Release Notes
v0.4.0
Vulnerability intelligence now comes from Codeward Intel.
The scanner no longer bundles a vulnerability database. It parses your lockfiles with its own parsers — 19 formats across 12 ecosystems — and resolves what it finds against Intel, which is now public and browsable at intel.codeward.io.
Beyond CVE matching, that brings EPSS exploitation probability, CISA KEV membership, exploit maturity, OWASP and CWE mappings, OSADL licence compatibility, and package health and risk scoring.
Your findings will change, and in diff mode the difference can block your first PR after
upgrading. See Migrating 0.3.0 → v0.4.0.
Breaking changes
| Change | What to do |
|---|---|
| Findings differ from 0.3.0 | Expect one noisy PR; see the migration guide |
TRIVY_SKIP_DB_UPDATE ignored | Use --intel-mode local with a pre-seeded cache |
| Cache layout changed | Warm 0.3.0 caches are not reused; the first run repopulates |
A scan with no vulnerability data now exits 1 | Set intel_required: 'false' to keep the old behaviour |
| Snapshot signing digest changed | A 0.3.0 scanner rejects v0.4.0 manifests — upgrade the scanner |
New
- Four Intel modes —
api,download,local,disabled, chosen automatically from whether a token is present. No key needed for the default path. - Compressed, mirrored, signed snapshots — zstd segments (~16× on SQLite), an ordered mirror list, and Ed25519 verification that is on by default and fails hard.
- Staleness warnings — a snapshot older than 7 days marks the scan degraded.
- Package intelligence — deprecation, replacements, EOL dates, health and risk scores, trust level, malicious-package signals.
- MCP server — authoritative answers about policy syntax and vulnerability data for AI coding agents.
- Binary mode in the GitHub Action — no Docker required, checksum-verified download.
- New action inputs —
intel_token,intel_mode,intel_api,intel_required,runtime,version; plus aresults_pathoutput and automatic snapshot caching.
Fixed
- The Docker image could not be built — it copied two directories that no longer exist.
--versionreporteddevin every released build, including in Intel telemetry.- A failed Intel query produced a silent "no vulnerabilities" pass with exit code 0.
- A failed segment download reported overall success, leaving a hole in the dataset.
- A failed signature check fell through to a legacy downloader that performed no verification.
429responses were fatal instead of retried.
v0.3.0
YAML configuration, CVSS scoring, multi-source licence resolution, TOML/env/properties file validation, line-level text scanning, cross-file value references, SARIF output and SBOM export.