I ran into a bug with Trivy imports while evaluating DefectDojo (2.59.0, Docker Compose). Legacy format reports (no `Class` field) parse fine, but the import then fails with `TypeError: expected string or bytes-like object, got 'NoneType'` in `clean_tags`. It reproduces with the fixture already in the repo (`unittests/scans/trivy/legacy_many_vulns.json`), on both the UI and API import paths. Imports work on 2.54.x and earlier and crash on 2.55.0 and later, so it looks like something introduced in 2.55 broke it. I have a writeup with the steps to reproduce and root cause, and a small fix with regression tests. Planning to file an issue and follow up with a PR unless there's a reason not to.
