bug(vex): VEX suppression no longer works in sbom mode starting from v0.67.0.

## Description
We added support for reusing scanned SBOM in #9439.
However, the reused BOM does not contain PkgIdentifier.UID, which causes an error here:
https://github.com/aquasecurity/trivy/blob/78f0d4ae0378f81940a5faa6497e6905cb5d034a/pkg/vex/vex.go#L153-L157
```
2025-10-05T18:46:11+02:00       ERROR   Component not found     uid="6926bf85598a26d3"
2025-10-05T18:46:11+02:00       ERROR   Component not found     uid="ed5af83f85d3f59f"
2025-10-05T18:46:11+02:00       ERROR   Component not found     uid="ed5af83f85d3f59f"
2025-10-05T18:46:11+02:00       ERROR   Component not found     uid="a520bd8e02f56b23"
2025-10-05T18:46:11+02:00       ERROR   Component not found     uid="6fc1805347faac92"
2025-10-05T18:46:11+02:00       ERROR   Component not found     uid="480c32763307f733"
```


## Solution
Don't use reused BOM from VEX filtering.



### Discussed in https://github.com/aquasecurity/trivy/discussions/9589

	c, ok := components[vuln.PkgIdentifier.UID]
	if !ok {
	log.Error("Component not found", log.String("uid", vuln.PkgIdentifier.UID))
	return true // Should never reach here
	}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

bug(vex): VEX suppression no longer works in sbom mode starting from v0.67.0. #9593

Description

Solution

Discussed in #9589

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

bug(vex): VEX suppression no longer works in sbom mode starting from v0.67.0. #9593

Description

Description

Solution

Discussed in #9589

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions