Sonatype IQ Server 209 Release Notes

IQ Server now validates SSH repository URLs in source control configurations, both when they are saved and when they are used. Supported formats are user@host:path and ssh://[user@]host[:port]/path. URLs may contain letters, digits, . _ ~ / + -, and %20 (an encoded space) in the path.

The Product License and Getting Started pages now display AI Developer Credits or Guide Credits instead of Licensed Credits, making it easier to identify credits associated with purchased add-ons.

Sonatype Lifecycle’s Nexus One UI provides searchable, filterable views for Applications, Violations, Components, Vulnerabilities, and Waivers, along with global search across all five. Use the Switch to Nexus One UI button to move between Nexus One and the Classic UI while keeping your place.

The Nexus One UI is in Preview, so some content may still appear in the Classic UI embedded within it. Before users can try the Switch to Nexus One UI button, an administrator must configure and build a new OpenSearch index. For full details, see the Set Up the Nexus One Index help documentation (Link Placeholder).

Sonatype Lifecycle now provides more precise control over auto-waivers configured for Upgrade Path is not available. The new The specific waived violation is resolved mode removes the auto-waiver after a subsequent policy evaluation when an available component version resolves the specific waived Security policy violation, even if that version contains other unrelated policy violations. Previously, the auto-waiver remained in place until Lifecycle identified an available version with no policy violations. This change helps teams act on available remediation sooner without continuing to suppress a risk that can already be addressed.

New auto-waiver rules use The specific waived violation is resolved by default. Existing rules retain the previous All violations on the component are resolved behavior, so upgrades do not change how existing auto-waivers operate. You can select either mode when configuring eligible auto-waivers. See the Automated Waivers help documentation for configuration details.

The Golden Versions Available for Components section in the Golden Fixes dashboard now displays the dependency type for each component, identifying dependencies as Direct, Transitive, or Undetermined. This additional information helps you better understand how components relate to your applications and make more informed decisions when evaluating recommended versions.

You can also filter the list by dependency type to focus on the components most relevant to your remediation efforts. This enhancement makes it easier to review recommended versions, prioritize updates, and streamline dependency management.

The Security Risk Breakdown dashboard now provides additional component and application details to help you better understand security risks and evaluate remediation options. The dashboard includes information about component age, fix availability, recommended Golden Versions, and associated policy violations, giving you greater visibility into the security risks affecting your applications.

These enhancements make it easier to identify components that require attention, assess available remediation paths, and prioritize updates based on security risk and policy information.

The Mythos Readiness dashboard is now named Sonatype Advanced Vulnerability Intelligence. This new name better reflect the dashboard's purpose: helping teams identify applications with components that may be affected by privately disclosed vulnerabilities so that they can assess potential impact and prioritize remediation.

Sonatype Repository Firewall now provides more accurate component identification for Python and Java packages, improving CVE reporting for Python packages that contain Red Hat backported security fixes. We have also expanded package detection for Go and APK packages and improved scanning accuracy for Red Hat hardened and OpenShift container images.

These improvements provide more complete visibility into components across supported environments, helping you assess security risks more confidently and prioritize remediation efforts based on more accurate vulnerability information.