Sonatype IQ Server 196 Release Notes

Automated Remediation with GoldenPRs™ automatically generates pull requests with remediation suggestions for policy violations discovered on the default branch. It helps keep dependencies secure and up to date by recommending safe, non-breaking versions, reducing the manual effort required to address vulnerabilities.

To help teams better manage automated pull requests (Auto PRs), two new configuration options are now available for GitHub and GitLab:

These settings apply only to Auto PRs created by GoldenPRs and can be enabled as part of your existing GitHub or GitLab configuration. See the IQ Server Configuration help documentation for details.

IQ Server and the IQ CLI Scanner now support bytecode fingerprinting for applications built with Java 25. This enhancement ensures accurate component identification and policy evaluation for projects compiled with the latest Java version, allowing teams to adopt new language features with continued confidence in Lifecycle’s analysis capabilities.

You can now retrieve details for multiple vulnerabilities in a single request using a new bulk lookup option in the Vulnerability Details REST API. This feature supports up to 1,000 CVE or Sonatype vulnerability IDs at once.

This new capability significantly reduces the number of API calls required when auditing or reporting on large sets of vulnerabilities, saving time, simplifying automation, and improving integration performance for security and compliance workflows.

The bulk response uses the same schema as the existing single-lookup API and preserves all request identifiers, including any that are invalid or unknown. This makes it easy to handle post-processing consistently. Full vulnerability details are returned when authenticated, including rootCauses, vulnerableVersionRanges, and contextual markdown fields.

For field definitions, usage examples, and error handling behavior, refer to the Vulnerability Details REST API documentation.

We have extended the Policy Waiver REST API to allow you to create bulk policy waivers. Leverage this new API to save time and reduce operational overhead by waiving up to 1,000 policy violations in a single API call.

The bulk policy waiver API operation includes automatic deduplication, validation of all provided IDs, and silent skipping of already-waived violations. This streamlines waiver management in high-volume environments such as CI pipelines or security audits.

You can apply bulk waivers with full configuration control, including options for expiration, waiver reason, scope matching strategy, and automatic expiration when a remediation becomes available.

To learn more about usage, valid parameters, and examples, refer to the Policy Waiver REST API documentation.

Sonatype Lifecycle now includes Advanced Container Scanning, a next-generation replacement for NeuVector-based container security. This new capability brings stronger, more flexible image scanning powered by Sonatype’s own vulnerability intelligence.

Advanced Container Scanning brings the following key benefits:

To benefit from ongoing feature development and full support, switch to Advanced Container Scanning (Sonatype Scanner Mode).

For full details, see the Advanced Container Scanning documentation.

The Firewall API now consistently uses the /api/v2/firewall/ path for all but the malware defense-specific endpoints. Previously existing /api/v2/malware-defense/ paths remain supported for backward compatibility.

The /api/v2/malware-defense/evaluate API continues to be available and uses malware-defense in its path.

While this release introduces the ability to create bulk waivers through the API, we will also soon bring this functionality to the Lifecycle user interface.