⚠️ Breaking Change
Impact Score: 7/10
Trivy v0.19.0 — Release Notes & Engineering Impact
Source available — automated, not human-reviewed
Component: trivy · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
Breaking-change evidence from the source
e362843 BREAKING: migrate to a new JSON schema (#782)
⚡ Executive Summary (TL;DR)
Trivy v0.19.0. Source highlight: dea3428 docs(misconf): add comparison with Conftest and tfsec (#1111)
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
⚠️ Breaking Changes & Deprecations (1)
- e362843 BREAKING: migrate to a new JSON schema (#782)
📄 View Raw Release Notes (Original Developer Log)
## Changelog
dea3428 docs(misconf): add comparison with Conftest and tfsec (#1111)
47d600a feat(report): add schema version (#1110)
eae4baf fix(scan): change unknown os from info to debug (#1109)
9e08bd4 docs: add misconfiguration (#1101)
d9883e4 fix(config): rename include-successes with include-non-failures (#1107)
e6f7e55 feat(config): support --trace (#1106)
4b84e79 fix(policy): reduce the Internet access (#1105)
05ae22a chore: bump golangci-lint to v1.41.1 (#1104)
a0e5c3a feat: support config scanning (#931)
712f9eb feat(report): add artifact metadata (#1079)
803b2f9 Generate SBOM (#1076)
92f980f fix(db): multiple prefixed data sources (#1070)
52e98f1 Add EOL date for Alpine 3.14 (#1072)
6cd9a32 suse: mark sle 15.3 as maintained, add opensuse 15.3 (#1059)
03a7366 docs: improve data sources (#1069)
a29d6d8 chore(label): add kind/security-advisory (#1068)
2a08969 fix(asff): replace slice with substr (#1058)
3a94b73 fix(helm-chart): parametrized ingress host path (#1049)
41d000c feat: support Google Artifact Repository (#1055)
78da283 Update ASFF template to use label for severity (#1047)
e362843 BREAKING: migrate to a new JSON schema (#782)
097b8d4 docs: Fix link to AWS Security Hub template (#1046)
3b6122f refactor(server): support gzip (#1045)
f75a369 chore(rpc): update protoc and twirp (#1044)
e4c32cd Added support for list all packages flag in client (#1032)
fb19abd chore: chart with 0.18.3 (#1033)
d2afc20 feat: add gitlab codequality template (#895)
43ff5f9 feat(plugin): add aqua plugin (#1029)
5e6a50b fix(go): if patchedVersion is empty mark it as vulnerable (#1030)
23b9533 docs(ubuntu): fix supported versions (#1028)
d1f8cfc Support Ubuntu 21.04 (#1027)
aa2336b chore: remove codecov (#1016)
e646172 fix typo on github-actions.md (#1022)
## Docker images
- `docker pull aquasec/trivy:0.19.0`
- `docker pull ghcr.io/aquasecurity/trivy:0.19.0`
- `docker pull public.ecr.aws/aquasecurity/trivy:0.19.0`
- `docker pull aquasec/trivy:latest`
- `docker pull ghcr.io/aquasecurity/trivy:latest`
- `docker pull public.ecr.aws/aquasecurity/trivy:latest`