2026 Notable Integrations Bug Fixes

INT-10658

Jira Data Center 3.0.2

Lifecycle Mapping configurations save successfully on Jira Data Center instances running PostgreSQL 16 or later.

INT-10559

Azure DevOps 2.13.2

Reachability Analysis results for JavaScript-only and .NET-only pipelines now appear correctly in the Azure DevOps Reachability Analysis report.

INT-10554

IDEA 4.18.2

Component analysis scans complete successfully in IntelliJ IDEA 2026.2 with the IQ plugin.

INT-10445

Jenkins 3.34.3

Container scans using rootless Podman on RPM-based images complete successfully with the Sonatype Container Scanner.

INT-9033

VS 2022-1.1.0

NuGet packages declared as direct dependencies in any project within a solution are now correctly identified as direct in the Visual Studio 2022 extension, ensuring that policy violations appear consistently in both the IDE and IQ Server reports.

INT-9017

VS 2022-1.1.0

Diagnostic logging for the Visual Studio 2022 extension's dependency identification now captures detailed scan activity, including per-project package counts, scan lifecycle events, and a runtime verbose mode, giving support teams the visibility needed to troubleshoot dependency detection issues.

INT-10072

VSCode 1.8.3

Sonatype for VS Code now invokes the Maven dependency plugin by its fully qualified coordinates, preventing Maven project analysis from resolving the wrong dependency-maven-plugin when custom plugin groups are configured.

INT-10082

VSCode 1.8.3

Sonatype for VS Code now correctly detects Maven components when Maven Wrapper output includes Java warnings or ANSI terminal formatting.

INT-10382

Jenkins version 3.34.1

The Sonatype Platform Plugin for Jenkins now connects successfully to newer Sonatype Nexus Repository versions that return the isCloud field in the version endpoint response.

INT-10383

Azure DevOps version 2.13.0

Sonatype for Azure DevOps now clears stale evaluation output before each Sonatype Evaluate task run, preventing policy results and report links from previous evaluations from appearing when the current evaluation fails or exits before producing results.

INT-10404

Azure DevOps version 2.13.0

Sonatype for Azure DevOps now correctly applies Azure Pipelines proxy settings to extension-managed HTTP and HTTPS requests, allowing CI configuration, vulnerability details, telemetry, and other IQ Server API calls to work through enterprise proxies.

INT-10415

Jenkins version 3.34.1

The Sonatype Platform Plugin for Jenkins now uploads Maven components successfully from agent workspaces when a Jenkins HTTP proxy is configured.

INT-10419

Azure DevOps version 2.13.0

Sonatype for Azure DevOps now reports its integration version correctly to Sonatype Lifecycle, preventing supported Azure DevOps evaluations from being rejected when minimum integration version enforcement is enabled.

INT-10420

GitLab CI version 2.12.0

Sonatype for GitLab CI now completes evaluations correctly when /sonatype/evaluate runs multiple times in the same container, preventing recursive wrapper execution that could cause pipeline jobs to hang.

INT-10433

GitLab CI version 2.12.0

Sonatype for GitLab CI now reports the correct GitLab plugin name and version in the User-Agent header instead of the embedded Sonatype IQ CLI identity and version.

INT-9920

Azure DevOps version 2.8.1

When a package.json dependency mismatch is detected during scanning, the scanner now falls back to using the unfiltered lockfile to ensure npm applications are analyzed successfully in Azure DevOps.

INT-10291

IQ CLI version 2.12.0

Scanning pnpm monorepos now correctly resolves the full dependency graph from the root pnpm-lock.yaml across all workspace packages, rather than reading only the root package.json.

INT-10378

Jenkins version 3.34.0

Testing a Nexus Repository Manager 3.x Server connection in Jenkins now succeeds when the server returns additional version fields such as isCloud.

INT-10427

Fortify version 6.0.0

The Fortify SSC integration is now available, enabling customers to connect IQ Server security findings with Fortify Software Security Center.

INT-10007

Jenkins version 3.33.0

The failBuildOnScanningErrors and unstableBuildOnScanningWarnings pipeline flags are now respected when scanning encounters unparseable files (such as malformed SPDX documents embedded in JARs), preventing unexpected UNSTABLE or FAILURE build results.

INT-10100

IQ CLI version 2.11.0

and

Azure DevOps version 2.11.0

Manifest file names are no longer evaluated against proprietary component regex patterns when scanning, ensuring dependencies declared inside files like .csproj are correctly detected regardless of the filename.

INT-10109

Jenkins version 3.32.0

Reachability analysis on Jenkins Kubernetes pod agents now completes successfully, with batch commands passed via a temporary file rather than STDIN to avoid container exec session limitations.

INT-10117

IQ CLI version 2.10.0

Container image names containing "container" as a substring are now parsed correctly when scanning with the IQ CLI, allowing scans to complete successfully.

INT-10132

Jenkins version 3.32.0

Proxy configuration and authentication classes are now serializable, which is required for remote agent support but may affect existing serialized session data. Maven artifact uploads to Nexus Repository Manager 3.x now execute directly on the remote Jenkins agent, eliminating the Jenkins Remoting data path that caused indefinite hangs when publishing large files from agent file systems.

INT-10219

Bamboo version 4.4.1

Policy evaluation scans against pom.xml files complete successfully in the Sonatype for Bamboo Data Center plugin when running on Bamboo Data Center 12.1.3 with JDK 21.

INT-10122

Fortify version 5.4.2

Project version retrieval in the Fortify SSC plugin now uses pagination, preventing database errors when applications have more than 1000 versions.

INT-9828

IQ CLI version 2.8.5

Container scans against private registries now retain the specified port in the image URL, allowing successful scans of images hosted on non-default HTTP or HTTPS ports.

INT-9904

IQ CLI version 2.8.4

Local container scans skip initializing or using the contentDownloader (when run with -D containerScannerMode=sonatype), preventing attempts to fetch bearer tokens or external registry content in proxy-restricted environments.

INT-9771

Jenkins version 3.29.10

Multi-step JavaScript callflow analysis in the Jenkins plugin now filters out unreachable methods so that the Priorities page displays accurate reachability results, consistent with single-step evaluation.

INT-9773

Jenkins version 3.29.10

Temporary folders created during JavaScript callflow analysis in Jenkins are now automatically removed after execution, preventing workspace clutter and unnecessary storage usage.