Sonatype IQ Server 206 Release Notes

Policy waiver request submitters can now withdraw their own pending requests through the Policy Waiver Requests API before a reviewer approves or rejects them. This capability gives submitters greater control over requests that contain incorrect information, require additional context, or no longer apply.

Sonatype Lifecycle now provides additional component details in the HeroDevs End-of-Life Components dashboard to help teams identify and investigate affected dependencies more efficiently. The dashboard displays full component names and associated Policy Violation IDs, making it easier to distinguish similarly named components, cross-reference findings with policy violations, and move from reporting to remediation.

The dashboard also now displays complete Package URLs (PURLs) that consistently include component version information across supported package formats. These standardized, versioned identifiers make it easier to correlate end-of-life components with vulnerability databases, SBOMs, policy data, and other tools that support the PURL specification.

For full details, see the HeroDevs End of Life Components help documentation.

Self-hosted Sonatype IQ Server deployments on Amazon Elastic Kubernetes Service (EKS) can now use IAM Roles for Service Accounts (IRSA) to authenticate with Amazon S3 file stores. IQ Server uses the AWS default credentials provider chain to retrieve temporary credentials from the IAM role associated with the Kubernetes service account, eliminating the need to store static AWS access keys in application configuration or Kubernetes secrets.

This enhancement helps organizations strengthen credential security and align IQ Server deployments with AWS-recommended identity practices. Teams can manage S3 access through IAM policies, reduce the operational overhead of rotating long-lived credentials, and use short-lived credentials that AWS automatically provides and refreshes.

AI Developer is now included as a part of your Lifecycle subscription. As a valued Lifecycle customer, you are entitled to an allocation of free monthly credits for AI Developer, bringing Sonatype component intelligence, dependency guidance, and Lifecycle policy context into the AI coding assistants your developers already use through its included Model Context Protocol (MCP) server.

We wanted to get you this value as quickly as possible, so we have decided to release this as a part of version 206 in Preview mode.  This means we will support you in using the AI Developer solution while we finalize some of the UI and UX work in order to deliver the polished experience we want and you deserve. Expect the capability to come out of Preview in the next one or two months.

Sonatype Repository Firewall now includes a new Firewall Success Metrics dashboard in Enterprise Reporting, giving organizations a clearer understanding of how effectively Firewall protects their software supply chain. By bringing key operational and security insights together in one place, the dashboard helps teams measure the impact of their security policies, identify trends in component risk, and determine whether quarantine workflows are reducing exposure to malicious or vulnerable components. At a glance, teams can monitor metrics such as component evaluations, quarantines, malicious component detections, waivers, and quarantine response times to understand how Firewall is performing over time.

With greater visibility into Firewall activity, security, platform, and engineering teams can make more informed decisions about policy tuning, prioritize response efforts, and demonstrate the value of their software supply chain security program. Interactive filtering and detailed reporting make it easier to investigate quarantine trends, understand why components are blocked, monitor waiver usage, and identify opportunities to reduce review times and continuously improve how open source risk is managed across the organization.

For full details, see the Firewall Success Metrics Dashboard help documentation.

Sonatype Nexus Repository now lets you configure the timeout used by Firewall for Docker when downloading container image layers during policy evaluation. Previously, this timeout was fixed at 10 minutes, which could prevent image evaluation from completing in environments where legitimate network conditions, such as proxy-based antivirus scanning or other network inspection, significantly increase download times. You can now adjust the timeout to up to 240 minutes by setting the nexus.firewall.container.download.timeout.minutes system property to better accommodate your environment while maintaining Firewall for Docker protection for large or slow-to-download images.

NeuVector-based Sonatype Container Security will reach the end of its Extended Maintenance period in September 2026. To continue receiving the latest container security capabilities, plan your transition to Advanced Container Scanning (Sonatype Scanner Mode), which provides broader coverage, enhanced detection capabilities, and continued product innovation.