> ## Documentation Index
> Fetch the complete documentation index at: https://docs.binarly.io/llms.txt
> Use this file to discover all available pages before exploring further.

# 3.123.0+2026.10.27

> Binarly v3.123.0 release notes: Mitigate check for unsafe U-Boot boot commands, faster vulnerability lookups between scans, report media types in the OpenAPI spec.

##  Features

* **Vulnerability lookups between scans**: Between scans, the platform checks the dependencies of your images against new vulnerability data. These lookups now run in parallel, four at a time by default, instead of one at a time. Before, a lookup that failed with a temporary error skipped that dependency until the next refresh. Failed lookups are now retried up to two times, and a dependency that still fails is looked up again on later refreshes. On-premises installations can change the number of parallel lookups with `server.vdb.componentVulnerabilitiesConcurrency`.
* **Server memory limit (on-premises)**: The server containers now set `GOMEMLIMIT` to 85% of their container memory limit. The server then frees memory more often as it nears the limit, which can help prevent out-of-memory restarts. Change the percentage with `server.goMemLimitPercent`, or set it to `0` to turn this off. A `GOMEMLIMIT` environment variable that you set yourself takes precedence.

##  Binarly Analysis Engine

* **New Context-Aware Rule Detection (Mitigate)**
  * Added a Mitigate check for U-Boot images built with a boot command that loads images without verifying their signatures. An attacker with access to the U-Boot shell, or control over the boot script, can use such a command to boot a tampered image and gain privileged control of the device (CWE-288, CVSS 7.6). The finding names the boot command, for example `bootz`.

##  Bug Fixes

### Grids

* **Total for empty results**: When a search or filter in a grid matched nothing, the grid showed no result total. The total is part of the pagination, which is hidden when there are no results. Grids now show "Total 0" in that case.

### API

* **Report media types in the OpenAPI specification**: The OpenAPI specification declared `application/json` for the SBOM and CBOM report endpoints, which return CycloneDX and SPDX media types such as `application/vnd.cyclonedx+json` and `application/spdx+json`. The specification now declares these media types. It also declares the `Content-Disposition` header that the SBOM, CBOM and VEX report endpoints send. The responses themselves have not changed. See [SBOM Reports](https://docs.binarly.io/api-reference/report/sbom-report.md), [CBOM Reports](https://docs.binarly.io/api-reference/report/cbom-report.md) and [VEX Reports](https://docs.binarly.io/api-reference/report/vex-report.md).

### Mitigate

* **U-Boot `bootdelay` on AARCH64**: The Mitigate check for the U-Boot `bootdelay` setting now reads the value correctly from upstream U-Boot binaries built for AARCH64.
* **U-Boot environment outside the image**: Mitigate tried to read the default U-Boot environment past the end of the image. It now reads the environment only within the image.

### CryptoScan

* **RSA OID**: When RSA matched both the OID `1.2.840.113549.1.1.1` and the OID `2.5.8.1.1`, CryptoScan now reports `1.2.840.113549.1.1.1`.

### Risk score

* **U-Boot Mitigate findings**: The [Binarly Risk Score](https://docs.binarly.io/resource-center/binarly-risk-score.md) formula now has weights for three Mitigate findings for U-Boot images: missing FIT signature verification support, a missing public key in the control FDT, and unsafe boot commands. They score the same as the finding for U-Boot images that load their environment from external storage, because they have the same metric values. Existing risk scores are recalculated.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.