3.119.0+2026.10.14 - Binarly Transparency Platform

Features

Stale finding banner: When a newer scan supersedes a finding, the finding details page shows a stale finding banner, and the breadcrumbs mark the finding as stale.
Known fixed versions for package dependencies: Between scans, the platform refreshes the known fixed versions of findings. For Linux package dependencies, the refresh looked them up by vendor, product and version only. That never matched distribution advisories, so their fixed versions only changed with a rescan. The refresh now looks up package dependencies by package, distribution, version and architecture, the same way a scan does.
Image creation API: Images are now created from an uploaded file with POST /api/v4/products/{productId}/images. The POST /images:upload endpoint has been retired. See Upload Image for the full upload flow.
Unknown Findings widget: The whole row in the Unknown Findings widget on the dashboard is now clickable. Before, only the filled part of the bar responded to clicks, so rows with very small values could not be opened.
Configurable label prefix (on-premises): The prefix of the labels the Helm chart sets on Kubernetes resources is now configurable with global.labelPrefix.

New Platforms/Formats
- Firmware unpacking now extracts U-Boot device tree blobs (DTBs) as separate components.
Vulnerability Database Service
- Vulnerability database updates no longer grow in memory from one run to the next, and no longer need temporary files to aggregate vulnerability data.
New Context-Aware Rule Detection (Mitigate)
- Added a Mitigate check for U-Boot images built without FIT signature verification support, which load boot images without verifying their authenticity. An attacker with physical access can modify the boot image and gain privileged control of the device (CWE-347, CVSS 7.6).
- Added a Mitigate check for U-Boot images whose control FDT does not contain the public key required for signature verification, so U-Boot may load untrusted FIT images (CWE-347, CVSS 7.6).
Analysis Framework Enhancements
- VulHunt now reports “entrypoint” reachability for known vulnerabilities it detects in U-Boot. The reachability comes from the VulHunt rules, which have enough evidence that the code is reachable in the given configuration.
- Analysis of binaries with many invalid or overlapping code blocks is much faster. On some binaries the speed increase is more than 100x: one binary that took about 4 hours to scan now takes about 2 minutes.

Analysis of some Dell UEFI firmware: Scans of some Dell UEFI firmware images failed or ran far longer than expected because of analysis issues with these images. They are now analyzed correctly.

High Confidence view applied when not the default: Going from the Overview tab of an image to the Findings tab could apply the High Confidence system view even when it was not set as the default view.
Empty classification box on Malicious Code findings: The classification box on Malicious Code findings was empty, and clicking it opened the same page in a new tab.
Enum properties on finding details: Enum properties on the finding details page were labelled inconsistently, with the enum entry description used as the label for some findings and the enum title for others. The way enum properties are displayed on the finding details page has been improved.

Important Findings widget and date range: Filtering in the Important Findings widget, which appears on the dashboard and the product image page, ignored the selected date range.
Slow product image page: Some tabs on the product image page loaded slowly and blocked the whole page while loading, up to 14 seconds for one image. The page now loads faster.

Image version in reports: Reports now include the image version, which was missing from the detailed PDF report.

U-Boot external environment findings: The risk score formula now has weights for the Mitigate finding for U-Boot images that load their environment variables from external storage. It scores the same as the U-Boot bootdelay finding, because both have the same CVSS score, impact and severity. Existing risk scores are recalculated.