Sonatype IQ Server Cloud Release Notes

Sonatype Lifecycle now stores audit logs in the database instead of shared log files, preventing corrupted or missing records during high traffic. Existing audit log files remain available during the transition period for access to historical data.

Legal Risk Analyzer dashboard now capture detailed usage and reporting metrics for customers using both Sonatype Lifecycle and Advanced Legal Pack, helping Sonatype improve the accuracy and value of legal obligations reporting.

Various bug fixes.

The Mythos Readiness dashboard now includes an Organization filter, making it easier to focus dashboard data on a specific organization.

Repository component-deletion APIs now allow service accounts to clean up components and purge repositories without System Administrator privileges, reducing the need for elevated access in integration workflows.

Reviewers with waiver approval permissions can now remove pending or rejected waiver requests from Sonatype Lifecycle and Sonatype Repository Firewall, helping teams keep waiver requests current while preserving approved requests for compliance history.

Administrators can now configure audit event retention periods in config.yml, making it easier to adjust retention requirements without code changes or redeployment.

The global search results page now provides searchable and alphabetically sorted filters, See more and See less controls, and persistent selected options, making large result sets easier to filter and manage.

Various bug fixes.

Sonatype Lifecycle now generates policy IDs server-side and replaces any policy ID supplied during policy creation, ensuring consistent and trustworthy policy identification.

Sonatype Repository Firewall now extends policy enforcement, quarantine, and Repository Health Check reporting to Swift proxy repositories in Sonatype Nexus Repository, helping teams protect Swift dependencies from open source risk.

Repositories onboarded through the API now automatically receive an initial Source-stage evaluation and continuous pull request scanning, while a new readiness API supports automated verification of evaluation status at scale.

Sonatype Lifecycle now supports Swift Package.resolved versions 2 and 3, enabling accurate component identification for remote Git dependencies in modern Swift projects while excluding local and registry-based dependencies.

Sonatype Lifecycle now provides Code Insights reports for pull requests that merge the default branch into a non-default branch, enabling teams using GitFlow or Release Flow to complete required merge checks without manual workarounds.

Users with the Waive Policy Violations permission can now delete pending and rejected waiver requests in Sonatype Lifecycle and Sonatype Repository Firewall, while requesters can withdraw their own pending requests to keep waiver requests current.

Various bug fixes.

SaaS tenant admins using a Sonatype-managed identity provider can now access both Invite User and Create User when local or service account management is enabled.

Waiver expiration notifications now extend to Sonatype Lifecycle organization and application owners through email and webhooks, helping the appropriate teams act before waivers expire.

Sonatype has upgraded the embedded httpclient5 library to version 5.6.4, addressing multiple security vulnerabilities, including a critical-severity TLS vulnerability.

Sonatype Lifecycle now provides complete transitive dependency coverage for Yarn Berry v2, v3, and v4 workspace monorepos across PnP and node_modules install modes

Various bug fixes.

Sonatype Lifecycle now reports unsupported SBOM specification versions in build logs for IQ CLI, Jenkins, and Bamboo scans and exits with a scanning error.

Various bug fixes.

The Best Practices Enterprise Reporting dashboard now includes a Return on Investment (ROI) section featuring projected time savings, supporting formulae, and an application-level breakdown, giving teams clearer visibility into the business value of their security investments.

The Mythos Readiness Enterprise Reporting dashboard now includes KPI cards, Components by Format and Component End-of-Life Status visualizations, and a Mythos Affected column to help teams assess component impact and environment readiness more easily.

Various bug fixes.

User token authentication now reduces authentication overhead to improve API response times. Existing tokens are automatically migrated after the next successful login.

Various bug fixes.

Firewall for Docker container image layer downloads now support a configurable timeout of up to 240 minutes, allowing scans to complete successfully in environments with proxy-based antivirus scanning, slow network connections, or large images.

The HeroDevs End-of-Life Components dashboard now makes it easier to identify and investigate affected components by displaying Policy Violation IDs, full component names, and complete Package URLs (PURLs) that consistently include version information across supported package formats.

Various bug fixes.

Policy Waiver Request submitters can now withdraw their own pending requests through the API before a review decision. This reduces coordination overhead when requests need to be corrected or resubmitted.

Various bug fixes.

Support for conda-forge upstreams in Repository Firewall.

Sonatype IQ Server now identifies and reports OSS components embedded in uber JARs using the new Embedded match state, improving visibility into transitive risk and enabling more accurate policy enforcement and vulnerability tracking.

Sonatype Repository Firewall now includes the Firewall Success Metrics enterprise dashboard, providing visibility into quarantine activity, malicious component trends, and key usage metrics with filters for date range, ecosystem, and quarantine type to help measure security posture over time.

The End-of-Life Components dashboard now supports cross-filtering by component version and stage, making it easier to isolate and analyze end-of-life components using the same workflow as the Golden Fixes dashboard.

Automated remediation pull requests now default to GoldenPRs across all ecosystems. To continue receiving non-golden pull requests, enable the nonGoldenPullRequestsEnabled API property.

Reachability analysis now supports .NET components, providing vulnerability reachability insights for NuGet and PE/COFF projects.

Automated remediation can now automatically close stale pull requests in Bitbucket Cloud and Bitbucket Data Center, helping keep repositories clean.

Sonatype IQ Server now securely stores GPG signing configuration and masks GPG passphrases during save and retrieval.

Lifecycle reports now identify scans performed by the Sonatype container scanner in the Triggered By field.

Application IDs with unsupported characters are now automatically normalized, improving compatibility across integrations and policy evaluation.

The Waive Violations tooltip now appears only when no automated waivers are configured, reducing unnecessary guidance.

Waiver expiration information is now displayed consistently on the Priorities and Component Details pages.

Enhanced the Re-Evaluate Report dialog with clearer descriptions of full and quick re-evaluation options.

Optimized InnerSource component search by batching dependency-data queries, significantly improving search performance.

Various bug fixes.

Sonatype Repository Firewall webhooks now support Violation Alert and Waiver Request events, enabling real-time notifications for repository proxy policies.

Various bug fixes.

The new Malware Threat Landscape Dashboard provides a centralized view of malware threats across your software supply chain, helping teams quickly identify, analyze, and respond to malicious components.

The new Legacy Violation Management API enables teams to automate the listing, granting, revoking, and configuration of legacy violation statuses through a supported integration surface.

Various bug fixes.

Users with read permission on individual proxy repositories can now access the Firewall Dashboard with data automatically scoped to only their permitted repositories.

The Firewall Repository Result table now displays separate Evaluation Time and Quarantine Time columns replacing the previous single column that showed evaluation timestamps for all components regardless of quarantine status. The Quarantine Time column displays a date only for currently quarantined components.

Sonatype Firewall can now send email notifications when Firewall waivers are approaching expiration.

Firewall administrators can now configure and manage IQ proxy repositories directly from the Firewall through the new Virtual Repository Managers section. This simplifies integration with external repository managers by eliminating manual API configuration.

A new Waivers tab on the Firewall Dashboard allows administrators to view, filter, and renew policy waivers from a centralized location. Expiration indicators and renewal workflows help teams maintain continuous policy coverage.

Firewall now provides an in-product waiver request workflow that enables developers to submit waiver requests and administrators to review and manage them through a centralized process.

The legacy standalone JAR-only IQ Server distribution has been removed following its published sunset date. Customers using the standalone format must migrate to the platform-bundled JReleaser distribution.

The Swagger API page now renders in dark mode, with improved styling for text, inputs, headers, and authorization dialogs.

Container scanning now captures Red Hat content_sets metadata and includes it in generated CycloneDX BOMs.

The evaluation status endpoint now supports Server-Sent Events (SSE) for real-time policy evaluation updates.

The Lifecycle CLI now supports passing SCM repository URL, branch name, and commit hash via environment variables with automatic Git detection as a fallback.

Auto-remediation pull requests now record whether they were created using a Personal Access Token or GitHub App authentication.

Database connection pool settings are now fully supported across both on-prem and SaaS deployments. This provides consistent tuning options while maintaining compatibility with existing database configurations.

You can now integrate multiple GitHub Apps with a single IQ organization. See the GitHub App Authentication for SCM help documentation.

Various bug fixes.

Redesigned the Success Metrics Enterprise Reporting dashboard by partitioning it into two focused tabs for Program Health and Remediation Ops. The update also adds new remediation metrics, industry benchmarks, and executive summary reporting to help teams track program performance more effectively.

Various bug fixes.

A new Mythos Readiness Enterprise Reporting dashboard helps you identify applications that may be affected by privately disclosed vulnerabilities before CVE information becomes publicly available. The report provides application component inventory data, visibility into newer and golden component versions, and flexible filtering to help teams quickly assess potential impact.

Various bug fixes.

IQ Cloud now displays an in-product maintenance banner across Lifecycle, Repository Firewall, and SBOM Manager so users can stay informed about upcoming maintenance windows.

The new Policy Configuration Export API enables programmatic retrieval of policy configurations across organizations, applications, and repositories, with optional inclusion of inherited parent policies.

Various bug fixes.

Improved startup time for large data migrations between versions and validated database migration consistency.

Improved Legal Attribution Report generation performance and reliability for large applications with thousands of components.

SCM pull request commenting is now enabled by default for Sonatype Lifecycle SaaS tenants, allowing automated PR analysis to begin after configuring an SCM integration while preserving existing tenant settings.

Various bug fixes.

SBOM Manager component details now include a Legal tab with Effective, Declared, and Observed license views aligned with Lifecycle and Firewall. Advanced Legal Pack users can also review obligations and manage license overrides directly from SBOM Manager. (Released in 203.1)

Advanced Search now supports filtering by Legal and Policy Violations, making it easier to identify and prioritize compliance risks across applications.

Various bug fixes.

Repository Firewall now sends webhook notifications when repository-level policy waivers expire, enabling proactive management of temporary security exceptions and helping prevent compliance gaps.

Firewall now supports bulk waivers, allowing users to waive up to 1,000 policy violations in a single operation directly from the Repository Results view. This can also be accomplished using new endpoints in the Firewall API.

The Source Header License page in Advanced Legal Pack now displays copyright notices within independent scrollable containers, preventing excessive page expansion when components contain large numbers of detected headers and keeping navigation controls visible during review.

The AI/ML Dashboard in Sonatype Lifecycle Enterprise Reporting now includes expanded filtering capabilities to help teams analyze AI component usage with greater precision across their organizations.

Added support for .NET reachability analysis for NuGet components.

Various bug fixes.

Sonatype SBOM Manager now continuously evaluates policies across all SBOM versions for each application rather than only the most recent. This provides broader visibility into risk over time.

A configurable evaluation queue distributes processing across instances and supports tuning through version evaluation windows and queue settings, allowing teams to balance coverage and performance. Complete help documentation for this feature will be published shortly.

Improved dashboard performance when multiple organizations or application categories are selected.

Various bug fixes.

Optimized the Developer Priorities API to improve response times under load.

Various bug fixes.

Bitbucket Cloud integrations now require API tokens with scopes as the only supported authentication method, replacing deprecated app passwords and access tokens. For full details, see our Bitbucket Cloud Configuration help documentation.

Introduced the Best Practices Dashboard in Sonatype Lifecycle, providing a centralized view of feature adoption, integration coverage, and scan activity across applications and stages. The dashboard enables teams to identify gaps in Lifecycle usage, monitor enablement of key capabilities such as CI/CD integration and Golden PRs, and improve consistency in DevSecOps workflows through actionable insights into configuration and scanning practices. For full details, see our Best Practices Dashboard help documentation.

Various bug fixes.

Updated the container scanning engine to prioritize Sonatype vulnerability data, ensuring alignment between container scan results and CLI evaluations. External data sources are now used only as a fallback when Sonatype data is unavailable, improving consistency and reliability across analysis methods.

Various bug fixes.

The built-in System Administrator role now includes audit log access by default, aligning with standard administrative capabilities and eliminating the need to create custom roles for this common task. Existing installations will automatically receive this permission update upon upgrade.

Various bug fixes.

Introduced Enterprise Reporting in Sonatype Repository Firewall, providing centralized dashboards that help organizations understand repository risk exposure, malware protection coverage, and trends affecting their software supply chain security posture.

Introduced the Firewall Malware Insights Enterprise Reporting dashboard in Sonatype Repository Firewall, providing visibility into malware detected and quarantined across protected repositories. The dashboard enables security and engineering teams to analyze malware trends, severity levels, attack vectors, and quarantine activity to better understand and strengthen software supply chain protection.

Various bug fixes.

Sonatype Lifecycle Enterprise Reporting now includes a HeroDevs End-of-Life Components dashboard, which provides visibility into open-source components that have reached end-of-life (EOL) and are eligible for HeroDevs support. For full details, see our HeroDevs End-of-Life Components help documentation.

Improved the Advanced Search user interface by clarifying instructional text to remove Lucene-specific assumptions and updating error messaging to provide more accurate and actionable feedback when an index is not found.

The Original BOM tab in SBOM Manager now includes a case-insensitive search that scans keys and values across the entire document, highlights matches with navigation controls, auto-expands results, and maintains responsive performance even for large SBOMs through optimized indexing and on-demand search handling.

Various bug fixes.

Various bug fixes.

New Operational Reporting section provides access to the React2Shell Impact Report for those Lifecycle customers who do not have Enterprise Reporting enabled.

Improvements to page load times in SaaS environments.

Sonatype SBOM Manager now includes an Original BOM tab on the SBOM detail page. This tab lets you view the SBOM exactly as it was uploaded.

NEXUS-49974 & NEXUS-49955 – The Sonatype Repository Firewall Zscaler integration now validates credentials by performing the required category create, update, and delete operations instead of calling /adminUsers/me. This eliminates the need for super admin access.

Various bug fixes.

Components quarantined by age-based policy constraints are now automatically re-evaluated and released once they exceed the defined age threshold, reducing manual intervention and improving development workflow efficiency.

Various bug fixes.