Sonatype IQ Server 207 – 207.1 Release Notes

FIRE-792

PyPI components evaluated through the Firewall Evaluation API now each maintain their own quarantine record, so all quarantined components remain visible in the quarantined components list until explicitly released.

FIRE-517

Policy Compliant Component Selection (PCCS) now correctly filters PyPI package versions that violate time-based Firewall policies from the simple index on the first request, preventing pip from attempting to download quarantined versions.

FIRE-513

Firewall dashboard historical charts now populate correctly for all date ranges when running on PostgreSQL deployments, with the metrics consolidation jobs completing successfully each scheduled cycle.

CLM-44515

Advanced search queries with leading wildcards return an HTTP 500 error response for the affected request without causing the server to shut down.

CLM-43920

GitHub pull request comments are now posted successfully even when evaluations contain large numbers of policy violations, with oversized content trimmed to fit provider limits and a link to the full report included rather than the comment being silently dropped.

CLM-43732

Container scans of Docker images with Python dependencies now resolve each installed wheel to its single platform-specific variant, eliminating duplicate vulnerability findings that previously appeared for every possible platform combination.

CLM-42178

npm package aliasing in package-lock.json files is now resolved correctly, ensuring aliased dependencies are identified by their actual package name rather than the alias path.

CLM-41689

Authenticated usernames in request.log are now recorded correctly for all request log rendering paths, restoring the attribution of users to their requests that was lost during the version 201 upgrade.

CLM-41469

Windows IQ Server startup on Windows correctly loads JVM options from the jvm.options file, resolving startup errors caused by an invalid path reference in the Windows launcher script.

CLM-40845

Audit log responses from the GET /api/v2/auditLogs endpoint are now delivered clean and well-formed, with NUL bytes caused by filesystem-level corruption stripped before reaching the client.

CLM-40143

Existing user tokens stored in the legacy Argon2id format will be automatically rehashed to the new format upon the next successful authentication; tokens already in use will continue to work without interruption, but this migration is irreversible. User token authentication now completes significantly faster under high request volumes, eliminating the latency spikes previously experienced during periods of heavy API traffic.

CLM-39953

Dashboard CSV exports for violations, components, applications, waivers, and waiver requests now stream results incrementally rather than loading the entire dataset into memory, preventing server outages when exporting data at large scale.

CLM-38213

Container image scans now report accurate policy violations for all Lifecycle product licenses, without requiring a Firewall license to detect vulnerable components.

CLM-37981

Advanced Search CSV export completes successfully when IQ Server is accessed through reverse proxies that use HTTP/1.0, including nginx environments with default proxy settings.

CLM-37908

"Younger than N days" age-based policy constraints now evaluate strictly, so components cataloged exactly N days ago correctly pass without triggering a violation.

CLM-37109

Pull request comments posted to Bitbucket are now trimmed to fit within Bitbucket's character limit, displaying the first 10 components and a link to the full report rather than failing silently when scan results exceed the maximum allowed size.

CLM-36307

SPDX SBOM scans containing externalRefs entries with non-standard reference types such as repository complete without generating repeated warning messages in the scan log.

CLM-34834

Source control evaluations complete successfully when SSH operations are re-enabled on applications that were originally imported with SSH disabled.

CLM-34561

Invalid or unparseable SBOM items within scanned archives are now skipped individually rather than aborting the entire scan. Log output from third-party scan processing no longer floods clm-server.log when errors occur during async operations, preventing runaway log growth that could fill disk storage and cause system outages.

CLM-33982

CycloneDX SBOM scans now emit a warning-level log message when a component contains an invalid or malformed package URL, making it visible in standard CLI output rather than silently omitting the component from the report.

CLM-33964

Advanced Search completes successfully for users with access to large numbers of applications or organizations, eliminating the "too many clauses" error that previously prevented searches even when organization or application criteria were specified.

CLM-25312

Violation details in older evaluation reports now display a clear error message instead of remaining indefinitely in a "Loading..." state when violation identifiers are unavailable.