# Sonatype IQ Server 188 Release Notes **Released March 2025** The IQ 188 release includes multiple changes to our IQ-powered solutions. View the details in each solution’s section below. ## Changes Impacting Multiple Solutions These changes impact multiple IQ-powered solutions. ### API Documentation Available in the User Interface for All IQ-Powered Solutions API documentation, powered by Swagger, is now [accessible directly within the user interface](https://help.sonatype.com/en/rest-apis.html "REST APIs") for all IQ-powered solutions, including Lifecycle, Developer, SBOM Manager, Firewall, and Advanced Legal Pack. | | | --- | | | A new _API_ tab in the left-hand navigation for each IQ-powered solution provides easy access to the Swagger documentation. Within the Swagger documentation, you can find detailed information about each API endpoint, including request and response formats, required parameters, authentication requirements, and example responses. You can even try out API calls directly from the user interface provided that you have the necessary permissions for that API. Regardless of the solution you are currently viewing, the API documentation remains consistent, displaying all available IQ APIs for your license type. This unified approach simplifies API exploration and usage, providing a centralized resource for developers. ## Sonatype Lifecycle This release includes the following changes for Sonatype Lifecycle: ### Update Existing Waivers with the Policy Waivers REST API In this release, we've expanded the Policy Waivers REST API capabilities, enabling users to update existing waivers through the API. This enhancement provides greater flexibility and efficiency in managing policy exceptions. Specifically, you can now modify attributes such as the waiver's expiration date, comments, and waiver reason ID, streamlining your workflow and ensuring precise control over policy enforcement. See the [Policy Waiver REST API help documentation](https://help.sonatype.com/en/policy-waiver-rest-api.html "Policy Waiver REST API") for details. ### Policy Violations REST API Now Returns Waived, Legacy, and Auto-Waived Violations We’ve enhanced the Policy Violation REST API to provide a more comprehensive view of your policy landscape. Previously, this API only returned active policy violations. Now, you can retrieve waived, auto-waived, and legacy violations as well. This enhancement eliminates the need to consult multiple APIs, providing a consolidated view similar to the violations dashboard in the user interface. For full details on how to use the Policy Violation REST API to retrieve various violation types, see the [Policy Violation REST API documentation](https://help.sonatype.com/en/policy-violation-rest-api.html "Policy Violation REST API"). ### Report REST API Policy Violations Now Returns Open Time The Report REST API now includes the `openTime` field when returning policy violation data, providing users with the timestamp of when a violation was first detected. This enhancement allows for more detailed analysis of violation age and improved tracking of remediation efforts directly within the report data. See the [Report REST API help documentation](https://help.sonatype.com/en/report-rest-api.html "Report REST APIs") for full details. ### Success Metrics Enterprise Dashboard Displays Remediation Status Charts We've enhanced the Success Metrics Enterprise Dashboard with two new donut charts, providing a clearer view of remediation status. | | | --- | | | The _Remediation Status: Critical Violations_ chart shows a breakdown of critical violations remediated through various methods, including upgrades, downgrades, component removal, vulnerability fixes, and waivers. The _Remediation Status: All Other Violations_ chart presents a breakdown of remediation actions for all non-critical violations. This chart specifically highlights remediations achieved through component version changes and waivers, offering insight into the strategies used to manage lower-severity violations. These visual enhancements provide a more comprehensive and actionable overview of your organization's remediation efforts. See the [Success Metrics Enterprise Dashboard help documentation](https://help.sonatype.com/en/success-metrics.html "Success Metrics") for full details. ### Enhanced Security Risk Analysis Dashboard We've enhanced the Security Risk Analysis dashboard to provide more granular insights into your application security posture. | | | --- | | | The dashboard now includes new _Mean Time To Remediate (MTTR)_ and _Fix Rate_ charts to provide a clear visualization of your team's remediation efficiency. The _Fix Rate_ chart displays the percentage of violations resolved over time, including resolutions achieved through component version changes and vulnerability fixes. Additionally, the dashboard now includes new remediation reason charts, offering a detailed breakdown of critical and non-critical violation remediation methods. These enhancements provide a more comprehensive and actionable view of your application security risks and remediation progress. For full details, see the [Security Risk Analysis Dashboard help documentation](https://help.sonatype.com/document/preview/261290#UUID-f1bed07d-8d75-ca7c-47d3-14e360d24901). ## Sonatype Developer This release does not include any additional changes for Sonatype Developer. ## Sonatype SBOM Manager This release does not include any additional changes for Sonatype SBOM Manager. ## Sonatype Repository Firewall This release does not include any additional changes for Sonatype Repository Firewall. ## Notable Integrations Changes We also wish to call out the following significant integrations changes: ### Enhanced Console Output with Lifecycle and Developer Links (IQ CLI) Released February 15, 2025 Sonatype CLI now provides direct links to both the detailed Sonatype Lifecycle report and the Developer priority page in the console output. This enhancement makes it easier to access critical vulnerability and policy violation details, streamlining remediation efforts for developers and security teams. ## Bug Fixes | **Issue ID** | **Description** | | --- | --- | | CLM-34067 | Policy violations without migrated `PolicyViolationConstraintFacts` are correctly handled, and users will no longer experience an internal error in the violations dashboard. | | CLM-33993 | Improved SCM integration error handling to prevent connection attempts and null pointer exceptions when configuration is invalid. | | CLM-33991 | Deleting a user via REST API with no active IQ browser session now succeeds as expected. | | CLM-31655 | Azure DevOps plugin log no longer shows unexpected invalid cookie header information. | | CLM-31489 | Skip validation for SPDX scans now works as expected. | | CLM-31394 | When the violations dashboard is disabled, users now see a descriptive alert in the user interface. | | CLM-29686 | Added explanatory tooltips and re-designed the Daily Automated Pull Request activity table. See the [Automated Pull Request help documentation](https://help.sonatype.com/en/automated-pull-requests.html "Automated remediation") for details.