This guide explains how to read and interpret the vulnerability scan reports generated by the Published Images Vulnerability Scanning workflow. It is intended for support, sales, and other non-developer audiences.

The workflow performs three types of scans on each published Docker image:

The "Trivy Vendor Data" column shows severity ratings from different security databases:

Note: Vendor severity ratings come from Trivy's database and may occasionally differ from the current assessment on the vendor's website.

After each scan, the following artifact is available for download:

• vulnerability-report-{community|secure}-{version} - Detailed markdown report with all vulnerability information

To download: Go to the workflow run > scroll to "Artifacts" section > click the download icon.

1. No vulnerabilities found - The image passed all scans with no HIGH/CRITICAL issues
2. Vulnerabilities with fixes available (✅) - These can be resolved by updating dependencies
3. Vulnerabilities without fixes (❌) - Must wait for upstream maintainers to release patches
4. Same CVE in multiple scanners - Normal; different scanners may detect the same issue

Q: Why do Trivy and Grype sometimes show different results? A: Each scanner uses different vulnerability databases and detection methods. Having multiple scanners provides more comprehensive coverage.

Q: What does "Parent JAR: (internal)" mean? A: The vulnerable component is part of Liquibase's core libraries, not a nested dependency from an extension.

Q: Why is the vendor severity different from what I see on their website? A: Trivy's database may not always be synchronized with the latest vendor assessments. The linked vendor URL shows the current rating.

Q: How often are published images scanned? A: The workflow runs Monday-Friday at 10 AM UTC, scanning the most recent tags of each image.

Q: Where can I view the scan results? A: There are two ways to view scan results:

1. Security Dashboard (recommended) — Visit Liquibase Security for an interactive view of all scan results across all versions. You can browse vulnerabilities by version, compare versions, filter by severity or component type, and export reports.
2. GitHub Actions — Go to the repository's Actions tab > "Published Images Vulnerability Scanning" workflow > select a run > view the summary or download artifacts.

Q: Can I compare vulnerabilities between two versions? A: Yes. The Version Compare page on Liquibase Security lets you select any two versions of the same image and shows which CVEs were fixed, which are new, and which are shared between them.

Q: How do I know if upgrading will fix a specific CVE? A: Each version detail page on Liquibase Security includes an "Upgrade Recommendations" section that groups fixable vulnerabilities by package and shows which upgrades would resolve the most CVEs.

Scan results from published image scans are persisted to the scan-results branch in this repository. This enables historical tracking and powers the interactive Security Dashboard.

The scan-results branch contains:

scan-results/
  manifest.json                          # Index of all scanned images and versions
  liquibase/liquibase/<version>/
    trivy-surface.json                   # OS and top-level library scan (Trivy)
    trivy-deep.json                      # Nested JAR dependency scan (Trivy)
    grype-results.json                   # SBOM-based scan (Grype)
    metadata.json                        # Scan timestamp, image digest, workflow run ID
  liquibase/liquibase-secure/<version>/
    ...

The manifest.json file is an index of all available scan data:

{
  "lastUpdated": "2026-03-10T10:00:00Z",
  "images": {
    "liquibase/liquibase": ["5.0.1", "5.0.0", "4.31.0"],
    "liquibase/liquibase-secure": ["5.0.1", "5.0.0"]
  }
}

Vulnerabilities are classified by component type to help identify the source:

• Vulnerability Scanning Scripts - Technical documentation for developers
• Trivy Documentation - Official Trivy scanner documentation
• Grype Documentation - Official Grype scanner documentation
• NVD - National Vulnerability Database