2024 Notable Integrations Bug Fixes
2024 Notable Integrations Bug Fixes
The following table lists notable bug fixes for Sonatype integrations in 2024. This record goes back to March 2024, but not earlier. Any other months that are omitted did not include any notable bug fixes.
December 2024
The following table lists notable bug fixes for Sonatype integrations in December 2024:
| Issue ID | Integration and Fix Version | Description |
|---|---|---|
| INT-8817 | Bamboo version 3.1.1 | The Bamboo plugin now checks for a null credentialsManager before use, preventing potential NPEs during execution. |
| INT-8760 | Jira Cloud version 2.13.0 | The Jira Cloud plugin now validates incoming webhook requests to ensure they're from Lifecycle. |
| INT-8675 | Bamboo version 3.1.0 | The Bamboo plugin can now properly process pnpm-lock.yaml files. |
November 2024
The following table lists notable bug fixes for Sonatype integrations in November 2024:
| Issue ID | Integration and Fix Version | Description |
|---|---|---|
| INT-8634 | Fortify version 5.1.2 | The sync service now always synchronizes the most recent non–continuous monitoring report, even when its data matches a previously synced report. |
| INT-8574 | GitLab version 1.184.1 | The GitLab Nexus Platform Plugin supports the source stage again. |
October 2024
The following table lists notable bug fixes for Sonatype integrations in October 2024:
| Issue ID | Integration and Fix Version | Description |
|---|---|---|
| INT-8633 | Bamboo version 3.0.2 | The Bamboo plugin now consistently uses its bundled ASM libraries, ensuring compatibility with newer Spring Boot projects. |
| INT-8571 | Jenkins version 3.20.7 | The Jenkins plugin now correctly processes poetry.lock files. |
| INT-8562 | Fortify version 5.1.1 | The sync service now correctly terminates when the killProcess flag is set to true, ensuring expected shutdown behavior. |
| INT-8567 | Fortify version 5.1.1 | The startScanLoad endpoint now supports the fortifyApplicationId parameter, enabling ad-hoc sync operations and optional mapping persistence without requiring the application name. |
| INT-8530 | GitLab version 1.183.0 | Added support for Java system properties using the -D flag, allowing users to pass runtime configuration settings for greater flexibility and compatibility. |
July 2024
The following table lists notable bug fixes for Sonatype integrations in July 2024:
| Issue ID | Integration and Fix Version | Description |
|---|---|---|
| INT-8338 | IQ CLI version 1.180.0 | The native Nexus IQ CLI now includes proper reflection metadata to support scanning JSON SBOM files. |
| INT-8299 | Jenkins version 3.20.1 | The Jenkins plugin now uses a method call instead of direct property access in the IqConfigNoIdToIdMigrator component, ensuring compatibility with Java 17 and supporting upcoming Jenkins upgrades. |
| INT-8260 | Jira Cloud version 2.11.0 | The Jira Cloud integration now correctly includes the full context path from the Nexus Lifecycle base URL when generating report links. |
| INT-8227 | IQ CLI with IQ version 179 | The scanner now correctly processes files with absolute paths inside layer tar archives, ensuring components in Docker images built with tools like Buildpacks or Spring Boot's build-image are properly detected during analysis. |
| INT-8110 | Jira Cloud plugin with IQ version 179 | Debug logging for Jira integrations now clearly distinguishes between the internal Jira integration and the Jira Cloud plugin, reducing confusion and improving troubleshooting clarity. |
June 2024
The following table lists notable bug fixes for Sonatype integrations in June 2024:
| Issue ID | Integration and Fix Version | Description |
|---|---|---|
| INT-8241 | IQ CLI with IQ version 179 | The IQ CLI is now able to scan and report on Docker tar image files created using new Docker CLI versions. |
| INT-8238 | VS Code version 1.0.7 | The authorization check in the VS Code extension no longer blocks analysis when the CSRF token cannot be read. |
| INT-8237 | Jira Cloud version 2.10.0 | The Jira Cloud plugin now gracefully handles unmapped or missing project configurations. |
| INT-8136 | Jira Cloud version 2.10.0 | The Jira Cloud integration now properly handles missing or outdated project mappings. |
| INT-7800 | IQ CLI version 178 | The IQ CLI now supports bypassing the proxy server when the -p flag is used by honoring the http.nonProxyHosts JVM property. |
May 2024
The following table lists notable bug fixes for Sonatype integrations in May 2024:
| Issue ID | Integration and Fix Version | Description |
|---|---|---|
| INT-8146 | Fortify version 5.1.0 | Addressed a NPE in sync-service that occurred when processing custom policy violations without associated CVE identifiers, improving stability when syncing reports with high-severity custom security rules. |
| INT-8109 | Jira Cloud version 2.8.0 | The Jira Cloud integration now correctly handles the reporter and labels fields by including them in the issue creation payload only when they are required or present in the configured screen. |
| INT-8035 | Maven version 2.47.14 | Restored the CLM Maven Plugin's compatibility with Java 21. |
| INT-8004 | Azure DevOps version 1.7.16 | The Azure DevOps plugin trims leading and trailing spaces from application name parameters to prevent scan failures caused by invalid URIs. |
| INT-7963 | Jenkins version 3.19.5 | Exclude Scan Patterns now works as expected. Files to exclude are passed as parameters with a "!" at the beginning. |
| INT-7918 | Azure DevOps version 1.7.16 | Updated documentation to better explain that the plugin wraps the nexus-iq-cli and that plugin version-to-IQ CLI version mapping can be found in the Visual Studio marketplace. |
April 2024
The following table lists notable bug fixes for Sonatype integrations in April 2024:
| Issue ID | Integration and Fix Version | Description |
|---|---|---|
| INT-8085 | Azure DevOps version 1.7.15 | Updated the Azure DevOps task to support execution with both Node.js 10 and Node.js 16. |
| INT-8077 | Sonatype for VS Code version 1.0.3 | The VS Code extension now supports specifying a custom path to a Maven settings.xml file via sonatype-config. |
| INT-8032 | Sonatype for VS Code version 1.0.2 | The VS Code plugin now correctly honors the Use env var for password setting. |
March 2024
The following table lists notable bug fixes for Sonatype integrations in March 2024:
| Issue ID | Integration and Fix Version | Description |
|---|---|---|
| INT-7910 | Container scanning-capable integrations with IQ version 175 | Scanning now supports Docker image tar files created with Docker 25.. |