TrivyAnalysisTaskIntegrationTest is failing for Trivy v0.54.0

[nscuro]

Current Behavior

Trivy v0.54.0 just got released, and all test cases in TrivyAnalysisTaskIntegrationTest running against latest broke:

Error:    TrivyAnalysisTaskIntegrationTest.testWithPackageWithTrivyPropertiesWithDistroWithoutOS:392 
Expecting any element of:
  []
to satisfy the given assertions requirements but none did:


Error:    TrivyAnalysisTaskIntegrationTest.testWithPackageWithTrivyProperties:301 
Expecting any element of:
  []
to satisfy the given assertions requirements but none did:


Error:    TrivyAnalysisTaskIntegrationTest.test:131 
Expecting any element of:
  []
to satisfy the given assertions requirements but none did:

Steps to Reproduce

1. Run TrivyAnalysisTaskIntegrationTest
2. Observe test failures when running against latest

Expected Behavior

The tests should not fail.

Dependency-Track Version

4.12.0-SNAPSHOT

Dependency-Track Distribution

Container Image, Executable WAR

Database Server

N/A

Database Server Version

No response

Browser

N/A

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[nscuro]

Caused by aquasecurity/trivy@7cbdb0a

vuln_type is now pkg_type:

dependency-track/src/main/java/org/dependencytrack/parser/trivy/model/Options.java

Lines 24 to 25 in e3b856f

	@SerializedName("vuln_type")
	private String[] vulnType;

Fun... Because we don't know the Trivy version at runtime, and Trivy's API doesn't have a version indicator, we'll need to send the same data for both vuln_type and pkg_type, similar to 08dfb0a

[msonnlei]

@nscuro thanks for the fix. Are you planning to backport it?

[nscuro]

@msonnlei Yes, there are a few other fixes that should be backported. So another bugfix release is justified I think.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.