Sonatype IQ Server 199 Release Notes

Released December 12, 2025

The IQ 199 release includes multiple changes to our IQ-powered solutions. View the details in each solution’s section below.

Changes Impacting Multiple Solutions

This release includes the following changes impacting multiple IQ-powered solutions:

Upgrade Posture and Rolling Recap Enterprise Reports to be Sunset
Data for the Upgrade Posture and Rolling Recap Enterprise Reporting dashboards will no longer be refreshed after January 2026. These dashboards will be sunset and removed from Sonatype IQ on February 23, 2026.
Customers are advised to review their usage of these dashboards and plan accordingly. Additional guidance is provided in the Sonatype IQ Server Feature Status section.

Improved Detection of Obscured Dependencies in JavaScript Projects

Sonatype's JavaScript analysis now more accurately identifies dependencies even when they are deeply nested or structured in ways that previously prevented their detection. This enhancement helps uncover additional components that may have otherwise gone unreported due to indirect or obscured associations with declared top-level dependencies.

With this improvement, users gain greater visibility into their actual open-source usage, leading to more complete and accurate security and policy evaluation results. More details are available in our Knowledgebase article.

React2Shell Impact Report Available via CSV Download

To help organizations respond quickly to the critical React2Shell vulnerability (CVE-2025-55182, CVE-2025-66478), Sonatype has released a React2Shell Impact Report that helps you assess which of your components and applications are impacted based on implicated files.

Tip
Sonatype’s vulnerability detection operates at the file level, not just the component level. Our report results reflect only the vulnerabilities present in the specific files included in your components and applications. This precision helps eliminate noise and ensures you're focused on real risk.

Along with summary information about affected applications, component versions, and implicated files, this report includes recommended remediation actions and information on active waivers.

Users can access this data via the Download CSV option that appears in the React2Shell Impact Report user interface under Enterprise Reporting.

You can also obtain the CSV using the Component Search API:

GET /api/v2/componentSearch/downloadComponentSearchReport

For full details, see the React2Shell Impact Report help documentation.
A fully featured user interface for the React2Shell Impact Report will be available next week.

Admin Connector Binds to Localhost by Default

IQ now defaults the admin HTTP connector (port 8071) to bind only to localhost (127.0.0.1), restricting access to local connections and improving overall system security. This change helps prevent unauthorized remote access to sensitive administrative endpoints, such as those used for operational tasks and system monitoring.

This update is fully backward compatible, with no required code or API changes.

User Token Expiration

Sonatype IQ user tokens can now be configured to expire after a defined number of days, helping organizations enforce stronger authentication practices. This feature is optional and disabled by default. When enabled, IQ Server evaluates token age during authentication and prevents the use of expired tokens. This applies to both new and existing tokens.

For full details, see the User Token and User Token Expiration Configuration REST API help documentation.

Sonatype Lifecycle

This release does not include any notable Sonatype Lifecycle-specific changes.

Sonatype Developer

This release does not include any Sonatype Developer-specific changes.

Sonatype SBOM Manager

This release does not include any Sonatype SBOM Manager-specific changes.

Sonatype Repository Firewall

This release includes the following changes for Sonatype Repository Firewall:

Repository Firewall Now Honors EPSS and KEV Policy Constraints

Sonatype Repository Firewall now supports policy enforcement based on Exploit Prediction Scoring System (EPSS) scores and Known Exploited Vulnerabilities (KEV) catalog data. When these policy constraints are configured at the proxy level, Repository Firewall will respect these policy constraints, providing more granular and threat-informed protection at the point of component entry.

Bug Fixes

This release includes the following notable bug fixes: