Impact Score: 5/10
Trivy v0.9.0 — Release Notes & Engineering Impact
Source available — automated, not human-reviewed
Component: trivy · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Trivy v0.9.0. Source highlight: [IMPORTANT] Support GitHub Advisory Database (#467)
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
📄 View Raw Release Notes (Original Developer Log)
## New Features
### [IMPORTANT] Support GitHub Advisory Database (#467)
Trivy supports GitHub Advisory Database to detect vulnerabilities of programming language libraries. It uses multiple data sources for each language as show below.
https://github.com/aquasecurity/trivy#data-source
This allows Trivy to be more accurate and affects the number of vulnerabilities Trivy detects.
Thank you for the contribution, @masahiro331!
### Filesystem scan
Scan a filesystem (such as a host machine, a virtual machine image, or an unpacked container image filesystem).
When you specify the path to your project, Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json.
```
$ trivy fs /path/to/project
```
Also, Trivy can scan your container from inside the container.
```
$ docker run --rm -it alpine:3.11
/ # apk add curl
/ # curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/master/contrib/install.sh | sh -s -- -b /usr/local/bin
/ # trivy fs /
```
### Embed in Dockerfile 🎉
Scan your image as part of the build process by embedding Trivy in the Dockerfile. This approach can be used to update Dockerfiles currently using Aqua’s [Microscanner](https://github.com/aquasecurity/microscanner)
```
$ cat Dockerfile
FROM alpine:3.7
RUN apk add --no-cache curl \
&& curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/master/contrib/install.sh | sh -s -- -b /usr/local/bin \
&& trivy filesystem --exit-code 1 --no-progress / \
&& trivy --reset && rm -f /usr/loca/bin/trivy && apk del curl
$ docker build -t vulnerable-image .
```
### Git Repository scan
Scan your remote git repository.
```
$ trivy repo https://github.com/aquasecurity/trivy-ci-test
```
Only public repositories are supported.
## Bug fixes
### CVE duplication in scanning result
Close https://github.com/aquasecurity/harbor-scanner-trivy/issues/114
When Trivy scans an image containing multiple lock files regardless of OS and packages, it sometimes has false positives.
## Changelog
020c4a3 fix(app): add ArgsUsage (#508)
2f2d1a9 feat: support repository and filesystem scan (#503)
03ad8a3 Add GHSA support (#467)
1218e11 refactor: define common options and embed them into the option for subcommand (#502)
## Docker images
- `docker pull docker.io/aquasec/trivy:0.9.0`
- `docker pull docker.io/aquasec/trivy:latest`