trivy Official Site ↗ Official Release Source ↗ All Trivy Releases 📡 Trivy RSS

Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

📊 Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

⚙️ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

📄 View Raw Release Notes (Original Developer Log)

## Release Note https://github.com/aquasecurity/trivy/discussions/966 ## Changelog 2316931 chore(ci): replace GITHUB_TOKEN with ORG_GITHUB_TOKEN (#965) 77f3d55 chore(ci): clone trivy-repo after releasing binaries (#963) b319579 docs: add golang support (#962) 0c0febe fix(table): skip zero vulnerabilities on java (#961) d41736b chore(ci): create a release discussion (#959) c88bbbd feat(go): support binary scan (#948) d88b7cf feat(java): support GitLab Advisory Database (#917) 1385fa4 feat: show help message when the context's deadline passes (#955) 0346a10 chore(mkdocs): replace github token (#954) 60a4e7e Update SARIF report template (#935) 39ab6bd Update install docs to make commands consistent (#933) 0518d27 Docker multi-platform image build with `buildx`, using Goreleaser (#915) a6b8ec3 Fix JUnit template for AWS CodeBuild compatibility (#904) 6d22387 break(cli): use StringSliceFlag for skip-dirs/files (#916) 7221579 docs: add white logo (#914) ee29ffa add package name in ruleID (#913) 8935aa6 feat: gh-action for stale issues (#908) 288481f chore(triage): add lifecycle/active label (#909) f961e99 feat: publish helm repository (#888) 0edf73b Fix Documentation Typo (#901) f5b060a docs: migrate README to MkDocs (#884) c26a3e4 refactor(internal): export internal packages (#887) 8b3b5d0 feat: support plugins (#878) 37edc66 chore(ci): deploy dev docs only for the main branch (#882) becd508 add MkDocs implementation (#870) e517bef docs(README): update ubuntu versions (#877) da2b28a support Ubuntu 20.10 (#876) 965bb6d feat(cache): introduce versioned cache (#865) 0497286 chore: bump up Go to 1.16 (#861) fcb9a93 fix: allow the latest tag (#864) 425eaf8 feat: disable analyzers (#846) 47ce996 chore(ci): push the official image to public ECR (#855) e890ae0 chore(ci): migrate CircleCI to GitHub Actions (#850) 9bc3565 adds example with multistage build (#853) a0cd5d7 remove SARIF helpUri if empty (#841) (#845) 3170dc3 Add Sprig to Template Engine (#832) 10ad2ed Fix "GitLab CI using Trivy container" usage example (fixes #843) (#844) c9f22f4 feat(java): support jar/war/ear (#837) 3047c52 fix(app): increase the default value of timeout (#842) 89e5295 Update README.md (#838) ## Docker images - `docker pull aquasec/trivy:0.17.0` - `docker pull ghcr.io/aquasecurity/trivy:0.17.0` - `docker pull public.ecr.aws/aquasecurity/trivy:0.17.0` - `docker pull aquasec/trivy:latest` - `docker pull ghcr.io/aquasecurity/trivy:latest` - `docker pull public.ecr.aws/aquasecurity/trivy:latest`

← Older Version Trivy v0.16.0 Newer Version → Trivy v0.17.1