aquasecurity/trivy

Dependencies

Trivy is a Go module (github.com/aquasecurity/trivy). The full list of direct and transitive dependencies is in go.mod (~~510 lines) and go.sum (~~148,000 lines). This page groups the most important dependencies by purpose to help readers locate the libraries Trivy uses for each subsystem.

CLI and configuration

Library	Purpose	Used in
`github.com/spf13/cobra`	Command tree	`pkg/commands/`
`github.com/spf13/pflag`	POSIX flag parsing	`pkg/flag/`
`github.com/spf13/viper`	Config and env-var binding	`pkg/flag/`
`github.com/spf13/cast`	Type coercion	`pkg/flag/`
`github.com/BurntSushi/toml`	TOML parsing	various
`gopkg.in/yaml.v3`	YAML parsing	many

Container images and registries

Library	Purpose	Used in
`github.com/google/go-containerregistry`	OCI/Docker registry client	`pkg/fanal/image/`
`github.com/containerd/containerd/v2`	Containerd v2 client	`pkg/fanal/image/`
`github.com/docker/cli`	Docker auth helpers	`pkg/fanal/image/`
`github.com/moby/buildkit`	Buildkit metadata	`pkg/fanal/image/`
`github.com/distribution/reference`	Image reference parsing	many
`github.com/opencontainers/go-digest`, `image-spec`	OCI spec types	many

SBOM and security exchange formats

Library	Purpose	Used in
`github.com/CycloneDX/cyclonedx-go`	CycloneDX read/write	`pkg/sbom/cyclonedx/`
`github.com/spdx/tools-golang`	SPDX read/write	`pkg/sbom/spdx/`
`github.com/openvex/go-vex`	OpenVEX read/write	`pkg/vex/`
`github.com/openvex/discovery`	VEX discovery	`pkg/vex/`
`github.com/gocsaf/csaf/v3`	CSAF/VEX	`pkg/vex/csaf.go`
`github.com/package-url/packageurl-go`	PURL identifiers	many
`github.com/in-toto/in-toto-golang`	In-toto attestations	`pkg/attestation/`
`github.com/sigstore/rekor`	Rekor transparency log	`pkg/rekor/`

Vulnerability and license data

Library	Purpose	Used in
`github.com/aquasecurity/trivy-db`	Vulnerability DB schema and types	`pkg/db/`
`github.com/aquasecurity/trivy-java-db`	Java DB schema	`pkg/javadb/`
`github.com/aquasecurity/trivy-checks`	Built-in Rego policies (embedded)	`pkg/iac/rego/`
`github.com/aquasecurity/trivy-kubernetes`	Kubernetes inventory	`pkg/k8s/`
`github.com/google/licenseclassifier/v2`	License classification	`pkg/licensing/`
`golang.org/x/vuln`	govulncheck integration	`pkg/detector/library/golang/`

IaC engine

Library	Purpose	Used in
`github.com/open-policy-agent/opa`	Rego runtime	`pkg/iac/rego/`
`github.com/hashicorp/hcl/v2`	HCL parser	`pkg/iac/scanners/terraform/`
`github.com/hashicorp/terraform-exec`	Terraform binary execution	`pkg/iac/scanners/terraformplan/`
`github.com/hashicorp/hc-install`	Terraform installer	`pkg/iac/scanners/terraformplan/`
`github.com/zclconf/go-cty`, `go-cty-yaml`	HCL types	`pkg/iac/scanners/terraform/`
`helm.sh/helm/v3`	Helm chart rendering	`pkg/iac/scanners/helm/`
`k8s.io/api`, `k8s.io/utils`	Kubernetes types	`pkg/iac/scanners/kubernetes/`, `pkg/k8s/`

Cloud SDKs (used by IaC adapters and registry auth)

Library	Purpose
`github.com/aws/aws-sdk-go-v2` (+ services: `ec2`, `ecr`, `s3`, etc.)	AWS API access for cloud-shaped scans and registry auth.
`github.com/Azure/azure-sdk-for-go`	Azure API + ACR auth.
`github.com/GoogleCloudPlatform/docker-credential-gcr/v2`	GCR auth helper.

Storage and serialization

Library	Purpose
`go.etcd.io/bbolt`	Embedded key-value store for the cache and DB.
`modernc.org/sqlite`	Pure-Go SQLite (RPM and Java DB).
`github.com/go-redis/redis/v8`	Redis cache backend.
`google.golang.org/protobuf`	Protobuf runtime for RPC.
`github.com/twitchtv/twirp`	Twirp RPC framework.

Filesystem and VM image readers

Library	Purpose
`github.com/masahiro331/go-disk`	Disk image dispatch.
`github.com/masahiro331/go-ebs-file`	AWS EBS snapshot streams.
`github.com/masahiro331/go-ext4-filesystem`	ext4 reader.
`github.com/masahiro331/go-xfs-filesystem`	XFS reader.
`github.com/masahiro331/go-vmdk-parser`	VMDK reader.
`github.com/sassoftware/go-rpmutils`	RPM archive reader.
`github.com/knqyf263/go-rpmdb`	RPM database reader.

Concurrency and utilities

Library	Purpose
`golang.org/x/sync`	`errgroup`, `semaphore`.
`golang.org/x/xerrors`	Error wrapping (used pervasively).
`github.com/samber/lo`	Functional helpers.
`github.com/hashicorp/go-multierror`	Aggregate errors.
`github.com/cenkalti/backoff/v4`	Retry/backoff.
`github.com/google/uuid`	UUID v4.
Internal `pkg/uuid`	UUIDv7 generation for `ReportID`.

WebAssembly

Library	Purpose
`github.com/tetratelabs/wazero`	Pure-Go WASM runtime for modules.

Testing

Library	Purpose
`github.com/stretchr/testify`	Assertions and mocks.
`github.com/google/go-cmp`	Deep equality.
`github.com/spf13/afero`	In-memory filesystem.
`github.com/testcontainers/testcontainers-go`	Real-container tests.
`github.com/aquasecurity/testdocker`, `bolt-fixtures`	Project-specific test helpers.

Aqua-owned dependencies

Trivy depends on several smaller libraries owned by Aqua Security:

github.com/aquasecurity/go-version — version comparison.
github.com/aquasecurity/go-gem-version, go-npm-version, go-pep440-version — language-specific version comparison.
github.com/aquasecurity/iamgo — IAM policy reader.
github.com/aquasecurity/table — table renderer (used by the table writer).
github.com/aquasecurity/tml — terminal markup.
github.com/aquasecurity/trivy-db, trivy-java-db, trivy-checks, trivy-kubernetes — already covered above.