trivy-offline-vulnerability-scanning

To perform offline vulnerability scanning, you need a pre-downloaded vulnerability database placed in your cache directory. You can then run a filesystem scan on dependency lock files to identify known CVEs without internet connectivity.

Yes, you can scan package-lock.json files offline by using a pre-downloaded Trivy database. The tool applies offline-scan mode to dependency lock files to detect vulnerabilities and generate JSON reports in restricted networks.

The best way to integrate offline vulnerability scans into CI/CD pipelines is by generating structured JSON outputs. Scanning dependency lock files against a pre-downloaded database in offline-scan mode provides the structured data needed for automated security audits.

Yes, a pre-downloaded vulnerability database is required to run an offline vulnerability scan. You must place this offline Trivy database in your cache directory before scanning dependency lock files in air-gapped environments.

Offline dependency vulnerability scanning targets dependency lock files such as package-lock.json, yarn.lock, or go.sum. These files are scanned against a pre-downloaded database to identify known CVEs in offline environments.