# 2024 Release Notes

## Release 185 (December 2024)

**Known Issue in Release 185**

Release 185 contains a known issue where deadlocking can occur under heavy usage causing the application to become unresponsive. This issue does not impact earlier versions and is resolved in release 186.

**Upgrade Impact**

After upgrading a Lifecycle instance using a PostgreSQL database from IQ 182 or earlier to IQ 183 or later, for high data volume installations, you may **temporarily** see an internal error when accessing the Violations dashboard. This is due to an internal job running in the background taking longer to process the large volume of data, and is logged as a NullPointerException (NPE) in the logs. Once the job completes, the dashboard will load as expected, and NPE will no longer be visible in the logs.

### New Features

#### New and Improved Success Metrics Dashboard Under Data Insights

We're excited to introduce an enhanced _Success Metrics_ dashboard under the _Data Insights_ section in the Lifecycle user interface. This dashboard is built to provide a more dynamic and comprehensive view of your organization's security management over time with key information such as the following:

- **Violation Activity** \- Track violation trends with comprehensive metrics, including totals, averages, and mean time to resolution (MTTR).

- **Application Security** \- Monitor application onboarding progress, scan coverage, and waiver usage.

- **Component Health** \- Assess component risk with insights into mitigation scores and quarantine trends.

- **Organizational Performance** \- Analyze success metrics across your entire organization, from the root level down to specific applications, with role-based access controls for data privacy.

This interactive dashboard allows you to filter data by week, policy type (security, license, quality, and others), and drill down into specific time frames for detailed analysis. Visualize trends over the last 12 months and gain a deeper understanding of your security posture.

#### Make SSO the Default Login Option

Lifecycle now allows you to streamline user authentication by setting SSO login as the default. This enhancement simplifies the login process by automatically redirecting users to your SSO provider upon accessing Lifecycle. This provides a smoother and more efficient user experience, especially for organizations that rely heavily on SSO for centralized access management.

See the [SAML integration help documentation](https://help.sonatype.com/en/saml-integration.html) and [Configuration REST API documentation](https://help.sonatype.com/en/configuration-rest-api.html) for more information on configuring SSO to be your default login option.

This feature was made possible through [your feedback](https://ideas.sonatype.com/ideas/IDEAS-I-1462) in the [Sonatype Ideas Portal](https://ideas.sonatype.com/).

#### Coordinates Policy Condition Supports Cargo, Cocoapods, Composer, Conan, and Hugging Face Formats

Lifecycle’s _Coordinates_ policy condition now supports Cargo, Cocoapods, Composer, Conan, and Hugging Face (hf-model) package formats alongside the previously supported Maven, npm, and PyPI formats. You can now create policies that specifically target components from these ecosystems without resorting to more complex workarounds like using labels.

#### Import Binary Files through the SBOM Manager User Interface

You can now easily import binary files directly through the SBOM Manager user interface, expanding your ability to analyze and understand your software components. This streamlined import process allows you to quickly generate SBOMs for your binaries, identify similar components, and gain deeper insights into your software supply chain.

For details, see the [SBOM Manager help documentation](https://help.sonatype.com/en/sbom-import.html).

#### Merge Multiple SBOMs

SBOM Manager now allows you to easily aggregate SBOMs from various sources, such as microservices within a single application, into a comprehensive, unified view. Import a .zip or .tar archive containing multiple SBOMs and SBOM Manager will generate a single, consolidated SBOM with duplicates removed.

For details, see the [Importing SBOMs help documentation](https://help.sonatype.com/en/sbom-import.html#merge-multiple-sboms-285999).

#### Generate PDF of Bill of Materials Report from SBOM Manager

SBOM Manager now allows you to export a Bill of Materials report as a PDF document, providing a convenient and shareable format for your SBOM data. This new export option includes policy violation and vulnerability details, and is accessible directly from the Bill of Materials view. See the [Bill of Materials View help documentation](https://help.sonatype.com/en/sbom-bill-of-material-view.html) for full details.

### Improvements

#### New Filtering Options in Security Risk Analysis Dashboard

The [Security Risk Analysis Dashboard](https://help.sonatype.com/document/preview/261290#UUID-f1bed07d-8d75-ca7c-47d3-14e360d24901) now allows users to filter by organization and application category, allowing for greater flexibility and precision when identifying and managing security vulnerabilities across your software development lifecycle.

#### Lifecycle Dashboard Performance Improvements

This release improves the [Lifecycle dashboard](https://help.sonatype.com/en/lifecycle-dashboard.html)'s performance by reducing database round trips. This results in faster dashboard loading times and reduced memory consumption.

#### Improved Transfer List Performance

This release improves transfer list performance throughout the application, resulting in faster and more responsive filtering when working with long lists of items. You'll notice this improvement in areas such as the license selection and the application filters.

#### Removed Old Framework for Data Insights

As detailed in our [Sunsetting documentation](https://help.sonatype.com/en/sonatype-iq-server-feature-status.html), we have officially sunsetted our legacy experimental Data Insights framework. If you are on an IQ version earlier than release 171 and navigate to the old _Data Insights_ section in Lifecycle, you will now see an alert informing you that the feature is no longer supported.

To take advantage of our most advanced data capabilities, upgrade to version 171 or higher and check out our growing list of enhanced Insights. See the [Data Insights help documentation](https://help.sonatype.com/en/data-insights.html) for details.

#### Embedded JDKs in IQ Server Docker Images

This release includes optimized IQ Server Docker images that leverage `jreleaser` assemblies with embedded JDKs. This eliminates unnecessary packages and dependencies, reducing image size and improving both efficiency and security while also aligning the Docker images with the latest advancements in our standalone bundles. Additionally, the updated images now support both linux/amd64 and linux/arm64 architectures, broadening platform compatibility.

#### Sonatype Container Security Enhancement - OS-Focused Container Scans

Sonatype Container Security now offers the option to focus container scans exclusively on OS-related components and their associated vulnerabilities, excluding other component types like Java (jar) files. You can enable this feature by setting the [new environmental variable](https://help.sonatype.com/en/sonatype-container-security.html#environment-variables-254008)`NEXUS_CONTAINER_INCLUDE_ONLY_OS_COMPONENTS` to `true`. This enhancement provides greater flexibility and control over scan results, allowing users to concentrate specifically on OS-level security concerns.

#### Sonatype Developer Enhancements

- **New Reachability Analysis Version for Java** \- This release updates Reachability Analysis to address an issue that prevented it from running against compressed artifacts. This ensures accurate and comprehensive analysis of your applications, including those packaged with compression formats.

- **Golden PR is Default for Maven when Auto PR is Enabled** \- Sonatype Developer now enables Golden Pull Requests for Maven projects by default when Auto PRs are enabled. Developers will receive recommendations to upgrade to the Golden Version of a component, streamlining upgrades and ensuring compatibility. This enhancement helps improve developer productivity by suggesting non-breaking upgrades that resolve issues for both the component and its dependencies.

- **Fail/Warn Filtering in Developer Priorities (UI and API)** \- This release introduces a new "fail/warn" filter for Developer Priorities in both the UI and API, allowing you to focus on the most critical components. This filter refines your results to show only components with "fail" or "warn" violations, streamlining your workflow and prioritizing your attention.

Currently, this filter is **enabled** by default to ensure you're immediately seeing the most urgent issues. Note that this can currently result in confusing messaging in the UI that will state "all clear no violations" when there still may be violations being filtered out due to their not having fail or warn notification/action. We will revise this wording in a future release to be more clear and conditionally change if filtering is enabled or disabled.

While the UI toggle to easily enable/disable this feature is coming soon, you can still control the filter programmatically. To disable it, simply set the `optionalActionFilter` parameter to `false` in your API calls.

- **Avoid Recommending Milestone Versions** \- We've enhanced our recommendation algorithm to prioritize stable, production-ready versions and ensure compatibility with your target platform. This means you'll receive more reliable and relevant upgrade suggestions, avoiding potentially disruptive pre-release milestone versions (alpha, beta, etc.) or platform-specific conflicts. These changes apply to all ecosystems and are reflected in our APIs, integrations, and UI, providing a more consistent and trustworthy experience for all Lifecycle and Developer customers.

#### SBOM Manager Enhancements

- **Improved Messaging to Support User Awareness of Imported SBOM Interpretation** \- SBOM Manager now provides clearer feedback when uploading invalid SBOM files. If an uploaded file fails validation but can still be processed as a binary, SBOM Manager provides a more informative message indicating the issue. This helps avoid confusion and ensures you have the necessary information to correct any syntax errors.

- **Updates to CycloneDX Property Names** \- This release updates property names in CycloneDX exports to align with Sonatype taxonomy standards and ensure consistency across both Lifecycle and SBOM Manager exports. These changes maintain backward compatibility, allowing seamless import and export functionality with both the old and new property names. See our [help documentation](https://help.sonatype.com/en/cyclonedx.html#sonatype-properties-in-sboms) for an updated list of Sonatype properties in SBOMs.

- **Standardize CycloneDX File Names** \- Lifecycle and SBOM Manager can now both ingest CycloneDX SBOMs with the standardized `.cdx.xml` and `cdx.json` file extensions. Additionally, exported SBOMs from SBOM Manager now also use the standardized `.cdx.xml` file extension. This change ensures consistency with industry best practices while maintaining support for existing `*-bom.xml|json` formats.

- **Improved Accuracy for Similar Matched Components** \- SBOM Manager now offers enhanced accuracy and consistency when managing CycloneDX SBOMs that contain components with similar matches. Similar matched components imported through a CycloneDX SBOM now retain their original designation and associated metadata, ensuring a consistent and reliable view of your component information throughout the SBOM lifecycle. This improvement strengthens your software supply chain security by providing a more accurate representation of your software's composition.

#### Firewall Enhancements

**Updates to Firewall Dashboard** \- We've enhanced the Firewall dashboard with improved filtering capabilities, allowing you to refine your view of quarantined components by repository and date.

| Sunsetting Announcements<br>Refer to [Sunsetting Announcements Details](https://help.sonatype.com/en/sonatype-iq-server-feature-status.html). |
| --- |
| Sunsetting a-name: Effective September, 2025 a-name identification process will no longer be supported. |
| Minimum Version Requirement for PostgreSQL: Sonatype IQ Server for older versions of PostgreSQL will be phased out. Effective from **December 2024**, PostgreSQL version 14.x will be the minimum version supported. |
| Sunsetting LORT: Effective October 2024, we are sunsetting the License Obligation Review Tool (LORT) |
| Sunsetting Legacy Evaluation Report |
| Sunsetting Shaded Vulnerability Detection Dashboard effective December 17, 2024 |

## Release 184 (November 2024)

**Upgrade Impact**

### New Features

#### New AI Model Dashboard

Our new _AI Model_ dashboard helps you understand which Hugging Face models are present in your applications and track usage trends across your organization. With this knowledge, you can make informed decisions to mitigate risks and optimize your AI strategy.

This dashboard provides detailed information on the Hugging Face models detected in your applications over the last 90 days. You can filter this data by organization, application, application category, and stage for targeted analysis. Visualizations include a breakdown of detected models, identical model identification across repositories, and a view of model usage in different applications.

To access the dashboard, ensure you are running IQ Server version 184 or higher, have scanned at least one application containing Hugging Face models, and have opted in to share telemetry data with Sonatype.

See the [AI Model dashboard help documentation](https://help.sonatype.com/en/ai-models-usage.html) for full details.

#### AI/ML Governance with Sonatype Lifecycle

The AI/ML model scanning capability with Sonatype IQ CLI and all supported plugins, introduces open-source AI/ML model observability in DevSecOps pipelines. Users can scan AI/ML models downloaded from the Hugging Face (HF) platform to retrieve and maintain the identity of the AI/ML model, in the form of evaluation reports in _Lifecycle_.

Learn more about the [new format/ecosystem](https://help.sonatype.com/en/analysis.html#ecosystem-support) and [component identifiers](https://help.sonatype.com/en/package-url-and-component-identifiers.html#idp218015) for the [analysis of AI/ML models](https://help.sonatype.com/en/hugging-face-model-analysis.html).

#### Security Risk Analysis Dashboard

The [Security Risk Analysis Dashboard](https://help.sonatype.com/document/preview/261290#UUID-f1bed07d-8d75-ca7c-47d3-14e360d24901) under Data Insights in _Sonatype Lifecycle_ provides visibility into the daily open violation counts and the time it takes to remediate them. The threat levels of the policy violations in conjunction with the number of violations gives a comprehensive insight into the overall security risk in applications.

#### Component EOL Policy Constraint in Sonatype Lifecycle

The [new policy constraint](https://help.sonatype.com/en/policy-constraints.html) _Component End-of-Life_ (EOL) allows users to create policies for evaluating applications containing EOL components. The policy actions and remediation for component EOL violations will prevent EOL components from jeopardizing the security of your applications and enable initiatives for a _Tech Refresh_ by encouraging use of newer open-source components.

This feature was based on a [user contribution](https://ideas.sonatype.com/ideas/IDEAS-I-1255) in the [Ideas Portal](https://ideas.sonatype.com/).

#### Golden Versions in IDE Plugins and Auto PRs

[Golden Versions](https://help.sonatype.com/en/golden-versions-and-prs.html) can elevate developer productivity by recommending a version of the component that has non-breaking changes, including its dependencies.

The Golden Versions are now available in the Sonatype IQ Server [plugin for IntelliJ IDEA](https://help.sonatype.com/en/iq-for-idea.html), Sonatype IQ Server [plugin for Eclipse](https://help.sonatype.com/en/iq-for-eclipse.html) and Sonatype IQ Server [IDE plugin for VS Code](https://help.sonatype.com/en/sonatype-for-vs-code.html) to enable the developers to apply violation fixes within the context of the development environment.

This feature was based on a [user contribution](https://ideas.sonatype.com/ideas/IDEAS-I-1852) in the [Ideas Portal](https://ideas.sonatype.com/).

### Improvements

#### Easy Copy Package URLs

The _Component Coordinates_ panel accessible from the _View Coordinates_ button on the [Component Details page](https://help.sonatype.com/en/component-details-page.html) offers the convenience of copying long and complicated package URLs to the clipboard, for use at other places.

#### Golden Versions Auto-enabled

It is no longer required to enable the _Golden Version_ feature using the Feature Configuration REST API. The feature is enabled by default for all users of Sonatype Lifecycle and Developer.

**Important Upgrade Impact**

If you enabled the _Golden Versions_ feature in release 183 and then upgraded IQ server to 184, you will need to disable and re-enable the feature post-upgrade in order to access it. This is a one-time requirement and will not be required after your next upgrade.

#### Reachability Analysis Performance Enhancements

This release offers major performance enhancements to [Reachability Analysis](https://help.sonatype.com/en/reachability-analysis.html) for faster response times.

#### Policy Constraints Now Include npm coordinates

[Policy constraints](https://help.sonatype.com/en/policy-constraints.html#coordinates) can include a condition to match (or do not match) npm coordinates when creating a policy in Sonatype Lifecycle.

#### Retrieve Paginated List of Priorities for a Scan/Evaluation

Users can now use a new /v2/developer/priorities API endpoint to retrieve a paginated list of priorities for a given scan/evaluation. You can also export them to CSV format through a new /v2/developer/priorities/export endpoint.

#### SBOM Manager Enhancements

- Software Bill of Materials that failed validation have a warning message indicating the failure

- An optional argument is added to the SBOM Import API to set the version ID on the upload of SBOMs

- SBOM Manager Search includes links to the specific version and vulnerability

| Sunsetting Announcements<br>Refer to [Sunsetting Announcements Details](https://help.sonatype.com/en/sonatype-iq-server-feature-status.html). |
| --- |
| Minimum Version Requirement for PostgreSQL: Sonatype IQ Server for older versions of PostgreSQL will be phased out. Effective from **December 2024**, PostgreSQL version 14.x will be the minimum version supported. |
| Sunsetting LORT: Effective October 2024, we are sunsetting the License Obligation Review Tool (LORT) |
| Sunsetting Legacy Evaluation Report |
| Sunsetting Shaded Vulnerability Detection Dashboard |

## Release 183 (October 2024)

| Announcements |
| --- |
| **Java Versions Support**<br>Starting from **release 179** onwards, support for running _Sonatype IQ Server_ and _Sonatype IQ CLI_ on Java 8 and 11 has been phased out. We strongly recommend running _Sonatype IQ Server_ and _IQ CLI_ on Java 17 or higher. Users may need to reconfigure the signature algorithm on their identity provider platform as SHA-1 is no longer supported.<br>Although Java 17 is required to run _IQ Server_ and _IQ CLI_, there is no change in the supported versions of Java for application scanning and analysis. |
| **Installation with Bundled JDK**<br>This release is also available in installation packages that include application binaries bundled with JDK.<br>The bundled JDK option is available here: [Download and Compatibility](https://help.sonatype.com/en/download-and-compatibility.html) |
| **Minimum Version Requirement for PostgreSQL**<br>Sonatype IQ Server for older versions of PostgreSQL will be phased out. Effective from **December 2024**, PostgreSQL version 14.x will be the minimum version supported. |
| **Upgrade Impact**<br>After upgrading a Lifecycle instance using a PostgreSQL database from IQ 182 or earlier to IQ 183 or later, for high data volume installations, you may **temporarily** see an internal error when accessing the Violations dashboard. This is due to an internal job running in the background taking longer to process the large volume of data, and is logged as a NullPointerException (NPE) in the logs. Once the job completes, the dashboard will load as expected, and NPE will no longer be visible in the logs. |

### New Features

#### Waiver Reasons

_Sonatype Lifecycle_ users can now add appropriate [reasons](https://help.sonatype.com/en/waivers.html#idp222509) when creating a waiver for a policy violation. This will enhance the ability to [categorize waivers](https://help.sonatype.com/en/waiver-tasks.html#idp222650) under same waiver reasons and improve visibility into the decision-making process for remediation.

The new [Waiver Reasons REST API](https://help.sonatype.com/en/waiver-reason-rest-api.html) allows users to view all the predefined waiver reasons that can be applied to a waiver.

This feature was based on a [user contribution](https://ideas.sonatype.com/ideas/IDEAS-I-877) in the [Ideas Portal](https://ideas.sonatype.com/).

#### Golden Versions in Sonatype Developer

[Golden Versions and Golden PR Comments](https://help.sonatype.com/en/golden-versions-and-prs.html) can elevate developer productivity by recommending a version of the component that has non-breaking changes, including its dependencies.

The Golden Pull Requests (PR) comments, which are generated in the Source Control Management systems supported by the Sonatype IQ Server SCM plugins (GitHub, GitLab, Bitbucket, and Azure DevOps) will contain recommendation to the change to the _Golden Version_ of the component.

This feature was based on a [user contribution](https://ideas.sonatype.com/ideas/IDEAS-I-1852) in the [Ideas Portal](https://ideas.sonatype.com/).

### Improvements

#### Policy Waiver REST API

The [Policy Waiver REST API](https://help.sonatype.com/en/policy-waiver-rest-api.html) has been updated to include the new parameter _waiverReasonId_. Using the POST method, users can assign a waiver reason ID while creating a policy waiver.

#### Component Golden Versions in Lifecycle

The [Component Details Page](https://help.sonatype.com/en/component-details-page.html#golden-version) in Sonatype Lifecycle, will now show [Golden Versions](https://help.sonatype.com/en/golden-versions-and-prs.html) of a component, if available. Users can replace the violating component to this _recommended-non-breaking-with dependencies_ version that is recommended by the version scoring system to remediate policy violations.

#### Enhanced Database Stability and Performance

We have improved the stability and performance of the IQ Server databases (PostgreSQL) by reducing the database size on disk to a considerable extent. To experience the performance improvement, we recommend running a `vacuum` command on PostgreSQL instances running the IQ Server. Refer to [Release specific upgrade instructions](https://help.sonatype.com/en/release-specific-upgrade-instructions.html) for details.

#### View _Reachability_ in Application Reports

The improved [Reachability Analysis](https://help.sonatype.com/en/reachability-analysis.html) now labels policy violations in the Application Report as _Reachable_, if a vulnerable component is found in the execution path.

#### SBOM Manager Enhancements

- Binary archives may be analyzed using SBOM Manager to generate a Bill of Materials; this is currently only supported via API but will be available via UI in a future release

- Exporting PDF reports has been added to the SBOM Bill of Materials

- Bill of Material reports now support importing and displaying unknown components from binary archives

## Release 182 (September 2024)

| Announcements |
| --- |
| **Shaded Vulnerability Detection Starting Soon**<br>Shaded Vulnerability Data covering all **Critical** shaded vulnerabilities will be rolled out to Sonatype customers starting 09/09/2024 (Drip 1.) This might lead to a jump in new policy violations. |
| **Java Versions Support**<br>Starting from release 179 onwards, support for running _Sonatype IQ Server_ and _Sonatype IQ CLI_ on Java 8 and 11 has been phased out. We strongly recommend running _Sonatype IQ Server_ and _IQ CLI_ on Java 17 or higher. Users may need to reconfigure the signature algorithm on their identity provider platform as SHA-1 is no longer supported.<br>Although Java 17 is required to run _IQ Server_ and _IQ CLI_, there is no change in the supported versions of Java for application scanning and analysis. |
| **Minimum Version Requirement for PostgreSQL**<br>_Sonatype IQ Server_ support for older versions of PostgreSQL is being phased out. Effective from October 2024, PostgreSQL version 14.x will be the minimum version supported. |
| **Firewall Guided Setup Temporarily Disabled**<br>The Guided Setup for _Sonatype Repository Firewall_ has been disabled in this release. |

### New Features

#### Stage Selection for Success Metrics in Lifecycle

_Sonatype Lifecycle_ users can now limit the generation of [Success Metrics](https://help.sonatype.com/document/preview/140034#UUID-2b00c0e3-c446-08eb-f1a9-95413db33a46) to a specific stage (source, build, stage-release, release and operate.)

The new property _successMetricsStageID_ added to the [Configuration REST API](https://help.sonatype.com/en/configuration-rest-api.html) enables users to set a specific **licensed stage** to generate Success Metrics, instead of generating this data for all stages, by default.

This feature was based on [a user contribution](https://ideas.sonatype.com/ideas/IDEAS-I-1059) in the [Ideas Portal](https://ideas.sonatype.com/).

### Improvements

#### Copy VEX Annotations in SBOM Manager

_Sonatype SBOM Manager_ offers the capability to copy [VEX annotations](https://help.sonatype.com/en/sbom-vex-workflow.html) from an application's previous SBOM to the SBOM for current version. The _Copy Annotation_ option in the Disclosed Vulnerabilities section allows users to copy previous annotation for a vulnerability and avoid rework.

#### Component EOL Dashboard Updates in Lifecycle

The updated [Component End-of-Life (EOL) dashboard](https://help.sonatype.com/en/component-end-of-life.html) under _Data Insights_ in Sonatype Lifecycle displays components of npm, NuGet and PyPI format/ecosystems.

### Notable Bug Fixes

#### Access to Application Data in Data Insights for Lifecycle

We have tweaked permissions for dashboards under _Data Insights_ in Lifecycle, that will now allow users to view data only for applications to which they have access. Dashboards reflecting this change are Component End-of-Life, Machine Learning AI, Dependency Scorecard, and Shaded Vulnerability Detection.

The minimum_IQ Server_versions required to view these dashboards is listed below:

| Data Insights/Dashboards | Minimum IQ Server Version |
| --- | --- |
| [Component End-of-Life](https://help.sonatype.com/en/component-end-of-life.html) | Release 177 |
| [Machine Learning AI](https://help.sonatype.com/en/machine-learning-ai.html) | Release 177 |
| [Rolling Recap Dashboard](https://help.sonatype.com/document/preview/170523#UUID-c25ba863-dd5e-6fdb-410b-11de0fa0cd7d) Rolling Recap Dashboard | Release 171 |
| [Supply Chain Monitoring](https://help.sonatype.com/en/supply-chain-monitoring.html) | Release 171 |
| [Dependency Scorecard](urn:resource:component:213657) | Release 177 |
| Shaded Vulnerability Detection | Release 177 |
| [Stack Divergence](https://help.sonatype.com/en/stack-divergence.html) | Release 171 |
| [Upgrade Posture](https://help.sonatype.com/document/preview/246519#UUID-31966075-fe73-7e9c-e11f-4439c2fd7c20) Upgrade Posture | Release 171 |

## Release 181 (August 2024)

**Note**

Emergency Bug Fix Release

This release fixes an issue with versions 179 and 180 that could cause IQ Server instances to shut down when using Source Control Management (SCM) features like Automated Pull Requests and Pull Request Commenting.

Users running versions 179 or 180 should upgrade to this version immediately.

### New Features

No new features are being added to this Release. This is a Bug-Fix release.

### Release Summary

This release contains a fix for IQ Server version 179 and 180, in addition to all new features, improvements, and notable bug fixes of version 180.

## Release 180 (August 2024)

| Sonatype Developer Now Available to all Lifecycle Users |
| --- |
| _Sonatype Developer_ (previously released as _Preview Only_) brings a developer-centric experience to manage the quality of open-source components for all Lifecycle users. Using the [solution switcher](https://help.sonatype.com/en/sonatype-solution-switcher.html), _Lifecycle users_ can easily access _Sonatype Developer_.<br>Learn more about [Sonatype Developer](https://help.sonatype.com/en/sonatype-developer.html). |

### New Features

#### Support for Fingerprinting Java 21 and 22

IQ Server and the IQ CLI Scanner now support Java 21 and 22 bytecode fingerprinting.

#### Added support for CycloneDX 1.6

The IQ Server is updated to support the CycloneDX Core Java library for the 1.6 version of the CycloneDX specification for export and application analysis. The validation library now supports specification 1.6 to ingest SBOM in XML and JSON formats through the SBOM Manager UI.

#### Custom Quarantine Messages for FWFA

The capability to display a custom quarantine message due to a Sonatype Repository Firewall policy failure has been extended to the Firewall for Artifactory (FWFA) plugin. Users can provide a custom quarantine message using the _quartantineItemCustomMessage_ property for [Configuration REST API](https://help.sonatype.com/en/configuration-rest-api.html) to set up more meaningful messages for failed component requests.

### Improvements

#### Re-evaluation of Stale Policy Evaluation Reports

The Re-evaluate button on the [Application Composition Report](https://help.sonatype.com/en/policy-reevaluation.html#re-evaluate-report-button) is disabled for all reports that are not the latest policy evaluations. This prevents users from encountering page load failures. An on-screen alert message will now inform the users and provide a link to navigate to the latest policy evaluation report.

#### Sonatype Developer Navigation Enhancements

_Sonatype Lifecycle_ users can seamlessly navigate to _Sonatype Developer_ for a standalone Developer experience, using the [solution switcher](https://help.sonatype.com/en/sonatype-solution-switcher.html). This offers users a focused and streamlined experience of using the functionalities of _Sonatype Developer_ outside the context of Lifecycle. The context-sensitive switching also allows users to navigate to the Lifecycle user interface when necessary, for e.g. when using Advanced Search or Reports view in _Sonatype Developer_.

#### Flexibility in Scanning CycloneDX SBOMs

The [Feature Configuration REST API](https://help.sonatype.com/en/feature-configuration-rest-api.html) now allows skipping schema validations for CycloneDX SBOMs. By enabling the feature _skipSbomImportValidation_ users can also ingest a CycloneDX SBOM that does not comply with the schema specifications and successfully generate an evaluation report.

#### ALP Legal Obligations Page Performance Improvements

This release offers major performance enhancements to the Legal Obligations page in the Advanced Legal Pack (ALP). It improves the response times for instances that have a large volume of applications (>10,000).

#### Detect the Type of Vulnerability Detection System

The new field _detectionType_ obtained in the response of the GET method of [Vulnerability Details REST API](https://help.sonatype.com/en/vulnerability-details-rest-api.html) will indicate the type of vulnerability detection that was used to detect the vulnerable component. The type of vulnerability detection (primary, secondary, AST, unshader) can help plan remediation efforts.

This feature was based on [a user contribution](https://ideas.sonatype.com/ideas/IDEAS-I-2643) in the [Ideas Portal](https://ideas.sonatype.com/).

#### Java 8 and 11 in Extended Maintenance

IQ and IQ CLI release 179 was the last to support Java 8 and 11, both of which are now in [Extended Maintenance](https://help.sonatype.com/en/sonatype-iq-server-feature-status.html) as defined in our [Sunsetting documentation](https://help.sonatype.com/en/sonatype-sunsetting-information.html). If you are unable to upgrade to Java 17, you will need to remain on release 179 until you can do so. Release 179 is available in the [Download Archives](https://help.sonatype.com/en/download-archives---iq-server---cli.html).

### Notable Bug Fix

#### Out of Memory error for Success Metrics API

This release resolves the out of memory error that occurred when calling the Success Metrics REST API.

## Release 179 (July 2024)

| Announcing our Latest Product Offering: Sonatype Developer (Preview only) |
| --- |
| _Sonatype Developer_ brings a developer-centric experience to manage the quality of open-source components. Developers can easily access prioritized and actionable suggestions to improve the quality and security posture of their applications and eliminate rework.<br>_Sonatype Developer_ brings the component intelligence and policy enforcement of the IQ Server within the context of CI/CD pipelines, SCM tools, issue tracking systems, and IDEs for easy access, to help plan and prioritize remediation tasks.<br>Learn more about [Sonatype Developer](https://help.sonatype.com/en/sonatype-developer.html).<br>Sonatype Developer is available in this release for preview only.

### New Features

#### Preview - Reachability Analysis

[Sonatype Platform Plugin for Jenkins](https://help.sonatype.com/en/sonatype-platform-plugin-for-jenkins.html) now offers the ability to enable _Reachability Analysis_ (previously known as Call Flow Analysis.) The availability of this feature is currently limited.

### Improvements

#### Remediation Details for Parent Dependencies

The new query param _includeParentRemediation_ for [Component Remediation REST API](https://help.sonatype.com/en/component-remediation-rest-api.html) when set to true, will return a POST response containing component details for remediating the implicated direct as well as transitive dependencies. The suggested remediation for transitive dependencies is based on the nearest parent dependency.

#### Automatic Role Assignment for SCM Users

The [Source Control REST API](https://help.sonatype.com/en/source-control-rest-api.html) can be used to automatically assign the _developer_ role on a specified application, to all contributors associated with a SCM repository. Using the _POST_ method and providing the applicationId, all contributors associated with an SCM repository will be assigned the _developer_ role for that application in IQ Server/Lifecycle.

**Note**

Support for Java 8 and 11 is being phased out for _Sonatype IQ Server_ and _Sonatype IQ CLI_ from this release onwards. Java 17 is recommended for this release.

Java 17 will be **required** from the next release onwards.

### Notable Bug Fixes

#### Scanning Docker Images Having Absolute Paths

Docker images containing absolute paths (when created with tools like buildpacks.io) can now be successfully scanned with Sonatype IQ CLI.

#### Scanning Docker Images on Windows OS

This release fixes an issue with _Sonatype IQ CLI_ that caused the scanning of Docker images on the Windows OS to fail.

## Release 178 (June 2024)

**Note**

This release fixes an upgrade issue with Sonatype IQ Server versions 169 and above, which rendered the upgraded instance in a non-functioning state when the upgrade process was interrupted.

### New Features

#### Streamlined Workflow for Waivers

The new Similar Waivers feature offers the convenience of looking up [Similar Waivers](https://help.sonatype.com/en/similar-waivers.html) for a specific policy violation. The waiver details displayed in the _Similar Waivers_ pane can be useful in determining if the selected policy violation can be waived for similar reasons.

The [Similar Waiver REST API](https://help.sonatype.com/en/similar-waivers-rest-api.html) retrieves all waivers that are _Similar_ and can potentially be applied to a given policy violation. By providing the _policyViolationId_ in the GET method, the response returns a list of all similar waivers, with details on each waiver.

#### Solution Switcher for Sonatype Platform

The [Solution Switcher](https://help.sonatype.com/en/sonatype-solution-switcher.html) simplifies navigating to different products offered by the Sonatype Platform. Using the _Solution Switcher_, users can easily transition to using other Sonatype products that are licensed to their organization.

## Release 177 (June 2024)

| Announcing our Latest Product Offering: SBOM Manager |
| --- |
| We are proud to announce _SBOM Manager_, with dual deployment options, SaaS and self-hosted (on-premise) for customers looking to streamline SBOM Management.<br>With _SBOM Manager_ users can catalog third-party SBOMs, associated with applications or libraries, in a configurable organizational structure that mimics their company's organizational structure or business units.<br>Powered by the _Sonatype Component Intelligence_ spanning over 14 ecosystems, the _SBOM Manager_ analyzes each component in the ingested SBOM and provides a **detailed vulnerability profile**, including transitive dependencies. This information can be used to audit third-party applications and libraries to ensure compliance with organizational or Federal policies.<br>The _VEX workflow_ allows users to communicate the exploitability status or provide clarity on vulnerabilities that may or may not pose a risk. _SBOM Manager_ can embed user annotations in CycloneDX format for downstream consumption, to facilitate decision-making for rapid roll-outs by eliminating blockers.<br>Contact your Customer Success representative to find out how SBOM Manager may fit your compliance needs. <br>[Learn more about SBOM Manager](https://help.sonatype.com/en/sonatype-sbom-manager.html).

### New Features

#### Dependency Scorecard

Users can review and evaluate the quality of upgrade decisions taken, using the new [Dependency Scorecard](urn:resource:component:213657). This new dashboard under _Data Insights_ reveals the _App Score_ (calculated per [Sonatype's Supply Chain Monitoring guidelines](/content/resources/software-supply-chain-management-part-4-understanding-the-basics/index.html)), the age of the components in applications or libraries, and the best version of the component. Based on the placement of an application in the scorecard quadrants, and the key factors determining the _App Score_, users can determine the next steps to improve their upgrade decisions for the most optimal threat protection.

This feature is available under _Data Insights_ for Sonatype IQ Server versions 171 and higher.

#### Supply Chain Monitoring

[The Supply Chain Monitoring](https://help.sonatype.com/en/supply-chain-monitoring.html) dashboard offers insights into the effectiveness of a _Sonatype Lifecycle_ instance in protecting the organization's open-source supply chain. Users can review the health of the open source component supply chain periodically, and take corrective actions like improving the management of critical vulnerabilities and increasing the extent of the protection provided by _Sonatype Lifecycle_ by adding more applications to the instance.

This feature is available under _Data Insights_ for Sonatype IQ Server versions 171 and higher.

IQ Server Version Requirements for _Data Insights_

### Improvements

#### Compatibility with Chrome Cookie Deprecation

We have implemented cookie-less embedding of all dashboards using Looker™, under Data Insights. This will ensure the normal functioning of all embedded dashboards in Chrome browsers after third-party cookies have been deprecated by Google Chrome.

### Notable Bug Fixes

#### Fix for Sonatype IQ CLI

This release fixes an issue that did not provide an option to set non-proxy hosts while using Sonatype IQ CLI. Users can now configure no-proxy lists while using Sonatype IQ CLI in environments such as Azure DevOps.