Bulk Waivers

When Firewall quarantines multiple components across repositories, releasing them one at a time is time-consuming and error-prone. Bulk Waivers lets you waive all failing violations in a single workflow, releasing quarantined components consistently and with a complete audit trail.

Key Benefits

• Release multiple quarantined components in one workflow instead of handling each violation individually.
• Apply a uniform scope, expiration, reason, and comment across all selected violations, reducing the risk of inconsistent waiver settings across repositories.
• Initiate bulk waiver from Repository Results or Component Details, directly where quarantine state is visible.
• Unknown or unclaimed components are handled safely: All Versions is restricted to identified components; unidentified components require Exact matching so scope stays controlled.

Accessing Bulk Waivers

The Bulk Waive button appears wherever quarantine state is surfaced in the Firewall UI:

• Repository Results: Available at the repository level when reviewing quarantined components

• Component Details: available when inspecting the violations on a specific quarantined component

The Bulk Waive button is visible only to users with the WAIVE_POLICY_VIOLATIONS permission. If there are no open waiveable violations in the current context, the button is disabled even when the permission is granted.

Step 1 - Select Violations

The Violation Selection page lists eligible Firewall policy violations that can be bulk waived. Violations are shown in a paginated, sortable, and filterable table, so you can narrow the view before choosing what to waive.

You can:

• Sort and filter by Threat Level, Policy, Component, or Constraint.
• Select individual violations from the current page.
• Use Select All to target the full filtered result set, not just the current page.

Selections are preserved when you:

• move between pages
• apply or change filters
• change sorting

When using Select All, your selection is preserved even as you refine or review the results. This ensures you don’t lose previously selected items while applying filters or navigating through the list.

Selecting Select All applies the action to the entire filtered set, not just the items currently visible on the screen. Before submission, the system processes all violations within the filtered results.

Only violations that are eligible for bulk waiver are displayed. After selecting at least one violation, click Next to proceed to the waiver configuration step.

Step 2 - Configure the Waiver

Set the scope, component matching strategy, expiration, and optional context for the waiver. These settings apply uniformly to every violation selected in Step 1.

Scope (Required)

Controls which repositories the waiver covers. Firewall scope options are Organization, Repository, Repository Manager, and Repository Container.

Narrower is safer: scoping to a single repository prevents the waiver from inadvertently releasing the component in repositories you did not intend to affect.

Component Matching (Required)

Determines how broadly the waiver matches the component across versions:

• Exact: Waives only the specific version in quarantine. Use this when a newer version is available or when you want the waiver to expire naturally with the component. Required for unknown or unclaimed components.
• All Versions: Waives all past, present, and future versions. Use sparingly; this prevents Firewall from quarantining any version of this component within the chosen scope, including versions not yet released. Not available for unknown or unclaimed components.

Waiver Expiration (Required)

Sets when the waiver expires and the violation becomes active again. Choose from 7, 14, 30, 60, 90, or 120 days, select Never, or pick a custom future date.

When a bulk waiver releases a quarantined component, that release is effectively permanent from the Firewall/Nexus enforcement perspective. If the waiver later expires, the component is not automatically re-quarantined or blocked again from Nexus, including during reevaluation.

Note

When selecting a custom date, you must choose a future date.

Reason (Optional)

Select a predefined reason configured in Sonatype Firewall. Associating a reason helps auditors and other teams understand why a quarantined component was released without remediation.

Comments (Optional)

Add context such as a ticket link, the remediation plan, or the name of the approving engineer (maximum 1000 characters). Comments appear in the waiver audit trail.

Unknown or Unclaimed Components

Firewall cannot determine the full version history of a component it has not yet identified. To prevent an All Versions waiver from silently releasing unreviewed future versions, the option is restricted when unknown or unclaimed components are involved.

Only unknown or unclaimed components selected:

"Claim these components to apply all versions waiver."

Mix of known and unknown components selected:

"The selected violations contain unknown/unclaimed components. When 'All Versions' is selected, the bulk waiver will only apply to identified components."

Click Next to proceed to the confirmation summary, Back to revise your violation selection, or Cancel to discard all changes and return to Repository Results.

Step 3 — Confirm and Submit

Review the full waiver before it is created. No changes can be made at this step, use Back to revise.

What to Verify

• The total number of violations and the number of distinct quarantined components that will be released.
• Scope - confirm the waiver does not cover more repositories than intended.
• Component matching strategy, expiration date, reason, and comments.

If the selection includes unknown or unclaimed components, a reminder is shown:

"The selected violations contain unknown/unclaimed components. When 'All Versions' is selected, the bulk waiver will only apply to identified components."

Submitting

Click Submit to create the waivers. All waivers in the batch are created in a single atomic transaction — if any violation fails validation, the entire batch is rolled back and no waivers are created.

On success, a confirmation banner is shown:

"Bulk Waivers will apply when the report is re-evaluated."

Waivers are applied after Firewall performs a report re-evaluation. Once applied, quarantined components are released and become available for download.

API Integration

You can create bulk waivers programmatically via the Policy Waiver REST API — useful for automating quarantine releases as part of a CI/CD pipeline or incident response workflow. The WAIVE_POLICY_VIOLATIONS permission is required. As with the UI, waivers are created in a single atomic transaction and the entire batch is rolled back if any violation fails validation.

See the full API reference and examples: Bulk Waivers API