Sonatype IQ Server 204 – 204.2 Release Notes

NEXUS-52635

Concurrent npm and PyPI proxy requests under PCCS now coalesce across cluster nodes, preventing uncoordinated IQ Server evaluation calls that could exhaust heap memory and cause a full Firewall outage. (This fix requires Nexus Repository 3.92.3+ and IQ 204+.)

NEXUS-52385

The IQ Server HDS connection pool size is now configurable, allowing HA/multi-node deployments to handle concurrent npm metadata requests without exhausting connections or falling back to stale cache data.

NEXUS-52218

The Malware Components CSV now reflects current Sonatype threat intelligence by automatically reconciling stored findings against up-to-date malicious status during the Automatic Malware Management task, so components whose malware classifications have been retracted or corrected no longer appear as active unresolved findings.

NEXUS-51730

Firewall integration users scoped to the Repository Manager level can now successfully retrieve the custom quarantine message without receiving 403 errors or generating spurious WARN log entries.

NEXUS-51450

The Automatic Malware Management task now correctly reports quarantine status in debug logs, accurately reflecting when malicious components are quarantined in the Firewall dashboard.

Note that this fix requires coordinated deployment of Nexus Repository Manager and Sonatype IQ Server—deploying Nexus Repository without the corresponding IQ Server update (or vice versa) will cause firewall evaluation requests to fail.

CLM-39884

The Developer Priorities REST API documentation now explains the purpose of the scanIdFromLatestBuildStageEvaluation field, including the conditions under which the UI uses it to display a Go to Build stage link in the Next Step column of the Priorities report.

CLM-39406

Saving custom filters in Success Metrics and Enterprise Reporting now works correctly for LDAP users whose Distinguished Names exceed 50 characters.

CLM-38656

The Priorities report now displays a "Create PR" button instead of a stale link when a previously merged pull request's changes are reverted and a new scan detects the violation again.

CLM-38299

Saving a License Threat Group on large organizations completes in milliseconds, regardless of the number of descendant organizations or applications in the hierarchy.

CLM-38233

Policy name validation during support zip imports now uses a single bulk database query per policy instead of recursive traversal, reducing import time for large organization hierarchies from 15+ minutes to seconds.

CLM-37819

Automated pull requests are now created only when scanning the default branch, preventing unexpected PRs from appearing on the default branch during feature branch scans.

CLM-35417

Source control configuration validation now returns specific, actionable error messages—distinguishing between invalid repository URLs, authentication failures, and insufficient token permissions—instead of a generic failure message.

CLM-31884

The CLMSESSIONID and CLM-CSRF-TOKEN session cookies now use SameSite=Lax on non-SAML paths; SAML authentication flows retain SameSite=None to support IdP cross-site POST callbacks.

CLM-30626

Application ID validation now blocks creation or updates when a public ID conflicts with an existing internal UUID, preventing UI crashes when viewing affected applications.