2020 Release Notes

InnerSource dependency analysis allows a user to visualize InnerSource components and their transitive dependencies in a report with links to any associated applications.

The application and component evaluation have been updated to support Java 14 and 15 bytecode.

Automated pull request feedback is now available for Gradle projects in all supported Source Control Management platforms.

Read the SCM documentation to learn more about configuring automated PRs, PR reviews, and code line comments to work with Gradle.

Two additional columns have been added to the exported file from the dashboard's violation tab:

The User Token UI allows each user to manage their User Token directly from the IQ Server.

The User Token API has a new endpoint that allows checking if a User Token exists for the current user.

Fixed an XML External Entity (XXE) vulnerability affecting IQ Server parsing of admin-submitted SAML metadata.

See the CVE-2020-29436 advisory for details.

Nexus IQ CLI no longer supports Lifecycle XC. IQ Server now has native support for all languages that were supported in Lifecycle XC.

PackageUrl for pecoff has a new structure. The namespace is part of the qualifiers with the key "nexusnamespace", older versions will not change. More information can be found in our supported formats.

The Manifest Evaluation REST API provides a way to perform an application policy evaluation on supported manifest files discovered in a source control branch.

The Waivers for Violation page allows viewing, adding, and deleting waivers for a violation.

Now Add Waiver page allows setting an expiration timeframe for the waiver.

Advanced Remediation Strategies, Hygiene Ratings, Breaking Changes, and Release Integrity capabilities are made Generally Available as part of the Advanced Development Pack add-on product license.

Add Waiver API now has the option to apply an expiry time to waivers as a means to better manage and remove waivers. When the timeframe for the expiry time has been met, the waiver will automatically expire.

GitLab MR reviews now provide MR line comments, noting the exact line of code that caused a policy violation. Supplemented with the summary of policy violations for a specific MR, developers have all the information at their fingertips to innovate with peace of mind.

IQ Server (through CLI) now supports evaluating policies against Go components defined in a Gopkg.lock file.

Installations that have not yet been created and configured in the Root Organization will automatically be migrated to a Root Organization with no policies defined.

Previously, the search index had to be rebuilt manually to ensure search results reflected the latest policy configuration and application data. This release starts adding an incremental update of the search index that runs automatically when the application data is changed. Automatic indexing currently covers organizations, applications, application categories, component labels, policies, and security vulnerabilities found during policy evaluations.

IQ Server now drops inbound requests containing in-the-path characters known to be used for unsafe purposes (semicolons, backslash, and unescaped non-ASCII characters).

GitLab MR reviews provide an MR comment with a summary of violations, affected components, and a description of violations introduced in that specific MR to help developers resolve policy violations effectively and efficiently.

IQ Server user sessions are now kept when the server is stopped such that they can continue to be used when the server is restarted as long as they have not timed out.

The Applicable Waivers REST API enables retrieval of all the waivers applicable to a given policy violation.

The Add Waiver page provides the ability to apply a waiver against a policy violation from two different workflows. You can access the Add Waiver page either directly from the Application Report or from the Violation Details page.

The SAML implementation in IQ Server has been updated and now requires the "Destination" field to be set if the SAML messages (request/response) are signed. This is in accordance with the SAML specification and if not done you may encounter an authentication error.

Email notifications for repository policy violations are sent now when the policy violation is detected instead of periodically.

Security Vulnerability Category is now available as a policy condition. See Understanding the Parts of a Policy for details and Policy Management.

The addition of the Security Vulnerability Override API now allows security vulnerability status overrides to be retrieved alongside information about the components where they are currently taking effect.

Policy Waiver REST API allows adding waivers with Application, Organization, or Root Organization scope. The API has the option to apply a waiver to all components with matching policy violations.

Support Automated Pull Requests for GitLab where pull requests are automatically created for policy violations with suggested remediation.

Check the configuration of your source control setup for appropriate permissions for pull requests.

Show recent automated pull request activity in the source control configuration screen.

Dependency Type is now available as a policy condition. See Understanding the Parts of a Policy for details and Policy Management.

IQ Server (through CLI) now supports evaluating policies against

Various performance improvements for accessing LDAP servers

Some PE/COFF component report data (raw/PDF-printed) and Component Information Panel (CIP) data may cause errors in rendering. The application log file would have contained messages such as MalformedPackageURLException: Segments in the namespace and the subpath may not be empty. This rendering problem is now resolved.

Components found in a manifest that were previously unknown by Sonatype will be shown in the CIP as identified by "Package Manifest" displaying the given coordinates in the scanned file.

Nuget data matching has been enhanced with PE (Portable Executable)/COFF (Common Objective File Format) data:

With the enhanced data, the identification of the following extensions is now supported: .acm, .ax, .cpl, .dll, .drv, .efi, .exe, .mui, .ocx, .scr, .sys, .tsp

The Reporting Area in IQ Server's UI is now paged, increasing performance by decreasing load time.

Improved the performance in various areas (UI, REST APIs, etc).

The configuration for LDAP connections now features an additional option to control how LDAP referrals are handled.

PR reviews available in GitHub and BitBucket now provide PR line comments, noting the exact line that introduced a policy violation. Supplemented with the summary of policy violations for a specific PR, developers have all the information at their fingertips to innovate with peace of mind.

The UI for saving, loading, and deleting Dashboard filters is simplified. Now the Save button is accessible directly in the sidebar footer. Saved filters can be loaded and deleted from the single dropdown menu.

IQ Server (through CLI) can now be used to evaluate policies against components defined in a conanfile.py file.

Policy violations can now be retrieved using the Cross-stage violation API to get information on a particular policy violation across the different stages of the lifecycle.

Centralized access point for policy violation information. It can be accessed from the Dashboard to obtain detailed information on a specific policy violation for an application, including report information across different stages of the lifecycle.

The Advanced Search is still an early access feature but one of its caveats has now been resolved: Search results are now filtered to only include those records the user has "View" permission for.

An additional recommended version is added to Component Info - Next version with no build failure violations.

Improved the performance when using an external database for policy evaluations, application reports UI, application reports, and other REST APIs.

The static resources like images that are needed to view email notifications are now retrieved via HTTPS instead of HTTP. Please make sure your network allows outbound connections as detailed in Configuring Outbound Traffic.

Policy Waivers can now be retrieved using the updated Policy Waivers REST API.

Application Categories can now be managed using the REST API.

Improved the performance of policy evaluations when using an external database.

IQ Server (through CLI) can now be used to evaluate policies against components from dependency files of Yum

Data Source is now available as a policy condition.

Firewall is extended to support packages of the following languages/ecosystems:

It is recommended to upgrade to the latest Reference Policy Set (reference-policies-v4) with the Component-Unknown policy changes.

Policy Waivers can now be deleted using the updated Policy Waivers REST API.

Component Labels can now be managed using the updated Component Labels REST API.

IQ Server (through CLI) can now be used to evaluate policies against components from dependency files of:

Support for both Bitbucket Server and Bitbucket Cloud has been added to Automated Pull Requests and Build Status.

The storage for Firewall data has been refactored to be faster and to require less disk space. A small performance impact may be noticed after the upgrade (for a few hours) until the existing data is migrated.

The Component Evaluation REST API now includes data about effective component licenses.

The Report-related REST API now includes data about effective component licenses.

IQ Server (through CLI) can now be used to evaluate policies against components from dependency files of:

The look and feel of the PDF Report for the Application Composition Report has been updated and streamlined to align more with the IQ Server's UI. This increases its focus on essential information in addition to improving PDF generation performance.

Now the Component Info tab in the Component Information Panel adds a Recommended Remediation section for transitive dependencies. It provides links to all direct dependencies that are brought in the selected component. Available for maven components only.

This release includes an Early Access version of Advanced Search. This new search feature provides a flexible way to locate items among your applications. For instance, Advanced Search can help find all applications that are affected by a given security vulnerability.

The Component Details REST API now includes data about effective component licenses.

IQ Server (through CLI) can now be used to evaluate policies against components from dependency files of:

GitHub PR reviews provide a PR comment to provide a summary of violations, affected components, and a description of violations introduced in a specific PR to help developers resolve policy violations effectively and efficiently.

User Tokens REST API exposes endpoints to System Administrators for querying tokens by creation date and supports deletion.

This release fixes a regression that prevented IQ Server 86 from loading some reports.

An application can now be moved from one organization to another using the REST API.

IQ Server (through CLI, Jenkins, and Bamboo plugins) can now be used to evaluate policies against components from dependencies files for:

Component Category is now available as a policy condition.

The Component Claim REST API allows you to view, add, update, and delete component claims.

Stale Waivers REST API now returns stale evaluations along with the stale waivers.

proxy:
  hostname: "proxy.server"
  port: 8081
  username: "proxy-user"
  password: ""

proxy:
  hostname: "proxy.server"
  port: 8081
  username: "proxy-user"
  # password: ""

Stale Waivers REST API allows you to retrieve stale application and repository waivers.

A sample email can be sent in the Email configuration UI to verify the email server being configured by entering the desired recipient and using the Send Test Email button.

The proxy server configuration is now configurable via the HTTP Proxy Server Configuration REST API or via the Proxy Server Configuration View found in System Preferences. Any existing proxy server configuration in config.yml will be migrated and become obsolete.

Nexus IQ for SCM now supports the NPM ecosystem.

The email server configuration for email notifications is now configurable via the new Mail REST API or via IQ Server's UI. Any existing email server configuration in config.yml will be migrated and become obsolete.

Three new permissions Waive Policy Violations, Change Licenses, and Change Security Vulnerabilities are now available for (un)waiving policy violations, changing component licenses, and changing component security vulnerabilities. Previously, the Edit IQ Elements permission was required for these operations. All roles that have the Edit IQ Elements permission are automatically updated to have these new permissions.

This release includes improvements to our proprietary advanced binary fingerprinting and will increase scan file sizes up to four times.

The Third-Party Scan REST API and CLI have been extended to support identifying components based on SHA-1 value (content hash).

The Policy-centric Application Composition Report no longer contains a banner with a link to the legacy version of the Application Composition Report. Instead, the legacy version may now be accessed via the Policy-centric report's Options menu.

Application Composition Report now displays Dependency Type Indicators for maven components. Components can be filtered by dependency type using the new Dependency Type filter.

Note: Dependency Type is only supported for maven components. Reports created prior to January 2, 2020, will show all non-maven components as a direct dependency type. Once the application is rescanned, the non-maven components will be shown as unknown dependency types.

A new Edit Access Control permission was added for managing the access control for applications, organizations, and repositories. Previously, the Edit IQ Elements permission was required for access control management. All roles that have the Edit IQ Elements permission are automatically updated to have the new Edit Access Control permission.