Finite State Platform

No entries match these filters. Clear filters

1. November 2, 2026 - CVE-2026-98432 kernel reachability (2026-11-02) Nov 2, 2026 · issue 130
   • New vulnerability check CVE-2026-98432 kernel reachability detection
2. October 30, 2026 - Component versions, kernel vulnerabilities, and .NET end of life (2026-10-30) Oct 30, 2026 · issue 130

   Finite State Platform adds Brotli component detection and raw NANDNANDA type of flash memory storage where cells are arranged in series, offering high density and low cost per bit, making it the standard medium for SSDs and embedded storage in cyber tools that handle large data volumes. dump extraction for extextA family of filesystems native to Linux, with ext4 being the most common; tools use it when they need to read, write, or forensically analyse Linux disk images. filesystems and U-Boot FITU-Boot FITA signed, self-describing firmware image format used by the U-Boot bootloader that bundles a kernel, device tree, and initramfs into one file, letting cyber tools verify integrity before boot. images⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Finite State Platform now identifies Brotli as a component and reads its version on firmware builds that export one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Finite State Platform now shows end-of-life status for .NET runtime components, including NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. runtime packs and installer names.
   • Finite State Platform now identifies Brotli as a component and reads its version on firmware builds that export one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

3. October 27, 2026 - Custom licenses, exclusion comments, and CVE severity (2026-10-27) Oct 27, 2026 · issue 123

   Finite State adds custom license lifecycle management via PATCH /v0/licenses and DELETE /v0/licenses, plus exclusion comment visibility on components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Retire a custom license that is no longer valid without breaking policies that still reference it — the delete is refused until the policy is updated.
   copy

   $ curl -X DELETE 'https://platform.finitestate.io/v0/licenses?id=<license-id>' \
     -H 'Authorization: Bearer <token>'

   Audit why a component was excluded from a scan result, including who excluded it and when, before deciding to re-include it.
   copy

   $ curl 'https://platform.finitestate.io/api/public/v0/components/<component-id>' \
     -H 'Authorization: Bearer <token>'

   Review the full audit trail of all component exclusions and inclusions, with comments and component counts, for compliance reporting.
   copy

   $ curl 'https://platform.finitestate.io/v0/audit' \
     -H 'Authorization: Bearer <token>'

   • Adds PATCH /v0/licenses and DELETE /v0/licenses (with id as a query parameter) to edit, deprecate, restore, or delete a custom license programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds custom license management to the Settings > Policy > Licenses UI, supporting edit, deprecate, restore, and delete actions with audit trail entries for create, update, and delete.
   • Extends GET /api/public/v0/components and the component detail endpoint to return the exclusion comment, the time of exclusion, and the author who excluded the component.
   • Records each exclude or include action — including the comment and full component count — in GET /v0/audit.
   • Surfaces the exclusion comment, the excluding user, and the timestamp on the Component view and the Excluded list in the UI.
   • Adds PATCH /v0/licenses and DELETE /v0/licenses (with id as a query parameter) to edit, deprecate, restore, or delete a custom license programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds custom license management to the Settings > Policy > Licenses UI, supporting edit, deprecate, restore, and delete actions with audit trail entries for create, update, and delete.

   3 more in Everything

4. October 27, 2026 - Scan email notifications (2026-10-27) Oct 27, 2026 · issue 123

   Finite State adds scan email notifications with per-scope subscriptions and a new POST /api/public/v0/notifications/subscriptions endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Enable the scan email channel for your organization so members receive scan completion and failure emails — do this once before individual subscriptions take effect.
   📍In the Finite State platform, go to Integrations, find the scan email channel, and toggle the switch to enable scan emails for the organization.
   • Adds POST /api/public/v0/notifications/subscriptions endpoint to subscribe to email notifications for every scan in a project programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds scan email notifications so the user who started a scan is automatically emailed on scan completion or failure.
   • Enables subscription to email notifications at three scopes: a single scan, every scan in a Folder, or every scan in a Project.
   • Adds a Notify me option on a running scan to subscribe mid-flight.
   • Adds a Notification Settings view where users can choose which events to receive for scans they upload, add a Folder or Project subscription, and filter that list by scope.

   +1 more show less

   • Lets organization administrators enable or disable the scan email channel org-wide under Integrations, with a single switch that reflects delivery status even after a recipient has used an unsubscribe link.

   6 details in Everything

5. October 26, 2026 - Current version and version order (2026-10-26) Oct 26, 2026 · issue 122

   Finite State Platform adds manual Version pinning and ordering on the Versions page, with new API fields to match.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Retrieve Versions for a project in the custom analyst-defined order, newest pinned release first, for downstream tooling or reporting.
   copy

   $ curl -X GET 'https://platform.finitestate.io/public/v0/versions?projectId=<id>&sort=order:desc' -H 'Authorization: Bearer <token>'

   Pin a stable release Version as current so that ongoing scans for new firmware builds do not overwrite it during an active audit review.
   📍In the Finite State Platform, go to the Project › Versions page, select the target Version, and choose Set as current. The Version is marked Current and the change is recorded in the Audit trail.
   • Adds previousVersion field to GET /public/v0/versions/{id} to expose the preceding version in the API response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds sort=order query parameter to GET /public/v0/versions to list a Project's Versions in the custom order set on the Versions page (e.g. projectId=<id>&sort=order:desc).
   • Adds ability to pin a Version as current on the Versions page, preventing new scans from replacing it, with changes recorded in the Audit trail.
   • Adds ability to reorder Versions on the Versions page and return to the latest Version from a pinned one.
   • Adds previousVersion field to GET /public/v0/versions/{id} to expose the preceding version in the API response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds ability to pin a Version as current on the Versions page, preventing new scans from replacing it, with changes recorded in the Audit trail.
   • Adds ability to reorder Versions on the Versions page and return to the latest Version from a pinned one.

   1 more in Everything

6. October 26, 2026 - Project ownership transfer and Project owner (2026-10-26) Oct 26, 2026 · issue 122

   Finite State Platform adds Project ownership transfer via new PUT API endpoints and bulk UI controls, with owner filtering on existing GET endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Transfer a single Project to a new owner and demote the previous owner to Editor in one API call.
   copy

   $ curl -X PUT 'https://platform.finitestate.io/public/v0/projects/{projectId}/owner' \
     -H 'Authorization: Bearer <token>' \
     -H 'Content-Type: application/json' \
     -d '{"newOwnerId": "<userId>", "previousOwnerRole": "Editor"}'

   Bulk-transfer ownership of multiple Projects at once — useful when offboarding a departing team member who owns many Projects.
   copy

   $ curl -X PUT 'https://platform.finitestate.io/public/v0/projects/owner' \
     -H 'Authorization: Bearer <token>' \
     -H 'Content-Type: application/json' \
     -d '{"projectIds": ["<projectId1>", "<projectId2>"], "newOwnerId": "<userId>", "previousOwnerRole": "Editor"}'

   Find all Projects owned by a specific user, including any whose owner has been deactivated, using the new owner fields and filter.
   copy

   $ curl -G 'https://platform.finitestate.io/public/v0/projects' \
     -H 'Authorization: Bearer <token>' \
     --data-urlencode 'filter[owner]=<ownerName>' \
     --data-urlencode 'sort=owner'

   • Adds PUT /public/v0/projects/{projectId}/owner to transfer ownership of a single Project to another user in the organization, with optional previousOwnerRole to set the departing owner's role.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds PUT /public/v0/projects/owner for bulk Project ownership transfer, also accepting previousOwnerRole.
   • Exposes owner, ownerId, and ownerDeactivated fields on GET /public/v0/projects, GET /public/v0/projects/{projectId}, and GET /public/v0/folders/{folderId}/projects, with filter and sort by owner.
   • Adds a Change owner control to the Projects list and Project settings UI, supporting single and bulk ownership transfer and optionally setting the previous owner's role.
   • Shows a warning when deactivating or deleting a user who still owns Projects.

   +1 more show less

   • Shows Project ownership changes — including previous owner and new owner — on the Audit trail.
   • Adds PUT /public/v0/projects/{projectId}/owner to transfer ownership of a single Project to another user in the organization, with optional previousOwnerRole to set the departing owner's role.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds PUT /public/v0/projects/owner for bulk Project ownership transfer, also accepting previousOwnerRole.
   • Adds a Change owner control to the Projects list and Project settings UI, supporting single and bulk ownership transfer and optionally setting the previous owner's role.
   • Shows a warning when deactivating or deleting a user who still owns Projects.

   2 more in Everything

7. October 23, 2026 - All versions on the Projects page (2026-10-23) Oct 23, 2026 · issue 122

   Finite State Platform adds an All versions tab to the Projects page for org-wide version discovery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Find a specific firmware version anywhere in the organization without navigating into each project individually.
   📍1. Go to the Projects page. 2. Click the All versions tab (between All projects and Folders). 3. Type a project name in the search box to narrow the list. 4. Click the matching row to open that version directly.
   • Adds an All versions tab on the Projects page (positioned between All projects and Folders) listing every visible version across the organization, sorted newest first, with search to filter by project and row-click to open a version directly — archived project versions are excluded.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

8. October 22, 2026 - Folder project lists and dependency versions (2026-10-22) Oct 22, 2026 · issue 122

   Finite State adds subfolder project listing, deprecated SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. license support, and dependency version editing via API and UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Retrieve all projects nested under a folder and its subfolders in a single API call — useful for inventorying an entire product line organized in a folder hierarchy.
   copy

   $ curl -s -H 'Authorization: Bearer <token>' 'https://platform.finitestate.io/public/v0/folders/{folderId}/projects?includeSubfolders=true'

   Filter versions to only those belonging to active (non-archived) projects, reducing noise in version listings used for triage or reporting.
   copy

   $ curl -s -H 'Authorization: Bearer <token>' 'https://platform.finitestate.io/public/v0/versions?archived=false'

   Retarget a dependency to a different version in-place instead of deleting and re-adding it — useful when a project upgrades a shared component.
   copy

   $ curl -s -X PUT -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"dependencyProjectVersionId": "<newVersionId>"}' 'https://platform.finitestate.io/public/v0/project-dependencies/{dependencyId}'

   • Adds includeSubfolders=true query parameter on GET /public/v0/folders/{folderId}/projects to return projects in a folder and all its subfolders in a single request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds includeSubfolderProjectCount=true query parameter on GET /public/v0/folders and GET /public/v0/folders/{folderId} to include each folder's project count across subfolders.
   • Includes deprecated SPDX licenses in GET /public/v0/licenses by default (listed after current licenses); adds filter=false to exclude them.
   • Lists deprecated SPDX licenses in the Add Licenses UI with a Deprecated badge, including those that share a name with a current license.
   • Adds optional archived parameter on GET /public/v0/versions to filter versions by whether the owning project is archived.

   +1 more show less

   • Supports changing a project dependency's version via dependencyProjectVersionId on PUT /public/v0/project-dependencies/{dependencyId} without removing and re-adding the dependency.
   • Adds includeSubfolders=true query parameter on GET /public/v0/folders/{folderId}/projects to return projects in a folder and all its subfolders in a single request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds includeSubfolderProjectCount=true query parameter on GET /public/v0/folders and GET /public/v0/folders/{folderId} to include each folder's project count across subfolders.

   4 more in Everything

9. October 19, 2026 - Finding history and license details (2026-10-19) Oct 19, 2026 · issue 114

   Finite State Platform now shows Finding history and complete declared license details to Project/Folder viewers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Exposes Finding history — including status updates and comments — to any user who has view access to the Project or Folder.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

10. changelog Oct 18, 2026 · issue 112

    Finite State Platform: Adds GET /api/public/v0/versions/{baseVersionId}/compare/{targetVersionId} to compare two Project Versions by Findings and Components changed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Compare two firmware versions before triaging findings — see exactly which vulnerabilities were introduced or resolved between builds.
    copy

    $ curl -s -H 'Authorization: Bearer <token>' \
      'https://platform.finitestate.io/api/public/v0/versions/<baseVersionId>/compare/<targetVersionId>'

    Handle the busy-comparison rate limit in a polling loop — respect the Retry-After header so your script backs off automatically.
    copy

    $ curl -s -w '%{http_code}' -H 'Authorization: Bearer <token>' \
      'https://platform.finitestate.io/api/public/v0/versions/<baseVersionId>/compare/<targetVersionId>' \
      | grep -q '503' && echo 'COMPARISON_BUSY — retry in 2 s' && sleep 2

    Detect a refused re-scan (conflicting scan configs) before your pipeline acts on a version rename.
    copy

    $ curl -s -w '\n%{http_code}' -X POST \
      -H 'Authorization: Bearer <token>' \
      'https://platform.finitestate.io/api/public/v0/versions/<projectVersionId>/rescan' \
      | tail -1 | grep -q '409' && echo 'SCAN_CONFIG_CONFLICT — resolve scan config before retrying'

    • Loads Project details and permissions together on GET /api/public/v0/projects, eliminating the serial wait between the two fetches.
    • Opens Policy Overview severity and exploit rows by clicking anywhere on the row.
    • Opens License Violations and License Warnings from Policy Overview on the components for that specific license policy, not every policy finding.

    3 more in Everything

11. October 16, 2026 - Component detection, kernel reachability, and NetX Duo vulnerabilities (2026-10-16) Oct 16, 2026 · issue 114

    Binary scans now detect nanoMODBUS, nanoprintf, cifra, TinyCrypt, and MPLAB Harmony libraries in firmware.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

12. October 14, 2026 - Version counts, component pages, Policy Overview, and re-scan (2026-10-14) Oct 14, 2026 · issue 111

    Finite State adds 503 COMPARISON_BUSY with Retry-After on version compare, Policy Overview row navigation, and re-scan conflict signaling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Implement retry logic in a polling loop for version comparisons that may be throttled under heavy load.
    copy

    $ curl -i -X GET 'https://platform.finitestate.io/api/public/v0/versions/{baseVersionId}/compare/{targetVersionId}' \
      -H 'Authorization: Bearer <token>' \
      # On 503 COMPARISON_BUSY, read Retry-After: 2 and sleep before retrying

    Detect a refused re-scan before a Version is renamed by catching the 409 SCAN_CONFIG_CONFLICT response.
    copy

    $ curl -i -X POST 'https://platform.finitestate.io/api/public/v0/versions/{projectVersionId}/rescan' \
      -H 'Authorization: Bearer <token>' \
      -H 'Content-Type: application/json'
    # HTTP 409 SCAN_CONFIG_CONFLICT means the re-scan was refused — no new Scan started

    • Adds 503 COMPARISON_BUSY with Retry-After: 2 header from GET /api/public/v0/versions/{baseVersionId}/compare/{targetVersionId} when too many Version comparisons are running at once, enabling retry logic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds 409 SCAN_CONFIG_CONFLICT from POST /api/public/v0/versions/{projectVersionId}/rescan when a basic scan and Quick scan are combined before a Version is renamed, making a refused re-scan distinguishable from one that started.
    • Loads a page of 10,000 components from GET /api/public/v0/components within the request time limit.
    • Policy Overview severity and exploit rows now open the matching component or finding list when clicked anywhere on the row, and License Violations/Warnings rows open only the findings for that specific license policy.
    • Adds 503 COMPARISON_BUSY with Retry-After: 2 header from GET /api/public/v0/versions/{baseVersionId}/compare/{targetVersionId} when too many Version comparisons are running at once, enabling retry logic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds 409 SCAN_CONFIG_CONFLICT from POST /api/public/v0/versions/{projectVersionId}/rescan when a basic scan and Quick scan are combined before a Version is renamed, making a refused re-scan distinguishable from one that started.

    2 more in Everything

13. October 13, 2026 - NetX Duo detection, Binary SAST rescan, and reachability fixes (2026-10-13) Oct 13, 2026 · issue 108
    • New detection NetX Duo version detection from version banner
    • New detection Binary component detection for NetX Secure and cereal
    • Updated detection RapidJSON detection from file content rather than symbol names alone
14. October 12, 2026 - Compare project versions and component fixes (2026-10-12) Oct 12, 2026 · issue 108

    Finite State adds a version-comparison endpoint and parallel project permission loading to accelerate Finding triage and Component review.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Diff two firmware versions before triaging new Findings — identify what was introduced, resolved, or changed between a baseline and a candidate build.
    copy

    $ curl -s -H "Authorization: Bearer <token>" \
      "https://platform.finitestate.io/api/public/v0/versions/<baseVersionId>/compare/<targetVersionId>"

    • Adds GET /api/public/v0/versions/{baseVersionId}/compare/{targetVersionId} to compare two Versions of a Project, returning Findings introduced, no longer present, or changed, and Components added, removed, or changed version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Loads Project details and permissions together on GET /api/public/v0/projects in parallel, eliminating the serial wait between the two fetches.
    • Adds GET /api/public/v0/versions/{baseVersionId}/compare/{targetVersionId} to compare two Versions of a Project, returning Findings introduced, no longer present, or changed, and Components added, removed, or changed version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

15. October 7, 2026 - Project audit trail and Product Reachability (2026-10-07) Oct 7, 2026 · issue 097

    Finite State adds Project-scoped Audit trail filtering, CSV export, and a per-Project Audit trail page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Export the Audit trail filtered to a specific Project to feed into a compliance report or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
    📍In the Finite State Platform, go to Audit trail, apply the Project filter to select your target project, then use the CSV export to download the filtered events.
    Review all activity scoped to a single Project without sifting through organisation-wide audit events.
    📍In the Finite State Platform, open the target Project, then navigate to its Audit trail page to see only events belonging to that Project.
    • Adds a Project column, filter, and CSV field to the Audit trail so events can be sliced and exported by Project.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a dedicated Audit trail page on each Project for viewing that Project's events in isolation.

    2 details in Everything

16. October 7, 2026 - Project on audit events (2026-10-07) Oct 7, 2026 · issue 097

    Finite State audit-event endpoints now return project id and name, letting security engineers trace events to a specific Project.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Retrieve audit events scoped to a specific project and confirm the new project object is present in each result, including its id and name.
    copy

    $ curl -s -H 'Authorization: Bearer <token>' 'https://platform.finitestate.io/public/v0/projects/<projectId>/audit' | jq '.[].project'

    • Adds project object (with id and name) to responses from GET /public/v0/audit, GET /public/v0/audit/{id}, GET /public/v0/audit-events, GET /public/v0/audit-events/{id}, and GET /public/v0/projects/{projectId}/audit whenever the event is associated with a Project.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The id, userId, and projectId filter parameters (e.g. ?userId=) on GET /public/v0/audit, GET /public/v0/audit-events, and GET /public/v0/projects/{projectId}/audit now accept only hyphenated UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.; hyphen-less and brace-wrapped UUIDs previously accepted will now return HTTP 400 with an error naming the field and value.
17. October 1, 2026 - CycloneDX VEX menu, Files downloads, and SBOM export errors (2026-10-01) Oct 1, 2026 · issue 092

    Finite State adds CycloneDX VEXCycloneDX VEXA CycloneDX-format document that records which known vulnerabilities in a software bill of materials actually affect a given product, letting cyber tools automate triage by filtering out irrelevant CVEs. downloads to the Generate SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. menu, backed by a new GET /public/v0/vex/cyclonedx/{projectVersionId} endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Pull a CycloneDX VEX document for a specific project version to feed into a downstream vulnerability management pipeline.
    copy

    $ curl -X GET 'https://platform.finitestate.io/public/v0/vex/cyclonedx/{projectVersionId}' -H 'Authorization: Bearer <token>'

    Download a triaged-only CycloneDX VEX file from the platform UI when you only want to share externally vetted, triaged vulnerability data.
    📍In the platform, open a Version, click Generate SBOM, select CycloneDX VEX (triaged only), and click Download.
    • Adds GET /public/v0/vex/cyclonedx/{projectVersionId} endpoint to retrieve CycloneDX VEX data for a project version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds CycloneDX VEX (vulnerabilities only) and CycloneDX VEX (triaged only) download options to the Generate SBOM menu on a Version.
    • Adds GET /public/v0/vex/cyclonedx/{projectVersionId} endpoint to retrieve CycloneDX VEX data for a project version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

18. October 1, 2026 - Compound SPDX license details and Finding comments (2026-10-01) Oct 1, 2026 · release notes

    Compound SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. license details now returned; Finding comments no longer time out

    └──▷ TRY IT
    Retrieve full license details for components with compound SPDX expressions via the API.
    copy

    $ curl -s https://api.finitestate.io/public/v0/components/{componentId}

    • GET /public/v0/components and GET /public/v0/components/{componentId} endpoints now return declared license details for compound SPDX expressions (OR, AND, or WITH) instead of an empty list

    1 detail in Everything

19. October 1, 2026 - CycloneDX VEX menu, Files downloads, and SBOM export errors Oct 1, 2026 · release notes

    Adds CycloneDX VEXCycloneDX VEXA CycloneDX-format document that records which known vulnerabilities in a software bill of materials actually affect a given product, letting cyber tools automate triage by filtering out irrelevant CVEs. download options to the Generate SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. menu for versions.

    • UI feedback improved so that a failed SBOM export shows an error state and keeps the Generate SBOM menu visible instead of saving bad content.

    1 detail in Everything

20. October 1, 2026 - Compound SPDX license details and Finding comments Oct 1, 2026 · release notes

    Compound SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. details returned via API; finding comment timeout fixed

    • GET /public/v0/components and GET /public/v0/components/{componentId} now return declared license details for compound SPDX expressions instead of an empty list.
    • Saving, editing, and deleting a comment on a Finding completes successfully without timing out.

    2 details in Everything

21. September 30, 2026 - Version Rescan (2026-09-30) Sep 30, 2026 · issue 092

    Finite State Platform adds Version Rescan, letting analysts re-run a scan from the stored file while checkpointing prior results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Re-run a binary scan on an existing Version after updating analysis settings, without losing the original scan results.
    📍In the Finite State Platform, navigate to the Version you want to re-scan, select Rescan, choose which analyses to run for the binary scan, then confirm — the current Version is checkpointed and a new Version scan starts under the original name.
22. September 30, 2026 - Version Rescan Sep 30, 2026 · release notes

    Adds Rescan on Version to re-scan a stored file while preserving previous results via checkpointing.

    • Adds Rescan on Version capability to restart a scan from the stored file and checkpoint the current Version.

    1 detail in Everything

23. September 29, 2026 - Standalone CycloneDX VEX export (2026-09-29) Sep 29, 2026 · issue 090

    Finite State adds a standalone CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. export endpoint with optional triage filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Export a standalone CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.6 VEX document for a specific project version, scoped only to Findings that have been triaged with a VEX status.
    copy

    $ curl -X GET 'https://platform.finitestate.io/public/v0/vex/cyclonedx/{projectVersionId}?triagedOnly=true' -H 'Authorization: Bearer <token>' -H 'Accept: application/json'

    • Adds GET /public/v0/vex/cyclonedx/{projectVersionId} endpoint to export a standalone CycloneDX 1.6 VEX document containing vulnerabilities and analysis, without Components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports optional triagedOnly=true query parameter on the VEX export endpoint to return only Findings that have a VEX status.
    • Improves Policy evaluation after Component and Finding edits so Policy status stays current without queuing behind other Policy work on the same Version.
    • Adds GET /public/v0/vex/cyclonedx/{projectVersionId} endpoint to export a standalone CycloneDX 1.6 VEX document containing vulnerabilities and analysis, without Components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports optional triagedOnly=true query parameter on the VEX export endpoint to return only Findings that have a VEX status.

    1 more in Everything

24. September 29, 2026 - Delete user and Component status picker (2026-09-29) Sep 29, 2026 · release notes

    Adds admin ability to delete users from Settings with Audit trail logging; removes Excluded option from Component Update Status picker.

    └──▷ HOW TO FIND IT
    When an administrator needs to remove a user and verify the action in audit logs.
    📍In the console, go to Settings → Users, select the user row menu or detail drawer, and click Delete to confirm removal.
    • Adds Delete action on Settings → Users (row menu and detail drawer) with confirmation and Audit trail record

    1 detail in Everything

25. September 29, 2026 - Standalone CycloneDX VEX export Sep 29, 2026 · release notes

    Adds GET /public/v0/vex/cyclonedx/{projectVersionId} endpoint for standalone CycloneDX VEXCycloneDX VEXA CycloneDX-format document that records which known vulnerabilities in a software bill of materials actually affect a given product, letting cyber tools automate triage by filtering out irrelevant CVEs. export.

    • Add GET /public/v0/vex/cyclonedx/{projectVersionId} to export a standalone CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. document with vulnerabilities and analysis, without Components
    • Optional triagedOnly=true keeps only Findings that have a VEX status

    2 details in Everything

26. September 29, 2026 - Delete user and Component status picker Sep 29, 2026 · release notes

    Finite State Platform vSept2026 adds user deletion with audit logging via Settings UI.

27. September 28, 2026 - Project name checks, Finding VEX retention, and faster Component replace (2026-09-28) Sep 28, 2026 · issue 089

    Finite State Platform now logs USER_DELETED audit events, retains VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable./comments through reassessment, and speeds up Component replace on large Versions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Verify that deleting a user produces an audit trail — confirm the USER_DELETED event and the user's id and email appear in the audit log.
    copy

    $ curl -X DELETE 'https://platform.finitestate.io/public/v0/users/{id}' -H 'Authorization: Bearer <token>'
    
    curl 'https://platform.finitestate.io/public/v0/audit' -H 'Authorization: Bearer <token>'

    • Adds USER_DELETED audit event to GET /public/v0/audit — including the deleted user's id and email — when DELETE /public/v0/users/{id} succeeds, and terminates the deleted user's active sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Speeds up Component replace and revert on large Versions by evaluating license Policy once per Component rather than per finding.
    • Preserves Findings that carry a VEX status or a comment (including SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.-supplied VEX and triage) through reassessment after exclude, include, replace, or revert operations.
    • Filtered, searched, and row-selected Findings CSV exports now use the same column header labels as the unfiltered export instead of raw internal key names.
    • Adds USER_DELETED audit event to GET /public/v0/audit — including the deleted user's id and email — when DELETE /public/v0/users/{id} succeeds, and terminates the deleted user's active sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    3 more in Everything

28. September 28, 2026 - Project name checks, Finding VEX retention, and faster Comp Sep 28, 2026 · release notes

    Project name validation, VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable./comment preservation on reassessment, and filtered CSV export consistency

    └──▷ TRY IT
    Verify a user deletion was recorded and capture their identity for audit trails.
    copy

    $ GET /public/v0/audit

    • Filtered Findings CSV exports now use the same column header labels as unfiltered exports.

    1 detail in Everything

29. September 22, 2026 - Scan queue API, Version counts, and Component license filters (2026-09-22) Sep 22, 2026 · issue 083

    Finite State adds a Scans page with live queue visibility and two new API endpoints for scan queue health and snapshots.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Poll the live scan queue from a CI pipeline or monitoring script to detect backlogs before they delay a release.
    copy

    $ curl -s -H 'Authorization: Bearer <token>' 'https://platform.finitestate.io/public/v0/scans/ops-snapshot'

    Pull weekly scan success rate and duration metrics to feed a security operations dashboard or SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. report.
    copy

    $ curl -s -H 'Authorization: Bearer <token>' 'https://platform.finitestate.io/public/v0/scans/analysis'

    • Adds GET /public/v0/scans/analysis endpoint returning Scan queue totals, success rate, and duration metrics for a selected period.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds GET /public/v0/scans/ops-snapshot endpoint returning the current live running and queued Scan snapshot.
    • Extends GET /public/v0/scans to include processing time, Finding count, start time, and filter/sort by who initiated the Scan.
    • Adds a Scans page showing live Processing and Queued counts, scan history grouped by Project and Version, and volume and duration metrics.
    • Adds GET /public/v0/scans/analysis endpoint returning Scan queue totals, success rate, and duration metrics for a selected period.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds GET /public/v0/scans/ops-snapshot endpoint returning the current live running and queued Scan snapshot.
    • Adds a Scans page showing live Processing and Queued counts, scan history grouped by Project and Version, and volume and duration metrics.

    1 more in Everything

30. September 22, 2026 - Scan queue API, Version counts, and Component license filte Sep 22, 2026 · release notes

    Finite State adds Scans page and queue APIs for live scan health monitoring.

    • Adds a Scans page with live Processing and Queued counts and scan history
    • Adds GET /public/v0/scans/analysis for scan queue totals, success rate, and duration metrics
    • Adds GET /public/v0/scans/ops-snapshot for the current running and queued snapshot

    3 details in Everything

31. September 17, 2026 - Automatic resolution for vendor-authored distro patches (2026-09-17) Sep 17, 2026 · issue 085

    Finite State now auto-resolves findings when a Linux distro package already contains a vendor-authored CVE patch, with advisory evidence in the audit trail.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Supports vendor-patch recognition for Debian, Ubuntu, Alpine, Wolfi, Chainguard, MinimOS, Red Hat Enterprise Linux, AlmaLinux, Rocky Linux, and openSUSE Leap packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

32. September 17, 2026 - Findings OR filters, binary match identifiers, and VEX carry-forward (2026-09-17) Sep 17, 2026 · release notes

    Findings OR filters, binary match identifiers, and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. carry-forward

    • GET /public/v0/findings now supports comma-OR filters (e.g. severity==critical,severity==high) and cross-field OR groups (e.g. (severity==critical,inKev==true) returning the union)
    • Binary scan findings now use match identifiers from the Component pURL and per-scan evidence, preventing drop during full Version reassessment
    • VEX carry-forward preserves Exploitable or In triage status for subsequent scans when the new finding lacks a status
    • Manually added components now match on every CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. candidate instead of only the top-ranked identifier

    4 details in Everything

33. September 14, 2026 - CVE update feed, bulk Finding status, and VEX precedence (2026-09-14) Sep 14, 2026 · release notes

    New GET /api/public/v0/cves/updates feed for migrated CVE history; PUT .../status/bulk supports CVE-style IDs.

    • Support CVE-style finding IDs in PUT /public/v0/findings/{projectVersionId}/status/bulk to apply VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. decisions to every matching Finding in a Version.
    • Include affectedCount for each result returned by PUT /public/v0/findings/{projectVersionId}/status/bulk.

    2 details in Everything

34. September 14, 2026 - CVE update feed, bulk Finding status, and VEX precedence Sep 14, 2026 · release notes

    Adds bulk Finding status API and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. precedence logic to Finite State Platform

    • Enables PUT /public/v0/findings/{projectVersionId}/status/bulk API endpoint to apply VEX decisions to all matching Findings in a Version, returning an affectedCount field per result.

    1 detail in Everything

35. September 10, 2026 - Firmware unpacking and Reachability coverage (2026-09-10) Sep 10, 2026 · issue 076

    Finite State adds Phoenix Contact FL SWITCH 2000 unpacking, broader Reachability verdicts, and static-library component detection across more firmware formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Unpacks Phoenix Contact FL SWITCH 2000 firmware updates so the Linux root filesystem and its Components appear in scan results and produce a complete SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Returns a clear error when importing an SPDX 3SPDX 3An open standard from the Linux Foundation for expressing software bill-of-materials data, letting cyber tools exchange dependency, license, and vulnerability metadata in a machine-readable, interoperable format..x SBOM stating that SPDX 3.x is not yet supported, instead of a generic format-detection failure.
    • Records generation context as after-build on binary scan SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., matching the CISA SBOM minimum elements.
    • Identifies additional static-library Components — including picolibc, PCRE2, glib, and LLVM runtimes — that previously had no signature coverage.
    • Treats static library archives (.a files) as a single Component and scans them directly, instead of unpacking into hundreds of object-file rows.

    +1 more show less

    • Keeps embedded resources in Windows executables, including those used by Delphi applications, so they are analyzed instead of discarded.
    • Unpacks Phoenix Contact FL SWITCH 2000 firmware updates so the Linux root filesystem and its Components appear in scan results and produce a complete SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    5 more in Everything

36. September 10, 2026 - Bulk Finding status updates and CVE feed pagination (2026-09-10) Sep 10, 2026 · release notes

    Bulk Finding status updates capped at 500, CVE feed pagination with migrated history, and stricter API validation.

    └──▷ TRY IT
    Check for deprecation warnings when consuming the CVE updates feed via curl
    copy

    $ curl -sI https://api.finitestate.io/api/public/v0/cves/updates | grep -i deprecation

    • GET /api/public/v0/cves/updates now returns deprecation headers for unsupported clients
    • Binary scans retry license-normalization timeouts instead of failing the scan

    2 details in Everything

37. September 10, 2026 - List refresh and Findings charts (2026-09-10) Sep 10, 2026 · release notes

    Overview Findings charts now display Unknown findings and matching severity colors; list refresh failures no longer clear the UI.

    └──▷ HOW TO FIND IT
    Verify that list data remains visible during transient network errors so you can continue searching without disruption.
    📍Attempt a list refresh while offline; observe the table, toolbar, and search box remain populated with a banner indicating pending load.
    Ensure Overview Findings charts correctly categorize and color Unknown findings for accurate severity assessment.
    📍Navigate to the Overview section; check that the Findings donut chart displays a distinct slice for Unknown and that its label color matches the segment.
    • Overview Findings charts include Unknown findings and match severity labels to donut colors.
    • Lists retain the table, toolbar, and search box when a refresh fails, showing a banner until loading completes.

    2 details in Everything

38. September 10, 2026 - Bulk Finding status updates and CVE feed pagination Sep 10, 2026 · release notes

    GET /api/public/v0/cves/updates adds pagination to CVE feed history; fixes batch size limits on bulk status updates.

    • ENSURES GET /api/public/v0/cves/updates returns an empty page when offset exceeds feed bounds, ending pagination cleanly
    • INCLUDES previously omitted CVE identifiers in migrated organization history within the CVE feed

    2 details in Everything

39. September 10, 2026 - Firmware unpacking and Reachability coverage Sep 10, 2026 · release notes

    New Phoenix Contact FL SWITCH 2000 firmware unpacking and expanded Reachability verdicts for binary scans

    • Unpack Phoenix Contact FL SWITCH 2000 firmware updates so the Linux root filesystem and its Components appear in scan results

    1 detail in Everything

40. September 9, 2026 - CVE permissions, Findings filters, and Jira ticket scope (2026-09-09) Sep 9, 2026 · release notes

    CVE endpoints now enforce Findings permissions; Jira tickets scoped to Project/Component.

    • GET /api/public/v0/cves/{cveId}/exploits and GET /api/public/v0/cves/{cveId}/metadata now require Findings permission, returning 403 for unauthorized callers.
    • GET /v0/findings and GET /v0/projects/{projectId}/findings sort terms are fully enforced, allowing reliable multi-column sorting including weighted EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching..
    • Jira tickets created from Findings are now scoped to the Project and Component.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !GET /api/public/v0/cves/{cveId}/exploits and GET /api/public/v0/cves/{cveId}/metadata now return 403 if the caller lacks Findings permission.
    • !GET /v0/findings and GET /v0/projects/{projectId}/findings now return 400 for invalid sort columns.
41. September 8, 2026 - Component export, CVE detail panel, and What's New unread in Sep 8, 2026 · release notes

    Component table CSV exports now persist complete data after in-session edits

    • Component, Product Components, and Audit trail CSV exports now retain all rows after in-session edits, with a new prompt asking whether to export all rows or only the current selection when rows are selected

    1 detail in Everything

42. August 27, 2026 - Empty-license policy and Source column consistency (2026-08-27) Aug 27, 2026 · issue 065

    Finite State Platform adds a License Policy setting to flag and severity-label Components with no license on the Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts..

    └──▷ HOW TO FIND IT
    Flag unlicensed components during a compliance review by configuring a severity and label for them in License Policy.
    📍In the Finite State Platform, go to License Policy, add a rule for Components with no license, and set a severity and label — the label will then appear on those Components in the Bill of Materials.
43. Changelog 2026-08-27 - Empty-license policy and Source column consistency (2026-08-27) Aug 27, 2026 · issue 061

    Finite State Platform lets License Policy flag components with no license, assigning severity and BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. labels.

    └──▷ HOW TO FIND IT
    Flag unlicensed components in a License Policy so they surface with a severity on the Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts..
    📍In the Finite State Platform, go to License Policy, add a rule for components with no license, set the desired severity and label, then save — the label will appear on the Bill of Materials for any component lacking a license.
    • Adds a License Policy setting for components with no license, enabling assignment of a severity and label that appears on the Bill of Materials.

    1 detail in Everything

44. August 27, 2026 - Policy exclusions, scan filters, and SBOM import Aug 27, 2026 · release notes

    New policy exclusion metrics, RSQL scan filters, and empty CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import support

    • Policy metrics now omit excluded Components and their Findings from counts
    • Binary scan retries now reuse a cached analysis artifact to improve performance

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !POST /api/public/v0/scans returns 4xx for invalid body or missing permissions instead of 500
45. August 27, 2026 - Empty-license policy and Source column consistency Aug 27, 2026 · release notes

    Finite State adds empty-license policy to flag unlicensed components in the Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts..

    • Adds a License Policy setting for Components with no license to assign severity and labels on the Bill of Materials

    1 detail in Everything

46. August 24, 2026 - ESP32 and Bluetooth-audio firmware unpacking (2026-08-24) Aug 24, 2026 · issue 065

    Finite State now unpacks ESP32 and Airoha Bluetooth-audio firmware and exports CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. with author metadata.

    • Unpacks Espressif ESP32 firmware images, including full flash dumps, so those devices are analyzed as firmware rather than as an unidentified blob.
    • Unpacks Airoha Bluetooth-audio firmware and identifies the vendor SDK and DSP components, producing a complete SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. for those images.
    • Exports binary scan SBOMs as CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.6 with author metadata included.
    • Saves reachability results with the scan and applies them before binary assessment so later analysis uses a consistent verdict.
    • Unpacks Espressif ESP32 firmware images, including full flash dumps, so those devices are analyzed as firmware rather than as an unidentified blob.
    • Unpacks Airoha Bluetooth-audio firmware and identifies the vendor SDK and DSP components, producing a complete SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. for those images.

    2 more in Everything

47. Changelog 2026-08-24 - ESP32 and Bluetooth-audio firmware unpacking (2026-08-24) Aug 24, 2026 · issue 061

    Finite State now unpacks ESP32 and Airoha Bluetooth-audio firmware and exports CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. with author metadata.

    • Exports binary scan SBOMs as CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.6 with author metadata, producing auditor-ready documents from binary analysis.
    • Unpacks Espressif ESP32 firmware images, including full flash dumps, so ESP32 devices are analyzed as firmware rather than unidentified blobs.
    • Unpacks Airoha Bluetooth-audio firmware and identifies vendor SDK and DSP components, enabling complete SBOMs from those images.
    • Saves reachability results with the scan and applies them before binary assessment so all later analysis uses a consistent verdict.

    4 details in Everything

48. August 24, 2026 - ESP32 and Bluetooth-audio firmware unpacking Aug 24, 2026 · release notes

    Finite State adds ESP32 and Airoha Bluetooth-audio firmware unpacking with CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export

    • Unpack Espressif ESP32 firmware images, including full flash dumps, for analysis as firmware
    • Unpack Airoha Bluetooth-audio firmware and identify the vendor SDK and DSP components
    • Export binary scan SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. as CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.6 with author metadata

    3 details in Everything

49. August 12, 2026 - What's New Drawer and Platform Reliability Fixes (2026-08-12) Aug 12, 2026 · issue 046

    Finite State adds an in-product What's New drawer and improves license search, Findings filtering, and API reliability.

    • Adds an in-product What's New drawer that surfaces release highlights from the documentation feed whenever new customer-facing updates are published.
    • Improves license search so prefix matches appear before substring matches in the Add Licenses and Component license pickers.
    • Updates the License Policy page to source the live license catalog and display a retryable error state when the catalog cannot load.

    3 details in Everything

50. August 12, 2026 - What's New Drawer and Platform Reliability Fixes Aug 12, 2026 · release notes

    In-product What's New drawer, dependency-based findings filtering, and live License Policy updates.

    • Adds an in-product What's New drawer to show release highlights from the documentation feed
    • Updates the License Policy page to source the live license catalog

    2 details in Everything

51. July 31, 2026 - Kernel Reachability, Scan Accuracy, and Reliability Improvements Jul 31, 2026 · release notes

    Finite State Platform expands kernel reachability analysis with configuration-aware detection and improved scan enrichment reliability

    • Adds configuration-aware detection to kernel reachability analysis for improved firmware scan precision
    • Improves component search speed and reliability for broad searches

    2 details in Everything

52. July 23, 2026 - Component Replacement, SBOM Export Validation, and Platform Reliability Improvements (2026-07-23) Jul 23, 2026 · issue 025

    Finite State adds match evidence to findings CSV exports, carry-forward component exclusions, and modernized Bamboo/Jenkins CI/CD plugins.

    └──▷ HOW TO FIND IT
    After running a findings export, use the match evidence columns to identify exactly which files contain a vulnerable component and prioritize remediation.
    📍In the console, navigate to a version's Findings tab, click Export CSV, and open the downloaded file — each row now includes file path columns under match evidence alongside the existing vulnerability fields.
    • Adds match evidence (file paths associated with each vulnerable component) to the findings CSV export, enabling precise remediation targeting.
    • Carries component exclusions forward to newly scanned versions by default, reducing repeated manual configuration.
    • Updates Bamboo and Jenkins CI/CD plugins to use the upgraded API, with the Jenkins plugin now published to the Jenkins Update Center.
    • Queues binary scan uploads that exceed the concurrency limit instead of rejecting them, and automatically cleans up scans stuck in a started state.
    • Recomputes policy violations and warnings automatically on very large versions when policy settings or vulnerability data change, without requiring a new scan.

    +3 more show less

    • Persists table sorting across your session on the Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts., All Components, and Project Dependencies tables.
    • Adds column tooltips, consistent number formatting, user display names, and clickable policy-status badges to data tables across the platform.
    • Accepts legacy identifiers across the upgraded API, including the legacy projectVersion query parameter as a deprecated alias for versionId.

    8 details in Everything

53. July 23, 2026 - Component Replacement, SBOM Export Validation, and Platform Reli Jul 23, 2026 · release notes

    New match evidence in CSV export, spec-valid SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. validation, and persistent table sorting for Fin

    • Adds match evidence (file paths) to findings CSV export to identify exact files for remediation
    • Validates SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. exports/imports against specification compliance
    • Persists table sorting state across sessions for Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts., All Components, and Project Dependencies tables

    3 details in Everything

54. June 10, 2026 - License Label Visibility and Scan Reliability Jun 10, 2026 · release notes

    License policy labels now visible in the component list for all users with access; deterministic project-name resolution fixes scan upload reliability.

    • Show the license policy label and its filter chip to any user with access to a component's bill of materialsbill of materialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts., removing the need for a separate org-level policy configuration permission — security engineers and compliance analysts can now filter and review license labels directly from the component list

    1 detail in Everything

55. June 5, 2026 - License Policy Labels and Bulk Component Exclusion Jun 5, 2026 · release notes

    Adds configurable labels to license policies and uncapped bulk component exclude/include via UI.

    • Add configurable labels to license policies — admins set labels in policy settings, and users see them alongside policy violations in the Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. and can filter components by label
    • Bulk exclude or include components matching a filter across all pages, not just the current page

    2 details in Everything

56. June 2, 2026 - Embedded Credential Detection and Firmware Unpacking Expansion Jun 2, 2026 · release notes

    Finite State adds embedded credential detection via YARA rules and virtual-ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. firmware unpacking support

    • Adds 32 new YARA flag rules to detect AWS access keys, GitHub tokens, Slack tokens, Stripe keys, Google API keys, SSH and PGP private keys, PEM certificates, JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. during binary SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scans with severity-tiered classification
    • Opens a new virtual-ELF conversion pipeline for analyzing SREC, Intel HEX, Cortex-M vector-table, and iMX boot-image firmware formats
    • Adds first-class unpacking support for TP-Link SafeLoader-v2 (Omada/Fusion), UBI/SquashFS volumes with device-tree-blob payloads, Realtek Ameba flash images, and QNX4 boot sectors

    3 details in Everything

57. May 8, 2026 - Custom License Policies, SBOM File Components, and Folder Access S May 8, 2026 · release notes

    Adds org-level license policy management, opt-in file components in SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. exports, and fs-scan auto-update

    • fs-scan binaries now auto-update on startup from signed releases with Ed25519Ed25519A fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe. verification
    • GET /api/public/v0/components returns canonical software identifiers including encoded PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. and full CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. set per component
    • SBOM exports support opt-in file components with CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence.-derived cryptographic hashes via per-project setting

    3 details in Everything

58. May 5, 2026 - License Policy Customization, Folder Permission Fixes, and Scanner May 5, 2026 · release notes

    FSI adds custom license creation, file-level SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. components, and fs-scan auto-update

    • GET /api/public/v0/components returns a softwareIdentifiers block with PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. and CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. data for each component.
    • Adds inline creation of custom licenses with SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format.-style identifiers within license policies, supplementing the standard SPDX catalog.

    2 details in Everything

59. April 29, 2026 - fs-cli Auto-Creates Destination Folders Apr 29, 2026 · release notes

    fs-cli v2.0.14 adds --create-folder flag and env vars to auto-provision destination folders

    • --create-folder flag on scan, upload, import, third-party, and deliver commands finds or creates the destination folder if it does not already exist.
    • --parent-folder and --parent-folder-id flags select the parent for folder creation.
    • FS_CREATE_FOLDER, FS_PARENT_FOLDER, and FS_PARENT_FOLDER_ID environment variables mirror the CLI flags for CI configuration.

    3 details in Everything

60. April 21, 2026 - Direct-to-S3 API Uploads and EPSS-Weighted Scoring UI Apr 21, 2026 · release notes

    Adds direct-to-S3 scan uploads via new API endpoints and EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching.-weighted risk scoring with UI toggles and export fields

    • Adds POST /public/v0/scans/upload endpoint returning presigned S3 URLs for multipart or single-part upload, removing the 210 MB body limit on POST /public/v0/scans
    • Adds EPSS-Weighted Risk Scoring enabled via Settings > Org Config toggle, exposing weighted severity and score columns in CVE findings tables, matching filters, CSV export fields, and EPSS percentile lines in the exploit popover

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The latestOnly query parameter is now required on GET /public/v0/findings to replicate the previous behavior of returning findings only for the latest version; without it, the endpoint returns findings across every accessible project version.
61. April 7, 2026 - Command Line Interface Migration and SPDX Export Fixes Apr 7, 2026 · release notes

    Finite State introduces new CLI installation modal, background processing for unreachable findings, and corrected SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. root package supplier population.

    • Adds a new platform modal dialog to install the Finite State CLI directly, displaying a copyable install command and documentation links
    • Moves auto-resolution of unreachable findings to background processing to eliminate timeouts for large project versions
    • Populates the root project package supplier field in SPDX exports with the organization's configured name

    3 details in Everything

62. April 1, 2026 - EPSS-Weighted Vulnerability Prioritization and Dependency Manage Apr 1, 2026 · release notes

    Finite State adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching.-weighted risk/severity columns to findings table and folder-scoped project search

    • Adds EPSS-weighted risk and EPSS-weighted severity columns to the findings table, available as sortable and filterable fields that combine CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. base scores with exploit probability.
    • Adds a dedicated in-table search input for folder-scoped project search, separating it from the sidebar folder navigation which now filters only the folder tree.

    2 details in Everything

63. March 25, 2026 - Projects Page and Folders Improvements Mar 25, 2026 · release notes

    Finite State adds bulk-project move, folder view search, parallel folder loading, sort/filter parity, and improved project search

    • Adds Bulk "Move to Folder" for batch reorganization from the All Projects and Folders views
    • Enables searching projects within a specific folder via the main search box while browsing the Folders view
    • Improves Folders tab load times up to 4x using parallel data fetching and progressive rendering
    • Adds alphabetical sorting for folders at every nesting level in the sidebar
    • Extends the folder-scoped projects endpoint with sort, filter, and pagination parity including pagination headers

    5 details in Everything

64. March 20, 2026 - Nightly Vulnerability Updates, Jira Integration Enhancements, a Mar 20, 2026 · release notes

    Adds org/project config for nightly vuln updates, Jira ticket type selection, and Python SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. via API/CLI

    • Adds organization-level and project-level settings pages for nightly vulnerability updates, with a global enable/disable toggle and a scope selector (Global vs Per Project)
    • Enable Python SAST (Bandit) scanning via the customer API and CLI by passing type=python during binary upload
    • Select a Jira issue type when creating tickets from the Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. or Findings views, with smart defaulting and per-project type availability

    3 details in Everything

65. March 17, 2026 - Issue Tracking, Vulnerability Updates, and Bug Fixes Mar 17, 2026 · release notes

    Finite State adds Jira issue tracking for findings and org/project-level nightly vulnerability update settings

    • Adds issue tracking in component and finding drawers to view, create, and manage linked Jira tickets directly from the UI

    1 detail in Everything

66. March 11, 2026 - Product Tagging, Dependency Rollups, and Jira Improvements Mar 11, 2026 · release notes

    Product tagging with dependency rollup metrics, Jira ticket type selection, and fixed PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. encoding

    • Adds the ability to tag projects as Products for hierarchical distinction.
    • Provides aggregated component counts, finding totals, and policy violation summaries that roll up through transitive dependency chains for product-tagged projects.
    • Enables filtering and sorting the project list by product tag, dependency count, and reverse-dependency count.
    • Adds a Ticket Type dropdown to the Jira ticket creation dialog for selecting issue types (Bug, Task, Story, etc.).
    • Grants Global Component Editor and Portfolio Viewer roles the ability to create project tickets without requiring additional permissions.

    5 details in Everything

67. February 24, 2026 - Unpack Evaluation and Folder Permissions Feb 24, 2026 · release notes

    Finite State adds AI-powered firmware unpack evaluation and consistent export naming using project name/version

    • Unpack Evaluation feature provides an AI-generated quality score for firmware extraction results after binary analysis.
    • Export filenames now include the human-readable project name and version, replacing internal IDs in SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., component, finding, and dependency exports.

    2 details in Everything

68. February 17, 2026 - Jira Issue Tracking Improvements Feb 17, 2026 · release notes

    Adds Issue Tracking column visibility control and CSV export inclusion

    • Adds the Issue Tracking column to the column toggle menu for showing and hiding the Jira ticket column
    • Adds the Issue Tracking column to CSV exports for component and finding list pages

    2 details in Everything

69. January 29, 2026 - Jira Integration Jan 29, 2026 · release notes

    Adds organization- and project-level Jira integration settings for ticket creation, linking, and bulk management

    • Configures Jira integration settings at the organization level with optional project-level overrides
    • Creates Jira tickets for individual findings or SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. components, or generates them in bulk
    • Displays linked Jira ticket details directly within the Findings and BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. data tables
    • Allows unlinking of Jira tickets from findings or components when needed
    • Tracks all Jira ticket creation and management activity in the audit trail

    5 details in Everything

70. January 8, 2026 - Dependency View and Audit Trail Improvements Jan 8, 2026 · release notes

    Adds Component Status triage feature and Dependency View v2 with server-side search

    • Adds Component Status feature to apply triage statuses (In Review, Needs Review, Confirmed, False Positive, Unknown) for team collaboration
    • Adds Dependency View v2 with incremental loading and server-side search to navigate large dependency trees

    2 details in Everything

71. December 4, 2025 - Component Replacement Dec 4, 2025 · release notes

    New component replacement workflow enables safe SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. updates with preview, dependency preservation, and revert capabilities.

    • Adds Component Replacement functionality to replace components in project versions while preserving dependency relationships
    • Adds Preview Before Replace capability to inspect metadata (supplier, homepage, license, release date) prior to confirmation
    • Adds Revert Replacements capability to remove a replacement and restore the original component
    • Adds Version Propagation to automatically propagate replacement relationships when creating new project versions
    • Adds Audit Trail tracking for all replacement and revert operations with user, timestamp, and comments in event history

    5 details in Everything

72. November 25, 2025 - Nested folders and CLT authentication improvements Nov 25, 2025 · release notes

    Finite State adds nested project folders and CLT auth via env vars or credential files.

    • Adds Add nested folder support with sidebar tree navigation, breadcrumb navigation, and full folder path display in selectors
    • Adds Add environment variable and credential file authentication methods for CLT
    • Adds Add Security Settings section with option to control token embedding in CLT downloads
    • Increases file upload limits to 210MB
    • Enables exporting projects with folder path information included in export files

    +1 more show less

    • Enables sharing folder URLs with preserved state including expanded folders, search, pagination, and sort

    6 details in Everything

73. November 6, 2025 - Improve SBOM downloads, add archive banner, and fix duplicate Nov 6, 2025 · release notes

    Adds archive banners with restore buttons and streamlines SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. download API calls.

    • Adds an archived status banner to project details screens

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Invalid CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. IDs now return a 404 status code instead of a 200 response
74. October 30, 2025 - Add optional vulnerability descriptions in Findings API Oct 30, 2025 · release notes

    Add optional includeAdditionalDetails parameter to Findings API to retrieve vulnerability descriptions

75. September 11, 2025 - EPSS Scoring and Enhanced License Management Sep 11, 2025 · release notes

    EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. Score Policy for vulnerability prioritization and enhanced license management with declared/concluded licenses

    • Introduces EPSS Score Policy component for advanced vulnerability prioritization using exploit prediction scores
    • Supports configured EPSS score thresholds for automated decision-making in risk assessment

    2 details in Everything

76. September 9, 2025 - Project Version Dashboard Sep 9, 2025 · release notes

    New Project Version Dashboard provides real-time overview of security posture via interactive widgets.

    • Adds the Project Version Dashboard UI for a comprehensive view of project version security posture
    • Adds advanced metrics in the dashboard including total components, vulnerabilities, and exploitable findings with reachability analysis
    • Adds exploit intelligence summary with breakdown by exploit types and threat categorization
    • Adds policy status overview with visual compliance status and direct links to violations
    • Adds interactive findings widgets analyzing severity, category, and status with animated counters

    +1 more show less

    • Adds activity monitoring for recent scan activities with 2-second refresh intervals

    6 details in Everything

77. September 4, 2025 - Workflow & Finding Management Sep 4, 2025 · release notes

    Finite State adds API endpoints for component filtering and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. upload alongside UI capability to clear finding statuses

    • Adds component API filtering by name and version via new API endpoints to search across all projects
    • Adds SBOM API endpoint for uploading SBOM files to support automated integration workflows
    • Adds UI capability to clear and reset single or multiple finding statuses simultaneously

    3 details in Everything

78. September 2, 2025 - SBOM Management and Permissions Enhancements Sep 2, 2025 · release notes

    New global component permission and enhanced SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. audit trails in Finite State Platform

    • Adds a new global add component permission allowing global admins to add components to any project
    • Improves SBOM audit trail tracking for uploads and processing activities with detailed logging of all SBOM-related operations

    2 details in Everything

79. August 28, 2025 - Canonical Components & Dashboard Aug 28, 2025 · release notes

    Canonical Components unify aggregated view of component data across all sources; new Copy to Markdown export for findings.

80. August 21, 2025 - Reachability Analysis and EPSS Policy Implementation Aug 21, 2025 · release notes

    Finite State adds reachability analysis for CLT/API and EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. policy thresholds to .fsconfig for vulnerability prioritization

    • Adds reachability analysis capability for both the fs CLI (CLT) and API endpoint to determine if vulnerable code paths are actually executable.
    • Adds configurable EPSS score threshold policy in .fsconfig.yaml via the epss.threshold key to filter vulnerabilities based on exploit likelihood.
    • Introduces CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. external reference type support for complete SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. output format compatibility.

    3 details in Everything

81. August 20, 2025 - Folders & Organization Aug 20, 2025 · release notes

    New folders for project organization with sharing controls; multiple concurrent scans per project version

    • Introduces folder-based organization system for projects with drag-and-drop and bulk operations
    • Adds folder-level permissions and sharing controls to manage team collaboration and access
    • Enables running multiple concurrent security scans per project version with unified result aggregation

    3 details in Everything

82. August 14, 2025 - Exploit Filtering and UI Improvements Aug 14, 2025 · release notes

    Adds exploit-based vulnerability filtering capabilities to the Finite State Platform.

    • Enables filtering vulnerability findings by specific exploit availability for risk prioritization.
    • Adds granular analysis filters to target vulnerabilities by exploit type (e.g., remote, local, DoS).

    2 details in Everything

83. Auto-Resolve Capability for Unreachable Findings Jul 31, 2025 · release notes

    New Auto-Resolve capability adds bulk VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. status updates for unreachable findings via a dedicated UI button.

84. Reachability Analysis for Vulnerability Prioritization Jun 30, 2025 · release notes

    Finite State introduces Reachability Analysis for vulnerability prioritization with a new filter and UI indicators

    • Adds reachability classification (Reachable, Unreachable, Inconclusive) to findings using static code analysis
    • Adds reachability filtering option on the Findings page
    • Adds color-coded badges in the findings table: pink for reachable, teal for unreachable, gray for inconclusive

    3 details in Everything

85. Third-Party Security Scan Import Jun 5, 2025 · release notes

    Finite State adds universal third-party security scan import from 161 tools via UI upload

    • Adds support for importing findings from 161 third-party security scanning tools including SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., container, and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. scanners
    • Adds a new Universal Scan Import interface in the UI for selecting scan types and uploading results with real-time progress tracking
    • Supports major file formats (JSON, XML, CSV, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface.) for third-party security tool integration

    3 details in Everything