> ## Documentation Index
> Fetch the complete documentation index at: https://docs.binarly.io/llms.txt
> Use this file to discover all available pages before exploring further.

# 3.103.0+2026.09.23

> Binarly v3.103.0 release notes: Package linkage for deb, rpm and apk dependencies, new U-Boot hardening checks, and Hikvision, Hanwha and Bosch CPP unpacking.

## <Icon icon="hand-sparkles" size={32} /> Hero Features

* **Package linkage for Linux package dependencies**
  * Dependencies identified from deb, rpm and apk package metadata now carry their own Package linkage instead of being reported as Project. The dependencies grid filters and sorts on the Relationship column, so package dependencies can be separated from the upstream components they sit next to.

## <Icon icon="hand" size={32} /> Features

* **Compressed report downloads**: JSON, CSV and Markdown report downloads are now compressed, so they transfer considerably less data than the file size on disk.

## <Icon icon="rocket" size={32} /> Binarly Analysis Engine

* **New Platforms/Formats**
  * Firmware unpacking now supports Hikvision, Hanwha and Bosch CPP firmware.
  * Firmware unpacking now handles U-Boot images carried inside FIT containers.
* **New Context-Aware Rule Detection (Mitigate)**
  * Added a Mitigate check for U-Boot images built without `CONFIG_DISABLE_CONSOLE`, where an attacker with serial port access can reach a U-Boot shell and take over the boot process (CWE-306, CWE-489, CVSS 7.6).
  * Added a Mitigate check for U-Boot images that load their environment variables from external storage, where an attacker with physical access can modify them and gain privileged control of the device (CWE-15, CWE-345, CVSS 7.6).
* **Analysis Framework Enhancements**
  * YAFFS2 unpacking was improved.

## <Icon icon="bug" size={32} /> Bug Fixes

### Reports

* **SBOM, VEX, CBOM and SPDX report memory usage**: Building these reports loaded every non-patch property of a scan into memory, which caused heap spikes and out-of-memory failures on scans with large property counts. The reports now load only the property types they emit, and VEX fetches only the components named by vulnerability findings.

### Dependencies

* **CPE and PURL backfill**: CPE and PURL were filled from an arbitrary referenced artefact of a dependency, so dependencies whose earlier artefacts predated these identifiers were left without them. Both are now backfilled from the latest artefact.
* **Duplicate dependency components**: The dependency component name column could disagree with the dependency components grid, because duplicated component properties joined the same component twice. The grid now lists each component once.

### Analysis

* **Function argument analysis on x86 U-Boot and Linux kernel binaries**: Argument analysis assumed the wrong default calling convention for x86 U-Boot and Linux kernel binaries. The convention these binaries are actually built with is now used, and VulHunt picks up the corrected analysis for detection on them.