trivy good first issues (Go)

--vuln-type library returning null in JSON when no vulnerabilites are found 7 days ago

help wanted kind/feature priority/important-longterm

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

bug(pnpm): direct dependencies with an aliased version in importers are marked as dev 10 days ago

kind/bug help wanted good first issue scan/vulnerability

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

fix(nuget): handle exact-version ranges ([x]) in *Packages.props 14 days ago

kind/bug help wanted good first issue scan/vulnerability

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

bug(python): pylock.toml dependencies without a version are dropped from the dependency graph 16 days ago

kind/bug help wanted good first issue scan/vulnerability

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

bug(alpine): apk dependencies that use the `~` version operator are dropped from the dependency graph 23 days ago

kind/bug help wanted good first issue

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Add support to conda lock files about 1 month ago

help wanted kind/feature priority/backlog scan/vulnerability

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

fix(alpine): false positives for apk packages without an origin (o:) field about 1 month ago

kind/bug help wanted scan/vulnerability

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Trivy filesystem scan failing for Windows os filesystem about 2 months ago

kind/bug help wanted lifecycle/active

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Bug: `index out of range [0]` panic in dependency parsers and the OS detector from unchecked `strings.Fields(...)[0]` about 2 months ago

kind/bug help wanted good first issue

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

bug(misconf): false positive in AWS-0126 when the TLS policy is Policy-Min-TLS-1-2-RFC9151-FIPS-2024-08 about 2 months ago

kind/bug good first issue scan/misconfiguration

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

bug(misconf): AWS-0112 only accepts TLS_1_2 and rejects the newer secure policies about 2 months ago

kind/bug good first issue scan/misconfiguration

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Python ZIP Application Support 3 months ago

help wanted kind/feature priority/backlog scan/vulnerability

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

bug(misconf): false positive in GCP-0039 when min_tls_version is TLS_1_3 3 months ago

kind/bug good first issue scan/misconfiguration

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat: add flag to pass credentials to different Git hosting platforms 3 months ago

help wanted kind/feature target/repository

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Support Fedora 3 months ago

help wanted kind/feature priority/backlog scan/vulnerability

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

enhancement(cyclonedx): use `component.evidence.occurrences.location` for filapaths and linenumber 4 months ago

help wanted

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

--no-color option 4 months ago

help wanted good first issue kind/feature

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(java): detect JAR license from the `Plugin-License-Name` manifest attribute (Jenkins plugins) 4 months ago

help wanted good first issue

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat: add SHA-512 hash support for SBOM formats (CycloneDX and SPDX) 6 months ago

help wanted good first issue kind/feature scan/sbom

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(maven): add `mirrors` support for settings.xml files 6 months ago

help wanted kind/feature

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

fix(nodejs): silently skip package.json files with invalid names 6 months ago

good first issue

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Include line numbers in json output 7 months ago

help wanted kind/feature priority/backlog

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Including invocation startTime and endTime in SARIF output 7 months ago

help wanted good first issue kind/feature lifecycle/frozen

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(java): Support for Maven 4 settings.xml 8 months ago

help wanted kind/feature target/filesystem

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

License exceptions with a plus sign 8 months ago

kind/bug help wanted scan/license

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

bug(go): Go 1.26 GOEXPERIMENT version format change causes stdlib version parsing warning 8 months ago

kind/bug help wanted good first issue

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

bug(cyclonedx): CVSS v4 ratings missing from CycloneDX vulnerability output 8 months ago

kind/bug help wanted good first issue scan/vulnerability

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(misconf): support for azurerm_network_interface_security_group_association 9 months ago

good first issue kind/feature scan/misconfiguration

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(misconf): support ID-based references for Azure resources in Terraform 9 months ago

good first issue kind/feature scan/misconfiguration

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

docs: update version endpoint example in client/server documentation 9 months ago

AI Summary: The client/server documentation for the `version` endpoint displays an outdated example response. The current example includes `JavaDB` and `PolicyBundle`, which are no longer returned by the server since #10075, as these are now handled client-side. The documentation needs to be updated to reflect the server's current response, which only contains `VulnerabilityDB` information.

Complexity: 1/5

good first issue kind/documentation

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Add support for `pylock.toml ` (PEP 751) 9 months ago

help wanted kind/feature scan/vulnerability target/filesystem

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(misconf): adapt ARM k8s clusters 9 months ago

good first issue kind/feature scan/misconfiguration

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

refactor(rpc): remove unused Insecure field from ServiceOption 9 months ago

help wanted good first issue kind/cleanup

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

fix: scan `.git/config` for secrets 10 months ago

help wanted scan/secret

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

bug(os): Trivy detects CentOS Stream as CentOS 11 months ago

kind/bug help wanted good first issue

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

docs: update binary signature verification instructions for sigstore bundles 11 months ago

help wanted good first issue kind/documentation

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Wrong logs and docs for Photon 5.0. about 1 year ago

help wanted good first issue

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(java): use remote repositories from `settings.xml` for `pom.xml` files about 1 year ago

help wanted kind/feature

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

bug(pip): Trivy doesn’t trim the end-of-range suffix when using the `--detection-priority comprehensive` flag. about 1 year ago

kind/bug help wanted good first issue

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Trivy incorrectly reports "UNLICENSED" software as "Unencumbered" about 1 year ago

kind/bug help wanted good first issue scan/license

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat: add scanning of `/etc/os-release` for RHEL-based images about 1 year ago

help wanted good first issue kind/feature

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(sbom): add CoreOS support about 1 year ago

help wanted good first issue kind/feature

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(alma): add AlmaLinux 10 support over 1 year ago

AI Summary: This task involves adding support for AlmaLinux 10 to the Trivy vulnerability scanner. This requires updating the vulnerability database (`vuln-list-update`) to include AlmaLinux 10 advisories, rebuilding the Trivy database (`trivy-db`), and finally updating the Trivy scanner itself to correctly identify and report vulnerabilities in AlmaLinux 10 images. The process involves using various command-line tools and potentially interacting with a BoltDB database.

Complexity: 4/5

help wanted good first issue kind/feature scan/vulnerability

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

Epochs never read from `/var/lib/rpmmanifest/container-manifest-2`. over 1 year ago

AI Summary: The task is to fix a bug in Trivy's RPM package analyzer where it fails to correctly parse epoch information from RPM entries within the `/var/lib/rpmmanifest/container-manifest-2` file. This requires modifying the `rpmqa.go` file to ensure accurate parsing of epoch data from RPM metadata.

Complexity: 4/5

kind/bug help wanted good first issue

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

feat(license): use separate SPDX ids to ignore SPDX expressions over 1 year ago

AI Summary: The task requires modifying Trivy's license ignore functionality. Currently, Trivy only ignores licenses matching the exact SPDX expression. This issue proposes enhancing it to ignore licenses if all individual SPDX IDs within an expression are present in the ignore list. This involves validating SPDX expressions, splitting them into individual IDs, and using Trivy's existing license matching function for both individual IDs and the full expression.

Complexity: 4/5

help wanted kind/feature scan/license

aquasecurity/trivy

36.8K

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Go

#containers#devsecops#docker#go#golang#hacktoberfest#iac#infrastructure-as-code#kubernetes#misconfiguration#security#security-tools#vulnerability#vulnerability-detection#vulnerability-scanners

aquasecurity/trivy

Open Issues Need Help