@codacy/tools-trivy-0 0.16.0 → 0.18.0

package/README.md

@@ -4,6 +4,12 @@
 
 - [Overview](#overview)
 - [Umbrella patterns](#umbrella-patterns)
+- [Issue parity with `codacy-trivy`](#issue-parity-with-codacy-trivy)
+  - [`sourceId` — why every issue carries its CVE](#sourceid--why-every-issue-carries-its-cve)
+  - [Scan flags that affect what is found](#scan-flags-that-affect-what-is-found)
+  - [Line-number resolution](#line-number-resolution)
+  - [Fix version](#fix-version)
+  - [Known divergences](#known-divergences)
 - [DB update management](#db-update-management)
 - [Malicious package detection](#malicious-package-detection)
 - [Updating patterns](#updating-patterns)
@@ -40,6 +46,113 @@ Trivy uses umbrella patterns rather than individual CVE patterns:
 | `Trivy_secret`                 | Error    | Hardcoded secrets                    |
 | `Trivy_malicious_packages`     | Error    | Malicious packages (via OSV.dev API) |
 
+## Issue parity with `codacy-trivy`
+
+Codacy Cloud analyses repositories with the `codacy-trivy` Docker engine, so a
+repository scanned locally and uploaded must produce the same results as the same
+repository scanned on the cloud. Three pieces of this adapter exist only to hold
+that line; the reference implementation is `codacy-trivy`
+`internal/tool/tool.go`, and the ports live in `src/vuln-mapping.ts`
+(`fallbackSearchForLineNumber`, `findLeastDisruptiveFixedVersion`,
+`purlPrettyPrint`). **Change them only alongside that file.**
+
+### `sourceId` — why every issue carries its CVE
+
+Codacy derives a result's deterministic UUID from an MD5 over four keys: filename,
+pattern id, the line's text with whitespace stripped, and `sourceId`
+(`codacy-worker` `shared/rules/…/rules/components/ResultUUIDRules.scala`).
+
+Trivy reports many CVEs under one of four severity umbrella patterns, so two CVEs
+on the same lockfile line share three of those four keys. **Without `sourceId`
+they collapse into a single Codacy result.** Every issue this adapter produces
+therefore sets it:
+
+| Finding           | `sourceId`                    |
+| ----------------- | ----------------------------- |
+| Vulnerability     | `VulnerabilityID` (the CVE)   |
+| Secret            | Trivy's `RuleID`              |
+| Malicious package | The OSV advisory id (`MAL-…`) |
+
+`src/metadata.ts` sets `needsSourceIdUpload: true`, which is what makes
+`upload` include the field in the v2 payload (mirroring
+`needs_source_id_upload` in the Go CLI's Trivy plugin manifest). Adapters without
+the flag omit the field entirely — sending it where the cloud engine does not
+would give the same finding a different UUID.
+
+### Scan flags that affect what is found
+
+The vulnerability scan passes **`--detection-priority comprehensive`**, matching
+`codacy-trivy`'s `DetectionPriority: PriorityComprehensive`. It reports more
+vulnerabilities — some of which may be false positives — and it is **required for Go
+standard-library findings**: verified against trivy 0.70, a `go.mod` scan without it
+reports **zero** `stdlib` vulnerabilities (6 issues instead of 26 on a small
+`go 1.20` module). Removing the flag would silently drop every stdlib finding and
+make the go.mod handling below dead code.
+
+### Line-number resolution
+
+Trivy reports **no line** for a vulnerable dependency, so the line is reconstructed:
+
+1. Look up the package's `Locations[0].StartLine`, **keyed by PURL** — the key the
+   cloud engine uses. `PkgID` is a secondary key for the rare package Trivy reports
+   without a PURL.
+2. On a miss or a zero, scan the manifest top to bottom for the first line whose
+   trimmed text contains the package name.
+3. Still nothing ⇒ emit a **file-level error** (`Line numbers not supported`,
+   deduplicated to one per file), not an issue on line 1. A confidently wrong
+   location is worse than an honest "unknown"; `codacy-trivy` makes the same call
+   via `mapIssuesWithoutLineNumber`.
+
+**go.mod standard library.** Trivy reports standard-library vulnerabilities against
+a package named `stdlib`, which never literally appears in `go.mod`. Trivy
+[documents](https://trivy.dev/v0.59/docs/coverage/language/golang/#gomod-stdlib)
+using the minimum of the `toolchain` and `go` directives, but in practice always
+uses `toolchain` when it exists. So the scan returns the `toolchain` line as soon
+as it sees one, and only falls back to the `go` directive line after reading the
+whole file. This is not derivable from Trivy's docs — do not "simplify" it.
+
+### Fix version
+
+Trivy's `FixedVersion` is a comma-separated **list** of every fixing version
+(`"1.9.0, 1.10.0, 2.0.1"`). The message reports only the least disruptive one: the
+smallest candidate strictly greater than the installed version, by semantic
+version. When no candidate is greater (or the scheme isn't semver — Ruby's `~>`,
+Maven qualifiers), Trivy's raw value is passed through; when `FixedVersion` is
+empty the message reads `(no fix available)`.
+
+Message format, matching the cloud engine verbatim:
+
+```
+Insecure dependency {pretty-printed PURL} ({CVE}: {title}) (update to {version})
+Insecure dependency {pretty-printed PURL} ({CVE}: {title}) (no fix available)
+```
+
+Comparison uses a port of Go's `golang.org/x/mod/semver` (`compareSemver`), not
+npm semver: it accepts two-component versions like `v1.2`, and treats an
+unparseable version as lower than any valid one, which is what makes non-semver
+schemes fall through instead of being ranked.
+
+### Known divergences
+
+Both are deliberate; see `docs/tech-debt.md`.
+
+- **Fix-version ordering.** `codacy-trivy` sorts the candidate strings _before_
+  adding the `v` prefix, so `x/mod/semver` sees them all as invalid, compares them
+  equal, and falls back to a lexicographic tiebreak — picking `1.10.0` over
+  `1.9.0`. We sort on the prefixed values and return the genuinely smallest.
+- **Packages without a PURL.** `codacy-trivy` skips those vulnerabilities entirely.
+  We keep them, resolving the line by name and rendering the package as
+  `name@version`, because silently dropping a real vulnerability is worse than a
+  message that differs from the cloud's.
+- **Secret message text.** Ours appends the secret's category
+  (`Possible hardcoded secret: {title} ({category})`); the cloud engine stops at
+  the title.
+- **Offline scan.** `codacy-trivy` sets `OfflineScan: true` (its container is
+  air-gapped); we don't, so Trivy may resolve some Java/Maven dependencies over the
+  network and report slightly more accurate results for those ecosystems. Not
+  changed here: making local scans less accurate to match an air-gap constraint we
+  don't have would be the wrong trade.
+
 ## DB update management
 
 The adapter reads Trivy's `metadata.json` (at `{cacheDir}/db/metadata.json`) to
@@ -89,11 +202,12 @@ pnpm test     # Run tests (requires trivy in PATH or auto-install)
 
 ## Notes for maintainers
 
-- Trivy runs **two separate scan invocations**: one for vulnerabilities (`--scanners vuln`) and one for secrets (`--scanners secret`). Malicious package detection piggybacks on the vuln scan output (no extra invocation). Which scans run depends on which umbrella patterns are enabled.
+- Trivy runs **two separate scan invocations**: one for vulnerabilities (`--scanners vuln --detection-priority comprehensive`) and one for secrets (`--scanners secret`). Malicious package detection piggybacks on the vuln scan output (no extra invocation). Which scans run depends on which umbrella patterns are enabled.
 - The vulnerability database is downloaded lazily on first run to `--cache-dir ~/.codacy/cache/trivy/`. Internet access is required on first use. DB staleness is managed via `metadata.json` → `NextUpdate`.
 - Trivy scans **whole directories**, not individual files. Results are filtered to `ctx.targetFiles` after scanning.
 - The binary is downloaded from GitHub releases as a `.tar.gz` archive.
 - Vulnerability severity (CRITICAL/HIGH/MEDIUM/LOW) maps to the corresponding umbrella pattern.
-- Message format: `Insecure dependency {pkg}@{version} ({CVE}: {title}). Update to {fixedVersion}.`
+- Message format, line resolution and `sourceId` are all parity-critical — see [Issue parity with `codacy-trivy`](#issue-parity-with-codacy-trivy) before touching them.
+- A vulnerability whose line cannot be resolved becomes a file-level `AnalysisError` (`kind: "LineNumbersNotSupported"`), one per file, rather than an issue on line 1.
 - Malicious package detection uses the OSV.dev batch API. On failure, it degrades gracefully (warning only).
 - Config file: checks for `trivy.yaml` in the repo root.

package/dist/index.js

@@ -252,9 +252,120 @@ var descriptor = {
   filePatterns: ["*"],
   supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],
-  supportedRunners: ["local", "container"]
+  supportedRunners: ["local", "container"],
+  // Trivy reports every CVE under one of four severity umbrella patterns, so its
+  // issues must upload `sourceId` (the CVE id) or two CVEs on the same manifest
+  // line collapse into a single Codacy result. Matches `needs_source_id_upload`
+  // in the Go CLI's Trivy plugin manifest.
+  needsSourceIdUpload: true
 };
 
+// src/vuln-mapping.ts
+function purlPrettyPrint(purl) {
+  const stripped = purl.startsWith("pkg:") ? purl.slice("pkg:".length) : purl;
+  try {
+    return decodeURIComponent(stripped);
+  } catch {
+    return stripped;
+  }
+}
+function fallbackSearchForLineNumber(lines, fileName, pkgName) {
+  if (!pkgName) return 0;
+  const isGoModStdLib = fileName.endsWith("go.mod") && pkgName === "stdlib";
+  let goDirectiveLine = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const lineText = lines[i].trim();
+    const lineNumber = i + 1;
+    if (isGoModStdLib) {
+      if (lineText.startsWith("toolchain ")) return lineNumber;
+      if (lineText.startsWith("go ")) goDirectiveLine = lineNumber;
+    } else if (lineText.includes(pkgName)) {
+      return lineNumber;
+    }
+  }
+  return goDirectiveLine;
+}
+function findLeastDisruptiveFixedVersion(installedVersion, fixedVersion) {
+  const sanitize = (version) => `v${version.replace(/^v/, "")}`;
+  const sanitizedInstalled = sanitize(installedVersion);
+  const candidates = fixedVersion.split(",").map((v) => v.trim()).filter((v) => compareSemver(sanitize(v), sanitizedInstalled) > 0);
+  if (candidates.length === 0) return fixedVersion;
+  candidates.sort(
+    (a, b) => compareSemver(sanitize(a), sanitize(b)) || (a < b ? -1 : a > b ? 1 : 0)
+  );
+  return candidates[0];
+}
+function compareSemver(v, w) {
+  const pv = parseSemver(v);
+  const pw = parseSemver(w);
+  if (!pv && !pw) return 0;
+  if (!pv) return -1;
+  if (!pw) return 1;
+  return compareNumeric(pv.major, pw.major) || compareNumeric(pv.minor, pw.minor) || compareNumeric(pv.patch, pw.patch) || comparePrerelease(pv.prerelease, pw.prerelease);
+}
+var NUMERIC_IDENT = /^(0|[1-9]\d*)$/;
+var ALPHANUMERIC_IDENT = /^[0-9A-Za-z-]+$/;
+function parseSemver(version) {
+  if (!version.startsWith("v")) return null;
+  let rest = version.slice(1);
+  const plusIndex = rest.indexOf("+");
+  if (plusIndex >= 0) {
+    const build = rest.slice(plusIndex + 1);
+    rest = rest.slice(0, plusIndex);
+    if (!isValidDotSeparated(build, false)) return null;
+  }
+  let prerelease = "";
+  const dashIndex = rest.indexOf("-");
+  if (dashIndex >= 0) {
+    prerelease = rest.slice(dashIndex);
+    rest = rest.slice(0, dashIndex);
+    if (!isValidDotSeparated(prerelease.slice(1), true)) return null;
+  }
+  const parts = rest.split(".");
+  if (parts.length > 3) return null;
+  if (!parts.every((p) => NUMERIC_IDENT.test(p))) return null;
+  return {
+    major: parts[0],
+    minor: parts[1] ?? "0",
+    patch: parts[2] ?? "0",
+    prerelease
+  };
+}
+function isValidDotSeparated(value, isPrerelease) {
+  if (value === "") return false;
+  return value.split(".").every((ident) => {
+    if (!ALPHANUMERIC_IDENT.test(ident)) return false;
+    if (isPrerelease && /^\d+$/.test(ident) && !NUMERIC_IDENT.test(ident)) return false;
+    return true;
+  });
+}
+function compareNumeric(x, y) {
+  if (x === y) return 0;
+  if (x.length !== y.length) return x.length < y.length ? -1 : 1;
+  return x < y ? -1 : 1;
+}
+function comparePrerelease(x, y) {
+  if (x === y) return 0;
+  if (x === "") return 1;
+  if (y === "") return -1;
+  const xs = x.slice(1).split(".");
+  const ys = y.slice(1).split(".");
+  for (let i = 0; i < Math.min(xs.length, ys.length); i++) {
+    const dx = xs[i];
+    const dy = ys[i];
+    if (dx === dy) continue;
+    const nx = /^\d+$/.test(dx);
+    const ny = /^\d+$/.test(dy);
+    if (nx !== ny) return nx ? -1 : 1;
+    if (nx) {
+      const byLength = compareNumeric(dx, dy);
+      if (byLength !== 0) return byLength;
+    }
+    return dx < dy ? -1 : 1;
+  }
+  return xs.length < ys.length ? -1 : 1;
+}
+
 // src/adapter.ts
 var TOOL_ID = "Trivy";
 var PATTERN_META = new Map(
@@ -403,9 +514,23 @@ async function runTrivyScan(binary, args, cwd, errors) {
     return null;
   }
 }
-async function parseVulnerabilities(output, enabledPatterns, targetFilesSet, repositoryRoot) {
+var LINE_NUMBERS_NOT_SUPPORTED = "Line numbers not supported";
+function recordUnlocatableFinding(errors, seenFiles, filePath) {
+  if (seenFiles.has(filePath)) return;
+  seenFiles.add(filePath);
+  errors.push({
+    toolId: TOOL_ID,
+    phase: "outputParse",
+    kind: "LineNumbersNotSupported",
+    message: LINE_NUMBERS_NOT_SUPPORTED,
+    level: "warning",
+    filePath
+  });
+}
+async function parseVulnerabilities(output, enabledPatterns, targetFilesSet, repositoryRoot, unlocatableFiles) {
   const issues = [];
-  if (!output.Results) return issues;
+  const errors = [];
+  if (!output.Results) return { issues, errors };
   const linesCache = /* @__PURE__ */ new Map();
   for (const result of output.Results) {
     if (!result.Vulnerabilities) continue;
@@ -415,14 +540,21 @@ async function parseVulnerabilities(output, enabledPatterns, targetFilesSet, rep
       linesCache.set(relPath, await (0, import_tooling.readFileLines)(import_path.default.join(repositoryRoot, relPath)));
     }
     const lines = linesCache.get(relPath);
-    const pkgLineByID = /* @__PURE__ */ new Map();
-    if (result.Packages) {
-      for (const pkg of result.Packages) {
-        if (pkg.Locations && pkg.Locations.length > 0 && pkg.Locations[0].StartLine > 0) {
-          pkgLineByID.set(pkg.ID, pkg.Locations[0].StartLine);
-        }
-      }
+    const lineByPurl = /* @__PURE__ */ new Map();
+    const lineByPkgId = /* @__PURE__ */ new Map();
+    for (const pkg of result.Packages ?? []) {
+      const startLine = pkg.Locations?.[0]?.StartLine ?? 0;
+      if (pkg.Identifier?.PURL) lineByPurl.set(pkg.Identifier.PURL, startLine);
+      if (pkg.ID) lineByPkgId.set(pkg.ID, startLine);
     }
+    const fallbackLines = /* @__PURE__ */ new Map();
+    const resolveFallbackLine = (pkgName) => {
+      const cached = fallbackLines.get(pkgName);
+      if (cached !== void 0) return cached;
+      const found = fallbackSearchForLineNumber(lines, relPath, pkgName);
+      fallbackLines.set(pkgName, found);
+      return found;
+    };
     for (const vuln of result.Vulnerabilities) {
       const patternId = VULN_SEVERITY_TO_PATTERN[vuln.Severity];
       if (!patternId) continue;
@@ -431,23 +563,34 @@ async function parseVulnerabilities(output, enabledPatterns, targetFilesSet, rep
         category: "Security",
         severity: "Info"
       };
-      const title = vuln.Title ? `: ${vuln.Title}` : "";
-      const fix = vuln.FixedVersion ? `Update to ${vuln.FixedVersion}.` : "No fix available.";
-      const line = vuln.PkgID && pkgLineByID.get(vuln.PkgID) || 1;
+      const purl = vuln.PkgIdentifier?.PURL;
+      const reportedLine = (purl !== void 0 ? lineByPurl.get(purl) : void 0) ?? (vuln.PkgID !== void 0 ? lineByPkgId.get(vuln.PkgID) : void 0) ?? 0;
+      const line = reportedLine > 0 ? reportedLine : resolveFallbackLine(vuln.PkgName);
+      if (line <= 0) {
+        recordUnlocatableFinding(errors, unlocatableFiles, relPath);
+        continue;
+      }
+      const fixedVersion = findLeastDisruptiveFixedVersion(
+        vuln.InstalledVersion,
+        vuln.FixedVersion ?? ""
+      );
+      const fix = fixedVersion ? `(update to ${fixedVersion})` : "(no fix available)";
+      const pkgLabel = purl ? purlPrettyPrint(purl) : `${vuln.PkgName}@${vuln.InstalledVersion}`;
       issues.push({
         filePath: relPath,
         patternId,
         toolId: TOOL_ID,
         line,
         column: 1,
-        message: `Insecure dependency ${vuln.PkgName}@${vuln.InstalledVersion} (${vuln.VulnerabilityID}${title}). ${fix}`,
+        message: `Insecure dependency ${pkgLabel} (${vuln.VulnerabilityID}: ${vuln.Title ?? ""}) ${fix}`,
         lineContent: (0, import_tooling.getLineContent)(lines, line),
         category: meta.category,
-        severity: meta.severity
+        severity: meta.severity,
+        ...vuln.VulnerabilityID ? { sourceId: vuln.VulnerabilityID } : {}
       });
     }
   }
-  return issues;
+  return { issues, errors };
 }
 async function parseSecrets(output, enabledPatterns, targetFilesSet, repositoryRoot) {
   const issues = [];
@@ -479,13 +622,14 @@ async function parseSecrets(output, enabledPatterns, targetFilesSet, repositoryR
         lineContent: (0, import_tooling.getLineContent)(lines, secret.StartLine),
         multilineContent: (0, import_tooling.getMultilineContent)(lines, secret.StartLine, secret.EndLine),
         category: meta.category,
-        severity: meta.severity
+        severity: meta.severity,
+        ...secret.RuleID ? { sourceId: secret.RuleID } : {}
       });
     }
   }
   return issues;
 }
-async function parseMaliciousPackages(output, enabledPatterns, targetFilesSet, repositoryRoot, logger) {
+async function parseMaliciousPackages(output, enabledPatterns, targetFilesSet, repositoryRoot, logger, unlocatableFiles) {
   const issues = [];
   const errors = [];
   const patternId = "Trivy_malicious_packages";
@@ -509,8 +653,13 @@ async function parseMaliciousPackages(output, enabledPatterns, targetFilesSet, r
       const key = `${ecosystem}:${pkg.Name}:${pkg.Version}:${relPath}`;
       if (seen.has(key)) continue;
       seen.add(key);
-      const line = pkg.Locations && pkg.Locations.length > 0 && pkg.Locations[0].StartLine > 0 ? pkg.Locations[0].StartLine : 1;
-      packages.push({ ecosystem, name: pkg.Name, version: pkg.Version, filePath: relPath, line });
+      packages.push({
+        ecosystem,
+        name: pkg.Name,
+        version: pkg.Version,
+        filePath: relPath,
+        reportedLine: pkg.Locations?.[0]?.StartLine ?? 0
+      });
     }
   }
   if (packages.length === 0) return { issues, errors };
@@ -564,18 +713,24 @@ async function parseMaliciousPackages(output, enabledPatterns, targetFilesSet, r
       linesCache.set(pkg.filePath, await (0, import_tooling.readFileLines)(import_path.default.join(repositoryRoot, pkg.filePath)));
     }
     const lines = linesCache.get(pkg.filePath);
+    const line = pkg.reportedLine > 0 ? pkg.reportedLine : fallbackSearchForLineNumber(lines, pkg.filePath, pkg.name);
+    if (line <= 0) {
+      recordUnlocatableFinding(errors, unlocatableFiles, pkg.filePath);
+      continue;
+    }
     for (const vuln of malVulns) {
       const summary = vuln.summary ? ` ${vuln.summary}` : "";
       issues.push({
         filePath: pkg.filePath,
         patternId,
         toolId: TOOL_ID,
-        line: pkg.line,
+        line,
         column: 1,
         message: `Malicious package detected: ${pkg.name}@${pkg.version} (${vuln.id}).${summary}`,
-        lineContent: (0, import_tooling.getLineContent)(lines, pkg.line),
+        lineContent: (0, import_tooling.getLineContent)(lines, line),
         category: meta.category,
-        severity: meta.severity
+        severity: meta.severity,
+        ...vuln.id ? { sourceId: vuln.id } : {}
       });
     }
   }
@@ -742,6 +897,7 @@ var adapter = {
     }
     const enabledPatterns = new Set(codacyConfig.patterns.map((p) => p.patternId));
     const targetFilesSet = new Set(ctx.targetFiles);
+    const unlocatableFiles = /* @__PURE__ */ new Set();
     const vulnPatternIds = Object.values(VULN_SEVERITY_TO_PATTERN);
     const runMaliciousScan = enabledPatterns.size === 0 || enabledPatterns.has("Trivy_malicious_packages");
     const runVulnScan = enabledPatterns.size === 0 || vulnPatternIds.some((id) => enabledPatterns.has(id)) || runMaliciousScan;
@@ -776,7 +932,14 @@ var adapter = {
           "vuln",
           "--pkg-types",
           "library",
-          "--list-all-pkgs"
+          "--list-all-pkgs",
+          // Matches codacy-trivy's `DetectionPriority: PriorityComprehensive`.
+          // Detects more vulnerabilities, potentially including some false positives
+          // — and it is REQUIRED for Go standard-library findings: without it Trivy
+          // reports zero `stdlib` vulnerabilities, so a go.mod scan silently misses
+          // every one of them and reports a fraction of the cloud's issue count.
+          "--detection-priority",
+          "comprehensive"
         ];
         const severities = [];
         if (enabledPatterns.size === 0) {
@@ -794,21 +957,23 @@ var adapter = {
         vulnArgs.push(ctx.repositoryRoot);
         const vulnOutput = await runTrivyScan(binary, vulnArgs, ctx.repositoryRoot, errors);
         if (vulnOutput) {
-          issues.push(
-            ...await parseVulnerabilities(
-              vulnOutput,
-              enabledPatterns,
-              targetFilesSet,
-              ctx.repositoryRoot
-            )
+          const vulnResult = await parseVulnerabilities(
+            vulnOutput,
+            enabledPatterns,
+            targetFilesSet,
+            ctx.repositoryRoot,
+            unlocatableFiles
           );
+          issues.push(...vulnResult.issues);
+          errors.push(...vulnResult.errors);
           if (runMaliciousScan && ctx.runner !== "container") {
             const malResult = await parseMaliciousPackages(
               vulnOutput,
               enabledPatterns,
               targetFilesSet,
               ctx.repositoryRoot,
-              ctx.logger
+              ctx.logger,
+              unlocatableFiles
             );
             issues.push(...malResult.issues);
             errors.push(...malResult.errors);

package/dist/metadata.js

@@ -44,7 +44,12 @@ var descriptor = {
   filePatterns: ["*"],
   supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],
-  supportedRunners: ["local", "container"]
+  supportedRunners: ["local", "container"],
+  // Trivy reports every CVE under one of four severity umbrella patterns, so its
+  // issues must upload `sourceId` (the CVE id) or two CVEs on the same manifest
+  // line collapse into a single Codacy result. Matches `needs_source_id_upload`
+  // in the Go CLI's Trivy plugin manifest.
+  needsSourceIdUpload: true
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-trivy-0",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Trivy adapter — CLI-mode security scanner",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.16.0"
+    "@codacy/tooling": "0.18.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",