[{"id":"14644866910","type":"WatchEvent","actor":{"id":223569760,"login":"pham0342","display_login":"pham0342","gravatar_id":"","url":"https://api.github.com/users/pham0342","avatar_url":"https://avatars.githubusercontent.com/u/223569760?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"started"},"public":true,"created_at":"2026-09-08T15:21:01Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14639547914","type":"WatchEvent","actor":{"id":35630004,"login":"onlyuuuuu","display_login":"onlyuuuuu","gravatar_id":"","url":"https://api.github.com/users/onlyuuuuu","avatar_url":"https://avatars.githubusercontent.com/u/35630004?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"started"},"public":true,"created_at":"2026-09-08T14:04:38Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14637679042","type":"WatchEvent","actor":{"id":35532803,"login":"michael-lemiale","display_login":"michael-lemiale","gravatar_id":"","url":"https://api.github.com/users/michael-lemiale","avatar_url":"https://avatars.githubusercontent.com/u/35532803?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"started"},"public":true,"created_at":"2026-09-08T13:37:31Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14634666592","type":"PullRequestEvent","actor":{"id":57435526,"login":"Eljees","display_login":"Eljees","gravatar_id":"","url":"https://api.github.com/users/Eljees","avatar_url":"https://avatars.githubusercontent.com/u/57435526?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"closed","number":11203,"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11203","id":4467500553,"number":11203,"head":{"ref":"fix/pom-embedded-archive-deps-as-dev","sha":"e39b766031de40e17fa5eeaccaee2c728716c975","repo":{"id":1304984635,"url":"https://api.github.com/repos/Eljees/trivy","name":"trivy"}},"base":{"ref":"main","sha":"6d90892649aebd0c9fc86b75173b566ca2307f9e","repo":{"id":180687624,"url":"https://api.github.com/repos/aquasecurity/trivy","name":"trivy"}}}},"public":true,"created_at":"2026-09-08T12:51:48Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14634645399","type":"IssueCommentEvent","actor":{"id":57435526,"login":"Eljees","display_login":"Eljees","gravatar_id":"","url":"https://api.github.com/users/Eljees","avatar_url":"https://avatars.githubusercontent.com/u/57435526?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"created","issue":{"url":"https://api.github.com/repos/aquasecurity/trivy/issues/11203","repository_url":"https://api.github.com/repos/aquasecurity/trivy","labels_url":"https://api.github.com/repos/aquasecurity/trivy/issues/11203/labels{/name}","comments_url":"https://api.github.com/repos/aquasecurity/trivy/issues/11203/comments","events_url":"https://api.github.com/repos/aquasecurity/trivy/issues/11203/events","html_url":"https://github.com/aquasecurity/trivy/pull/11203","id":5378718150,"node_id":"PR_kwDOCsUTCM8AAAABCkimCQ","number":11203,"title":"fix(java): mark dependencies of an embedded pom.xml as dev","user":{"login":"Eljees","id":57435526,"node_id":"MDQ6VXNlcjU3NDM1NTI2","avatar_url":"https://avatars.githubusercontent.com/u/57435526?v=4","gravatar_id":"","url":"https://api.github.com/users/Eljees","html_url":"https://github.com/Eljees","followers_url":"https://api.github.com/users/Eljees/followers","following_url":"https://api.github.com/users/Eljees/following{/other_user}","gists_url":"https://api.github.com/users/Eljees/gists{/gist_id}","starred_url":"https://api.github.com/users/Eljees/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Eljees/subscriptions","organizations_url":"https://api.github.com/users/Eljees/orgs","repos_url":"https://api.github.com/users/Eljees/repos","events_url":"https://api.github.com/users/Eljees/events{/privacy}","received_events_url":"https://api.github.com/users/Eljees/received_events","type":"User","user_view_type":"public","site_admin":false},"labels":[],"state":"closed","locked":false,"assignees":[],"milestone":null,"comments":1,"created_at":"2026-09-07T20:20:44Z","updated_at":"2026-09-08T12:52:08Z","closed_at":"2026-09-08T12:52:08Z","assignee":null,"issue_field_values":[],"type":null,"active_lock_reason":null,"draft":false,"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11203","html_url":"https://github.com/aquasecurity/trivy/pull/11203","diff_url":"https://github.com/aquasecurity/trivy/pull/11203.diff","patch_url":"https://github.com/aquasecurity/trivy/pull/11203.patch","merged_at":null},"body":"## Description\n\nA `pom.xml` under `META-INF/maven/<groupId>/<artifactId>/` is the copy of the *build* descriptor that maven-archiver embeds into every artifact. It describes what the artifact was compiled against, not what ships next to it: test, provided and optional dependencies are listed just the same, and none of them is necessarily present. When such an artifact is scanned in exploded form (a JAR unzipped in a Dockerfile layer, an exploded WAR, an unpacked delivery) the file is visible to the `pom` analyzer, which treats it as a project manifest and reports **every declared dependency as an installed package**. The `jar` analyzer never does this for the same jar — it reads the embedded pom for identity only — so the same artifact gets two different answers depending on whether it is a file or a directory.\n\nIn the scan that surfaced this (an unpacked Java delivery), every CRITICAL finding was attached to such a package: `bcprov-jdk18on` and `woodstox-core` were \"found\" through the embedded pom of `xmlsec-2.3.4.jar`, which ships neither.\n\n**Fix:** keep the root package — it is the artifact that was unpacked — and mark the declared dependencies as `Dev`, so they are skipped by default but still reachable with `--include-dev-deps`. This mirrors how integration-test poms of `maven-invoker-plugin` are already handled in this analyzer (`isIntegrationTestDir`). The analyzer `version` is bumped so cached results are refreshed.\n\nWhy `Dev` rather than dropping the file: skipping `META-INF/maven/**/pom.xml` entirely (the `--skip-files` workaround) also removes the artifact itself whenever the jar is not present as a file — exactly the case in which the pom analyzer is the only thing that sees it.\n\n### Before / after\n\n`trivy fs --format cyclonedx --offline-scan <dir with xmlsec-2.3.4 unzipped>` (0.73.0, library components):\n\n```\nbefore:  bcprov-jdk18on@1.76  woodstox-core@6.5.0  xmlsec@2.3.4\nafter:   xmlsec@2.3.4                                     (bcprov-jdk18on, woodstox-core: Dev, hidden unless --include-dev-deps)\n```\n\nUnit test: the happy-path pom placed at `testdata/embedded/META-INF/maven/com.example/example/pom.xml` yields the root `com.example:example:1.0.0` as before and its dependency `com.example:example-api:2.0.0` with `Dev: true` (`Dev: false` on `main`). `isEmbeddedArchivePom` is covered for the positive path, a too-shallow path and a project pom that merely mentions `META-INF` elsewhere.\n\n## Related issues\n\n- Discussion: #11204\n- #3197 (closed as stale; a different mechanism — shaded jar — but the same confusion between what a pom declares and what is shipped)\n\n## Checklist\n- [x] I've read the [guidelines for contributing](https://trivy.dev/docs/latest/community/contribute/pr/) to this repository.\n- [x] I've followed the [conventions](https://trivy.dev/docs/latest/community/contribute/pr/#title) in the PR title.\n- [x] I've added tests that prove my fix is effective or that my feature works.\n- [ ] I've updated the [documentation](https://github.com/aquasecurity/trivy/blob/main/docs) with the relevant information (if needed). — no new options; happy to add a note under the Java coverage page if wanted.\n- [x] I've included a \"before\" and \"after\" example to the description.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nhttps://claude.ai/code/session_015CsUTRwsaFCwavDJTPwEpW","reactions":{"url":"https://api.github.com/repos/aquasecurity/trivy/issues/11203/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"timeline_url":"https://api.github.com/repos/aquasecurity/trivy/issues/11203/timeline","performed_via_github_app":null,"state_reason":null},"comment":{"url":"https://api.github.com/repos/aquasecurity/trivy/issues/comments/5585422543","html_url":"https://github.com/aquasecurity/trivy/pull/11203#issuecomment-5585422543","issue_url":"https://api.github.com/repos/aquasecurity/trivy/issues/11203","id":5585422543,"node_id":"IC_kwDOCsUTCM8AAAABTOrIzw","user":{"login":"Eljees","id":57435526,"node_id":"MDQ6VXNlcjU3NDM1NTI2","avatar_url":"https://avatars.githubusercontent.com/u/57435526?v=4","gravatar_id":"","url":"https://api.github.com/users/Eljees","html_url":"https://github.com/Eljees","followers_url":"https://api.github.com/users/Eljees/followers","following_url":"https://api.github.com/users/Eljees/following{/other_user}","gists_url":"https://api.github.com/users/Eljees/gists{/gist_id}","starred_url":"https://api.github.com/users/Eljees/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Eljees/subscriptions","organizations_url":"https://api.github.com/users/Eljees/orgs","repos_url":"https://api.github.com/users/Eljees/repos","events_url":"https://api.github.com/users/Eljees/events{/privacy}","received_events_url":"https://api.github.com/users/Eljees/received_events","type":"User","user_view_type":"public","site_admin":false},"created_at":"2026-09-08T12:51:48Z","updated_at":"2026-09-08T12:51:48Z","body":"Hello Dmitriy,\n\nYou are right on every point, and the central one is my fault. I have reproduced each of your findings before writing this.\n\n## The bcprov example — my fixture, not xmlsec\n\nI built a hand-written pom to stand in for the embedded one and never diffed it against the real artifact. Mine declared `bcprov-jdk18on` with no scope; the real one declares it `test`. So the \"before\" line in my PR description is real Trivy output over a pom I made up, presented as the behaviour of `xmlsec-2.3.4.jar`. That is exactly the thing you should not have had to catch.\n\nThe real jar from Maven Central, unpacked, `trivy 0.73.0 fs --offline-scan --list-all-pkgs`:\n\n```\nTarget=META-INF/maven/org.apache.santuario/xmlsec/pom.xml  Type=pom\n  org.apache.santuario:xmlsec        2.3.4    root\n  com.fasterxml.woodstox:woodstox-core 6.5.0  direct    (runtime)\n  commons-codec:commons-codec        1.15     direct\n  org.slf4j:slf4j-api                1.7.36   direct\nvulnerabilities: 0\n```\n\n`bcprov-jdk18on` is absent, as you said, and `woodstox-core` is a runtime dependency, so calling it a phantom was wrong too.\n\n## The scope claim\n\nRetracted. `pkg/dependency/parser/java/pom/parse.go:597` drops everything outside compile/runtime and everything optional, and the coverage table says `Exclude`. I carried that sentence over from an observation about a different tool's Java cataloger without checking it against Trivy's parser.\n\n## Analyzer types\n\nAlso retracted. `pom` is `TypeLockfiles` and `jar` is `TypeIndividualPkgs`, so no mode runs both and one artifact never gets two answers. I had actually measured that asymmetry myself (`fs` returning only pom packages, `rootfs` only jar packages) and misread it as a defect instead of the design.\n\n## The regression\n\nReproduced with a binary built from my own branch, on the layout you describe — `META-INF/maven/com.example/myapp/pom.xml` declaring `log4j-core:2.14.1`, with the jars in `WEB-INF/lib/`:\n\n```\ntrivy 0.73.0   fs       myapp, log4j-core 2.14.1        7 vulns (incl. CVE-2021-44228)\nPR branch      fs       myapp                           0 vulns\nPR branch      fs --include-dev-deps                    7 vulns\ntrivy 0.73.0   rootfs   log4j-core, log4j-api           8 vulns\n```\n\nLog4Shell drops out of the default report. The path alone cannot separate an application's own descriptor from an unpacked third-party jar's, and in `fs` mode that descriptor is the only source for `WEB-INF/lib`. Your point about `Dev` semantics holds as well: compile and runtime dependencies of a shipped artifact are not dev dependencies, and `maven-invoker-plugin` template poms are not a comparable case.\n\n## What I am doing\n\nClosing #11203. Your prescription is what our pipeline now does: unpacked deliveries are scanned as `rootfs` (the same measurement on our own artefact — 558 jars — gave 19 pom-derived findings under `fs` against 134 jar-derived ones under `rootfs`), and scanning before unpacking where we can. No Trivy change is needed for it.\n\nSorry for the time this cost. Complete command output with the version attached, verified against the real artifact, from the start next time.","reactions":{"url":"https://api.github.com/repos/aquasecurity/trivy/issues/comments/5585422543/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"performed_via_github_app":null,"minimized":null}},"public":true,"created_at":"2026-09-08T12:51:48Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14632342581","type":"PullRequestEvent","actor":{"id":2841473,"login":"wy65701436","display_login":"wy65701436","gravatar_id":"","url":"https://api.github.com/users/wy65701436","avatar_url":"https://avatars.githubusercontent.com/u/2841473?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"opened","number":11211,"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11211","id":4474086866,"number":11211,"head":{"ref":"topic/yw/error-msg","sha":"4773e5115bf10355d643c239b1526392dcb754ac","repo":{"id":1361263011,"url":"https://api.github.com/repos/wy65701436/trivy","name":"trivy"}},"base":{"ref":"main","sha":"af9d5108a0f53b3cc0428f342f2239724959bc3f","repo":{"id":180687624,"url":"https://api.github.com/repos/aquasecurity/trivy","name":"trivy"}}}},"public":true,"created_at":"2026-09-08T12:14:45Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14630475595","type":"WatchEvent","actor":{"id":47358106,"login":"GuihVicentini","display_login":"GuihVicentini","gravatar_id":"","url":"https://api.github.com/users/GuihVicentini","avatar_url":"https://avatars.githubusercontent.com/u/47358106?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"started"},"public":true,"created_at":"2026-09-08T11:42:28Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14628610806","type":"WatchEvent","actor":{"id":93278808,"login":"destructivedata","display_login":"destructivedata","gravatar_id":"","url":"https://api.github.com/users/destructivedata","avatar_url":"https://avatars.githubusercontent.com/u/93278808?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"started"},"public":true,"created_at":"2026-09-08T11:09:40Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14628311824","type":"PullRequestReviewCommentEvent","actor":{"id":91113035,"login":"DmitriyLewen","display_login":"DmitriyLewen","gravatar_id":"","url":"https://api.github.com/users/DmitriyLewen","avatar_url":"https://avatars.githubusercontent.com/u/91113035?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"created","comment":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/comments/3957207110","pull_request_review_id":5140876438,"id":3957207110,"node_id":"PRRC_kwDOCsUTCM7r3jBG","diff_hunk":"@@ -9,6 +9,19 @@ import (\n )\n \n func TestParseIgnoreFile(t *testing.T) {\n+\tt.Run(\"empty path disables the default ignore file\", func(t *testing.T) {\n+\t\tt.Chdir(t.TempDir())\n+\t\trequire.NoError(t, os.WriteFile(\".trivyignore\", []byte(\"CVE-2024-1234\\n\"), 0o600))\n+\n+\t\tgot, err := ParseIgnoreFile(t.Context(), \".trivyignore\")\n+\t\trequire.NoError(t, err)\n+\t\tassert.Len(t, got.Vulnerabilities, 1)\n+\n+\t\tgot, err = ParseIgnoreFile(t.Context(), \"\")","path":"pkg/result/ignore_test.go","commit_id":"6f81e327491337841fbb32b5935efd43dacabc90","original_commit_id":"6f81e327491337841fbb32b5935efd43dacabc90","user":{"login":"DmitriyLewen","id":91113035,"node_id":"MDQ6VXNlcjkxMTEzMDM1","avatar_url":"https://avatars.githubusercontent.com/u/91113035?v=4","gravatar_id":"","url":"https://api.github.com/users/DmitriyLewen","html_url":"https://github.com/DmitriyLewen","followers_url":"https://api.github.com/users/DmitriyLewen/followers","following_url":"https://api.github.com/users/DmitriyLewen/following{/other_user}","gists_url":"https://api.github.com/users/DmitriyLewen/gists{/gist_id}","starred_url":"https://api.github.com/users/DmitriyLewen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DmitriyLewen/subscriptions","organizations_url":"https://api.github.com/users/DmitriyLewen/orgs","repos_url":"https://api.github.com/users/DmitriyLewen/repos","events_url":"https://api.github.com/users/DmitriyLewen/events{/privacy}","received_events_url":"https://api.github.com/users/DmitriyLewen/received_events","type":"User","user_view_type":"public","site_admin":false},"body":"Тест фиксирует правильное поведение, но сейчас оно держится на побочном эффекте: `os.Stat(\"\")` возвращает `fs.ErrNotExist`, и мы попадаем в ветку «файла нет» с сообщением `DEBUG Specified ignore file does not exist file=\"\"`.\nПустой путь — это не «файл не найден», а осознанное отключение, и в логе это выглядит сбивающе.\nПредлагаю добавить в `ParseIgnoreFile` явный ранний выход — тогда намерение станет явным, и тест будет проверять реальную ветку, а не поведение `os.Stat`:\n\n```go\n// An empty path explicitly disables the ignore file\nif ignoreFile == \"\" {\n\tlog.Debug(\"Ignore file is disabled\")\n\treturn IgnoreConfig{}, nil\n}\n```","created_at":"2026-09-08T11:04:29Z","updated_at":"2026-09-08T11:04:29Z","html_url":"https://github.com/aquasecurity/trivy/pull/11210#discussion_r3957207110","pull_request_url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11210","_links":{"self":{"href":"https://api.github.com/repos/aquasecurity/trivy/pulls/comments/3957207110"},"html":{"href":"https://github.com/aquasecurity/trivy/pull/11210#discussion_r3957207110"},"pull_request":{"href":"https://api.github.com/repos/aquasecurity/trivy/pulls/11210"}},"reactions":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/comments/3957207110/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"original_position":12,"position":12,"subject_type":"line"},"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11210","id":4471621822,"number":11210,"head":{"ref":"disable-config-files","sha":"6f81e327491337841fbb32b5935efd43dacabc90","repo":{"id":1171579042,"url":"https://api.github.com/repos/knqyf263/trivy","name":"trivy"}},"base":{"ref":"main","sha":"6d90892649aebd0c9fc86b75173b566ca2307f9e","repo":{"id":180687624,"url":"https://api.github.com/repos/aquasecurity/trivy","name":"trivy"}}}},"public":true,"created_at":"2026-09-08T11:04:29Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14628311718","type":"PullRequestReviewCommentEvent","actor":{"id":91113035,"login":"DmitriyLewen","display_login":"DmitriyLewen","gravatar_id":"","url":"https://api.github.com/users/DmitriyLewen","avatar_url":"https://avatars.githubusercontent.com/u/91113035?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"created","comment":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/comments/3957207106","pull_request_review_id":5140876438,"id":3957207106,"node_id":"PRRC_kwDOCsUTCM7r3jBC","diff_hunk":"@@ -28,3 +28,13 @@ $ TRIVY_DEBUG=true TRIVY_SEVERITY=CRITICAL trivy image alpine:3.15\n Any setting can be set in a YAML file. By default, config file named `trivy.yaml` is read from the current directory where Trivy is run. To load configuration from a different file, use the `--config` flag and specify the config path to load: `trivy --config /etc/trivy/myconfig.yaml`.\n \n The structure and settings of the YAML config file is documented in the [Config file](../references/configuration/config-file.md) document.\n+\n+### Disabling configuration files\n+\n+Pass an empty string to `--config` to skip loading `trivy.yaml`. To also skip the default `.trivyignore` and `trivy-secret.yaml` files, pass empty strings to `--ignorefile` and `--secret-config`:","path":"docs/guide/configuration/index.md","commit_id":"6f81e327491337841fbb32b5935efd43dacabc90","original_commit_id":"6f81e327491337841fbb32b5935efd43dacabc90","user":{"login":"DmitriyLewen","id":91113035,"node_id":"MDQ6VXNlcjkxMTEzMDM1","avatar_url":"https://avatars.githubusercontent.com/u/91113035?v=4","gravatar_id":"","url":"https://api.github.com/users/DmitriyLewen","html_url":"https://github.com/DmitriyLewen","followers_url":"https://api.github.com/users/DmitriyLewen/followers","following_url":"https://api.github.com/users/DmitriyLewen/following{/other_user}","gists_url":"https://api.github.com/users/DmitriyLewen/gists{/gist_id}","starred_url":"https://api.github.com/users/DmitriyLewen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DmitriyLewen/subscriptions","organizations_url":"https://api.github.com/users/DmitriyLewen/orgs","repos_url":"https://api.github.com/users/DmitriyLewen/repos","events_url":"https://api.github.com/users/DmitriyLewen/events{/privacy}","received_events_url":"https://api.github.com/users/DmitriyLewen/received_events","type":"User","user_view_type":"public","site_admin":false},"body":"Возможность передать пустую строку не отражена в `Usage` самих флагов (`ConfigFileFlag`, `IgnoreFileFlag`, `SecretConfigFlag`), поэтому ни в `trivy --help`, ни в сгенерированном CLI reference (`docs/guide/references/configuration/cli/*.md`) про неё ничего нет — фича видна только в этом guide.\nПредлагаю дописать про пустое значение в `Usage` этих трёх флагов и перегенерировать docs.","created_at":"2026-09-08T11:04:29Z","updated_at":"2026-09-08T11:04:29Z","html_url":"https://github.com/aquasecurity/trivy/pull/11210#discussion_r3957207106","pull_request_url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11210","_links":{"self":{"href":"https://api.github.com/repos/aquasecurity/trivy/pulls/comments/3957207106"},"html":{"href":"https://github.com/aquasecurity/trivy/pull/11210#discussion_r3957207106"},"pull_request":{"href":"https://api.github.com/repos/aquasecurity/trivy/pulls/11210"}},"reactions":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/comments/3957207106/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"original_position":7,"position":7,"subject_type":"line"},"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11210","id":4471621822,"number":11210,"head":{"ref":"disable-config-files","sha":"6f81e327491337841fbb32b5935efd43dacabc90","repo":{"id":1171579042,"url":"https://api.github.com/repos/knqyf263/trivy","name":"trivy"}},"base":{"ref":"main","sha":"6d90892649aebd0c9fc86b75173b566ca2307f9e","repo":{"id":180687624,"url":"https://api.github.com/repos/aquasecurity/trivy","name":"trivy"}}}},"public":true,"created_at":"2026-09-08T11:04:29Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14628311578","type":"PullRequestReviewCommentEvent","actor":{"id":91113035,"login":"DmitriyLewen","display_login":"DmitriyLewen","gravatar_id":"","url":"https://api.github.com/users/DmitriyLewen","avatar_url":"https://avatars.githubusercontent.com/u/91113035?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"created","comment":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/comments/3957207102","pull_request_review_id":5140876438,"id":3957207102,"node_id":"PRRC_kwDOCsUTCM7r3jA-","diff_hunk":"@@ -28,3 +28,13 @@ $ TRIVY_DEBUG=true TRIVY_SEVERITY=CRITICAL trivy image alpine:3.15\n Any setting can be set in a YAML file. By default, config file named `trivy.yaml` is read from the current directory where Trivy is run. To load configuration from a different file, use the `--config` flag and specify the config path to load: `trivy --config /etc/trivy/myconfig.yaml`.\n \n The structure and settings of the YAML config file is documented in the [Config file](../references/configuration/config-file.md) document.\n+\n+### Disabling configuration files\n+\n+Pass an empty string to `--config` to skip loading `trivy.yaml`. To also skip the default `.trivyignore` and `trivy-secret.yaml` files, pass empty strings to `--ignorefile` and `--secret-config`:\n+\n+```shell\n+trivy --config=\"\" fs --ignorefile=\"\" --secret-config=\"\" /workspace/project\n+```\n+\n+CLI flags and environment variables still apply. Secret scanning continues to use its built-in rules and allow rules. Omitting these flags preserves the default file-loading behavior.","path":"docs/guide/configuration/index.md","commit_id":"6f81e327491337841fbb32b5935efd43dacabc90","original_commit_id":"6f81e327491337841fbb32b5935efd43dacabc90","user":{"login":"DmitriyLewen","id":91113035,"node_id":"MDQ6VXNlcjkxMTEzMDM1","avatar_url":"https://avatars.githubusercontent.com/u/91113035?v=4","gravatar_id":"","url":"https://api.github.com/users/DmitriyLewen","html_url":"https://github.com/DmitriyLewen","followers_url":"https://api.github.com/users/DmitriyLewen/followers","following_url":"https://api.github.com/users/DmitriyLewen/following{/other_user}","gists_url":"https://api.github.com/users/DmitriyLewen/gists{/gist_id}","starred_url":"https://api.github.com/users/DmitriyLewen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DmitriyLewen/subscriptions","organizations_url":"https://api.github.com/users/DmitriyLewen/orgs","repos_url":"https://api.github.com/users/DmitriyLewen/repos","events_url":"https://api.github.com/users/DmitriyLewen/events{/privacy}","received_events_url":"https://api.github.com/users/DmitriyLewen/received_events","type":"User","user_view_type":"public","site_admin":false},"body":"Здесь стоит явно оговорить, что отключение работает только через CLI-флаги.\nВыше в этом же документе сказано «Any CLI option can be set as an environment variable», но пустое значение переменной окружения файл не отключает: viper по умолчанию работает с `AllowEmptyEnv(false)`, поэтому пустая переменная считается неустановленной и подставляется дефолт.\n\nПроверил на собранном из этой ветки бинарнике:\n\n```console\n$ TRIVY_CONFIG= trivy fs --scanners secret target\nINFO    Loaded  file_path=\"trivy.yaml\"\n\n$ TRIVY_IGNOREFILE= trivy fs --scanners secret --debug target\nDEBUG   Found an ignore file    file_path=\".trivyignore\"\n\n$ TRIVY_SECRET_CONFIG= trivy fs --scanners secret --debug target\nDEBUG   [secret] No secret config detected       config_path=\"trivy-secret.yaml\"\n```\n\nДля контейнеров и CI, где Trivy обычно настраивают через `TRIVY_*`, это неочевидно, причём происходит молча — ни ошибки, ни предупреждения.","created_at":"2026-09-08T11:04:29Z","updated_at":"2026-09-08T11:04:29Z","html_url":"https://github.com/aquasecurity/trivy/pull/11210#discussion_r3957207102","pull_request_url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11210","_links":{"self":{"href":"https://api.github.com/repos/aquasecurity/trivy/pulls/comments/3957207102"},"html":{"href":"https://github.com/aquasecurity/trivy/pull/11210#discussion_r3957207102"},"pull_request":{"href":"https://api.github.com/repos/aquasecurity/trivy/pulls/11210"}},"reactions":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/comments/3957207102/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"original_position":13,"position":13,"subject_type":"line"},"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11210","id":4471621822,"number":11210,"head":{"ref":"disable-config-files","sha":"6f81e327491337841fbb32b5935efd43dacabc90","repo":{"id":1171579042,"url":"https://api.github.com/repos/knqyf263/trivy","name":"trivy"}},"base":{"ref":"main","sha":"6d90892649aebd0c9fc86b75173b566ca2307f9e","repo":{"id":180687624,"url":"https://api.github.com/repos/aquasecurity/trivy","name":"trivy"}}}},"public":true,"created_at":"2026-09-08T11:04:29Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14627849012","type":"ForkEvent","actor":{"id":2841473,"login":"wy65701436","display_login":"wy65701436","gravatar_id":"","url":"https://api.github.com/users/wy65701436","avatar_url":"https://avatars.githubusercontent.com/u/2841473?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"forked","forkee":{"id":1361263011,"node_id":"R_kgDOUSM5ow","name":"trivy","full_name":"wy65701436/trivy","private":false,"owner":{"login":"wy65701436","id":2841473,"node_id":"MDQ6VXNlcjI4NDE0NzM=","avatar_url":"https://avatars.githubusercontent.com/u/2841473?v=4","gravatar_id":"","url":"https://api.github.com/users/wy65701436","html_url":"https://github.com/wy65701436","followers_url":"https://api.github.com/users/wy65701436/followers","following_url":"https://api.github.com/users/wy65701436/following{/other_user}","gists_url":"https://api.github.com/users/wy65701436/gists{/gist_id}","starred_url":"https://api.github.com/users/wy65701436/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wy65701436/subscriptions","organizations_url":"https://api.github.com/users/wy65701436/orgs","repos_url":"https://api.github.com/users/wy65701436/repos","events_url":"https://api.github.com/users/wy65701436/events{/privacy}","received_events_url":"https://api.github.com/users/wy65701436/received_events","type":"User","user_view_type":"public","site_admin":false},"html_url":"https://github.com/wy65701436/trivy","description":"Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more","fork":true,"url":"https://api.github.com/repos/wy65701436/trivy","forks_url":"https://api.github.com/repos/wy65701436/trivy/forks","keys_url":"https://api.github.com/repos/wy65701436/trivy/keys{/key_id}","collaborators_url":"https://api.github.com/repos/wy65701436/trivy/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/wy65701436/trivy/teams","hooks_url":"https://api.github.com/repos/wy65701436/trivy/hooks","issue_events_url":"https://api.github.com/repos/wy65701436/trivy/issues/events{/number}","events_url":"https://api.github.com/repos/wy65701436/trivy/events","assignees_url":"https://api.github.com/repos/wy65701436/trivy/assignees{/user}","branches_url":"https://api.github.com/repos/wy65701436/trivy/branches{/branch}","tags_url":"https://api.github.com/repos/wy65701436/trivy/tags","blobs_url":"https://api.github.com/repos/wy65701436/trivy/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/wy65701436/trivy/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/wy65701436/trivy/git/refs{/sha}","trees_url":"https://api.github.com/repos/wy65701436/trivy/git/trees{/sha}","statuses_url":"https://api.github.com/repos/wy65701436/trivy/statuses/{sha}","languages_url":"https://api.github.com/repos/wy65701436/trivy/languages","stargazers_url":"https://api.github.com/repos/wy65701436/trivy/stargazers","contributors_url":"https://api.github.com/repos/wy65701436/trivy/contributors","subscribers_url":"https://api.github.com/repos/wy65701436/trivy/subscribers","subscription_url":"https://api.github.com/repos/wy65701436/trivy/subscription","commits_url":"https://api.github.com/repos/wy65701436/trivy/commits{/sha}","git_commits_url":"https://api.github.com/repos/wy65701436/trivy/git/commits{/sha}","comments_url":"https://api.github.com/repos/wy65701436/trivy/comments{/number}","issue_comment_url":"https://api.github.com/repos/wy65701436/trivy/issues/comments{/number}","contents_url":"https://api.github.com/repos/wy65701436/trivy/contents/{+path}","compare_url":"https://api.github.com/repos/wy65701436/trivy/compare/{base}...{head}","merges_url":"https://api.github.com/repos/wy65701436/trivy/merges","archive_url":"https://api.github.com/repos/wy65701436/trivy/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/wy65701436/trivy/downloads","issues_url":"https://api.github.com/repos/wy65701436/trivy/issues{/number}","pulls_url":"https://api.github.com/repos/wy65701436/trivy/pulls{/number}","milestones_url":"https://api.github.com/repos/wy65701436/trivy/milestones{/number}","notifications_url":"https://api.github.com/repos/wy65701436/trivy/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/wy65701436/trivy/labels{/name}","releases_url":"https://api.github.com/repos/wy65701436/trivy/releases{/id}","deployments_url":"https://api.github.com/repos/wy65701436/trivy/deployments","created_at":"2026-09-08T10:56:15Z","updated_at":"2026-09-08T10:56:15Z","pushed_at":"2026-09-08T12:14:09Z","git_url":"git://github.com/wy65701436/trivy.git","ssh_url":"git@github.com:wy65701436/trivy.git","clone_url":"https://github.com/wy65701436/trivy.git","svn_url":"https://github.com/wy65701436/trivy","homepage":"https://trivy.dev","size":811617,"stargazers_count":0,"watchers_count":0,"language":null,"has_issues":false,"has_projects":true,"has_downloads":false,"has_wiki":false,"has_pages":false,"has_discussions":false,"forks_count":0,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"allow_forking":true,"is_template":false,"web_commit_signoff_required":false,"has_pull_requests":true,"pull_request_creation_policy":"all","topics":[],"visibility":"public","forks":0,"open_issues":0,"watchers":0,"default_branch":"main"}},"public":true,"created_at":"2026-09-08T10:56:15Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"20430493271","type":"DeleteEvent","actor":{"id":118344674,"login":"github-merge-queue[bot]","display_login":"github-merge-queue","gravatar_id":"","url":"https://api.github.com/users/github-merge-queue[bot]","avatar_url":"https://avatars.githubusercontent.com/u/118344674?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"ref":"gh-readonly-queue/main/pr-11207-bb4a5f5c703e208d4007cbfc92809f539526a249","ref_type":"branch","full_ref":"refs/heads/gh-readonly-queue/main/pr-11207-bb4a5f5c703e208d4007cbfc92809f539526a249","pusher_type":"user"},"public":true,"created_at":"2026-09-08T10:22:12Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"20430492315","type":"PushEvent","actor":{"id":118344674,"login":"github-merge-queue[bot]","display_login":"github-merge-queue","gravatar_id":"","url":"https://api.github.com/users/github-merge-queue[bot]","avatar_url":"https://avatars.githubusercontent.com/u/118344674?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"repository_id":180687624,"push_id":42916974315,"ref":"refs/heads/main","head":"4eac9a04f2c2b3ae990b9b361d14b65103278c7b","before":"bb4a5f5c703e208d4007cbfc92809f539526a249"},"public":true,"created_at":"2026-09-08T10:22:11Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"20430461911","type":"PushEvent","actor":{"id":283413663,"login":"repo-trivy-write-33ed3c[bot]","display_login":"repo-trivy-write-33ed3c","gravatar_id":"","url":"https://api.github.com/users/repo-trivy-write-33ed3c[bot]","avatar_url":"https://avatars.githubusercontent.com/u/283413663?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"repository_id":180687624,"push_id":42917033755,"ref":"refs/heads/release-please--branches--main","head":"a6b1bc168ff6c9cc9633b77db637501bb17673f8","before":"569a5a3df2edfab0fba7b1d752f91c533b6d6af8"},"public":true,"created_at":"2026-09-08T10:22:48Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"20430412524","type":"DeleteEvent","actor":{"id":118344674,"login":"github-merge-queue[bot]","display_login":"github-merge-queue","gravatar_id":"","url":"https://api.github.com/users/github-merge-queue[bot]","avatar_url":"https://avatars.githubusercontent.com/u/118344674?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"ref":"gh-readonly-queue/main/pr-11205-4eac9a04f2c2b3ae990b9b361d14b65103278c7b","ref_type":"branch","full_ref":"refs/heads/gh-readonly-queue/main/pr-11205-4eac9a04f2c2b3ae990b9b361d14b65103278c7b","pusher_type":"user"},"public":true,"created_at":"2026-09-08T10:22:13Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14625891883","type":"PullRequestEvent","actor":{"id":100182843,"login":"nikpivkin","display_login":"nikpivkin","gravatar_id":"","url":"https://api.github.com/users/nikpivkin","avatar_url":"https://avatars.githubusercontent.com/u/100182843?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"merged","number":11205,"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11205","id":4469986699,"number":11205,"head":{"ref":"deps/checks","sha":"8fc83366e3095898808fc354109d4364c12c86be","repo":{"id":1170421960,"url":"https://api.github.com/repos/nikpivkin/trivy","name":"trivy"}},"base":{"ref":"main","sha":"6d90892649aebd0c9fc86b75173b566ca2307f9e","repo":{"id":180687624,"url":"https://api.github.com/repos/aquasecurity/trivy","name":"trivy"}}}},"public":true,"created_at":"2026-09-08T10:22:12Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14625891650","type":"PullRequestEvent","actor":{"id":100182843,"login":"nikpivkin","display_login":"nikpivkin","gravatar_id":"","url":"https://api.github.com/users/nikpivkin","avatar_url":"https://avatars.githubusercontent.com/u/100182843?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"merged","number":11207,"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11207","id":4470813629,"number":11207,"head":{"ref":"fix/k8s-multi-doc-line-numbers","sha":"63ce32515055dc24ab28bc2eff0c8ba7bd826940","repo":{"id":1170421960,"url":"https://api.github.com/repos/nikpivkin/trivy","name":"trivy"}},"base":{"ref":"main","sha":"6d90892649aebd0c9fc86b75173b566ca2307f9e","repo":{"id":180687624,"url":"https://api.github.com/repos/aquasecurity/trivy","name":"trivy"}}}},"public":true,"created_at":"2026-09-08T10:22:11Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14624733809","type":"WatchEvent","actor":{"id":181156951,"login":"suruiij","display_login":"suruiij","gravatar_id":"","url":"https://api.github.com/users/suruiij","avatar_url":"https://avatars.githubusercontent.com/u/181156951?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"started"},"public":true,"created_at":"2026-09-08T10:02:32Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14621112658","type":"ForkEvent","actor":{"id":145062510,"login":"pintxxo","display_login":"pintxxo","gravatar_id":"","url":"https://api.github.com/users/pintxxo","avatar_url":"https://avatars.githubusercontent.com/u/145062510?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"forked","forkee":{"id":1361152320,"node_id":"R_kgDOUSGJQA","name":"trivy","full_name":"pintxxo/trivy","private":false,"owner":{"login":"pintxxo","id":145062510,"node_id":"U_kgDOCKV6bg","avatar_url":"https://avatars.githubusercontent.com/u/145062510?v=4","gravatar_id":"","url":"https://api.github.com/users/pintxxo","html_url":"https://github.com/pintxxo","followers_url":"https://api.github.com/users/pintxxo/followers","following_url":"https://api.github.com/users/pintxxo/following{/other_user}","gists_url":"https://api.github.com/users/pintxxo/gists{/gist_id}","starred_url":"https://api.github.com/users/pintxxo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pintxxo/subscriptions","organizations_url":"https://api.github.com/users/pintxxo/orgs","repos_url":"https://api.github.com/users/pintxxo/repos","events_url":"https://api.github.com/users/pintxxo/events{/privacy}","received_events_url":"https://api.github.com/users/pintxxo/received_events","type":"User","user_view_type":"public","site_admin":false},"html_url":"https://github.com/pintxxo/trivy","description":"Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more","fork":true,"url":"https://api.github.com/repos/pintxxo/trivy","forks_url":"https://api.github.com/repos/pintxxo/trivy/forks","keys_url":"https://api.github.com/repos/pintxxo/trivy/keys{/key_id}","collaborators_url":"https://api.github.com/repos/pintxxo/trivy/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/pintxxo/trivy/teams","hooks_url":"https://api.github.com/repos/pintxxo/trivy/hooks","issue_events_url":"https://api.github.com/repos/pintxxo/trivy/issues/events{/number}","events_url":"https://api.github.com/repos/pintxxo/trivy/events","assignees_url":"https://api.github.com/repos/pintxxo/trivy/assignees{/user}","branches_url":"https://api.github.com/repos/pintxxo/trivy/branches{/branch}","tags_url":"https://api.github.com/repos/pintxxo/trivy/tags","blobs_url":"https://api.github.com/repos/pintxxo/trivy/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/pintxxo/trivy/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/pintxxo/trivy/git/refs{/sha}","trees_url":"https://api.github.com/repos/pintxxo/trivy/git/trees{/sha}","statuses_url":"https://api.github.com/repos/pintxxo/trivy/statuses/{sha}","languages_url":"https://api.github.com/repos/pintxxo/trivy/languages","stargazers_url":"https://api.github.com/repos/pintxxo/trivy/stargazers","contributors_url":"https://api.github.com/repos/pintxxo/trivy/contributors","subscribers_url":"https://api.github.com/repos/pintxxo/trivy/subscribers","subscription_url":"https://api.github.com/repos/pintxxo/trivy/subscription","commits_url":"https://api.github.com/repos/pintxxo/trivy/commits{/sha}","git_commits_url":"https://api.github.com/repos/pintxxo/trivy/git/commits{/sha}","comments_url":"https://api.github.com/repos/pintxxo/trivy/comments{/number}","issue_comment_url":"https://api.github.com/repos/pintxxo/trivy/issues/comments{/number}","contents_url":"https://api.github.com/repos/pintxxo/trivy/contents/{+path}","compare_url":"https://api.github.com/repos/pintxxo/trivy/compare/{base}...{head}","merges_url":"https://api.github.com/repos/pintxxo/trivy/merges","archive_url":"https://api.github.com/repos/pintxxo/trivy/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/pintxxo/trivy/downloads","issues_url":"https://api.github.com/repos/pintxxo/trivy/issues{/number}","pulls_url":"https://api.github.com/repos/pintxxo/trivy/pulls{/number}","milestones_url":"https://api.github.com/repos/pintxxo/trivy/milestones{/number}","notifications_url":"https://api.github.com/repos/pintxxo/trivy/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/pintxxo/trivy/labels{/name}","releases_url":"https://api.github.com/repos/pintxxo/trivy/releases{/id}","deployments_url":"https://api.github.com/repos/pintxxo/trivy/deployments","created_at":"2026-09-08T09:03:01Z","updated_at":"2026-09-08T09:03:01Z","pushed_at":"2026-09-08T08:14:24Z","git_url":"git://github.com/pintxxo/trivy.git","ssh_url":"git@github.com:pintxxo/trivy.git","clone_url":"https://github.com/pintxxo/trivy.git","svn_url":"https://github.com/pintxxo/trivy","homepage":"https://trivy.dev","size":942315,"stargazers_count":0,"watchers_count":0,"language":null,"has_issues":false,"has_projects":true,"has_downloads":false,"has_wiki":false,"has_pages":false,"has_discussions":false,"forks_count":0,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"allow_forking":true,"is_template":false,"web_commit_signoff_required":false,"has_pull_requests":true,"pull_request_creation_policy":"all","topics":[],"visibility":"public","forks":0,"open_issues":0,"watchers":0,"default_branch":"main"}},"public":true,"created_at":"2026-09-08T09:03:01Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14620501782","type":"PullRequestReviewEvent","actor":{"id":19297627,"login":"afdesk","display_login":"afdesk","gravatar_id":"","url":"https://api.github.com/users/afdesk","avatar_url":"https://avatars.githubusercontent.com/u/19297627?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"review":{"id":5139492018,"node_id":"PRR_kwDOCsUTCM8AAAABMlZssg","user":{"login":"afdesk","id":19297627,"node_id":"MDQ6VXNlcjE5Mjk3NjI3","avatar_url":"https://avatars.githubusercontent.com/u/19297627?v=4","gravatar_id":"","url":"https://api.github.com/users/afdesk","html_url":"https://github.com/afdesk","followers_url":"https://api.github.com/users/afdesk/followers","following_url":"https://api.github.com/users/afdesk/following{/other_user}","gists_url":"https://api.github.com/users/afdesk/gists{/gist_id}","starred_url":"https://api.github.com/users/afdesk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/afdesk/subscriptions","organizations_url":"https://api.github.com/users/afdesk/orgs","repos_url":"https://api.github.com/users/afdesk/repos","events_url":"https://api.github.com/users/afdesk/events{/privacy}","received_events_url":"https://api.github.com/users/afdesk/received_events","type":"User","user_view_type":"public","site_admin":false},"body":null,"commit_id":"63ce32515055dc24ab28bc2eff0c8ba7bd826940","state":"approved","html_url":"https://github.com/aquasecurity/trivy/pull/11207#pullrequestreview-5139492018","pull_request_url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11207","_links":{"html":{"href":"https://github.com/aquasecurity/trivy/pull/11207#pullrequestreview-5139492018"},"pull_request":{"href":"https://api.github.com/repos/aquasecurity/trivy/pulls/11207"}},"submitted_at":"2026-09-08T08:53:00Z","updated_at":"2026-09-08T08:53:00Z"},"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11207","id":4470813629,"number":11207,"head":{"ref":"fix/k8s-multi-doc-line-numbers","sha":"63ce32515055dc24ab28bc2eff0c8ba7bd826940","repo":{"id":1170421960,"url":"https://api.github.com/repos/nikpivkin/trivy","name":"trivy"}},"base":{"ref":"main","sha":"6d90892649aebd0c9fc86b75173b566ca2307f9e","repo":{"id":180687624,"url":"https://api.github.com/repos/aquasecurity/trivy","name":"trivy"}}},"action":"created"},"public":true,"created_at":"2026-09-08T08:53:01Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14620433237","type":"PullRequestReviewEvent","actor":{"id":19297627,"login":"afdesk","display_login":"afdesk","gravatar_id":"","url":"https://api.github.com/users/afdesk","avatar_url":"https://avatars.githubusercontent.com/u/19297627?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"review":{"id":5139479640,"node_id":"PRR_kwDOCsUTCM8AAAABMlY8WA","user":{"login":"afdesk","id":19297627,"node_id":"MDQ6VXNlcjE5Mjk3NjI3","avatar_url":"https://avatars.githubusercontent.com/u/19297627?v=4","gravatar_id":"","url":"https://api.github.com/users/afdesk","html_url":"https://github.com/afdesk","followers_url":"https://api.github.com/users/afdesk/followers","following_url":"https://api.github.com/users/afdesk/following{/other_user}","gists_url":"https://api.github.com/users/afdesk/gists{/gist_id}","starred_url":"https://api.github.com/users/afdesk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/afdesk/subscriptions","organizations_url":"https://api.github.com/users/afdesk/orgs","repos_url":"https://api.github.com/users/afdesk/repos","events_url":"https://api.github.com/users/afdesk/events{/privacy}","received_events_url":"https://api.github.com/users/afdesk/received_events","type":"User","user_view_type":"public","site_admin":false},"body":null,"commit_id":"8fc83366e3095898808fc354109d4364c12c86be","state":"approved","html_url":"https://github.com/aquasecurity/trivy/pull/11205#pullrequestreview-5139479640","pull_request_url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11205","_links":{"html":{"href":"https://github.com/aquasecurity/trivy/pull/11205#pullrequestreview-5139479640"},"pull_request":{"href":"https://api.github.com/repos/aquasecurity/trivy/pulls/11205"}},"submitted_at":"2026-09-08T08:51:55Z","updated_at":"2026-09-08T08:51:55Z"},"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11205","id":4469986699,"number":11205,"head":{"ref":"deps/checks","sha":"8fc83366e3095898808fc354109d4364c12c86be","repo":{"id":1170421960,"url":"https://api.github.com/repos/nikpivkin/trivy","name":"trivy"}},"base":{"ref":"main","sha":"6d90892649aebd0c9fc86b75173b566ca2307f9e","repo":{"id":180687624,"url":"https://api.github.com/repos/aquasecurity/trivy","name":"trivy"}}},"action":"created"},"public":true,"created_at":"2026-09-08T08:51:56Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14618104176","type":"PullRequestEvent","actor":{"id":2253692,"login":"knqyf263","display_login":"knqyf263","gravatar_id":"","url":"https://api.github.com/users/knqyf263","avatar_url":"https://avatars.githubusercontent.com/u/2253692?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"merged","number":11200,"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11200","id":4464674973,"number":11200,"head":{"ref":"docs-terraform-remote-modules","sha":"e1ce1dab4787632197dbc15cd5645349fefbb146","repo":{"id":1171579042,"url":"https://api.github.com/repos/knqyf263/trivy","name":"trivy"}},"base":{"ref":"main","sha":"f30c208c7c5b7abd5056799d3485674a7c33832d","repo":{"id":180687624,"url":"https://api.github.com/repos/aquasecurity/trivy","name":"trivy"}}}},"public":true,"created_at":"2026-09-08T08:13:01Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"20419471736","type":"PushEvent","actor":{"id":118344674,"login":"github-merge-queue[bot]","display_login":"github-merge-queue","gravatar_id":"","url":"https://api.github.com/users/github-merge-queue[bot]","avatar_url":"https://avatars.githubusercontent.com/u/118344674?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"repository_id":180687624,"push_id":42904009290,"ref":"refs/heads/main","head":"bb4a5f5c703e208d4007cbfc92809f539526a249","before":"6d90892649aebd0c9fc86b75173b566ca2307f9e"},"public":true,"created_at":"2026-09-08T08:13:02Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14617034145","type":"PullRequestReviewEvent","actor":{"id":100182843,"login":"nikpivkin","display_login":"nikpivkin","gravatar_id":"","url":"https://api.github.com/users/nikpivkin","avatar_url":"https://avatars.githubusercontent.com/u/100182843?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"review":{"id":5138885730,"node_id":"PRR_kwDOCsUTCM8AAAABMk0sYg","user":{"login":"nikpivkin","id":100182843,"node_id":"U_kgDOBfirOw","avatar_url":"https://avatars.githubusercontent.com/u/100182843?v=4","gravatar_id":"","url":"https://api.github.com/users/nikpivkin","html_url":"https://github.com/nikpivkin","followers_url":"https://api.github.com/users/nikpivkin/followers","following_url":"https://api.github.com/users/nikpivkin/following{/other_user}","gists_url":"https://api.github.com/users/nikpivkin/gists{/gist_id}","starred_url":"https://api.github.com/users/nikpivkin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nikpivkin/subscriptions","organizations_url":"https://api.github.com/users/nikpivkin/orgs","repos_url":"https://api.github.com/users/nikpivkin/repos","events_url":"https://api.github.com/users/nikpivkin/events{/privacy}","received_events_url":"https://api.github.com/users/nikpivkin/received_events","type":"User","user_view_type":"public","site_admin":false},"body":null,"commit_id":"c4307000f80e2231633a98407a9467c3947e6d1e","state":"commented","html_url":"https://github.com/aquasecurity/trivy/pull/11162#pullrequestreview-5138885730","pull_request_url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11162","_links":{"html":{"href":"https://github.com/aquasecurity/trivy/pull/11162#pullrequestreview-5138885730"},"pull_request":{"href":"https://api.github.com/repos/aquasecurity/trivy/pulls/11162"}},"submitted_at":"2026-09-08T07:54:48Z","updated_at":"2026-09-08T07:54:48Z"},"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11162","id":4400103002,"number":11162,"head":{"ref":"perf/secret-word-boundary","sha":"15dabf5e57752e3929aff0fe5272d2af8b8964fa","repo":{"id":1170421960,"url":"https://api.github.com/repos/nikpivkin/trivy","name":"trivy"}},"base":{"ref":"main","sha":"af9d5108a0f53b3cc0428f342f2239724959bc3f","repo":{"id":180687624,"url":"https://api.github.com/repos/aquasecurity/trivy","name":"trivy"}}},"action":"created"},"public":true,"created_at":"2026-09-08T07:54:49Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14617032641","type":"PullRequestReviewCommentEvent","actor":{"id":100182843,"login":"nikpivkin","display_login":"nikpivkin","gravatar_id":"","url":"https://api.github.com/users/nikpivkin","avatar_url":"https://avatars.githubusercontent.com/u/100182843?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"created","comment":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/comments/3955591669","pull_request_review_id":5138885730,"id":3955591669,"node_id":"PRRC_kwDOCsUTCM7rxYn1","diff_hunk":"@@ -129,21 +130,155 @@ func (g Global) IsSkipped(path string) bool {\n \treturn false\n }\n \n-// Regexp adds unmarshalling from YAML for regexp.Regexp\n+// Regexp wraps regexp.Regexp with unmarshalling from YAML and the leading word boundary check.\n type Regexp struct {\n-\t*regexp.Regexp\n+\tre *regexp.Regexp\n+\n+\t// wordPrefix tells that the leading word boundary is not part of the pattern\n+\t// and has to be checked in Go. Without it in front the engine has a chance to\n+\t// jump to the literal prefix of the pattern instead of testing every byte of\n+\t// the chunk.\n+\twordPrefix bool\n }\n \n+// MustCompileWithoutWordPrefix compiles a pattern that matches only when the\n+// character in front of it is not an ASCII word character. The boundary is\n+// checked while searching, the compiled pattern does not carry it. The pattern\n+// must start with a literal ASCII word character.\n func MustCompileWithoutWordPrefix(str string) *Regexp {\n-\treturn MustCompile(fmt.Sprintf(\"%s(%s)\", startWord, str))\n+\treturn mustCompileWordPrefix(fmt.Sprintf(\"(%s)\", str))\n }\n \n+// MustCompileWithBoundaries compiles a pattern that matches only when neither the\n+// character in front of it nor the character after it is an ASCII word character.\n+// The one after stays in the pattern and becomes part of the match. The same\n+// restrictions as in MustCompileWithoutWordPrefix apply.\n func MustCompileWithBoundaries(str string) *Regexp {\n-\treturn MustCompile(fmt.Sprintf(\"%s(%s)%s\", startWord, str, endWord))\n+\treturn mustCompileWordPrefix(fmt.Sprintf(\"(%s)%s\", str, endWord))\n+}\n+\n+func mustCompileWordPrefix(str string) *Regexp {\n+\tparsed, err := syntax.Parse(str, syntax.Perl)\n+\tif err != nil {\n+\t\tpanic(fmt.Sprintf(\"secret: cannot parse pattern %q: %s\", str, err))\n+\t}\n+\n+\tif !startsWithWordLiteral(parsed) {\n+\t\tpanic(fmt.Sprintf(\"secret: pattern %q must start with a literal ASCII word character. \"+\n+\t\t\t`The leading word boundary is checked outside the pattern, so ^, \\A and \\b in front of it are not allowed`, str))\n+\t}\n+\n+\treturn &Regexp{\n+\t\tre:         regexp.MustCompile(str),\n+\t\twordPrefix: true,\n+\t}\n+}\n+\n+// startsWithWordLiteral reports whether every way re can match begins with a literal\n+// ASCII word character. What it cannot prove it rejects.\n+func startsWithWordLiteral(re *syntax.Regexp) bool {\n+\tswitch re.Op {\n+\tcase syntax.OpLiteral:\n+\t\treturn len(re.Rune) > 0 && isWordChar(re.Rune[0])\n+\tcase syntax.OpCapture, syntax.OpConcat:\n+\t\treturn len(re.Sub) > 0 && startsWithWordLiteral(re.Sub[0])\n+\tcase syntax.OpAlternate:\n+\t\tif len(re.Sub) == 0 {\n+\t\t\treturn false\n+\t\t}\n+\t\tfor _, sub := range re.Sub {\n+\t\t\tif !startsWithWordLiteral(sub) {\n+\t\t\t\treturn false\n+\t\t\t}\n+\t\t}\n+\t\treturn true\n+\t}\n+\treturn false\n }\n \n func MustCompile(str string) *Regexp {\n-\treturn &Regexp{regexp.MustCompile(str)}\n+\treturn &Regexp{re: regexp.MustCompile(str)}\n+}\n+\n+func (r *Regexp) String() string {\n+\treturn r.re.String()\n+}\n+\n+func (r *Regexp) SubexpNames() []string {\n+\treturn r.re.SubexpNames()\n+}\n+\n+// FindAllIndex works as regexp.Regexp.FindAllIndex does, but for the patterns\n+// compiled by MustCompileWithoutWordPrefix and MustCompileWithBoundaries it also\n+// checks the leading word boundary.\n+func (r *Regexp) FindAllIndex(content []byte, n int) [][]int {\n+\tif r.wordPrefix {\n+\t\treturn r.findAll(content, n, r.re.FindIndex)\n+\t}\n+\treturn r.re.FindAllIndex(content, n)\n+}\n+\n+// FindAllSubmatchIndex works as regexp.Regexp.FindAllSubmatchIndex does, but for\n+// the patterns compiled by MustCompileWithoutWordPrefix and MustCompileWithBoundaries\n+// it also checks the leading word boundary.\n+func (r *Regexp) FindAllSubmatchIndex(content []byte, n int) [][]int {\n+\tif r.wordPrefix {\n+\t\treturn r.findAll(content, n, r.re.FindSubmatchIndex)\n+\t}\n+\treturn r.re.FindAllSubmatchIndex(content, n)\n+}\n+\n+// MatchString works as regexp.Regexp.MatchString does, but for the patterns compiled\n+// by MustCompileWithoutWordPrefix and MustCompileWithBoundaries it also checks the\n+// leading word boundary.\n+func (r *Regexp) MatchString(s string) bool {\n+\tif r.wordPrefix {\n+\t\treturn len(r.findAll([]byte(s), 1, r.re.FindIndex)) > 0\n+\t}\n+\treturn r.re.MatchString(s)\n+}\n+\n+// findAll walks content the way regexp does and drops the matches that start right\n+// after an ASCII word character. A match at the very beginning of content is kept,\n+// there is nothing in front of it to reject it by.\n+//\n+// The reported start is one character before where the pattern matched. Everything else,\n+// including the offsets of the named groups, is left untouched.\n+func (r *Regexp) findAll(content []byte, n int, find func([]byte) []int) [][]int {\n+\tvar matches [][]int\n+\tfor pos := 0; pos <= len(content) && (n < 0 || len(matches) < n); {\n+\t\tm := find(content[pos:])\n+\t\tif m == nil {\n+\t\t\tbreak\n+\t\t}\n+\t\tfor i, idx := range m {\n+\t\t\tif idx >= 0 {\n+\t\t\t\tm[i] = idx + pos\n+\t\t\t}\n+\t\t}\n+\t\tstart := m[0]\n+\n+\t\t// The boundary is a character, not a byte, so a multi-byte one in front of\n+\t\t// the match counts as a whole. At the start of content there is nothing to\n+\t\t// decode and the match is kept.\n+\t\tprev, size := utf8.DecodeLastRune(content[:start])\n+\t\tif isWordChar(prev) {\n+\t\t\t// This position is out, but a match can still start to the right of it.\n+\t\t\tpos = start + 1\n+\t\t\tcontinue\n+\t\t}","path":"pkg/fanal/secret/scanner.go","commit_id":"15dabf5e57752e3929aff0fe5272d2af8b8964fa","original_commit_id":"c4307000f80e2231633a98407a9467c3947e6d1e","user":{"login":"nikpivkin","id":100182843,"node_id":"U_kgDOBfirOw","avatar_url":"https://avatars.githubusercontent.com/u/100182843?v=4","gravatar_id":"","url":"https://api.github.com/users/nikpivkin","html_url":"https://github.com/nikpivkin","followers_url":"https://api.github.com/users/nikpivkin/followers","following_url":"https://api.github.com/users/nikpivkin/following{/other_user}","gists_url":"https://api.github.com/users/nikpivkin/gists{/gist_id}","starred_url":"https://api.github.com/users/nikpivkin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nikpivkin/subscriptions","organizations_url":"https://api.github.com/users/nikpivkin/orgs","repos_url":"https://api.github.com/users/nikpivkin/repos","events_url":"https://api.github.com/users/nikpivkin/events{/privacy}","received_events_url":"https://api.github.com/users/nikpivkin/received_events","type":"User","user_view_type":"public","site_admin":false},"body":"@DmitriyLewen I added a check that rejects an unbounded quantifier in a rule that uses the boundary. `github-app-token` and `openai-service-api-key` keep the boundary in the pattern now, and `endSecret` lost its `+`, so `aws-access-key-id` still uses the optimization. https://github.com/aquasecurity/trivy/pull/11162/changes/fb2ce7db42d27684a9c00b5a4c655c1155cd369e","created_at":"2026-09-08T07:54:47Z","updated_at":"2026-09-08T07:57:45Z","html_url":"https://github.com/aquasecurity/trivy/pull/11162#discussion_r3955591669","pull_request_url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11162","_links":{"self":{"href":"https://api.github.com/repos/aquasecurity/trivy/pulls/comments/3955591669"},"html":{"href":"https://github.com/aquasecurity/trivy/pull/11162#discussion_r3955591669"},"pull_request":{"href":"https://api.github.com/repos/aquasecurity/trivy/pulls/11162"}},"reactions":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/comments/3955591669/reactions","total_count":0,"+1":0,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"in_reply_to_id":3948881160,"original_position":153,"position":82,"subject_type":"line"},"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11162","id":4400103002,"number":11162,"head":{"ref":"perf/secret-word-boundary","sha":"15dabf5e57752e3929aff0fe5272d2af8b8964fa","repo":{"id":1170421960,"url":"https://api.github.com/repos/nikpivkin/trivy","name":"trivy"}},"base":{"ref":"main","sha":"af9d5108a0f53b3cc0428f342f2239724959bc3f","repo":{"id":180687624,"url":"https://api.github.com/repos/aquasecurity/trivy","name":"trivy"}}}},"public":true,"created_at":"2026-09-08T07:54:47Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14616207001","type":"PullRequestReviewEvent","actor":{"id":100182843,"login":"nikpivkin","display_login":"nikpivkin","gravatar_id":"","url":"https://api.github.com/users/nikpivkin","avatar_url":"https://avatars.githubusercontent.com/u/100182843?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"review":{"id":5138746199,"node_id":"PRR_kwDOCsUTCM8AAAABMksLVw","user":{"login":"nikpivkin","id":100182843,"node_id":"U_kgDOBfirOw","avatar_url":"https://avatars.githubusercontent.com/u/100182843?v=4","gravatar_id":"","url":"https://api.github.com/users/nikpivkin","html_url":"https://github.com/nikpivkin","followers_url":"https://api.github.com/users/nikpivkin/followers","following_url":"https://api.github.com/users/nikpivkin/following{/other_user}","gists_url":"https://api.github.com/users/nikpivkin/gists{/gist_id}","starred_url":"https://api.github.com/users/nikpivkin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nikpivkin/subscriptions","organizations_url":"https://api.github.com/users/nikpivkin/orgs","repos_url":"https://api.github.com/users/nikpivkin/repos","events_url":"https://api.github.com/users/nikpivkin/events{/privacy}","received_events_url":"https://api.github.com/users/nikpivkin/received_events","type":"User","user_view_type":"public","site_admin":false},"body":null,"commit_id":"e1ce1dab4787632197dbc15cd5645349fefbb146","state":"approved","html_url":"https://github.com/aquasecurity/trivy/pull/11200#pullrequestreview-5138746199","pull_request_url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11200","_links":{"html":{"href":"https://github.com/aquasecurity/trivy/pull/11200#pullrequestreview-5138746199"},"pull_request":{"href":"https://api.github.com/repos/aquasecurity/trivy/pulls/11200"}},"submitted_at":"2026-09-08T07:40:24Z","updated_at":"2026-09-08T07:40:24Z"},"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11200","id":4464674973,"number":11200,"head":{"ref":"docs-terraform-remote-modules","sha":"e1ce1dab4787632197dbc15cd5645349fefbb146","repo":{"id":1171579042,"url":"https://api.github.com/repos/knqyf263/trivy","name":"trivy"}},"base":{"ref":"main","sha":"f30c208c7c5b7abd5056799d3485674a7c33832d","repo":{"id":180687624,"url":"https://api.github.com/repos/aquasecurity/trivy","name":"trivy"}}},"action":"created"},"public":true,"created_at":"2026-09-08T07:40:26Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14615825758","type":"PullRequestReviewEvent","actor":{"id":91113035,"login":"DmitriyLewen","display_login":"DmitriyLewen","gravatar_id":"","url":"https://api.github.com/users/DmitriyLewen","avatar_url":"https://avatars.githubusercontent.com/u/91113035?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"review":{"id":5138688286,"node_id":"PRR_kwDOCsUTCM8AAAABMkopHg","user":{"login":"DmitriyLewen","id":91113035,"node_id":"MDQ6VXNlcjkxMTEzMDM1","avatar_url":"https://avatars.githubusercontent.com/u/91113035?v=4","gravatar_id":"","url":"https://api.github.com/users/DmitriyLewen","html_url":"https://github.com/DmitriyLewen","followers_url":"https://api.github.com/users/DmitriyLewen/followers","following_url":"https://api.github.com/users/DmitriyLewen/following{/other_user}","gists_url":"https://api.github.com/users/DmitriyLewen/gists{/gist_id}","starred_url":"https://api.github.com/users/DmitriyLewen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DmitriyLewen/subscriptions","organizations_url":"https://api.github.com/users/DmitriyLewen/orgs","repos_url":"https://api.github.com/users/DmitriyLewen/repos","events_url":"https://api.github.com/users/DmitriyLewen/events{/privacy}","received_events_url":"https://api.github.com/users/DmitriyLewen/received_events","type":"User","user_view_type":"public","site_admin":false},"body":null,"commit_id":"e1ce1dab4787632197dbc15cd5645349fefbb146","state":"approved","html_url":"https://github.com/aquasecurity/trivy/pull/11200#pullrequestreview-5138688286","pull_request_url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11200","_links":{"html":{"href":"https://github.com/aquasecurity/trivy/pull/11200#pullrequestreview-5138688286"},"pull_request":{"href":"https://api.github.com/repos/aquasecurity/trivy/pulls/11200"}},"submitted_at":"2026-09-08T07:33:34Z","updated_at":"2026-09-08T07:33:34Z"},"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11200","id":4464674973,"number":11200,"head":{"ref":"docs-terraform-remote-modules","sha":"e1ce1dab4787632197dbc15cd5645349fefbb146","repo":{"id":1171579042,"url":"https://api.github.com/repos/knqyf263/trivy","name":"trivy"}},"base":{"ref":"main","sha":"f30c208c7c5b7abd5056799d3485674a7c33832d","repo":{"id":180687624,"url":"https://api.github.com/repos/aquasecurity/trivy","name":"trivy"}}},"action":"created"},"public":true,"created_at":"2026-09-08T07:33:36Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14615765102","type":"PullRequestEvent","actor":{"id":2253692,"login":"knqyf263","display_login":"knqyf263","gravatar_id":"","url":"https://api.github.com/users/knqyf263","avatar_url":"https://avatars.githubusercontent.com/u/2253692?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"labeled","number":11210,"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11210","id":4471621822,"number":11210,"head":{"ref":"disable-config-files","sha":"6f81e327491337841fbb32b5935efd43dacabc90","repo":{"id":1171579042,"url":"https://api.github.com/repos/knqyf263/trivy","name":"trivy"}},"base":{"ref":"main","sha":"6d90892649aebd0c9fc86b75173b566ca2307f9e","repo":{"id":180687624,"url":"https://api.github.com/repos/aquasecurity/trivy","name":"trivy"}}},"label":{"id":2026888794,"node_id":"MDU6TGFiZWwyMDI2ODg4Nzk0","url":"https://api.github.com/repos/aquasecurity/trivy/labels/kind/feature","name":"kind/feature","color":"c7def8","default":false,"description":"Categorizes issue or PR as related to a new feature."},"labels":[{"id":2026888794,"node_id":"MDU6TGFiZWwyMDI2ODg4Nzk0","url":"https://api.github.com/repos/aquasecurity/trivy/labels/kind/feature","name":"kind/feature","color":"c7def8","default":false,"description":"Categorizes issue or PR as related to a new feature."}]},"public":true,"created_at":"2026-09-08T07:32:29Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}},{"id":"14615764119","type":"PullRequestEvent","actor":{"id":2253692,"login":"knqyf263","display_login":"knqyf263","gravatar_id":"","url":"https://api.github.com/users/knqyf263","avatar_url":"https://avatars.githubusercontent.com/u/2253692?"},"repo":{"id":180687624,"name":"aquasecurity/trivy","url":"https://api.github.com/repos/aquasecurity/trivy"},"payload":{"action":"opened","number":11210,"pull_request":{"url":"https://api.github.com/repos/aquasecurity/trivy/pulls/11210","id":4471621822,"number":11210,"head":{"ref":"disable-config-files","sha":"6f81e327491337841fbb32b5935efd43dacabc90","repo":{"id":1171579042,"url":"https://api.github.com/repos/knqyf263/trivy","name":"trivy"}},"base":{"ref":"main","sha":"6d90892649aebd0c9fc86b75173b566ca2307f9e","repo":{"id":180687624,"url":"https://api.github.com/repos/aquasecurity/trivy","name":"trivy"}}}},"public":true,"created_at":"2026-09-08T07:32:29Z","org":{"id":12783832,"login":"aquasecurity","gravatar_id":"","url":"https://api.github.com/orgs/aquasecurity","avatar_url":"https://avatars.githubusercontent.com/u/12783832?"}}]