Support CycloneDX 1.7 SBOMs

[candrews]

Description

Trivy doesn't currently support CycloneDX 1.7 SBOMs, failing with an error when an attempt is made to process one.

The CycloneDX 1.7 specification was published October 21, 2025: https://github.com/CycloneDX/specification/releases/tag/1.7

Example CycloneDX 1.7 SBOM:
merged.cdx.json

Desired Behavior

Trivy should support CycloneDX 1.7 SBOMs.

Actual Behavior

$ trivy sbom merged.cdx.json
FATAL	Fatal error	run error: sbom scan error: scan error: scan failed: failed analysis: SBOM decode error: failed to decode: CycloneDX decode error: CycloneDX decode error: invalid specification version

Reproduction Steps

1. trivy sbom merged.cdx.json

Target

SBOM

Scanner

Vulnerability

Output Format

None

Mode

Standalone

Debug Output

$ trivy sbom merged.cdx.json --debug
2026-02-10T16:56:30-05:00	DEBUG	No plugins loaded
2026-02-10T16:56:30-05:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2026-02-10T16:56:30-05:00	DEBUG	Cache dir	dir="/home/candrews/.cache/trivy"
2026-02-10T16:56:30-05:00	DEBUG	Cache dir	dir="/home/candrews/.cache/trivy"
2026-02-10T16:56:30-05:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2026-02-10T16:56:30-05:00	DEBUG	Ignore statuses	statuses=[]
2026-02-10T16:56:30-05:00	DEBUG	DB update was skipped because the local DB is the latest
2026-02-10T16:56:30-05:00	DEBUG	DB info	schema=2 updated_at=2026-02-10T18:45:00.479326566Z next_update=2026-02-11T18:45:00.479326385Z downloaded_at=2026-02-10T21:55:50.062849681Z
2026-02-10T16:56:30-05:00	DEBUG	[pkg] Package types	types=[os library]
2026-02-10T16:56:30-05:00	DEBUG	[pkg] Package relationships	relationships=[unknown root workspace direct indirect]
2026-02-10T16:56:30-05:00	INFO	[vuln] Vulnerability scanning is enabled
2026-02-10T16:56:30-05:00	DEBUG	Initializing scan cache...	type="memory"
2026-02-10T16:56:30-05:00	DEBUG	[notification] Running version check
2026-02-10T16:56:30-05:00	INFO	Detected SBOM format	format="cyclonedx-json"
2026-02-10T16:56:30-05:00	DEBUG	Unmarshalling CycloneDX JSON...
2026-02-10T16:56:30-05:00	FATAL	Fatal error
  - run error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.Run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:411
  - sbom scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.run
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:452
  - scan error:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scanArtifact
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:304
  - scan failed:
    github.com/aquasecurity/trivy/pkg/commands/artifact.(*runner).scan
        /home/runner/work/trivy/trivy/pkg/commands/artifact/run.go:706
  - failed analysis:
    github.com/aquasecurity/trivy/pkg/scan.Service.ScanArtifact
        /home/runner/work/trivy/trivy/pkg/scan/service.go:54
  - SBOM decode error:
    github.com/aquasecurity/trivy/pkg/fanal/artifact/sbom.Artifact.Inspect
        /home/runner/work/trivy/trivy/pkg/fanal/artifact/sbom/sbom.go:59
  - failed to decode:
    github.com/aquasecurity/trivy/pkg/sbom.Decode
        /home/runner/work/trivy/trivy/pkg/sbom/sbom.go:337
  - CycloneDX decode error:
    github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.(*BOM).UnmarshalJSON
        /home/runner/work/trivy/trivy/pkg/sbom/cyclonedx/unmarshal.go:46
  - CycloneDX decode error:
    github.com/aquasecurity/trivy/pkg/sbom/cyclonedx.DecodeJSON
        /home/runner/work/trivy/trivy/pkg/sbom/cyclonedx/unmarshal.go:33
  - invalid specification version
[1]

Operating System

Linux

Version

$ trivy --version
Version: 0.69.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2026-02-10 18:45:00.479326566 +0000 UTC
  NextUpdate: 2026-02-11 18:45:00.479326385 +0000 UTC
  DownloadedAt: 2026-02-10 21:55:50.062849681 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @candrews
Thanks for your report!

cyclonedx-go doesn't currently support 1.7.
We will try to update this package as quickly as possible immediately after they add support for 1.7.

Related issue - #10185

Regards, Dmitriy