Sonatype IQ Server 208 Release Notes

FIRE-762

Cleanup policy removal of cached Docker images now triggers the corresponding container evaluation report deletion in Repository Firewall, keeping IQ Server storage consistent with the repository cache.

FIRE-724

GET /api/v2/component-change-detection/event now rejects any value for the includeEvaluationData query parameter other than true or false (case-insensitive) with an HTTP 400 error; callers passing non-boolean values such as 1, yes, or on must update their requests, while a new includeEvaluationData=false option is available to omit the componentEvaluationData field from each event and dramatically reduce response sizes that previously exceeded 500 MB.

FIRE-517

Policy Compliant Component Selection (PCCS) for PyPI proxy repositories now correctly filters package versions that violate time-based Firewall policies from the simple index on the first request, preventing pip from attempting to download quarantined versions.

CLM-51743

AI Developer loads correctly when IQ Server is configured with a non-root applicationContextPath, with all session, feature-flag, and navigation requests properly scoped to the configured context path.

CLM-51328

SBOM Manager preserves existing SBOMs during report processing and policy re-evaluation, even when the active license limit is reached or the license changes, with count enforcement applied only when new SBOMs are uploaded.

CLM-51297

The server version banner is now written to clm-server.log at startup, making the running release version immediately visible when reviewing logs during troubleshooting or after an upgrade.

CLM-50593

Advanced Search indexes from earlier installations continue receiving incremental updates after an upgrade, rather than silently stalling and returning stale results.

CLM-49848

The relay-link status badge in the Manage GitHub Apps list now appears only when the relay integration feature is enabled, eliminating the misleading "Pending registration" indicator that previously displayed on every GitHub App under default self-hosted configurations.

CLM-47953

Modern SPDX license identifiers such as LGPL-2.1-only and GPL-3.0-only declared in CycloneDX BOMs now resolve correctly to their catalog equivalents, ensuring components are accurately represented in license reports and evaluated by license policies.

CLM-46722

OIDC/OAuth2 authentication diagnostics now include JWT claim values at TRACE log level, making it possible to troubleshoot group mapping and role assignment issues without requiring browser-captured IdP responses.

CLM-45874

The realm query parameter on the user token REST API endpoints (GET /api/v2/userTokens and GET /api/v2/userTokens/{username}) now correctly resolves LDAP realm identifiers, returns matching tokens for LDAP-authenticated users, and responds with a 400 Bad Request when an unrecognized realm value is provided instead of silently falling back to the Internal realm.

CLM-45805

SBOM Manager's application overview now displays all SBOM rows fully visible and clickable regardless of browser window size or screen resolution.

CLM-45385

Support bundle downloads for large tenants complete successfully without timing out, as the archive now streams to the client as it is generated rather than waiting for the full file to be built before sending any data.

CLM-45380

Tenant provisioning in multi-node SaaS deployments completes successfully without search index lock conflicts, ensuring new instances reach an active state without requiring manual intervention.

CLM-44461

Reviewer comments added to a waiver request during the approval or rejection process are now preserved in the waiver record and visible in the approved waiver detail view.

CLM-44448

The Legal backlog's application table now displays a loading indicator while results are being fetched, and the "No applications found" message appears only after the request completes with no results.

CLM-44361

Legal tab Application backlog pages load significantly faster in self-hosted instances with large numbers of applications, as filtering, sorting, and pagination are now handled by the database rather than in memory.

CLM-44352

The Legal Application backlog dashboard loads significantly faster for organizations with large numbers of applications, including those with 50,000 or more.

CLM-43913

The GET /api/v2/applications API documentation now correctly identifies its query parameter as publicId, distinguishing it from the internal application ID required by endpoints such as the move application API.

CLM-42907

Startup validation now refuses to launch when the database schema version is newer than the running application supports, logging a clear fatal message that identifies the version mismatch per data store and instructs operators to use the correct application version or restore a matching database backup; an escape hatch is available by setting the environment variable NXIQ_ALLOW_NEWER_DATABASE_SCHEMA=true, which downgrades the refusal to a warning and permits startup at the operator's own risk.

CLM-42782

Reachability Analysis status displays consistently across all violation views, with vulnerabilities lacking callable method signatures now correctly labeled "Unknown" instead of "Not Reachable."

CLM-42239

Policy evaluation completes successfully when concurrent scans are processed against file-backed report storage.

CLM-42088

OIDC single sign-on re-authentication succeeds after session timeout when using Microsoft Entra ID or other identity providers that require an exact-match redirect URI.

CLM-42014

Client-side validation for application names now correctly rejects forward slashes inline, showing an error message and preventing form submission before reaching the server.

CLM-41535

Pending waiver requests can now be rejected even when the underlying policy violation no longer exists, allowing reviewers to clear orphaned requests through the standard UI or API without requiring database intervention.

CLM-41113

Reachability Analysis results are now preserved when a scan is promoted between lifecycle stages, ensuring the promoted report displays the same reachability status as the source report.

CLM-40952

The Developer Priorities CSV export (/api/v2/developer/priorities/{applicationId}/{scanId}/export) now produces fully RFC 4180-compliant output, with fields containing commas properly quoted so that every row parses correctly in Excel and standard CSV parsers.

CLM-40847

Role permission assignments take effect reliably for all users, including LDAP-authenticated users, without requiring an application restart when permissions are updated concurrently.

CLM-40845

Audit log responses from GET /api/v2/auditLogs are now free of NUL byte corruption, with audit events stored reliably in the database rather than shared log files prone to multi-writer conflicts.

CLM-40826

The componentIdentifier query parameter format in the License Overrides API is now correctly documented in the built-in API reference as a JSON object, and customers using the API reference UI or generated client code based on the previous OpenAPI specification must update their componentIdentifier query values to pass a URL-encoded JSON string.

CLM-40070

CycloneDX SBOM exports now correctly attribute vulnerability rating scores to Sonatype when Sonatype calculated the CVSS score, rather than incorrectly labeling Sonatype-computed scores as originating from NVD.

CLM-39952

Policy condition value selects display the correct saved value immediately after updating a constraint, without requiring a page navigation to refresh the view.

CLM-39541

Policy violation rows in the component details report now display consistently after a waiver is removed, reflecting the open status both in the Waiver Status column and in the violation's visual presentation without requiring a re-evaluation.

CLM-39539

Advanced Search results now include vulnerabilities when queried by CVE identifier, even when the CVE is recorded as an alias of a Sonatype-specific vulnerability identifier rather than the primary ID.

CLM-39468

GitLab commit-status updates are processed reliably without incorrectly suspending the repository URL when a referenced commit hash is not found.

CLM-39406

Saving custom filters in Success Metrics and Enterprise Reporting works correctly for LDAP users whose directory distinguished names exceed 50 characters.

CLM-39367

Version Explorer loads component and version details successfully even when the application's Source Control configuration contains an invalid access token, with pull request and remediation features gracefully marked as unavailable instead of returning an error.

CLM-39208

Role Memberships API endpoints now accept user and group names containing slash characters, enabling scripted role membership management for IdP-integrated environments where group names include path separators such as /engineering/design.

CLM-39181

License threat levels in PDF exports, raw report API responses, and SBOM exports now consistently reflect the effective license rather than displaying a higher threat level derived from synthetic placeholder licenses.

CLM-38965

Deleting an organization with a large number of applications completes more efficiently, preserves progress if the server restarts mid-deletion, and allows a re-issued delete request to resume from where it left off rather than starting over.

CLM-38947

Reachability markers and their associated auto-waivers are correctly preserved in application reports after Continuous Monitoring re-evaluates a previously scanned release stage application.

CLM-38931

Developer Dashboard Overview card footer links now open the correct Sonatype documentation pages for CI/CD systems, SCM integrations, and IDE integrations in a new tab.

CLM-38699

Policies combining a DependencyType condition with other conditions now correctly evaluate and trigger violations for components where dependency type data is unavailable, such as Python packages scanned via requirements.txt.

CLM-38693

Version Explorer vulnerability counts and severity ratings now stay consistent across all views when evaluating which version of a component to adopt.

CLM-38597

Azure DevOps pull request status checks for "Security/IQ Policy Evaluation" now resolve correctly after a pipeline-triggered policy evaluation completes on a feature branch, allowing developers to proceed with merging without requiring Pull Request Commenting to be enabled.

CLM-38445

Policy re-evaluation completes successfully on NFS-backed storage environments, even when filesystem metadata caching causes stale directory entries to appear during report replacement.

CLM-38428

Automated remediation pull requests now support a configurable commit message template, allowing administrators to define a custom format using ${component} and ${version} placeholders that satisfies SCM branch policies.

CLM-38357

The Advanced Legal Pack License Obligations tile now displays complete obligation text for components with disjunctive (OR) licenses, including an explanatory message when no standard text is available for a specific license variant.

CLM-38349

The Advanced Legal Pack license details panel now displays a clear explanation and recommended action when a component carries an unidentifiable license variant, rather than showing an unexplained empty text area.

CLM-38159

Policy evaluation during Proxy Cache Control Service (PCCS) component metadata requests performs significantly faster when packages contain large numbers of versions, such as npm packages with thousands of releases.

CLM-37843

The /healthcheck/database endpoint now correctly reports an unhealthy state when the database is in read-only mode, enabling Kubernetes to automatically restart and reconnect pods to a writable database instance instead of continuing to serve failing write operations.

CLM-37390

The dashboard policy violations CSV export now includes a new "Organization Path" column showing the full ancestor hierarchy for each application; consumers that validate an exact column count will need to be updated to account for this additional column.

CLM-37199

The componentIdentifier query parameter format for the Component Search API has changed in the published OpenAPI contract; client code generated from the API specification must be regenerated because componentIdentifier is now correctly declared as a JSON-encoded string value rather than a flattened object.

CLM-37179

Golden Version suggestions now require the recommended version to carry zero policy violations, meaning fewer versions may qualify as Golden compared to previous behavior.

CLM-37133

Policy notification overrides inherited from a parent organization are now correctly displayed when viewing a policy from a child application or organization.

CLM-37101

The addWaiverLink included in Waiver Request webhook payloads now carries the requested waiver expiration, so the Add Waiver form opens with the correct expiration date prefilled instead of defaulting to "Never."

CLM-36831

SPDX imports containing Package URLs with percent-encoded special characters now display correctly in SBOM Manager, with encoding preserved accurately throughout the import process rather than being corrupted into unreadable characters.

CLM-36783

Transitive dependency labels now appear correctly for all components in a report, including those in mixed scans where some components previously received no Direct or Transitive classification.

CLM-36766

Pull request status checks for SCM-integrated applications now complete reliably, even when a transient SCM error occurs or when developers follow common branching workflows such as merging an updated base branch into an open pull request.

CLM-36306

Log entries for corrupted report JSON files now include the affected application, scan ID, and specific report entry name, making it possible to identify and resolve the problematic file without manual inspection of the report directory.

CLM-35754

License data synchronization across high-availability cluster nodes completes reliably without duplicate-key errors or transaction rollbacks during concurrent refreshes.

CLM-35315

Reachability analysis results now display correctly when scanning an application multiple times, including when alternating between scans with and without the -ra flag, and when promoting scans between lifecycle stages.

CLM-35150

Support zip database exports now include vulnerability group data, ensuring policies that reference security vulnerability groups remain valid and resolvable when the zip is loaded for troubleshooting.

CLM-34757

The OpenAPI specification for CycloneDX SBOM export endpoints now correctly documents the response body schema and the Content-Disposition header returned when downloading a bill of materials report.

CLM-34330

Policy violations dashboard background migration completes reliably under concurrent write load, preventing the dashboard from becoming inoperable after upgrading with a PostgreSQL database.

CLM-34302

Proprietary regex matchers containing the @ character now correctly identify scoped npm packages such as @adobe/css-tools as proprietary.

CLM-34161

CycloneDX SBOM ingestion now correctly processes UTF-16 BOM-encoded files, reporting accurate component counts and policy violations instead of silently completing with zero results.

CLM-34160

Scan tickets now include a warning when files in an uploaded archive could not be read, making it visible that a report may be incomplete rather than silently returning a successful evaluation.

CLM-33893

The global error banner now displays a meaningful, actionable message when the IQ server cannot be reached, instead of showing a generic placeholder.

CLM-32605

The Access tile on organization pages now displays a clear error message with a retry option when role membership data cannot be loaded, rather than incorrectly showing "No local access configured."

CLM-32341

License enforcement checks for features unavailable on Firewall-only licenses are now logged at the appropriate severity level, eliminating spurious error messages in server logs when navigating organizations.

CLM-32103

SCM onboarding validation failures now log the specific repository whose URL is invalid, making it straightforward to identify and resolve problematic repositories without manually inspecting the SCM system's full repository list.

CLM-32078

Proxy configuration settings are accessible without a product license installed.

CLM-32012

PDF report titles for applications with long names now display in full, with the font size automatically adjusted to fit the complete application name within the page width.

CLM-31661

The "Security/IQ Policy Evaluation" status check on Azure DevOps pull requests now resolves automatically after a successful policy evaluation, without requiring a separate manual evaluation on the feature branch.

CLM-30716

The application scan history API (GET /api/v2/reports/applications/{applicationInternalId}/history) now returns reports across all pipeline stages when no stage filter is specified, ensuring scans from every stage are represented in the results rather than only the most recently active stage.

CLM-30586

PDF report generation completes successfully when component file paths contain characters that cannot be rendered by the embedded fonts, substituting unrenderable characters rather than returning an error.

CLM-30488

The Dependency Type policy condition now correctly matches components that lack dependency data when using the "is not Transitive" or "is not Direct" operators, ensuring their policy violations are no longer silently omitted from security policy evaluations.

CLM-29888

Report retrieval operations complete reliably without causing server outages, even when large report entries are accessed concurrently.

CLM-29783

Poetry projects with no production dependencies defined in pyproject.toml now correctly return zero components during scanning, preventing dev-only dependencies like pylint from appearing as false-positive violations.

CLM-29728

Vulnerability custom data API requests now reject component identifiers containing coordinate fields that are invalid for the specified format, returning an error instead of silently storing malformed data that would cause report failures.

CLM-28854

Version Explorer and Risk Remediation panels load correctly for applications whose IDs contain non-ASCII characters such as Japanese or accented Latin characters.

CLM-25452

"View the latest report" on an InnerSource component's details page now links to the producer application's most recently scanned report, regardless of which stage it was scanned in.

CLM-25209

LDAP user and group lookups complete successfully even when a short "Connection" timeout is configured, as the read timeout is now independently floored at 30 seconds rather than inheriting the connection timeout value.

CLM-22062

Advanced Search queries with large numbers of clauses now succeed by default, with the maximum clause limit raised from 2,048 to 10,000 to accommodate complex searches without requiring administrator configuration changes.

CLM-21579

Role membership grants via the global and repository container Role Memberships APIs now support the validateMember=true query parameter, which causes the request to return a 404 error if the specified user or group does not exist in any configured security realm.

CLM-21225

The Vulnerability Details tab now remains visible with an explanatory warning when Sonatype's security data has been updated since an evaluation was completed, rather than silently disappearing from the policy violation view.

CLM-18813

Proxy authentication through NTLMv2-only forward proxies now succeeds when the proxy's NTLM challenge omits target information, with full NTLMv2 support available by enabling the com.sonatype.insight.proxy.forceNtlmV2 system property.