chore(deps): bump github.com/aquasecurity/trivy from 0.20.0 to 0.22.0

.gitignore

@@ -10,7 +10,6 @@ issues/
 vendor/
 log/
 results
-!integration/data/results
 config.toml
 !setup/docker/*
 .DS_Store

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "integration"]
+	path = integration
+	url = https://github.com/vulsio/integration

GNUmakefile

@@ -91,7 +91,7 @@ NOW=$(shell date --iso-8601=seconds)
 NOW_JSON_DIR := '${BASE_DIR}/$(NOW)'
 ONE_SEC_AFTER=$(shell date -d '+1 second' --iso-8601=seconds)
 ONE_SEC_AFTER_JSON_DIR := '${BASE_DIR}/$(ONE_SEC_AFTER)'
-LIBS := 'gemfile' 'pipfile' 'poetry' 'composer' 'packagelock' 'yarn' 'cargo' 'gomod' 'nvd_exact' 'nvd_rough' 'nvd_vendor_product' 'nvd_match_no_jvn' 'jvn_vendor_product' 'jvn_vendor_product_nover'
+LIBS := 'bundler' 'pip' 'pipenv' 'poetry' 'composer' 'npm' 'yarn' 'cargo' 'gomod' 'gobinary' 'jar' 'pom' 'nuget-lock' 'nuget-config' 'nvd_exact' 'nvd_rough' 'nvd_vendor_product' 'nvd_match_no_jvn' 'jvn_vendor_product' 'jvn_vendor_product_nover'
 
 diff:
 	# git clone git@github.com:vulsio/vulsctl.git
@@ -208,6 +208,9 @@ build-integration:
 	git stash apply stash@\{0\}
 	make build
 
+	# update integration data
+	git submodule update --remote
+
 	# for integration testing, vuls.new and vuls.old needed.
 	# ex)
 	# $ ln -s ./vuls ./vuls.new

contrib/trivy/pkg/converter.go

@@ -218,6 +218,7 @@ func IsTrivySupportedLib(typestr string) bool {
 		ftypes.NodePkg:   struct{}{},
 		ftypes.Yarn:      struct{}{},
 		ftypes.Jar:       struct{}{},
+		ftypes.Pom:       struct{}{},
 		ftypes.GoBinary:  struct{}{},
 		ftypes.GoMod:     struct{}{},
 	}

go.mod

@@ -7,11 +7,12 @@ require (
 	github.com/BurntSushi/toml v0.4.1
 	github.com/Ullaakut/nmap/v2 v2.1.2-0.20210406060955-59a52fe80a4f
 	github.com/VividCortex/ewma v1.2.0 // indirect
-	github.com/aquasecurity/fanal v0.0.0-20211005172059-69527b46560c
-	github.com/aquasecurity/trivy v0.20.0
+	github.com/aquasecurity/fanal v0.0.0-20211224205755-c94f68b6d71a
+	github.com/aquasecurity/go-dep-parser v0.0.0-20220110153540-4a30ebc4b509
+	github.com/aquasecurity/trivy v0.22.0
 	github.com/aquasecurity/trivy-db v0.0.0-20210916043317-726b7b72a47b
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
-	github.com/aws/aws-sdk-go v1.40.49
+	github.com/aws/aws-sdk-go v1.42.0
 	github.com/boltdb/bolt v1.3.1
 	github.com/briandowns/spinner v1.16.0 // indirect
 	github.com/cenkalti/backoff v2.2.1+incompatible
@@ -84,7 +85,6 @@ require (
 	github.com/Masterminds/sprig v2.22.0+incompatible // indirect
 	github.com/PuerkitoBio/goquery v1.7.1 // indirect
 	github.com/andybalholm/cascadia v1.3.1 // indirect
-	github.com/aquasecurity/go-dep-parser v0.0.0-20210919151457-76db061b9305 // indirect
 	github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce // indirect
 	github.com/aquasecurity/go-npm-version v0.0.0-20201110091526-0b796d180798 // indirect
 	github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46 // indirect
@@ -154,7 +154,7 @@ require (
 	go.opencensus.io v0.23.0 // indirect
 	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/multierr v1.6.0 // indirect
-	go.uber.org/zap v1.19.1 // indirect
+	go.uber.org/zap v1.20.0 // indirect
 	golang.org/x/sys v0.0.0-20211210111614-af8b64212486 // indirect
 	golang.org/x/term v0.0.0-20201210144234-2321bbc49cbf // indirect
 	google.golang.org/api v0.63.0 // indirect