Sonatype IQ Server 194 Release Notes

Sonatype’s data catalog now includes Exploit Prediction Scoring System (EPSS) data, further enhancing your ability to assess and prioritize risk based on real-world exploitation likelihood. EPSS provides a probability score estimating the chance a vulnerability will be exploited in the next 30 days, helping teams focus on what’s most likely to pose an immediate threat.

The EPSS score is now available in the Vulnerability Details API response, alongside existing severity and classification data. You can also now create policy constraints using the EPSS Score (percentage) condition, allowing you to define thresholds for acceptable exploit likelihood in your environments. Combined with existing constraint options, this gives you greater precision in enforcing risk-based remediation practices at scale.

You can now extend Sonatype Repository Firewall’s automatic policy enforcement to containerized applications, enabling your team to block non-compliant or vulnerable Docker images before they enter your development environments.

Repository Firewall analyzes Docker images as they are requested through a protected proxy repository. Images that violate your defined policies are automatically quarantined, ensuring developers and deployment pipelines only use trusted containers. Violations are reported in a new Containers dashboard that also provides clear insights into which components within a container triggered enforcement.

You can also apply waivers to container-level violations directly from the container report or via the new Container Waivers API, streamlining security review and enabling critical images to proceed when necessary.

This functionality supports Docker Schema 2 (both single and multi-architecture) images from any container registry proxied by Sonatype Nexus Repository. Support for OCI images and other formats is not available at this time. To optimize performance, local disk storage is recommended for temporary container analysis. Note that Sonatype does not ingest or retain container data during analysis.

For full configuration instructions, supported formats, and usage details, see the Repository Firewall for Docker help documentation.