3.89.0+2026.09.01

Hero Features

CPE and PURL in dependency identity: Dependencies are now identified by their CPE and PURL alongside vendor, product, version, license, and linkage. Two dependencies that share a name but carry different package identifiers stay separate, each with its own advisory sources, known vulnerabilities, and known fixed versions. Existing product dependencies were backfilled with their CPE and PURL identifiers.

New Platforms/Formats
- Firmware unpacking now supports Cisco CSP.
- Firmware unpacking now supports Cisco ASDM.
- Firmware unpacking now supports Cisco SGZ archives.
- Firmware unpacking now supports Fortinet FortiOS.
Vulnerability Database Service
- GHSA and Go advisory aliases are now deduplicated, so a vulnerability that carries both is reported once.
New Features
- Secrets scanning now detects IBM Cloud API keys and reports their validity status.
Analysis Framework Enhancements
- Control flow graph reconstruction was improved, making file loading up to 30% faster across the analysis tools.

Reachability columns in CSV exports: The findings CSV export reported an isReachable column instead of the Code Reachability and Environment Reachability columns used in the findings grid and reports. The export now reports both.
Component information in JSON exports: Filtered findings exported in detailed JSON format from the image findings grid were missing component information for some finding types, including mitigation failures and suspicious code. Component information is now included.
Linux kernel package vulnerabilities: When a Linux kernel image carried package metadata, known vulnerabilities for the kernel were still sourced from NVD instead of from the kernel package. Kernel images with package metadata are now matched to the kernel package.

Empty image uploads: An image with no content could be uploaded through the API and passed to a scan. Empty uploads are now rejected.

Code size limit documentation link: Updated the code size limit documentation link in the dashboard.