Trivy 0.72 broadens detection and VEX handling

Aqua Security released Trivy 0.72.0 on June 30. The official changelog lists new Bottlerocket vulnerability matching, detection of bundled .NET runtimes, additional Java license discovery, repository-local VEX loading, and a breaking Docker configuration migration.

Findings gain more deployment context

Self-contained .NET applications carry their runtime, so scanning only an external runtime can miss the version actually shipped. Trivy’s new detection closes that gap. Bottlerocket matching similarly expands coverage for a host operating system used in container environments. For Java inventories, reading licenses from packaged license files and embedded POM metadata can improve the evidence attached to an SBOM or policy decision.

Repository-local VEX support is operationally important because a vulnerability match and an exploitable condition are different facts. Keeping a VEX document near the scanned source can make an explicit assessment part of the same reviewable change. Teams should still require ownership and expiry for suppressions; a stale VEX statement can hide risk as effectively as a broad ignore rule.

The configuration break needs a rehearsal

Version 0.72 migrates Docker configuration to a new implementation. CI images and wrappers that mount credentials or expect old lookup behavior should run against the new binary before rollout. The release also changes temporary-directory naming from process IDs to random suffixes, reducing collision and predictability problems.

A useful acceptance test scans the same pinned image and repository with old and new versions, then explains every finding delta. Unexpected disappearance is more urgent than a larger result set.

Trivy 0.72 improves the scanner’s view of real artifacts, but upgrades should preserve reproducibility: pin databases, record tool versions, and review changed findings before replacing the production baseline.