2026 Self-Hosted IQ Server Release Notes

Sonatype Lifecycle and Sonatype Repository Firewall now let authorized users delete policy waiver requests that are still pending or have been rejected.

Sonatype IQ Server now supports database-backed audit logging.

Administrators can now configure database-backed audit event retention periods in config.yml.

Sonatype Lifecycle now supports scanning hosted repositories connected from Sonatype Nexus Repository.

Introduced a new Legal Risk Analyzer dashboard, giving teams a centralized view of legal risk across applications and components.

Complete transitive dependency coverage for Yarn Berry v2, v3, and v4 workspace monorepos during manifest-based analysis

Sonatype Lifecycle now provides the same automated evaluation experience for repositories onboarded through the REST API as repositories onboarded through the UI.

A new The specific waived violation is resolved mode removes the auto-waiver after a subsequent policy evaluation when an available component version resolves the specific waived Security policy violation, even if that version contains other unrelated policy violations.

Sonatype Lifecycle now supports pull request monitoring when the configured default branch is the source and a non-default branch, such as a release branch, is the target.

The Mythos Readiness Enterprise Reporting dashboard is now called Sonatype Advanced Vulnerability Intelligence

The Sonatype Advanced Vulnerability Intelligence (previously Mythos Readiness ) dashboard now includes an Organization filter.

Support for Swift Package.resolved versions 2 and 3.

Sonatype Lifecycle now supports waiver expiration notifications for applications and organizations.

Sonatype Repository Firewall now supports Swift proxy repositories in Sonatype Nexus Repository

Improved user token authentication performance.

Mythos Readiness dashboard enhancements, including KPI cards, visualizations, and clearer Mythos Affected visibility.

Best Practices dashboard enhancements for clearer adoption, scan activity, and projected time-savings insights.

Sonatype Lifecycle now provides complete transitive dependency coverage for Yarn Berry v2, v3, and v4 workspace monorepos across PnP and node_modules install modes

Self-hosted Lifecycle customers can enable AI Developer for their organization through a simple in-product opt-in.

Withdraw pending policy waiver requests through the API.

Enhanced component identification in the HeroDevs End-of-Life Components dashboard.

Support IAM Roles for Service Accounts (IRSA) with Amazon S3 file stores.

AI Developer Preview for self-hosted Lifecycle customers.

Extended .NET Reachability Analysis across IQ CLI and supported CI integrations.

Added Reachability Evidence for vulnerable execution paths.

Improved visibility into embedded components in uber JARs.

Automatically close stale automated remediation pull requests in Bitbucket Cloud and Bitbucket Data Center.

Mythos Readiness dashboard for Enterprise Reporting.

Support for conda-forge upstreams.

Java 25 is required for IQ Server 204 and later.

New Policy Configuration Export API.

Improved startup time for large data migrations.

Redesigned Success Metrics Enterprise Reporting experience with Program Health and Remediation Ops dashboards.

Enhanced legal visibility and advanced search capabilities.

Optional external log aggregation for IQ Server Helm deployments.

Enhanced filtering and cross-filtering for AI/ML Dashboard reporting.

Mythos Readiness data added to the Supply Chain Monitoring report.

Legal tab in component details and expanded Advanced Search filters.

Sonatype Container Scanner is now the default container scanner.

Improved consistency of container vulnerability results.

Centralized CI configuration through a REST API.

Clearer Advanced Search instructions and error messages.

HeroDevs End-of-Life Components dashboard under Enterprise Reporting.

Operational Reporting access point for the React2Shell Impact Report.

Case-insensitive search in the Original BOM tab.

HeroDevs End-of-Life Components dashboard under Enterprise Reporting.

Expanded React2Shell Impact Report with in-product insights.

Original BOM tab for viewing uploaded CycloneDX and SPDX SBOM details.

Automatic re-evaluation for components quarantined by age-based policy constraints.