# Sonatype IQ Server 187 Release Notes **Released February 4, 2025** The IQ 187 release includes multiple changes to our IQ-powered solutions. View the details in each solution’s section below. ## Sonatype Lifecycle This release includes the following changes for Sonatype Lifecycle: ### Hugging Face Declared and Observed License Detection As of January 28, 2025, all Lifecycle customers running IQ Server version 184 or higher will see declared licenses for Hugging Face models in their application reports. This is the same license that is visible on the readme.md in the metadata section for the model hosted on the Hugging Face platform. Additionally, [Advanced Legal Pack](https://help.sonatype.com/en/add-on-packs.html#advanced-legal-pack "Advanced Legal Pack") customers with [extended observed license detection](https://help.sonatype.com/en/advanced-legal-pack-extended-observed-license-detections.html "Advanced Legal Pack Extended Observed License Detections") enabled will also receive observed license and other advanced legal information for these models. Advanced Legal Pack supports extracting copyright statements, notice files, license files, and original source code links from the Hugging Face repository that publishes the AI model. Users can leverage the legal pack's legal compliance workflow to ensure compliance with AI and open source licenses. This enhancement ensures visibility into license compliance and helps mitigate potential risks associated with using Hugging Face models in your applications. See our [Hugging Face help documentation](https://help.sonatype.com/en/hugging-face-model-analysis.html "Hugging Face Model Analysis") for full details. ### View Latest Evaluations This release introduces a new _View Latest Evaluations_ page in Sonatype Lifecycle, providing a comprehensive overview of your system's security posture. The page, which you can access from the _Options_ drop-down menu, displays evaluation dates, trigger information, report links, and key metrics like component and violation counts. This provides developers with quick access to historical evaluation reports, allowing them to track changes across different stages and assess the overall health of their systems. For full details, see the [options help documentation](https://help.sonatype.com/en/options-dropdown.html "Options Dropdown"). | | | --- | | | ### Improvements to Security Risk Analysis Dashboard This release includes a number of improvements to the Security Risk Analysis dashboard to provide a more streamlined and informative experience: - We've simplified the Mean Time to Remediate (MTTR) chart to provide a clearer view of overall remediation performance. - A new _Remediation Status_ filter provides deeper insights into the reasons behind vulnerability fixes. See the [Security Risk Analysis Dashboard help documentation](https://help.sonatype.com/document/preview/261290#UUID-f1bed07d-8d75-ca7c-47d3-14e360d24901) for details. ## Sonatype Developer This release includes the following changes for Sonatype Developer. ### Enhanced Vulnerability Remediation with Auto-Waivers for Policy Violations on Components with "No Path Forward" Sonatype Developer can now intelligently identify and automatically waive policy violations in open-source components where no updated version is available to address the issue. Auto-waivers can help you focus on critical issues, streamline your policy violation management process, and minimize distractions for developers, ultimately improving software supply chain security and developer productivity. Administrators can configure auto waivers to honor a maximum tolerated threat level at the organization or application level. This ensures control over risk tolerance and alignment with organizational security posture. Auto-waivers are visible on the waivers dashboard, in violation details, and on the license compliance application report. Users can also manually remove auto-waivers for specific violations when necessary. You can also manage auto-waivers programmatically through the API. See the [auto-waiver help documentation](https://help.sonatype.com/en/automated-waivers.html "Automated Waivers") and [auto-waiver API documentation](https://help.sonatype.com/en/auto-policy-waiver-rest-api.html "Auto Policy Waiver REST API") for full details on configuring this powerful new feature. ### Branch Name Display in _Priorities_ View Sonatype Developer now displays the branch name in the breadcrumbs of the _Priorities_ view for an application when a scan is triggered using the CLI. This enhancement provides better visibility into the scan context by making the branch name available in the frontend. ## Sonatype SBOM Manager This release includes the following changes for Sonatype SBOM Manager: ### Specify SBOM Application Version During Import You can now specify the application version during the import process, giving you more control over how your SBOM data is organized and tracked. If no version is specified, SBOM Manager will continue to use the existing logic, either extracting the version from the SBOM itself or generating one based on the date and time. This enhancement provides a more streamlined and user-friendly experience, allowing for better management of SBOMs associated with specific application versions. For full details, see the [SBOM Applications help documentation](https://help.sonatype.com/en/sbom-applications.html "SBOM Manager Applications View"). ### Easily View SBOM Release Status This release introduces a new Release Status feature to provide a clearer picture of your SBOMs' security posture. The BOM page now displays the overall release status of an SBOM version, replacing the previous annotation percentage. This status is calculated based on annotations for critical and high vulnerabilities, providing a more focused view of your risk. Additionally, the _Release Status_ column in the _Components_ table offers a granular view of individual component statuses, empowering you to prioritize remediation efforts. These enhancements improve SBOM analysis and risk assessment by highlighting the most critical vulnerabilities impacting your software. See the [BOM page documentation](https://help.sonatype.com/en/sbom-bill-of-material-view.html "SBOM Bill of Material View") for full details. ## Sonatype Repository Firewall IQ release 187 includes the following changes to Sonatype Repository Firewall. ### Notable User Interface Changes Options like _Vulnerability Lookup_ and _Advanced Search_ no longer display in the standalone Firewall user interface available via [Solution Switcher](https://help.sonatype.com/en/sonatype-solution-switcher.html "Sonatype Solution Switcher"). You can find these items by switching to the _Lifecycle_ option via [Solution Switcher](https://help.sonatype.com/en/sonatype-solution-switcher.html "Sonatype Solution Switcher"). ## Notable Integrations Changes We also wish to call out the following significant integrations changes: ### Support for Python pipfile.lock (IQ CLI) IQ CLI 2.0 now supports Python `pipfile.lock` files. This allows it to accurately and efficiently identify dependencies directly from Pipenv projects. This eliminates the need for manual workarounds or CI configurations when analyzing Python projects with Pipenv. Note that users leveraging the Jenkins plugin will need to upgrade their Jenkins plugin to take advantage of this functionality as the changes were made within the scanner. ## Bug Fixes | **Issue ID** | **Description** | | --- | --- | | CLM-34075 | Waivers created for a specific security vulnerability and matcher strategy are no longer incorrectly marked as "unapplied waivers" on unrelated violation. | | CLM-33553 | Backslashes in package names no longer cause an `InvalidPackageURLException` during application scans, ensuring proper handling of invalid entries in `bom.json`. | | CLM-33047 | Policy violation constraint facts now load properly so that requesting success metrics for certain applications no longer results in a 500 error. | | CLM-32350 | The Success Metrics report header now correctly reflects the configured `successMetricsStageId` instead of always displaying all stages. | | CLM-29183 | The IQ CLI now correctly processes `pnpm-lock.yaml` files inside archives without throwing a "Not a directory" error. | | CLM-29148 | You can now configure the maximum number of PostgreSQL connections for on-premises Nexus IQ Server installations using the `maxConnections` property in the `database` section of your config.yml. | | NEXUS-45401 | Resolved an issue that was causing some features of Firewall to not be available when also using SBOM Manager for some license types.