https://cybertoolchain.io/tools/finite-state-platform New releases and features in Finite State Platform, tracked by The Cyber Toolchain. en Mon, 02 Nov 2026 00:00:00 GMT https://docs.finitestate.io/changelog/cve-2026-98432-kernel-reachability https://docs.finitestate.io/changelog/cve-2026-98432-kernel-reachability Mon, 02 Nov 2026 00:00:00 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/component-versions-kernel-vulnerabilities-and-dotnet-end-of-life https://docs.finitestate.io/changelog/component-versions-kernel-vulnerabilities-and-dotnet-end-of-life Fri, 30 Oct 2026 00:00:00 GMT Finite State Platform adds Brotli component detection and raw NAND dump extraction for ext filesystems and U-Boot FIT images⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Finite State Platform now identifies Brotli as a component and reads its version on firmware builds that export one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Finite State Platform now shows end-of-life status for .NET runtime components, including NuGet runtime packs and installer names. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/custom-licenses-and-cve-severity https://docs.finitestate.io/changelog/custom-licenses-and-cve-severity Tue, 27 Oct 2026 00:00:00 GMT Finite State adds custom license lifecycle management via `PATCH /v0/licenses` and `DELETE /v0/licenses`, plus exclusion comment visibility on components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `PATCH /v0/licenses` and `DELETE /v0/licenses` (with `id` as a query parameter) to edit, deprecate, restore, or delete a custom license programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds custom license management to the Settings > Policy > Licenses UI, supporting edit, deprecate, restore, and delete actions with audit trail entries for create, update, and delete. • Extends `GET /api/public/v0/components` and the component detail endpoint to return the exclusion comment, the time of exclusion, and the author who excluded the component. • Records each exclude or include action — including the comment and full component count — in `GET /v0/audit`. • Surfaces the exclusion comment, the excluding user, and the timestamp on the Component view and the Excluded list in the UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/scan-email-notifications https://docs.finitestate.io/changelog/scan-email-notifications Tue, 27 Oct 2026 00:00:00 GMT Finite State adds scan email notifications with per-scope subscriptions and a new `POST /api/public/v0/notifications/subscriptions` endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `POST /api/public/v0/notifications/subscriptions` endpoint to subscribe to email notifications for every scan in a project programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds scan email notifications so the user who started a scan is automatically emailed on scan completion or failure. • Enables subscription to email notifications at three scopes: a single scan, every scan in a Folder, or every scan in a Project. • Adds a 'Notify me' option on a running scan to subscribe mid-flight. • Adds a Notification Settings view where users can choose which events to receive for scans they upload, add a Folder or Project subscription, and filter that list by scope. • Lets organization administrators enable or disable the scan email channel org-wide under Integrations, with a single switch that reflects delivery status even after a recipient has used an unsubscribe link. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/current-version-and-version-order https://docs.finitestate.io/changelog/current-version-and-version-order Mon, 26 Oct 2026 00:00:00 GMT Finite State Platform adds manual Version pinning and ordering on the Versions page, with new API fields to match.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `previousVersion` field to `GET /public/v0/versions/{id}` to expose the preceding version in the API response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `sort=order` query parameter to `GET /public/v0/versions` to list a Project's Versions in the custom order set on the Versions page (e.g. `projectId=<id>&sort=order:desc`). • Adds ability to pin a Version as current on the Versions page, preventing new scans from replacing it, with changes recorded in the Audit trail. • Adds ability to reorder Versions on the Versions page and return to the latest Version from a pinned one. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/project-ownership-transfer-and-project-owner https://docs.finitestate.io/changelog/project-ownership-transfer-and-project-owner Mon, 26 Oct 2026 00:00:00 GMT Finite State Platform adds Project ownership transfer via new PUT API endpoints and bulk UI controls, with owner filtering on existing GET endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `PUT /public/v0/projects/{projectId}/owner` to transfer ownership of a single Project to another user in the organization, with optional `previousOwnerRole` to set the departing owner's role.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `PUT /public/v0/projects/owner` for bulk Project ownership transfer, also accepting `previousOwnerRole`. • Exposes `owner`, `ownerId`, and `ownerDeactivated` fields on `GET /public/v0/projects`, `GET /public/v0/projects/{projectId}`, and `GET /public/v0/folders/{folderId}/projects`, with filter and sort by owner. • Adds a 'Change owner' control to the Projects list and Project settings UI, supporting single and bulk ownership transfer and optionally setting the previous owner's role. • Shows a warning when deactivating or deleting a user who still owns Projects. • Shows Project ownership changes — including previous owner and new owner — on the Audit trail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/all-versions-on-the-projects-page https://docs.finitestate.io/changelog/all-versions-on-the-projects-page Fri, 23 Oct 2026 00:00:00 GMT Finite State Platform adds an 'All versions' tab to the Projects page for org-wide version discovery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an `All versions` tab on the Projects page (positioned between `All projects` and `Folders`) listing every visible version across the organization, sorted newest first, with search to filter by project and row-click to open a version directly — archived project versions are excluded.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/folder-project-lists-and-dependency-versions https://docs.finitestate.io/changelog/folder-project-lists-and-dependency-versions Thu, 22 Oct 2026 00:00:00 GMT Finite State adds subfolder project listing, deprecated SPDX license support, and dependency version editing via API and UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `includeSubfolders=true` query parameter on `GET /public/v0/folders/{folderId}/projects` to return projects in a folder and all its subfolders in a single request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `includeSubfolderProjectCount=true` query parameter on `GET /public/v0/folders` and `GET /public/v0/folders/{folderId}` to include each folder's project count across subfolders. • Includes deprecated SPDX licenses in `GET /public/v0/licenses` by default (listed after current licenses); adds `filter=false` to exclude them. • Lists deprecated SPDX licenses in the Add Licenses UI with a 'Deprecated' badge, including those that share a name with a current license. • Adds optional `archived` parameter on `GET /public/v0/versions` to filter versions by whether the owning project is archived. • Supports changing a project dependency's version via `dependencyProjectVersionId` on `PUT /public/v0/project-dependencies/{dependencyId}` without removing and re-adding the dependency. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/finding-history-and-license-details https://docs.finitestate.io/changelog/finding-history-and-license-details Mon, 19 Oct 2026 00:00:00 GMT Finite State Platform now shows Finding history and complete declared license details to Project/Folder viewers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Exposes Finding history — including status updates and comments — to any user who has view access to the Project or Folder.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/ https://docs.finitestate.io/changelog/ Sun, 18 Oct 2026 07:49:56 GMT Finite State Platform: Adds `GET /api/public/v0/versions/{baseVersionId}/compare/{targetVersionId}` to compare two Project Versions by Findings and Components changed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Loads Project details and permissions together on `GET /api/public/v0/projects`, eliminating the serial wait between the two fetches. • Opens Policy Overview severity and exploit rows by clicking anywhere on the row. • Opens License Violations and License Warnings from Policy Overview on the components for that specific license policy, not every policy finding. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/component-detection-and-kernel-reachability https://docs.finitestate.io/changelog/component-detection-and-kernel-reachability Fri, 16 Oct 2026 00:00:00 GMT Binary scans now detect nanoMODBUS, nanoprintf, cifra, TinyCrypt, and MPLAB Harmony libraries in firmware.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds component detection for nanoMODBUS, nanoprintf, cifra, TinyCrypt, and MPLAB Harmony libraries in binary firmware scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/version-counts-component-pages-and-rescan https://docs.finitestate.io/changelog/version-counts-component-pages-and-rescan Wed, 14 Oct 2026 00:00:00 GMT Finite State adds 503 COMPARISON_BUSY with Retry-After on version compare, Policy Overview row navigation, and re-scan conflict signaling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `503 COMPARISON_BUSY` with `Retry-After: 2` header from `GET /api/public/v0/versions/{baseVersionId}/compare/{targetVersionId}` when too many Version comparisons are running at once, enabling retry logic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `409 SCAN_CONFIG_CONFLICT` from `POST /api/public/v0/versions/{projectVersionId}/rescan` when a basic scan and Quick scan are combined before a Version is renamed, making a refused re-scan distinguishable from one that started. • Loads a page of 10,000 components from `GET /api/public/v0/components` within the request time limit. • Policy Overview severity and exploit rows now open the matching component or finding list when clicked anywhere on the row, and License Violations/Warnings rows open only the findings for that specific license policy. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/netx-duo-binary-sast-and-reachability-fixes https://docs.finitestate.io/changelog/netx-duo-binary-sast-and-reachability-fixes Tue, 13 Oct 2026 00:00:00 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/compare-versions-and-component-fixes https://docs.finitestate.io/changelog/compare-versions-and-component-fixes Mon, 12 Oct 2026 00:00:00 GMT Finite State adds a version-comparison endpoint and parallel project permission loading to accelerate Finding triage and Component review.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `GET /api/public/v0/versions/{baseVersionId}/compare/{targetVersionId}` to compare two Versions of a Project, returning Findings introduced, no longer present, or changed, and Components added, removed, or changed version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Loads Project details and permissions together on `GET /api/public/v0/projects` in parallel, eliminating the serial wait between the two fetches. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/project-audit-trail-and-product-reachability https://docs.finitestate.io/changelog/project-audit-trail-and-product-reachability Wed, 07 Oct 2026 00:00:00 GMT Finite State adds Project-scoped Audit trail filtering, CSV export, and a per-Project Audit trail page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `Project` column, filter, and CSV field to the Audit trail so events can be sliced and exported by Project.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a dedicated Audit trail page on each Project for viewing that Project's events in isolation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/project-on-audit-events https://docs.finitestate.io/changelog/project-on-audit-events Wed, 07 Oct 2026 00:00:00 GMT Finite State audit-event endpoints now return project id and name, letting security engineers trace events to a specific Project.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `project` object (with `id` and `name`) to responses from `GET /public/v0/audit`, `GET /public/v0/audit/{id}`, `GET /public/v0/audit-events`, `GET /public/v0/audit-events/{id}`, and `GET /public/v0/projects/{projectId}/audit` whenever the event is associated with a Project.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • The `id`, `userId`, and `projectId` filter parameters (e.g. `?userId=`) on `GET /public/v0/audit`, `GET /public/v0/audit-events`, and `GET /public/v0/projects/{projectId}/audit` now accept only hyphenated UUIDs; hyphen-less and brace-wrapped UUIDs previously accepted will now return HTTP 400 with an error naming the field and value. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/cyclonedx-vex-menu-file-download-sbom-export https://docs.finitestate.io/changelog/cyclonedx-vex-menu-file-download-sbom-export Thu, 01 Oct 2026 00:00:00 GMT Finite State adds CycloneDX VEX downloads to the Generate SBOM menu, backed by a new GET /public/v0/vex/cyclonedx/{projectVersionId} endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `GET /public/v0/vex/cyclonedx/{projectVersionId}` endpoint to retrieve CycloneDX VEX data for a project version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds 'CycloneDX VEX (vulnerabilities only)' and 'CycloneDX VEX (triaged only)' download options to the Generate SBOM menu on a Version. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/version-rescan https://docs.finitestate.io/changelog/version-rescan Wed, 30 Sep 2026 00:00:00 GMT Finite State Platform adds Version Rescan, letting analysts re-run a scan from the stored file while checkpointing prior results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Rescan on Version: confirms and checkpoints the current Version, starts a new Version under the original name, and re-runs the scan from the stored file — for binary scans, analysts can choose which analyses to run while prior results remain accessible on the checkpoint Version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/cyclonedx-vex-export https://docs.finitestate.io/changelog/cyclonedx-vex-export Tue, 29 Sep 2026 00:00:00 GMT Finite State adds a standalone CycloneDX 1.6 VEX export endpoint with optional triage filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `GET /public/v0/vex/cyclonedx/{projectVersionId}` endpoint to export a standalone CycloneDX 1.6 VEX document containing vulnerabilities and analysis, without Components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports optional `triagedOnly=true` query parameter on the VEX export endpoint to return only Findings that have a VEX status. • Improves Policy evaluation after Component and Finding edits so Policy status stays current without queuing behind other Policy work on the same Version. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/project-name-checks-finding-vex-and-component-replace https://docs.finitestate.io/changelog/project-name-checks-finding-vex-and-component-replace Mon, 28 Sep 2026 00:00:00 GMT Finite State Platform now logs USER_DELETED audit events, retains VEX/comments through reassessment, and speeds up Component replace on large Versions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `USER_DELETED` audit event to `GET /public/v0/audit` — including the deleted user's `id` and `email` — when `DELETE /public/v0/users/{id}` succeeds, and terminates the deleted user's active sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Speeds up Component replace and revert on large Versions by evaluating license Policy once per Component rather than per finding. • Preserves Findings that carry a VEX status or a comment (including SBOM-supplied VEX and triage) through reassessment after exclude, include, replace, or revert operations. • Filtered, searched, and row-selected Findings CSV exports now use the same column header labels as the unfiltered export instead of raw internal key names. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/scan-queue-api-version-counts-and-license-filters https://docs.finitestate.io/changelog/scan-queue-api-version-counts-and-license-filters Tue, 22 Sep 2026 00:00:00 GMT Finite State adds a Scans page with live queue visibility and two new API endpoints for scan queue health and snapshots.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `GET /public/v0/scans/analysis` endpoint returning Scan queue totals, success rate, and duration metrics for a selected period.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `GET /public/v0/scans/ops-snapshot` endpoint returning the current live running and queued Scan snapshot. • Extends `GET /public/v0/scans` to include processing time, Finding count, start time, and filter/sort by who initiated the Scan. • Adds a Scans page showing live Processing and Queued counts, scan history grouped by Project and Version, and volume and duration metrics. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/distro-patch-detection https://docs.finitestate.io/changelog/distro-patch-detection Thu, 17 Sep 2026 00:00:00 GMT Finite State now auto-resolves findings when a Linux distro package already contains a vendor-authored CVE patch, with advisory evidence in the audit trail.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports vendor-patch recognition for Debian, Ubuntu, Alpine, Wolfi, Chainguard, MinimOS, Red Hat Enterprise Linux, AlmaLinux, Rocky Linux, and openSUSE Leap packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/firmware-unpacking-and-reachability https://docs.finitestate.io/changelog/firmware-unpacking-and-reachability Thu, 10 Sep 2026 00:00:00 GMT Finite State adds Phoenix Contact FL SWITCH 2000 unpacking, broader Reachability verdicts, and static-library component detection across more firmware formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Unpacks Phoenix Contact FL SWITCH 2000 firmware updates so the Linux root filesystem and its Components appear in scan results and produce a complete SBOM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Returns a clear error when importing an SPDX 3.x SBOM stating that SPDX 3.x is not yet supported, instead of a generic format-detection failure. • Records generation context as `after-build` on binary scan SBOMs, matching the CISA SBOM minimum elements. • Identifies additional static-library Components — including picolibc, PCRE2, glib, and LLVM runtimes — that previously had no signature coverage. • Treats static library archives (`.a` files) as a single Component and scans them directly, instead of unpacking into hundreds of object-file rows. • Keeps embedded resources in Windows executables, including those used by Delphi applications, so they are analyzed instead of discarded. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/empty-license-policy-and-source-column https://docs.finitestate.io/changelog/empty-license-policy-and-source-column Thu, 27 Aug 2026 00:00:00 GMT Finite State Platform adds a License Policy setting to flag and severity-label Components with no license on the Bill of Materials. • Adds a License Policy setting for Components with no license, letting you assign a severity and label that appears on the Bill of Materials. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/empty-license-policy-and-source-column https://docs.finitestate.io/changelog/empty-license-policy-and-source-column Thu, 27 Aug 2026 00:00:00 GMT Finite State Platform lets License Policy flag components with no license, assigning severity and BOM labels. • Adds a License Policy setting for components with no license, enabling assignment of a severity and label that appears on the Bill of Materials. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/esp32-and-bluetooth-audio-firmware-unpacking https://docs.finitestate.io/changelog/esp32-and-bluetooth-audio-firmware-unpacking Mon, 24 Aug 2026 00:00:00 GMT Finite State now unpacks ESP32 and Airoha Bluetooth-audio firmware and exports CycloneDX 1.6 SBOMs with author metadata. • Unpacks Espressif ESP32 firmware images, including full flash dumps, so those devices are analyzed as firmware rather than as an unidentified blob. • Unpacks Airoha Bluetooth-audio firmware and identifies the vendor SDK and DSP components, producing a complete SBOM for those images. • Exports binary scan SBOMs as CycloneDX 1.6 with author metadata included. • Saves reachability results with the scan and applies them before binary assessment so later analysis uses a consistent verdict. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/esp32-and-bluetooth-audio-firmware-unpacking https://docs.finitestate.io/changelog/esp32-and-bluetooth-audio-firmware-unpacking Mon, 24 Aug 2026 00:00:00 GMT Finite State now unpacks ESP32 and Airoha Bluetooth-audio firmware and exports CycloneDX 1.6 SBOMs with author metadata. • Exports binary scan SBOMs as CycloneDX 1.6 with author metadata, producing auditor-ready documents from binary analysis. • Unpacks Espressif ESP32 firmware images, including full flash dumps, so ESP32 devices are analyzed as firmware rather than unidentified blobs. • Unpacks Airoha Bluetooth-audio firmware and identifies vendor SDK and DSP components, enabling complete SBOMs from those images. • Saves reachability results with the scan and applies them before binary assessment so all later analysis uses a consistent verdict. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/whats-new-drawer-and-platform-reliability-fixes https://docs.finitestate.io/changelog/whats-new-drawer-and-platform-reliability-fixes Wed, 12 Aug 2026 00:00:00 GMT Finite State adds an in-product What's New drawer and improves license search, Findings filtering, and API reliability. • Adds an in-product What's New drawer that surfaces release highlights from the documentation feed whenever new customer-facing updates are published. • Improves license search so prefix matches appear before substring matches in the Add Licenses and Component license pickers. • Updates the License Policy page to source the live license catalog and display a retryable error state when the catalog cannot load. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/component-replacement-sbom-validation-and-reliability-improvements https://docs.finitestate.io/changelog/component-replacement-sbom-validation-and-reliability-improvements Thu, 23 Jul 2026 00:00:00 GMT Finite State adds match evidence to findings CSV exports, carry-forward component exclusions, and modernized Bamboo/Jenkins CI/CD plugins. • Adds match evidence (file paths associated with each vulnerable component) to the findings CSV export, enabling precise remediation targeting. • Carries component exclusions forward to newly scanned versions by default, reducing repeated manual configuration. • Updates Bamboo and Jenkins CI/CD plugins to use the upgraded API, with the Jenkins plugin now published to the Jenkins Update Center. • Queues binary scan uploads that exceed the concurrency limit instead of rejecting them, and automatically cleans up scans stuck in a started state. • Recomputes policy violations and warnings automatically on very large versions when policy settings or vulnerability data change, without requiring a new scan. • Persists table sorting across your session on the Bill of Materials, All Components, and Project Dependencies tables. • Adds column tooltips, consistent number formatting, user display names, and clickable policy-status badges to data tables across the platform. • Accepts legacy identifiers across the upgraded API, including the legacy `projectVersion` query parameter as a deprecated alias for `versionId`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/license-label-visibility-and-scan-reliability/ https://docs.finitestate.io/changelog/license-label-visibility-and-scan-reliability/ Wed, 10 Jun 2026 00:00:00 GMT License policy labels now visible in the component list for all users with access; deterministic project-name resolution fixes scan upload reliability. • Show the license policy label and its filter chip to any user with access to a component's bill of materials, removing the need for a separate org-level policy configuration permission — security engineers and compliance analysts can now filter and review license labels directly from the component list Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/license-policy-labels-and-bulk-exclusion/ https://docs.finitestate.io/changelog/license-policy-labels-and-bulk-exclusion/ Fri, 05 Jun 2026 00:00:00 GMT Adds configurable labels to license policies and uncapped bulk component exclude/include via UI. • Add configurable labels to license policies — admins set labels in policy settings, and users see them alongside policy violations in the Bill of Materials and can filter components by label • Bulk exclude or include components matching a filter across all pages, not just the current page Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/embedded-credential-detection-and-firmware-unpacking/ https://docs.finitestate.io/changelog/embedded-credential-detection-and-firmware-unpacking/ Tue, 02 Jun 2026 00:00:00 GMT Finite State adds embedded credential detection via YARA rules and virtual-ELF firmware unpacking support • Adds `32 new YARA flag rules` to detect AWS access keys, GitHub tokens, Slack tokens, Stripe keys, Google API keys, SSH and PGP private keys, PEM certificates, JWTs during binary SCA scans with severity-tiered classification • Opens a new virtual-ELF conversion pipeline for analyzing SREC, Intel HEX, Cortex-M vector-table, and iMX boot-image firmware formats • Adds first-class unpacking support for TP-Link SafeLoader-v2 (Omada/Fusion), UBI/SquashFS volumes with device-tree-blob payloads, Realtek Ameba flash images, and QNX4 boot sectors Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/license-policies-sbom-files-and-folder-security/ https://docs.finitestate.io/changelog/license-policies-sbom-files-and-folder-security/ Fri, 08 May 2026 00:00:00 GMT Adds org-level license policy management, opt-in file components in SBOM exports, and fs-scan auto-update • `fs-scan` binaries now auto-update on startup from signed releases with Ed25519 verification • GET /api/public/v0/components returns canonical software identifiers including encoded PURL and full CPE set per component • SBOM exports support opt-in file components with CycloneDX-derived cryptographic hashes via per-project setting Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/license-policy-customization-and-folder-permission-improvements/ https://docs.finitestate.io/changelog/license-policy-customization-and-folder-permission-improvements/ Tue, 05 May 2026 00:00:00 GMT FSI adds custom license creation, file-level SBOM components, and fs-scan auto-update • `GET /api/public/v0/components` returns a `softwareIdentifiers` block with PURL and CPE data for each component. • Adds inline creation of custom licenses with SPDX-style identifiers within license policies, supplementing the standard SPDX catalog. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/fs-cli-folder-auto-creation/ https://docs.finitestate.io/changelog/fs-cli-folder-auto-creation/ Wed, 29 Apr 2026 00:00:00 GMT fs-cli v2.0.14 adds --create-folder flag and env vars to auto-provision destination folders • `--create-folder` flag on `scan`, `upload`, `import`, `third-party`, and `deliver` commands finds or creates the destination folder if it does not already exist. • `--parent-folder` and `--parent-folder-id` flags select the parent for folder creation. • `FS_CREATE_FOLDER`, `FS_PARENT_FOLDER`, and `FS_PARENT_FOLDER_ID` environment variables mirror the CLI flags for CI configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/direct-to-s3-uploads-and-epss-scoring-ui/ https://docs.finitestate.io/changelog/direct-to-s3-uploads-and-epss-scoring-ui/ Tue, 21 Apr 2026 00:00:00 GMT Adds direct-to-S3 scan uploads via new API endpoints and EPSS-weighted risk scoring with UI toggles and export fields • Adds `POST /public/v0/scans/upload` endpoint returning presigned S3 URLs for multipart or single-part upload, removing the 210 MB body limit on `POST /public/v0/scans` • Adds EPSS-Weighted Risk Scoring enabled via `Settings > Org Config` toggle, exposing weighted severity and score columns in CVE findings tables, matching filters, CSV export fields, and EPSS percentile lines in the exploit popover Breaking changes: • The `latestOnly` query parameter is now required on `GET /public/v0/findings` to replicate the previous behavior of returning findings only for the latest version; without it, the endpoint returns findings across every accessible project version. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/cli-migration-and-export-fixes/ https://docs.finitestate.io/changelog/cli-migration-and-export-fixes/ Tue, 07 Apr 2026 00:00:00 GMT Finite State introduces new CLI installation modal, background processing for unreachable findings, and corrected SPDX root package supplier population. • Adds a new platform modal dialog to install the Finite State CLI directly, displaying a copyable install command and documentation links • Moves auto-resolution of unreachable findings to background processing to eliminate timeouts for large project versions • Populates the root project package supplier field in SPDX exports with the organization's configured name Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/epss-prioritization-and-dependency-management/ https://docs.finitestate.io/changelog/epss-prioritization-and-dependency-management/ Wed, 01 Apr 2026 00:00:00 GMT Finite State adds EPSS-weighted risk/severity columns to findings table and folder-scoped project search • Adds `EPSS-weighted risk` and `EPSS-weighted severity` columns to the findings table, available as sortable and filterable fields that combine CVSS base scores with exploit probability. • Adds a dedicated in-table search input for folder-scoped project search, separating it from the sidebar folder navigation which now filters only the folder tree. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/projects-and-folders-improvements/ https://docs.finitestate.io/changelog/projects-and-folders-improvements/ Wed, 25 Mar 2026 00:00:00 GMT Finite State adds bulk-project move, folder view search, parallel folder loading, sort/filter parity, and improved project search • Adds `Bulk "Move to Folder"` for batch reorganization from the All Projects and Folders views • Enables searching projects within a specific folder via the main search box while browsing the Folders view • Improves Folders tab load times up to 4x using parallel data fetching and progressive rendering • Adds alphabetical sorting for folders at every nesting level in the sidebar • Extends the folder-scoped projects endpoint with sort, filter, and pagination parity including pagination headers Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/nightly-updates-jira-enhancements-and-projects-table-fixes/ https://docs.finitestate.io/changelog/nightly-updates-jira-enhancements-and-projects-table-fixes/ Fri, 20 Mar 2026 00:00:00 GMT Adds org/project config for nightly vuln updates, Jira ticket type selection, and Python SAST via API/CLI • Adds organization-level and project-level settings pages for nightly vulnerability updates, with a global enable/disable toggle and a scope selector (Global vs Per Project) • Enable Python SAST (Bandit) scanning via the customer API and CLI by passing `type=python` during binary upload • Select a Jira issue type when creating tickets from the Bill of Materials or Findings views, with smart defaulting and per-project type availability Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/2026-03-17-platform-update/ https://docs.finitestate.io/changelog/2026-03-17-platform-update/ Tue, 17 Mar 2026 00:00:00 GMT Finite State adds Jira issue tracking for findings and org/project-level nightly vulnerability update settings • Adds `issue tracking` in component and finding drawers to view, create, and manage linked Jira tickets directly from the UI Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/product-tagging-and-jira-improvements/ https://docs.finitestate.io/changelog/product-tagging-and-jira-improvements/ Wed, 11 Mar 2026 00:00:00 GMT Product tagging with dependency rollup metrics, Jira ticket type selection, and fixed PURL encoding • Adds the ability to tag projects as 'Products' for hierarchical distinction. • Provides aggregated component counts, finding totals, and policy violation summaries that roll up through transitive dependency chains for product-tagged projects. • Enables filtering and sorting the project list by product tag, dependency count, and reverse-dependency count. • Adds a Ticket Type dropdown to the Jira ticket creation dialog for selecting issue types (Bug, Task, Story, etc.). • Grants Global Component Editor and Portfolio Viewer roles the ability to create project tickets without requiring additional permissions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/unpack-evaluation-and-folder-permissions/ https://docs.finitestate.io/changelog/unpack-evaluation-and-folder-permissions/ Tue, 24 Feb 2026 00:00:00 GMT Finite State adds AI-powered firmware unpack evaluation and consistent export naming using project name/version • `Unpack Evaluation` feature provides an AI-generated quality score for firmware extraction results after binary analysis. • Export filenames now include the human-readable `project name` and `version`, replacing internal IDs in SBOM, component, finding, and dependency exports. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/jira-issue-tracking-improvements/ https://docs.finitestate.io/changelog/jira-issue-tracking-improvements/ Tue, 17 Feb 2026 00:00:00 GMT Adds Issue Tracking column visibility control and CSV export inclusion • Adds the `Issue Tracking` column to the column toggle menu for showing and hiding the Jira ticket column • Adds the `Issue Tracking` column to CSV exports for component and finding list pages Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/jira-integration/ https://docs.finitestate.io/changelog/jira-integration/ Thu, 29 Jan 2026 00:00:00 GMT Adds organization- and project-level Jira integration settings for ticket creation, linking, and bulk management • Configures Jira integration settings at the organization level with optional project-level overrides • Creates Jira tickets for individual findings or SBOM components, or generates them in bulk • Displays linked Jira ticket details directly within the Findings and BOM data tables • Allows unlinking of Jira tickets from findings or components when needed • Tracks all Jira ticket creation and management activity in the audit trail Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/dependency-view-and-audit-trail/ https://docs.finitestate.io/changelog/dependency-view-and-audit-trail/ Thu, 08 Jan 2026 00:00:00 GMT Adds Component Status triage feature and Dependency View v2 with server-side search • Adds `Component Status` feature to apply triage statuses (In Review, Needs Review, Confirmed, False Positive, Unknown) for team collaboration • Adds Dependency View v2 with incremental loading and server-side search to navigate large dependency trees Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/component-replacement/ https://docs.finitestate.io/changelog/component-replacement/ Thu, 04 Dec 2025 00:00:00 GMT New component replacement workflow enables safe SBOM updates with preview, dependency preservation, and revert capabilities. • Adds `Component Replacement` functionality to replace components in project versions while preserving dependency relationships • Adds `Preview Before Replace` capability to inspect metadata (supplier, homepage, license, release date) prior to confirmation • Adds `Revert Replacements` capability to remove a replacement and restore the original component • Adds `Version Propagation` to automatically propagate replacement relationships when creating new project versions • Adds `Audit Trail` tracking for all replacement and revert operations with user, timestamp, and comments in event history Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/2025/11/25/nested-folders-and-cli-security/ https://docs.finitestate.io/changelog/2025/11/25/nested-folders-and-cli-security/ Tue, 25 Nov 2025 00:00:00 GMT Finite State adds nested project folders and CLT auth via env vars or credential files. • Adds `Add nested folder support` with sidebar tree navigation, breadcrumb navigation, and full folder path display in selectors • Adds `Add environment variable and credential file authentication methods for CLT` • Adds `Add Security Settings section with option to control token embedding in CLT downloads` • Increases file upload limits to 210MB • Enables exporting projects with folder path information included in export files • Enables sharing folder URLs with preserved state including expanded folders, search, pagination, and sort Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/2025/11/06/sbom-download-performance/ https://docs.finitestate.io/changelog/2025/11/06/sbom-download-performance/ Thu, 06 Nov 2025 00:00:00 GMT Adds archive banners with restore buttons and streamlines SBOM download API calls. • Adds an `archived` status banner to project details screens Breaking changes: • Invalid CWE IDs now return a `404` status code instead of a `200` response Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform https://docs.finitestate.io/changelog/2025/10/30/component-fixes-and-improvements/ https://docs.finitestate.io/changelog/2025/10/30/component-fixes-and-improvements/ Thu, 30 Oct 2025 00:00:00 GMT Add optional `includeAdditionalDetails` parameter to Findings API to retrieve vulnerability descriptions • Adds optional `includeAdditionalDetails` query parameter to Findings API to enable retrieval of detailed vulnerability descriptions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/finite-state-platform