BREAKING CHANGE: deprecate --light option

[knqyf263]

Summary

Please remove the --light option.

Before

$ trivy image --light YOUR_IMAGE

After

$ trivy image YOUR_IMAGE

Due date

July 31, 2022

Description

We used to have two types of Trivy DB, full and lightweight. The lightweight database doesn’t contain descriptions, references, and such details so the size would be small. It could be used with --light option. But the full database is also less than 30MB now because of some optimization and is lightweight enough. We removed the lightweight database support to reduce the maintenance cost.

You will see the following warning with --light.

$ trivy image --light alpine:3.11
2022-01-31T14:18:37.618+0200    WARN    '--light' option is deprecated and will be removed. See also: https://github.com/aquasecurity/trivy/discussions/1649

The full database will be used regardless of the --light option in Trivy CLI v0.23.0 or later. The --light option will be removed after a while. Trivy CLI v0.22.0 or below still can use the lightweight database, but newly disclosed vulnerabilities will not be added after August 1, 2022. Please remove --light and migrate to the full database in v0.23.0+.

[brauznitz-ww]

This seems to have been deployed fully, not just the deprecation warning. I am getting this:

Incorrect Usage. flag provided but not defined: -light

NAME:
   trivy - A simple and comprehensive vulnerability scanner for containers

USAGE:
   trivy [global options] command [command options] target

VERSION:
   0.23.0

[knqyf263]

Please see here.
#1515