Notable Integrations Changes

Notable Integrations Changes

This page summarizes the major changes in Sonatype integrations. Note that this is not an exhausted list of all changes across all integrations; detailed change logs are available within each individual integration's main help page. This page focuses only on highlighting major changes.

June 2026

IQ CLI & All CI Integrations: Reachability Evidence Provides Visibility into Vulnerable Execution Paths

Sonatype IQ and its CI integrations now include Reachability Evidence for reachable vulnerabilities, giving teams visibility into the application call paths that lead from their code to vulnerable methods in third-party dependencies. This additional context helps developers understand why a vulnerability is considered reachable and prioritize remediation with greater confidence.

When Reachability Analysis identifies a reachable vulnerability, the vulnerability details now include a Reachability Evidence section that displays one or more representative call paths from application code to the vulnerable method. The evidence is presented in a concise, readable format that highlights transitions between application and dependency code while reducing unnecessary detail, making it easier to investigate and validate findings.

GitLab: Richer Sonatype Vulnerability Details in GitLab Ultimate

The GitLab Ultimate Security Dashboard now provides more actionable vulnerability information, helping developers investigate and remediate policy violations without leaving their GitLab workflow. Vulnerability details now include recommended remediation guidance, links to the corresponding Policy Violations view in Lifecycle, and references to the original vulnerability information, making it easier to understand and address issues from within GitLab.

When Reachability Analysis is enabled, GitLab vulnerability details also include reachability information that indicates whether a vulnerability is reachable from application code and identifies the vulnerable methods that can be reached. These enhancements give developers the context they need to prioritize remediation and move from detection to resolution without unnecessary context switching.

GitHub Actions: Optional Java Setup for GitHub Actions Evaluations

The Evaluate action for GitHub Actions now includes an optional skip-java-setup input that lets workflows bypass the built-in Java setup step when Java is already available on the GitHub runner. This helps reduce unnecessary setup work, shorten workflow execution time, and provides greater flexibility for organizations that manage their own Java runtime within their CI environment.

May 2026

IQ CLI & All CI Integrations: .NET Reachability Analysis

IQ's Reachability Analysis now covers .NET applications and NuGet components, helping teams identify which vulnerable dependencies are actually reachable from application code. By highlighting vulnerabilities that are part of an application's execution path, .NET development teams can prioritize remediation efforts based on actual risk rather than every reported vulnerability.

.NET Reachability Analysis is available for the IQ CLI and across supported CI integrations, including Sonatype Platform Plugin for Jenkins, Sonatype for Azure DevOps, Sonatype for Bamboo Data Center, Sonatype for GitHub Actions, and Sonatype for GitLab CI. Each integration provides native configuration options for enabling .NET reachability analysis, including namespace filtering, configurable entry point strategies, and an optional path to the dotnet executable, making it easy to incorporate .NET reachability analysis into existing build pipelines.

GitHub Actions: Updated to Node.js 24

All Sonatype GitHub Actions now use the Node.js 24 runtime, aligning with the default runtime on GitHub-hosted runners. By adopting the current default runtime, GitHub Actions workflows can continue to run without requiring additional configuration as GitHub phases out support for older Node.js versions.

GitHub Actions: Now Using Immutable Releases

Sonatype GitHub Actions now use immutable releases, providing an additional layer of security for CI workflows. Immutable releases ensure that published action versions cannot be modified after release, giving teams confidence that workflows always execute the exact action version they selected.

Azure DevOps: Latest IQ CLI Downloaded at Runtime

Sonatype for Azure DevOps now downloads the latest Sonatype IQ CLI at runtime instead of including it within the extension package. This significantly reduces the extension size, ensuring continued compatibility with Azure DevOps Server package size limits while preserving the existing evaluation workflow.

Existing pipelines continue to work without configuration changes. If you need to control which version of the IQ CLI is used or download it from a custom location, use the SonatypeEvaluate task, which provides configurable IQ CLI version and download options.

IDEA Plugin: Search Applications in the Sonatype for IDEA Plugin

The Sonatype for IDEA plugin now includes search functionality in the Application list, making it easier to locate the correct Lifecycle application in environments with large numbers of configured projects. Instead of scrolling through long lists, you can quickly find and select an application by searching for its name.

April 2026

IQ CLI & All CI Integrations: Centralized CI Configuration with the CI Configuration REST API

We've added a new CI Configuration REST API that lets administrators centrally manage CI evaluation settings across the organization and application hierarchy. Instead of updating individual pipeline definitions whenever evaluation settings change, teams can define shared configuration once and apply it consistently across supported CI integrations and Sonatype IQ CLI. This approach simplifies onboarding for new projects, reduces configuration drift, and makes it easier to adopt new capabilities such as Reachability Analysis without requiring widespread pipeline changes.

For full details, see the CI Configuration REST API help documentation.

IQ CLI & All CI Integrations: Sonatype Container Scanner is Now Default for Container Scanning

The Sonatype Container Scanner is now the default method for container scanning, replacing the NeuVector-based scanner. This update ensures that organizations benefit from improved detection accuracy powered by Sonatype’s proprietary vulnerability intelligence, along with a more unified security posture across all artifact types. The Sonatype Container Scanner also expands support for CI/CD integrations, enabling broader coverage across modern build and automation workflows while delivering improved performance and scalability for high-volume scanning environments.

Organizations currently using the default scanner will transition automatically, while those with an explicit NeuVector configuration can continue using it temporarily during the migration period. Review your container scanning configurations and CI integrations to ensure compatibility with the Sonatype Container Scanner, and refer to the Sonatype Container Security help documentation for full details.

Sonatype Container Security: Support for zstd-Compressed Docker Image Layers

Sonatype Container Security now supports scanning container images that use zstd-compressed Docker image layers. The scanner automatically detects whether image layers are compressed with gzip or zstd and processes them accordingly, improving compatibility with modern container images, including Docker Hardened Images.

March 2026

See below to learn more about exciting changes to our integrations in March 2026.

Jenkins: Improved Temporary File Handling for Docker Image Scans

Docker image TAR scans now use the Jenkins-provided temporary directory (WORKSPACE_TMP) instead of the JVM default (/tmp). Temporary files, including extracted Docker layers, are written to the workspace-specific location, preventing “No space left on device” errors when /tmp has limited capacity.

Jenkins: Control Build Behavior with failOnError Parameter for Reachability

You can now control how reachability check errors impact your build with a new failOnError parameter. When set to false, errors encountered during reachability analysis no longer affect the overall build outcome, allowing pipelines to continue without interruption. This enhancement gives you greater flexibility in CI workflows, enabling teams to gather reachability insights without blocking delivery when issues occur during analysis.

Jenkins: Support for Proxy Configurations Without Credentials

The Jenkins plugin now handles proxy configurations where a password is not set. Pipelines will continue to run policy evaluations without errors, eliminating the need to reconfigure existing Jenkins proxy settings and ensuring smoother upgrades between plugin versions.

Jenkins: Specify a Project Directory When Running JavaScript Reachability Analysis

We have added support for specifying a project directory when running JavaScript Reachability analysis in Jenkins freestyle jobs. You can now point the scan to the correct location of your package.json, ensuring analysis runs as expected even when your project is not located at the workspace root, and avoiding skipped scans or unstable results.

See our Reachability Analysis with Jenkins help documentation for full details.

Jenkins: More Reliable Reachability Analysis with Mixed Technology Stacks

The Jenkins plugin now gracefully handles cases where reachability analysis is skipped or not applicable. Builds no longer fail when JavaScript reachability is disabled or when no vulnerable method data is available, even if files like yarn.lock are included in scan patterns. This update ensures policy evaluation completes as expected, helping you maintain faster, more reliable pipeline execution without unnecessary errors.

Jira Cloud: Improved Jira Configuration Experience

Single-choice dropdown fields in the Jira Cloud configuration page now work as expected. You can now reliably select and save options without display or input issues, making it easier to configure Jira integrations and reducing friction during setup.

VS Code: Better Proxy Handling in VS Code Extension

The VS Code extension now properly respects the http.noProxy setting when making network requests. The extension now bypasses the proxy for configured hosts, allowing you to use corporate proxy settings alongside direct connections where needed. This improves compatibility with enterprise environments and ensures the extension works seamlessly without requiring changes to existing VS Code proxy configurations.

VS Code: Improved VS Code Extension Reliability for Application Discovery

We have enhanced the VS Code extension to improve reliability when communicating with IQ Server during application discovery. Requests now handle query parameters correctly and allow more time for responses, reducing timeout errors in slower environments. This ensures scans start successfully and provides a more consistent experience without requiring version rollbacks or manual adjustments.

Sunsetting Notice: Sonatype for Jira Data Center

The Sonatype for Jira Data Center plugin entered Extended Maintenance on January 31, 2026 (no additional features; best‑effort support for critical bug fixes). The plugin will receive only critical bug and security fixes through December 31, 2026.

On January 1, 2027, the plugin will be sunsetted, removed from the Atlassian Marketplace, and archived. For full details on Sonatype's sunsetting process, see our sunsetting help documentation.

February 2026

See below to learn more about exciting changes to our integrations in January 2026.

IQ CLI: Updated Bundles to Use Temurin JDK 21

IQ CLI distributions that include a bundled JDK have been updated to use Temurin JDK 21.0.9 (LTS). This update aligns with the latest long-term support version of Java and ensures a consistent runtime across environments.

IQ CLI (Docker): Multi-Architecture Support for Alpine Image

The IQ CLI Alpine Docker image is now available for both amd64 (Intel) and arm64 (ARM) architectures. This enables the image to run across a broader range of environments, including Apple Silicon and ARM-based cloud infrastructure.

GitHub Actions: Improved Security Validation for IQ CLI Downloads

Security checks have been enhanced when downloading the IQ CLI in GitHub Actions. Downloads must now use HTTPS and are validated using checksums before execution. These improvements help ensure the integrity of the CLI and reduce the risk of using untrusted or modified binaries.

Azure DevOps: Secure IQ CLI Download Support

The Sonatype Evaluate task in Azure DevOps now supports securely downloading the IQ CLI from custom URLs, including internal repositories that require authentication. This enables use in restricted or disconnected environments where the CLI must be retrieved from a trusted internal source.

Azure DevOps: Conditional Display of Sonatype Build Tabs

Sonatype build tabs in Azure DevOps now appear only when Sonatype tasks are used in the pipeline. This change reduces unnecessary clutter and ensures that build results remain focused and relevant.

GitHub Actions: Basic Authentication Support for IQ CLI Downloads

The setup-iq-cli GitHub Action now supports downloading the IQ CLI from locations that require Basic Authentication. This enables secure access to private repositories and ensures compatibility with environments that require authenticated access to private repositories.

For more details, see Sonatype CLI Setup Action.

GitLab CI: ARM64 Support for Plugin Docker Image

The GitLab CI plugin Docker image is now available for both amd64 (Intel) and arm64 (ARM) architectures. This enhancement allows the plugin to run on modern ARM-based systems, including Apple Silicon and ARM servers.

Bamboo: Support for Version 12.1.0

The Sonatype Bamboo plugin is now compatible with Bamboo version 12.1.0. This ensures continued support for the latest Bamboo platform and allows teams to upgrade without disruption to their CI workflows.

Jenkins: Updated Behavior for Reachability failOnError Parameter

The Jenkins plugin has been updated to improve how the failOnError parameter behaves during reachability analysis. When set to false, errors encountered during analysis no longer cause the build to fail, resulting in more predictable pipeline behavior.

Azure DevOps: JavaScript Reachability Analysis Support

The Sonatype Evaluate task in Azure DevOps now supports JavaScript reachability analysis. This enables more accurate identification of vulnerable JavaScript code paths and helps teams prioritize remediation based on actual usage. JavaScript and Java reachability analysis can be run independently or together, with flexible configuration options within the pipeline.

For more details, see the Reachability Analysis with Sonatype.

Bamboo: JavaScript Reachability Analysis Support

The Bamboo plugin now supports JavaScript reachability analysis, enabling more accurate identification of vulnerable JavaScript code paths during policy evaluation. This capability can be configured directly in the Bamboo UI and used alongside Java reachability analysis or independently.

For more details, see the Sonatype for Bamboo Data Center.

January 2026

See below to learn more about exciting changes to our integrations in January 2026.

Improved Stability in npm Package Lock Processing

When processing package-lock.json files, specific nested dependency structures could cause unbounded recursion in the npm lock file filtering logic, leading to a stack overflow and premature scan termination. As a result, npm-based scans could fail before completing analysis.

The lock file filtering logic has been updated to prevent excessively deep recursive processing while preserving existing pnpm behavior and performance. npm lock files are now processed reliably, allowing scans to complete successfully and sensitive content to be filtered as intended.

Azure DevOps: Conditional Display of IQ Build Tabs

Improved the Azure DevOps integration to prevent unnecessary UI clutter in pipelines that do not use Sonatype tasks. Previously, IQ-related build result tabs were displayed even when the pipeline YAML did not include any Sonatype extensions (such as NexusIqPipelineTask or SonatypeEvaluate), pushing other relevant result tabs out of view.

With this update, IQ build tabs are now shown only when Sonatype tasks are present in the pipeline. If no IQ scan is configured, the tabs will not appear. This enhancement ensures a cleaner pipeline view, improves usability, and aligns behavior with customer expectations.

Fortify SSC: Support for Automatic Waivers in Policy Violation Sync

Added support for automatic waivers in the sync-service to ensure auto-waived policy violations are correctly reflected in Fortify SSC. The service now retrieves auto-waiver data in addition to standard waivers and more flexibly processes waiver comments, including reachability and pathForward details. This update ensures accurate synchronization of auto-waived violations and improves overall reporting consistency.

IQ CLI: Bearer Token Authentication Support for Container Registries

Sonatype Container now supports Bearer Token authentication when scanning remote container images. Previously, only Basic Authentication was supported, which caused failures with registries such as GitLab that do not accept basic auth. The scanner now attempts Bearer authentication first and falls back to Basic Authentication if needed, improving compatibility and security. Related test updates in the insight-scanner repository ensure reliable validation of the new authentication flow.

November 2025

See below to learn more about exciting changes to our integrations in November 2025.

Improved Support for npm Workspaces

Scanning accuracy has been improved for projects using npm workspaces. The scanner now correctly processes multiple package.json files and a shared package-lock.json structure, resulting in more complete and reliable analysis of dependencies across all workspaces.

IQ CLI: Support for JavaScript Reachability Analysis

IQ CLI now supports JavaScript Reachability Analysis, enabling more precise identification of whether vulnerable functions in JavaScript components are actually invoked. This enhancement helps reduce noise in security reports by highlighting only actionable vulnerabilities.

GitHub Actions: Improved Security for IQ CLI Download URL Parameter

Improved GitHub Actions workflow to improve validation of the IQ CLI download and ensure it is secure and authentic before it's used. This improves the reliability and security of using the IQ CLI in automated processes, reducing the risk of workflow failures or security issues related to an incorrect or compromised tool download.

Maven Plugin: Java 17 Minimum Required Java Version

The CLM Maven Plugin now requires Java 17 or later. This update aligns with broader platform requirements and ensures compatibility with current Java standards.

October 2025

See below to learn more about exciting changes to our integrations in October 2025.

Support for Java 25 Bytecode Analysis

Added support for bytecode fingerprinting for applications built with Java 25. This enhancement ensures accurate component identification and policy evaluation for projects compiled with the latest Java version, allowing teams to adopt new language features with continued confidence in Sonatype's scanning capabilities.

Support for Docker Client Version 28 in Docker Image Analysis

Added support for scanning image tar files created with Docker v28 using the docker save command. This update ensures accurate identification of open-source components when using the latest Docker clients in automated pipelines.

Improvements in Analyzing pnpm-lock.yaml and Support for Version 9+

Added support for the updated pnpm-lock.yaml file format introduced in version 9, which includes dependency information in the new snapshots section. This enhancement ensures accurate parsing of both direct and transitive dependencies for projects using pnpm v9 and above.

In addition, we have significantly improved fingerprinting performance for pnpm-lock.yaml files, reducing analysis times in large npm-based projects.

Changes in Minimum Supported Jenkins Plugin Version

The minimum supported version of Jenkins for the Sonatype Jenkins plugin is now 2.479.3, which requires Java 17 or later.

Fortify SSC: Support for Ad-Hoc Single Application Synchronizations

The Fortify SSC integration now supports ad-hoc synchronization for individual applications using a specific scan. This enhancement provides greater control and reliability in CI/CD pipelines by ensuring that the correct scan data is synchronized, even when multiple evaluations occur in parallel.

September 2025

See below to learn more about exciting changes to our integrations in September 2025.

Jira Data Center Plugin Supports Jira Data Center 11

The Sonatype for Jira Data Center plugin now supports Jira Data Center version 11.0.0. This update helps teams maintain compatibility with their issue-tracking workflows on supported Jira Data Center deployments.

Removed Python Component Analysis from IDEA Plugin

To improve compatibility with the latest IntelliJ IDEA Ultimate builds, we've removed Python support from the Sonatype IntelliJ IDEA plugin as of version 4.15.0-01. This change allows the plugin to remain accessible through the JetBrains Marketplace and ensures continued support for core functionality.

August 2025

See below to learn more about exciting changes to our integrations in August 2025.

JavaScript Reachability Analysis Now Available in Sonatype Platform Plugin for Jenkins

The Sonatype Platform Plugin for Jenkins now supports JavaScript Reachability Analysis, enabling teams to better prioritize security vulnerabilities in JavaScript components that are actually used at runtime. This helps reduce noise by highlighting only the components that are truly exploitable based on your application's execution paths.

By focusing remediation efforts on reachable components, development teams can make faster, more informed decisions to improve application security. For details on enabling this new feature, see the Sonatype Platform Plugin for Jenkins help documentation.

Support for Fingerprinting Java 23 and 24

The following integrations now support Java 23 and 24 bytecode fingerprinting, helping teams stay up to date with the latest Java versions while maintaining accurate component identification:

July 2025

See below to learn more about exciting changes to our integrations in July 2025.

Generate SARIF Files with Sonatype for Azure DevOps

The SonatypeEvaluate task now allows you to optionally generate a SARIF file containing all identified vulnerabilities during a policy evaluation. The file can be named to your preference and uploaded as a pipeline artifact, making it easier to integrate with security tools that consume SARIF for reporting and analysis.

For full details, see the Sonatype for Azure DevOps help documentation.

New Reachability Analysis Tab Enhances Vulnerability Insights in Sonatype for Azure DevOps

The Sonatype for Azure DevOps plugin's SonatypeEvaluate task results now includes a separate Reachability Analysis tab. When reachability analysis is enabled, this tab shows which vulnerabilities are actually reachable in your code, helping you prioritize remediation efforts more effectively.

For full details, see the Sonatype for AzureDevOps help documentation.

Consistent Method-Selection Strategy Across IQ CLI, GitLab Plugin, and GitHub Actions

We've updated the default method-selection strategy for reachability analysis to ensure consistent results across the Sonatype IQ CLI, GitLab plugin, and GitHub Actions. Reachability analysis now uses the CONCRETE strategy by default, which includes all non-abstract, non-synthetic methods from non-interface and non-annotation classes. This change improves consistency across Sonatype's supported integrations.

Sonatype for IDEA Plugin Now Compatible with IDEA 2025.1+

We've updated the Sonatype for IDEA plugin to support IntelliJ IDEA version 2025.1 and newer. This update replaces deprecated APIs, upgrades dependencies, and refactors key components to align with the latest IntelliJ platform changes. These enhancements ensure continued compatibility and improve long-term maintainability of the plugin within modern development environments.

Analyze Java 23 and 24 Bytecode with IDEA and Eclipse Plugins

The Sonatype plugins for IntelliJ IDEA and Eclipse now support bytecode fingerprinting for Java 23 and Java 24.

June 2025

See below to learn more about exciting changes to our integrations in June 2025.

Enhanced Reachability Analysis in Jenkins Plugin

When reachability analysis is enabled, users can now access a new Reachability Analysis page that clearly displays evaluated components and their associated vulnerable methods. This page distinctly highlights which vulnerabilities are reachable, helping you prioritize high-risk issues more effectively.

We have also refreshed the Build Report page with new UI elements that present component and method-level insights, adapting its display based on whether reachability is enabled, disabled, or if the analysis encounters an error.

Finally, the default method-selection strategy for reachability analysis has been updated to CONCRETE, which includes all non-abstract and non-synthetic methods from non-interface and non-annotation classes, providing broader and more relevant coverage of potentially exploitable code paths.

For full details, see the Sonatype Platform Plugin for Jenkins help documentation.

Sonatype for VS Code Now Supports CycloneDX JSON Analysis

You can now analyze CycloneDX-formatted SBOMs directly within the Sonatype for VS Code extension. This enhancement gives you visibility into component risk and policy violations for SBOMs already present in your projects, helping you make informed decisions about upgrades and vulnerability remediation without needing to rescan your full workspace. See the Sonatype for VS Code CycloneDX help documentation for details on using this new feature.

Improved Error Visibility and Troubleshooting in Sonatype for VS Code

The Sonatype for VS Code extension now provides clearer error messages when local build tools like Maven or npm cannot be run. This improvement helps you quickly identify configuration issues that prevent dependency analysis. For full details, see the Sonatype for VS Code help documentation.

Support for Bamboo Data Center 11

The Sonatype for Bamboo Data Center plugin now supports Bamboo Data Center version 11. This update ensures compatibility with the latest Bamboo platform, allowing teams to continue integrating Sonatype policy evaluations into their CI workflows without interruption.

SPDX v2.2 SBOM Download Support in GitLab Plugin

The Sonatype for GitLab CI plugin now supports downloading SBOMs in SPDX v2.2 format. This enhancement enables teams to generate and retrieve standardized SBOMs directly from their GitLab CI pipelines, improving compatibility with third-party tools and compliance workflows.

Configurable CI Image Registry and Name in GitLab Plugin

The Sonatype for GitLab CI plugin now includes dedicated input variables for setting the Docker image registry and image name used in CI jobs. This enhancement gives teams more control over their build environments by allowing them to specify a custom ci-image-registry and ci-image-name, improving flexibility for organizations with internal registries or customized CI setups.

Bug Fixes

The table below lists notable Integrations bug fixes:

Issue ID Description
INT-9434 Container scans using the Nexus Platform Plugin now correctly report policy violations by including only the intended files in the plugin package.

May 2025

See below to learn more about exciting changes to our integrations in May 2025.

Sonatype CLI Available as Homebrew, Debian, and RPM Packages

The Sonatype CLI is now available as a Homebrew package for Mac users and as Debian and RPM packages for Linux users. These new distribution methods streamline the installation process, allowing you to quickly set up and utilize the Sonatype CLI for your development workflows. See the Sonatype CLI with Bundled JDK help documentation.

Improved Pipeline Status Visibility for Azure DevOps Plugin

Azure DevOps users now have visibility into the status and details of long-running pipelines. Previously, you had to wait for a pipeline to complete before viewing the results of a policy evaluation. Now, the Sonatype-contributed tabs display content as soon as the evaluation step finishes, even if the overall pipeline is still running. This allows you to quickly identify progress, issues, or failures without waiting for the pipeline to finish.

See the Sonatype for Azure DevOps help documentation.

Enhanced Azure DevOps Widget Capabilities

Azure DevOps users now have greater flexibility in analyzing and reporting on policy violations within their pipelines. You can specify dashboard widgets by Application ID or Evaluation Index Number to create separate summary widgets for each evaluation, providing detailed insights per application.

Additionally, a single dashboard trend widget can aggregate the total number of policy violations from multiple evaluations, providing a holistic view of your security posture.

These enhancements provide a more comprehensive and tailored view of your Sonatype Lifecycle policy evaluation results directly within your Azure DevOps dashboards.

See the Sonatype for Azure DevOps help documentation.

Improved Exclusion Patterns in Jenkins Scans

The Sonatype Platform Plugin for Jenkins now correctly applies exclusion patterns, preventing unintended scans of specified files and directories. This improvement ensures that when you configure a pipeline scan with iqScanPatterns that include exclusion rules (e.g., !**/malformed_package_json/package.json), those files and directories are skipped as expected. This change also optimizes the scanning process by preventing the system from scanning the same targets multiple times.

See the Sonatype Platform Plugin for Jenkins help documentation.

Enhanced Visibility for Multiple Policy Evaluations in Jenkins

The Sonatype Platform Plugin for Jenkins now provides improved visibility for jobs that invoke multiple policy evaluations. The main job page now shows multiple summary fragments for all policy evaluations conducted within that run, giving you a more complete and immediate overview of your scan results without needing to navigate to individual run details.

April 2025

See below to learn more about exciting changes to our integrations in April 2025.

All CI Integrations Use reachability Instead of callflow for Parameters

To enhance clarity and consistency across our CI integrations, we've renamed parameters related to callflow to use the term reachability. While the original callflow parameters remain available in this release, they are now deprecated and will be removed in a future version. We encourage you to begin using the new reachability parameters in your CI configurations. This change streamlines terminology and prepares for future enhancements in how Sonatype products interact with your continuous integration pipelines.

Jenkins Plugin: Improved Reachability Configuration

The Jenkins plugin now offers a simplified configuration experience for reachability analysis. This improvement applies specifically to Java call flow analysis, ensuring that other language configurations remain unaffected and the core reachability analysis for Java remains consistent. See the Reachability Analysis documentation for full configuration details.

Bamboo Plugin: Support for Multi-Step Evaluation and Auto-Waivers

The Bamboo plugin now includes support for multi-step evaluation, enabling you to take advantage of automated waivers in Sonatype IQ Server version 191+. This enhancement streamlines the evaluation process for complex builds with multiple steps. This feature simplifies policy management and reduces manual intervention for qualifying security and license violations.

Azure DevOps Plugin: Download and Run User-Specified Versions of IQ CLI

The Azure DevOps plugin now offers greater flexibility in IQ CLI usage with the introduction of the SonatypeEvaluate task. This new task allows you to specify and download a particular version of the IQ CLI to use during your build process, mirroring the functionality available in our GitHub Actions integration.

VS Code Plugin: Support for Yarn v4-Based Projects

The Sonatype VS Code plugin now includes compatibility for projects using Yarn v4. The plugin now detechts the Yarn version in your VS Code workspace and dynamically uses the appropriate Yarn command (yarn info or yarn why) to accurately generate the dependency tree. This enhancement ensures that developers working with the latest Yarn version can seamlessly leverage the plugin's dependency analysis features within their VS Code environment.

Updated Apt and Yum Public Keys

Sonatype has updated the public keys for our Apt and Yum repositories. The previous keys are expired; to continue downloading Debian or RPM packages from Sonatype, you must update the keys in your infrastructure.

The new public keys are available at the following locations:

Please ensure these keys are updated at your earliest convenience to maintain uninterrupted access to Sonatype packages.

March 2025

See below to learn more about exciting changes to our integrations in March 2025.

Enhanced Prioritization with Integration-Specific Filters

When navigating to the Priorities view from one of our supported integrations, the results are now automatically filtered to display violating components that directly impact your build. This means you'll immediately see components causing build failures or warnings, eliminating the need to sift through irrelevant data. For example, if you access the Priorities view through Jenkins, the filter will highlight components that caused your Jenkins build to fail. This focused view ensures that you address critical vulnerabilities promptly, streamline your vulnerability management process, and reduce the time spent manually adjusting filters.

February 2025

See below to learn more about exciting changes to our integrations in February 2025.

Enhanced Console Output with Lifecycle and Developer Links (IQ CLI)

Released February 15, 2025

Sonatype CLI now provides direct links to both the detailed Sonatype Lifecycle report and the Developer priority page in the console output. This enhancement makes it easier to access critical vulnerability and policy violation details, streamlining remediation efforts for developers and security teams.

Branch Name Collection (Bamboo, Jenkins, Maven, GitLab, GitHub, Azure DevOps)

Released February 5, 2025

Sonatype's CI/CD integrations—including Bamboo, Jenkins, Maven, GitLab, GitHub, and Azure DevOps—can now retrieve and send Git branch names along with scan data. This enhancement provides better context for security and policy evaluations, ensuring that branch-specific insights are available within reports. By associating scans with their respective branches, developers can more effectively track and address issues. For more details, see the Sonatype CI and CLI Integrations documentation.

January 2025

See below to learn more about changes to our integrations in January 2025.

Sonatype IQ CLI is now a Standalone Solution (IQ CLI)

Released January 9, 2025

We're excited to announce that the IQ CLI is now a standalone solution. The standalone IQ CLI (i.e., IQ CLI 2.0) includes all the functionality you're used to but will now follow its own independent versioning and release cadence. This change allows for faster development, more frequent releases, and better integration with your existing workflows.

Note that this change means that the IQ CLI is now a separate download and is not included in the bundled IQ download. See the Download and Compatibility page to download the CLI.

Dependency Tree Visualization for Cargo (IQ CLI)

Released January 9, 2025

With IQ CLI 2.0, the dependency tree visualization now allows you to explore the full dependency tree of your Cargo projects, including direct and transitive dependencies sorted by threat level. This provides a comprehensive view of your project's dependencies and potential vulnerabilities, facilitating better risk assessment and management.

Note that for the dependency tree visualization to work for Cargo, both your Cargo.lock and Cargo.toml files must exist in the same location. For more details, see the dependency tree help documentation.