2026 Release Notes
2026 Release Notes
This page contains a list of 2026 IQ releases, links to each release's release notes, and a brief list of major changes per release.
Note that while we strive to fully document new features before releasing them to our Cloud environments, there may be occasional delays. In such instances, we will update this page with links to the relevant help documentation as soon as it becomes available.
Summary of Major Changes in 2026
The following table lists major changes in 2026 that should be considered when upgrading to a new version.
Features and fixes are added to Sonatype Cloud-based deployments on a weekly basis. The same features and fixes are made available to self-hosted deployments on a monthly basis.
| Features and Changes | Cloud Release Date | Included in Self-Hosted Release |
|---|---|---|
| Features / Enhancements - Self-hosted IQ Server deployments on Amazon EKS now support IAM Roles for Service Accounts (IRSA) when using Amazon S3 as a file store. This enables secure, credential-free authentication using AWS IAM roles and the standard AWS credential provider chain. Bug Fixes - CLM-42440 – Database connections used by jOOQ streaming queries are now returned to the connection pool when streaming operations fail, preventing pool exhaustion and subsequent IQ Server outages. - CLM-42247 – IQ Server now starts successfully with multiple applicationConnectors and adminConnectors configured, binding all configured HTTP and HTTPS ports as expected.- CLM-41689 – Authenticated usernames are now consistently recorded in request.log entries across both the classic and logback-access request logging implementations. |
July 22, 2026 | 206 (Coming August 2026) |
| Features / Enhancements - Firewall for Docker container image layer downloads now support a configurable timeout of up to 240 minutes, allowing scans to complete successfully in environments with proxy-based antivirus scanning, slow network connections, or large images. - The HeroDevs End-of-Life Components dashboard now makes it easier to identify and investigate affected components by displaying Policy Violation IDs, full component names, and complete Package URLs (PURLs) that consistently include version information across supported package formats. Bug Fixes - CLM-40930 – Deleting an SBOM version through the API now also removes associated policy evaluation report files and scan artifacts from storage, preventing orphaned files from accumulating |
July 15, 2026 | 206 (Coming August 2026) |
| Features / Enhancements - Policy Waiver Request submitters can now withdraw their own pending requests through the API before a review decision. This reduces coordination overhead when requests need to be corrected or resubmitted. Bug Fixes - CLM-38159 - Policy evaluation now preloads security vulnerability group data during repository component metadata evaluation, eliminating unnecessary database queries and improving evaluation performance. |
July 8, 2026 | 206 (Coming August 2026) |
| Features / Enhancements - Support for conda-forge upstreams in Repository Firewall. - Sonatype IQ Server now identifies and reports OSS components embedded in uber JARs using the new Embedded match state, improving visibility into transitive risk and enabling more accurate policy enforcement and vulnerability tracking. - Sonatype Repository Firewall now includes the Firewall Success Metrics enterprise dashboard, providing visibility into quarantine activity, malicious component trends, and key usage metrics with filters for date range, ecosystem, and quarantine type to help measure security posture over time. - The End-of-Life Components dashboard now supports cross-filtering by component version and stage, making it easier to isolate and analyze end-of-life components using the same workflow as the Golden Fixes dashboard. - Automated remediation pull requests now default to GoldenPRs across all ecosystems. To continue receiving non-golden pull requests, enable the nonGoldenPullRequestsEnabled API property.- Reachability analysis now supports .NET components, providing vulnerability reachability insights for NuGet and PE/COFF projects. - Automated remediation can now automatically close stale pull requests in Bitbucket Cloud and Bitbucket Data Center, helping keep repositories clean. - Sonatype IQ Server now securely stores GPG signing configuration and masks GPG passphrases during save and retrieval. - Lifecycle reports now identify scans performed by the Sonatype container scanner in the Triggered By field. - Application IDs with unsupported characters are now automatically normalized, improving compatibility across integrations and policy evaluation. - The Waive Violations tooltip now appears only when no automated waivers are configured, reducing unnecessary guidance. - Waiver expiration information is now displayed consistently on the Priorities and Component Details pages. - Enhanced the Re-Evaluate Report dialog with clearer descriptions of full and quick re-evaluation options. - Optimized InnerSource component search by batching dependency-data queries, significantly improving search performance. Bug Fixes - NEXUS-52537 - View Repository Results now routes Docker proxy repositories to the correct container results page, matching the behavior of selecting the repository name directly. - INT-9591 - Container scans now complete successfully when CVE reference URLs are malformed or missing, returning full report links instead of a server error. - CLM-38947 - Reachability markers from manual scans are now preserved during Continuous Monitoring re-evaluation, keeping reachability-scoped auto-waivers intact across monitoring cycles. - CLM-37908 - The younger than N days policy condition now correctly excludes components whose cataloged age is exactly N days from policy violations. |
July 1, 2026 | 205 (July 7, 2026) and 206 (Coming August 2026) |
| Features / Enhancements - Sonatype Repository Firewall webhooks now support Violation Alert and Waiver Request events, enabling real-time notifications for repository proxy policies. Bug Fixes - INT-10303 – Large policy reports can now be retrieved in smaller chunks, improving compatibility with ServiceNow size limitations. - CLM-40944 – GitHub App registration for SCM authentication now completes successfully without configuration errors. - CLM-39938 – Developer prioritization now loads only the data required for analysis, preventing memory exhaustion on large scans. - CLM-38777 – Vulnerability customizations for NeuVector-sourced OS-level findings now load correctly when weakness or severity values are null. - CLM-32426 – Source Control settings at the sub-organization and application levels now correctly display Inherit (Not Configured) when no explicit value has been set. |
June 24, 2026 | 205 (July 7, 2026) |
| Features / Enhancements - The new Malware Threat Landscape Dashboard provides a centralized view of malware threats across your software supply chain, helping teams quickly identify, analyze, and respond to malicious components. - The new Legacy Violation Management API enables teams to automate the listing, granting, revoking, and configuration of legacy violation statuses through a supported integration surface. Bug Fixes - NEXUS-52941 – The Malware Defense evaluate API now returns malware assessment results when components are identified by hash only, without requiring a packageUrl.- CLM-39800 – Components with names similar to internal project modules are no longer incorrectly classified as InnerSource components, and previously affected records are automatically corrected during subsequent scans. - CLM-37563 – View Dependency Tree now remains available and fully populated after Re-Evaluate Report and Quick Re-Evaluate operations on SBOM-uploaded scans. - CLM-35969 – SBOM components with empty license values are now treated as Not Provided and Not Declared, allowing License-None policies to evaluate correctly. |
June 17, 2026 | 205 (July 7, 2026) |
| Features / Enhancements - Users with read permission on individual proxy repositories can now access the Firewall Dashboard with data automatically scoped to only their permitted repositories. - The Firewall Repository Result table now displays separate Evaluation Time and Quarantine Time columns replacing the previous single column that showed evaluation timestamps for all components regardless of quarantine status. The Quarantine Time column displays a date only for currently quarantined components. - Sonatype Firewall can now send email notifications when Firewall waivers are approaching expiration. - Firewall administrators can now configure and manage IQ proxy repositories directly from the Firewall through the new Virtual Repository Managers section. This simplifies integration with external repository managers by eliminating manual API configuration. - A new Waivers tab on the Firewall Dashboard allows administrators to view, filter, and renew policy waivers from a centralized location. Expiration indicators and renewal workflows help teams maintain continuous policy coverage. - Firewall now provides an in-product waiver request workflow that enables developers to submit waiver requests and administrators to review and manage them through a centralized process. - The legacy standalone JAR-only IQ Server distribution has been removed following its published sunset date. Customers using the standalone format must migrate to the platform-bundled JReleaser distribution. - The Swagger API page now renders in dark mode, with improved styling for text, inputs, headers, and authorization dialogs. - Container scanning now captures Red Hat content_sets metadata and includes it in generated CycloneDX BOMs.- The evaluation status endpoint now supports Server-Sent Events (SSE) for real-time policy evaluation updates. - The Lifecycle CLI now supports passing SCM repository URL, branch name, and commit hash via environment variables with automatic Git detection as a fallback. - Auto-remediation pull requests now record whether they were created using a Personal Access Token or GitHub App authentication. - Database connection pool settings are now fully supported across both on-prem and SaaS deployments. This provides consistent tuning options while maintaining compatibility with existing database configurations. - IQ Server can now register with the webhook relay service to receive SCM webhook events without requiring direct inbound network access. Administrators can access the generated webhook URL directly from source control configuration pages for streamlined configuration. - You can now integrate multiple GitHub Apps with a single IQ organization. See the GitHub App Authentication for SCM help documentation. Bug Fixes - NEXUS-52196 – The format filter selection on the Repository Managers page persists correctly when navigating into a repository detail view and returning to the list. - NEXUS-52143 – The Firewall container quarantine view now displays only Docker images from repositories where quarantine is actively enabled, excluding audit-only repositories whose images were never blocked. - NEXUS-49583 – The Quarantine Time column in container-specific repository results views is now labeled Evaluation Time, accurately reflecting that the timestamp represents when the container image was scanned, not when it was quarantined. - CLM-40144 – Telemetry processing now limits queue growth and per-scan data collection to prevent excessive memory consumption when HDS is unavailable or responding slowly. - CLM-40054 – Go module scanning now ignores go.sum files in auxiliary directories to prevent incorrect component matches from bundled tooling, examples, and test assets.- CLM-39840 – When an Auto or Golden PR fails because a detected component is not declared as a direct dependency in the manifest file, the Retry button is now disabled with an actionable tooltip explaining that the component must first be added as a direct dependency before a pull request can succeed. - CLM-39830 – The policy violations API endpoint now retrieves application component data in a single batch query rather than one database call per violation, eliminating timeouts for policies with millions of violations. - CLM-39739 – Component age policies now skip age evaluation for components that are not present in the HDS catalog. - CLM-38844 – Audit log entries for license identification and component status changes scoped to non-root organizations are now captured and visible in the application audit log view, including any comments entered at the time of the change. - CLM-38729 – SBOM scans now complete successfully when license URLs exceed 200 characters. - CLM-38128 – The OIDC option in Firewall product preferences now navigates correctly to the OIDC configuration page. - CLM-37954 – Nexus IQ Server now automatically restores missing reference policies at the root organization during upgrades to ensure accurate Firewall malware-risk export results. |
June 10, 2026 | 205 (July 7, 2026) |
| These self-hosted patch releases include the following bug fix: - EI-1273 – Memory usage remains bounded during audit and remediation collection, preventing excessive memory growth and OutOfMemoryError conditions under large workloads. |
- | 203.4 (June 9, 2026) and 204.2 (June 9, 2026) |
| These self-hosted patch releases include the following bug fix: - CLM-40144 – Telemetry processing now limits the number of queued telemetry events, preventing unbounded queue growth that could lead to excessive memory consumption and improve Sonatype Lifecycle stability under sustained telemetry load. |
- | 203.3 (June 6, 2026) and 204.1 (June 8, 2026) |
| Features / Enhancements - Redesigned the Success Metrics Enterprise Reporting dashboard by partitioning it into two focused tabs for Program Health and Remediation Ops. The update also adds new remediation metrics, industry benchmarks, and executive summary reporting to help teams track program performance more effectively. |
June 1, 2026 | 204 (June 2, 2026) |
| Features / Enhancements - A new Mythos Readiness Enterprise Reporting dashboard helps you identify applications that may be affected by privately disclosed vulnerabilities before CVE information becomes publicly available. The report provides application component inventory data, visibility into newer and golden component versions, and flexible filtering to help teams quickly assess potential impact. - Available immediately for Sonatype IQ cloud customers through a new Mythos Readiness card under Enterprise Reporting. - Self-hosted customers can access the same data through the updated Supply Chain Monitoring Enterprise Report today, with a dedicated Mythos Readiness card arriving in IQ Server 204. |
May 29, 2026 | 205 (July 7, 2026) |
| Features / Enhancements - IQ Cloud now displays an in-product maintenance banner across Lifecycle, Repository Firewall, and SBOM Manager so users can stay informed about upcoming maintenance windows. - The new Policy Configuration Export API enables programmatic retrieval of policy configurations across organizations, applications, and repositories, with optional inclusion of inherited parent policies. Bug Fixes - NEXUS-52635 – Concurrent npm and PyPI proxy requests under PCCS now coalesce across cluster nodes, preventing uncoordinated bursts of evaluate/componentMetadata calls from exhausting IQ Server heap memory. (This fix requires IQ Server 204+ and Nexus Repository 3.92.3+.) - NEXUS-52385 – (Included in Self-Hosted 203.2) The IQ Server HDS connection pool size is now configurable to support concurrent npm metadata requests in HA deployments and reduce fallback to stale cache when the default connection limit is reached. - CLM-38656 – The Priorities report now displays a Create PR button instead of a stale link when a previously merged pull request's changes are reverted and a new scan detects the reintroduced violation. - CLM-35417 – Source control configuration validation now provides specific error messages for invalid repository URLs, authentication failures, and insufficient token permissions to help users quickly identify and correct configuration issues. |
May 20, 2026 | 204 (June 2, 2026) and 203.2 (May 25, 2026) |
| Features / Enhancements - Improved startup time for large data migrations between versions and validated database migration consistency. - Improved Legal Attribution Report generation performance and reliability for large applications with thousands of components. - SCM pull request commenting is now enabled by default for Sonatype Lifecycle SaaS tenants, allowing automated PR analysis to begin after configuring an SCM integration while preserving existing tenant settings. Bug Fixes - NEXUS-52434 – PCCS evaluation results for PyPI and npm proxy repositories are now cached and reused within the configured metadata maximum age window, so a single request to IQ Server serves all subsequent lookups until the cache expires. (Fixed in Nexus Repository 3.92.3) - NEXUS-52218 – The Malware Components CSV now removes components whose malicious classifications were retracted or corrected during Automatic Malware Management reconciliation, ensuring unresolved findings reflect current Sonatype threat intelligence. - NEXUS-51730 – Repository Manager-scoped Firewall integration users can now retrieve custom quarantine messages without 403 errors or repeated WARN log entries in Nexus Repository. |
May 13, 2026 | 204 (June 2, 2026) |
| Features / Enhancements - SBOM Manager component details now include a Legal tab with Effective, Declared, and Observed license views aligned with Lifecycle and Firewall. Advanced Legal Pack users can also review obligations and manage license overrides directly from SBOM Manager. (Released in 203.1) - Advanced Search now supports filtering by Legal and Policy Violations, making it easier to identify and prioritize compliance risks across applications. Bug Fixes - NEXUS-51450 – The Automatic Malware Management task log now reports accurate quarantine states for malicious components detected in Firewall-enabled proxy repositories. - CLM-39406 – Saving custom filters in Success Metrics and Enterprise Reporting now succeeds for LDAP users with distinguished names longer than 50 characters. - CLM-38233 – Policy name validation during support zip imports now performs a single bulk database query per policy instead of recursive traversal, reducing import times for large organization hierarchies from more than 15 minutes to seconds. - CLM-31884 – Session cookies now use SameSite=Lax by default, while SAML authentication paths retain SameSite=None for IdP callback compatibility. Identity provider configuration review may be required before upgrading.- CLM-30626 – Application create and update operations now validate application IDs against existing internal UUIDs to prevent collisions that could cause the application management UI to crash. |
May 6, 2026 | 204 (June 2, 2026) and 203.1 (May 14, 2026) |
| Bug Fixes - CLM-38299 – License Threat Group updates now complete successfully without UI hangs by optimizing name validation queries to eliminate excessive database calls in large organizational hierarchies. |
April 29, 2026 | 204 (June 2, 2026) |
| Maintenance release | April 23, 2026 | 203 (May 5, 2026) |
| Features / Enhancements - Repository Firewall now sends webhook notifications when repository-level policy waivers expire, enabling proactive management of temporary security exceptions and helping prevent compliance gaps. - Firewall now supports bulk waivers, allowing users to waive up to 1,000 policy violations in a single operation directly from the Repository Results view. This can also be accomplished using new endpoints in the Firewall API. - The Source Header License page in Advanced Legal Pack now displays copyright notices within independent scrollable containers, preventing excessive page expansion when components contain large numbers of detected headers and keeping navigation controls visible during review. - The AI/ML Dashboard in Sonatype Lifecycle _Enterprise Reporting_now includes expanded filtering capabilities to help teams analyze AI component usage with greater precision across their organizations. - Added support for .NET reachability analysis for NuGet components. Bug Fixes - NEXUS-51881 - Component re-evaluation through Firewall completes successfully when using an H2 database, allowing quarantined components to be released without lock timeout errors. - NEXUS-51535 - Bulk waiver functionality in the Firewall dashboard container view now works correctly, with the waive button fully operational, the date picker displaying without overlapping text, and the back button returning users directly to the Firewall dashboard. - NEXUS-51509 - Concurrent Policy Compliant Component Selection requests for the same PyPI or npm package are now deduplicated, ensuring only one evaluation request reaches Firewall. - NEXUS-51485 - Docker proxy repositories now return Docker Registry API V2-compliant error responses containing the quarantine reason and Firewall report URL directly in the JSON body, making blocked image pulls immediately actionable in standard Docker and Podman clients without requiring additional client-side configuration. - CLM-39913 - Policy evaluations no longer deadlock when database connection pools are exhausted, improving reliability under high-load conditions with concurrent ClusterLock and transaction operations.- CLM-39405 - User and role detail pages open correctly for Repository Firewall-only licensed instances, without redirecting to the Firewall dashboard. - CLM-36995 - The Dependency Tree REST API, CycloneDX exports, and SPDX exports include all components shown in the UI dependency tree, including those with unknown match states. - CLM-36831 - SPDX files containing percent-encoded Package URLs, including special characters, are imported into SBOM Manager without double-encoding or UI display issues. The packageurl-java library upgrade introduces updated PURL normalization behavior that may affect existing integrations.- CLM-38424 - OIDC token exchange requests route through the HTTP proxy configured via the IQ Server REST API ( /api/v2/config/httpProxyServer), removing the need for JVM system property-based proxy configuration.- CLM-37414 - Migration from H2 to PostgreSQL requires granting SET ON PARAMETER``"session_replication_role" to the importing user prior to running the import, including in managed PostgreSQL environments. |
April 22, 2026 | 203 (May 5, 2026) |
| The self-hosted IQ Server version 202.1 release fixes the following bug: - NEXUS-51881 – Re-evaluating quarantined components with an H2 database no longer times out because transaction handling now avoids creating nested database transactions. |
April 22, 2026 | 202.1 (April 21, 2026) |
| Features / Enhancements - Sonatype SBOM Manager now continuously evaluates policies across all SBOM versions for each application rather than only the most recent. This provides broader visibility into risk over time. A configurable evaluation queue distributes processing across instances and supports tuning through version evaluation windows and queue settings, allowing teams to balance coverage and performance. Complete help documentation for this feature will be published shortly. - Improved dashboard performance when multiple organizations or application categories are selected. Bug Fixes - CLM-38934 – Vulnerability Lookup displays KEV and EPSS data correctly regardless of whether CVE identifiers are entered in uppercase, lowercase, or mixed case. - CLM-38699– Policy conditions combining DependencyType with other criteria now correctly evaluate Python packages, which may result in new violations appearing for components that were previously skipped.- CLM-38674 – Raw reports now include AI Content policy violation details for troubleshooting and analysis. |
April 15, 2026 | 203 (May 5, 2026) |
| Features / Enhancements - Optimized the Developer Priorities API to improve response times under load. Bug Fixes - CLM-38690 – Re-evaluating a CycloneDX SBOM report now preserves SBOM-supplied license data for exactly matched components, so License Detections no longer change to Not Provided when no better curated license data exists. |
April 13, 2026 | 203 (May 5, 2026) |
| Maintenance release | April 8, 2026 | 203 (May 5, 2026) |
| Bug Fixes - CLM-38633 – Support ZIP files now include OAuth2, OIDC, Crowd, and tenant metadata configuration details, enabling more efficient troubleshooting of authentication and tenant-related issues while ensuring sensitive data remains obfuscated. |
April 3, 2026 | 203 (May 5, 2026) |
| Features / Enhancements - Bitbucket Cloud integrations now require API tokens with scopes as the only supported authentication method, replacing deprecated app passwords and access tokens. For full details, see our Bitbucket Cloud Configuration help documentation. - Introduced the Best Practices Dashboard in Sonatype Lifecycle, providing a centralized view of feature adoption, integration coverage, and scan activity across applications and stages. The dashboard enables teams to identify gaps in Lifecycle usage, monitor enablement of key capabilities such as CI/CD integration and Golden PRs, and improve consistency in DevSecOps workflows through actionable insights into configuration and scanning practices. For full details, see our Best Practices Dashboard help documentation. Bug Fixes - CLM-39124 - Bitbucket Cloud integrations automatically discover repositories across all accessible workspaces following Bitbucket's API migration from deprecated cross-workspace endpoints to workspace-scoped APIs. - CLM-38555 - CycloneDX SBOM evaluations now accept components containing newer SPDX license identifiers such as SMAIL-GPL and WXwindows without validation errors. - CLM-37113 - Application deletion completes successfully even when approved policy waivers are associated with the application, and historical reports remain accessible throughout the deletion process. |
April 2, 2026 | 202 (April 7, 2026) |
| Features / Enhancements - Updated the container scanning engine to prioritize Sonatype vulnerability data, ensuring alignment between container scan results and CLI evaluations. External data sources are now used only as a fallback when Sonatype data is unavailable, improving consistency and reliability across analysis methods. |
March 30, 2026 | 202 (April 7, 2026) |
| Bug Fixes - CLM-38750 - Reduced excessive INFO and DEBUG logging in SbomPersistenceServiceProvider during Applicable Waivers REST API calls, preventing rapid log growth and excessive disk consumption.- CLM-38370 - HDS requests that require a license are no longer sent when the license header is missing or null, eliminating intermittent 402 Invalid License responses for valid tenants. |
March 25, 2026 | 202 (April 7, 2026) |
| Features / Enhancements - The built-in System Administrator role now includes audit log access by default, aligning with standard administrative capabilities and eliminating the need to create custom roles for this common task. Existing installations will automatically receive this permission update upon upgrade. |
March 18, 2026 | 202 (April 7, 2026) |
| Features / Enhancements - Introduced_Enterprise Reporting_ in Sonatype Repository Firewall, providing centralized dashboards that help organizations understand repository risk exposure, malware protection coverage, and trends affecting their software supply chain security posture. - Introduced the Firewall Malware Insights Enterprise Reporting dashboard in Sonatype Repository Firewall, providing visibility into malware detected and quarantined across protected repositories. The dashboard enables security and engineering teams to analyze malware trends, severity levels, attack vectors, and quarantine activity to better understand and strengthen software supply chain protection. Bug Fixes - NEXUS-50206 – Quarantine counts for Docker repositories are now displayed only when quarantine is enabled, preventing misleading vulnerability status information in the Firewall UI. - CLM-38747 – Automated remediation pull requests for Go projects now successfully update direct dependencies in go.mod files, including support for Go 1.21+ projects using toolchain directives. - CLM-38213 – Container image scans performed with the CLI now correctly evaluate policy violations across all Lifecycle product licenses, including SBOM Manager and Teams Edition. |
March 11, 2026 | 202 (April 7, 2026) |
| Maintenance release | March 4, 2026 | 202 (April 7, 2026) |
| Bug Fixes - NEXUS-50689 – Updated the verify operation to validate the correct license feature, ensuring connection verification succeeds for Sonatype Repository Firewall licenses and only fails when a legitimate license restriction exists.- NEXUS-49616 – The Firewall dashboard container waivers view honors organization-specific View IQ Elements permissions as documented. - NEXUS-49569 – Firewall scan reports now accurately display policy violations even when Legacy Violations are enabled at the root organization level, providing clear visibility into why components are quarantined. - NEXUS-48549 – Enhanced container image error messages to display the specific image identifier (namespace, name, and version) when processing failures occur, making troubleshooting more straightforward. - CLM-38607 – Email server configuration is now automatically managed in SaaS environments, ensuring consistent and reliable email delivery across all tenants. |
February 25, 2026 | 202 (April 7, 2026) |
| Features / Enhancements - Sonatype Lifecycle Enterprise Reporting now includes a HeroDevs End-of-Life Components dashboard, which provides visibility into open-source components that have reached end-of-life (EOL) and are eligible for HeroDevs support. For full details, see our HeroDevs End-of-Life Components help documentation. - Improved the Advanced Search user interface by clarifying instructional text to remove Lucene-specific assumptions and updating error messaging to provide more accurate and actionable feedback when an index is not found. - The Original BOM tab in SBOM Manager now includes a case-insensitive search that scans keys and values across the entire document, highlights matches with navigation controls, auto-expands results, and maintains responsive performance even for large SBOMs through optimized indexing and on-demand search handling. Bug Fixes - NEXUS-43058 – Quarantined components now display only safer alternative versions that meet policy requirements, excluding pre-cached versions with security violations from the allowed versions list. - CLM-38434 – Policy violation _First Reported_dates now remain stable when reordering or modifying policy conditions, ensuring consistent tracking for compliance reporting and SLA management. |
February 18, 2026 | 201 (March 5, 2026) |
| Bug Fixes - CLM-38370 – IQ SaaS customers should no longer see intermittent 402 invalid license responses. - NEXUS-48816 – The Review Obligations button now works as expected for customer with an Advanced Legal Pack license. |
February 5, 2026 | 201 (March 5, 2026) |
| Bug Fixes - NEXUS-47170 – NuGet registry index JSON assets are now excluded from Firewall analysis by expanding the ignore pattern to filter all NuGet feed JSON metadata, ensuring repository reports focus only on actual package artifacts such as .nupkg files. - NEXUS-44853 – Improved synchronization handling between Sonatype Repository Firewall and JFrog Artifactory so that out-of-sync states are automatically detected and corrected, ensuring users receive clear and accurate quarantine status messages when downloading components. |
February 4, 2026 | 201 (March 5, 2026) |
| Upgrade Posture and Rolling Recap Enterprise Reports to be Sunset Data for the Upgrade Posture and Rolling Recap Enterprise Reporting dashboards will no longer be refreshed after January 2026. These dashboards will be sunset and removed from Sonatype IQ on February 23, 2026. Customers are advised to review their usage of these dashboards and plan accordingly. Additional guidance is provided in the Sonatype IQ Server Feature Status section. Bug Fixes - NEXUS-41977 – The Repository Managers navigation item now expands when selected, and its counter accurately displays the number of repository managers instead of the total number of repositories. - NEXUS-49174 – The Firewall Evaluate API no longer requires a SHA1 hash for formats like Conan that use coordinate-based matching, allowing requests to omit the hash field without impacting evaluation. - NEXUS-37403 – Components with a null pathname in audit batch requests no longer prevent processing of the entire batch, allowing Repository Audit to complete successfully even when encountering malformed assets.- CLM-38540 – Deleting applications with more than 1,000 associated reports now uses batched delete requests to avoid exceeding S3 request limits and prevent errors during deletion. (SaaS only) - CLM-38452 – Vulnerability lookup results and the vulnerability API now return EPSS scores consistently with application reports, even when a componentIdentifier is not provided.- CLM-35001 – The /api/v2/config/sourceControl endpoint now enforces a non-zero minimum for pullRequestMonitoringIntervalSeconds, preventing invalid values from being saved and avoiding startup failures caused by a zero scheduling interval. |
January 29, 2026 | 201 (March 5, 2026) |
| Features and Improvements - New Operational Reporting section provides access to the React2Shell Impact Report for those Lifecycle customers who do not have Enterprise Reporting enabled. - Improvements to page load times in SaaS environments. - Sonatype SBOM Manager now includes an Original BOM tab on the SBOM detail page. This tab lets you view the SBOM exactly as it was uploaded. - NEXUS-49974 & NEXUS-49955 – The Sonatype Repository Firewall Zscaler integration now validates credentials by performing the required category create, update, and delete operations instead of calling /adminUsers/me. This eliminates the need for super admin access.Bug Fixes - NEXUS-49650 – Clicking a row in the Auto Release from Quarantine view now opens the Component Information panel as expected. - NEXUS-47131 – Long repository names in the Repository Firewall left-hand navigation now display correctly, and the back button from component details reliably returns users to the appropriate prior context in Repository Firewall. - CLM-38159 – Reduced query volume and improved component metadata evaluation performance for large component sets when performing policy evaluations for PCCS. (This fix will be made available to self-hosted deployments in release 200.) |
January 21, 2026 | 201 (March 5, 2026) |
| Features and Improvements - Components quarantined by age-based policy constraints are now automatically re-evaluated and released once they exceed the defined age threshold, reducing manual intervention and improving development workflow efficiency. Bug Fixes - NEXUS-47170 – NuGet registry index JSON assets beyond index.json are now excluded from analysis to prevent unnecessary Component-Unknown entries in repository reports. - NEXUS-44585 – Users with repository-level access now see only authorized information without encountering 403 errors on the Firewall landing page or Repository Manager screen. - CLM-34494 – IQ Server now provides a clearer error message when database connection fails due to incorrect PostgreSQL credentials. |
January 14, 2026 | 200 (February 4, 2026) |
| Bug Fixes - NEXUS-49569 – Docker policy violations marked as legacy no longer bypass quarantine enforcement when Allow violations of this policy to be granted legacy status is enabled at the root organization level. - NEXUS-47285 – The malware remediation task now skips components with empty or null hashes in NuGet proxy repositories, allowing the evaluation batch to continue running without interruption. (Will require Nexus Repository 3.88.0+ to be fully resolved.) |
January 7, 2026 | 200 (February 4, 2026) |
Search results
No results found