# Sonatype IQ Server 199 Release Notes

**Released December 12, 2025**

The IQ 199 release includes multiple changes to our IQ-powered solutions. View the details in each solution’s section below.

## Changes Impacting Multiple Solutions

This release includes the following changes impacting multiple IQ-powered solutions:

**_Upgrade Posture_ and _Rolling Recap_ Enterprise Reports to be Sunset**  
Data for the _Upgrade Posture_ and _Rolling Recap_ Enterprise Reporting dashboards will no longer be refreshed after **January 2026**. These dashboards will be sunset and removed from Sonatype IQ on **February 23, 2026**.  
Customers are advised to review their usage of these dashboards and plan accordingly. Additional guidance is provided in the [Sonatype IQ Server Feature Status](https://help.sonatype.com/en/sonatype-iq-server-feature-status.html#sonatype-iq-server-feature-status) section.

### Improved Detection of Obscured Dependencies in JavaScript Projects

Sonatype's JavaScript analysis now more accurately identifies dependencies even when they are deeply nested or structured in ways that previously prevented their detection. This enhancement helps uncover additional components that may have otherwise gone unreported due to indirect or obscured associations with declared top-level dependencies.

With this improvement, users gain greater visibility into their actual open-source usage, leading to more complete and accurate security and policy evaluation results. More details are available in [our Knowledgebase article](https://support.sonatype.com/hc/en-us/articles/47423166321555).

### React2Shell Impact Report Available via CSV Download

To help organizations respond quickly to the [critical React2Shell vulnerability](https://help.sonatype.com/en/find-and-fix-react2shell.html "Find and Fix React2Shell") (CVE-2025-55182, CVE-2025-66478), Sonatype has released a _React2Shell Impact Report_ that helps you assess which of your components and applications are impacted based on implicated files.

**Tip**  
Sonatype’s vulnerability detection operates at the **file level**, not just the component level. Our report results reflect only the vulnerabilities present in the specific files included in your components and applications. This precision helps eliminate noise and ensures you're focused on real risk.

Along with summary information about affected applications, component versions, and implicated files, this report includes recommended remediation actions and information on active waivers.

Users can access this data via the _Download CSV_ option that appears in the _React2Shell Impact Report_ user interface under _Enterprise Reporting_.

You can also obtain the CSV using the [Component Search API](https://help.sonatype.com/en/component-search-rest-api.html "Component Search REST API"):

```bash
GET /api/v2/componentSearch/downloadComponentSearchReport
```

For full details, see the [React2Shell Impact Report help documentation](https://help.sonatype.com/en/react2shell-impact-report.html "React2Shell Impact Report").  
A fully featured user interface for the React2Shell Impact Report will be available next week.

### Admin Connector Binds to Localhost by Default

IQ now defaults the admin HTTP connector (port 8071) to bind only to localhost (127.0.0.1), restricting access to local connections and improving overall system security. This change helps prevent unauthorized remote access to sensitive administrative endpoints, such as those used for operational tasks and system monitoring.

This update is fully backward compatible, with no required code or API changes.

### User Token Expiration

Sonatype IQ user tokens can now be configured to expire after a defined number of days, helping organizations enforce stronger authentication practices. This feature is optional and disabled by default. When enabled, IQ Server evaluates token age during authentication and prevents the use of expired tokens. This applies to both new and existing tokens.

For full details, see the [User Token](https://help.sonatype.com/en/iq-server-user-tokens.html "User Tokens") and [User Token Expiration Configuration REST API](https://help.sonatype.com/en/user-token-expiration-configuration-rest-api.html "User Token Expiration Configuration REST API") help documentation.

##  Sonatype Lifecycle

This release does not include any notable Sonatype Lifecycle-specific changes.

##  Sonatype Developer

This release does not include any Sonatype Developer-specific changes.

##  Sonatype SBOM Manager

This release does not include any Sonatype SBOM Manager-specific changes.

##  Sonatype Repository Firewall

This release includes the following changes for Sonatype Repository Firewall:

### Repository Firewall Now Honors EPSS and KEV Policy Constraints

Sonatype Repository Firewall now supports policy enforcement based on Exploit Prediction Scoring System (EPSS) scores and Known Exploited Vulnerabilities (KEV) catalog data. When these [policy constraints](https://help.sonatype.com/en/policy-constraints.html "Policy Constraints") are configured at the proxy level, Repository Firewall will respect these policy constraints, providing more granular and threat-informed protection at the point of component entry.

## Bug Fixes

This release includes the following notable bug fixes:

| Issue ID | Description |
| --- | --- |
| NEXUS-49342 | Firewall now honors policies that include EPSS and KEV policy constraints. |
| NEXUS-49289 | Repository manager–level policy waivers now appear in the policy waiver dashboard alongside repository-level waivers when filtering by repositories. |
| NEXUS-43056 | Policy deletion behavior has been updated to prevent automatic unquarantining of components and loss of waivers. |
| CLM-37987 | Upgraded the `semver4j` library to version 5.3.0 to prevent `NumberFormatException` errors during policy evaluations when encountering complex pre-release version strings. |
| CLM-37982 | Updated the SBOM Manager API to check for file existence before attempting to delete temporary binary SBOM files, preventing 500 errors when deleting non-existent BINARY-type SBOMs. |
| CLM-37582 | Support zips now include the public data source configuration setting. |
| CLM-37109 | Pull request comments and annotations for Bitbucket are now truncated to stay within the 32 KB limit, preventing failures when posting scan results that exceed the allowable size. |
| CLM-26943 | The OpenAPI specification at `/api/v2/endpoints/public` now includes `securitySchemes` and global security definitions. |
| CLM-19259 | Administrative API endpoints on port 8071 are now bound to localhost by default.