# 2026 Release Notes

This page contains a list of 2026 IQ releases, links to each release's release notes, and a brief list of major changes per release.

Note that while we strive to fully document new features before releasing them to our Cloud environments, there may be occasional delays. In such instances, we will update this page with links to the relevant help documentation as soon as it becomes available.

## Summary of Major Changes in 2026

The following table lists major changes in 2026 that should be considered when upgrading to a new version.

Features and fixes are added to Sonatype Cloud-based deployments on a **weekly** basis. The same features and fixes are made available to self-hosted deployments on a **monthly** basis.

| Features and Changes | Cloud Release Date | Included in Self-Hosted Release |
| --- | --- | --- |
| Features / Enhancements<br>- Self-hosted IQ Server deployments on Amazon EKS now support IAM Roles for Service Accounts (IRSA) when using Amazon S3 as a file store. This enables secure, credential-free authentication using AWS IAM roles and the standard AWS credential provider chain.<br>  <br>Bug Fixes<br>- **CLM-42440** – Database connections used by jOOQ streaming queries are now returned to the connection pool when streaming operations fail, preventing pool exhaustion and subsequent IQ Server outages.<br>  <br>- **CLM-42247** – IQ Server now starts successfully with multiple `applicationConnectors` and `adminConnectors` configured, binding all configured HTTP and HTTPS ports as expected.<br>  <br>- **CLM-41689** – Authenticated usernames are now consistently recorded in `request.log` entries across both the `classic` and `logback-access` request logging implementations. | July 22, 2026 | 206 (Coming August 2026) |
| Features / Enhancements<br>- Firewall for Docker container image layer downloads now support a configurable timeout of up to 240 minutes, allowing scans to complete successfully in environments with proxy-based antivirus scanning, slow network connections, or large images.<br>  <br>- The HeroDevs End-of-Life Components dashboard now makes it easier to identify and investigate affected components by displaying Policy Violation IDs, full component names, and complete Package URLs (PURLs) that consistently include version information across supported package formats.<br>  <br>Bug Fixes<br>- **CLM-40930** – Deleting an SBOM version through the API now also removes associated policy evaluation report files and scan artifacts from storage, preventing orphaned files from accumulating | July 15, 2026 | 206 (Coming August 2026) |
| Features / Enhancements<br>- Policy Waiver Request submitters can now withdraw their own pending requests through the API before a review decision. This reduces coordination overhead when requests need to be corrected or resubmitted.<br>  <br>Bug Fixes<br>- **CLM-38159** \- Policy evaluation now preloads security vulnerability group data during repository component metadata evaluation, eliminating unnecessary database queries and improving evaluation performance. | July 8, 2026 | 206 (Coming August 2026) |
| Features / Enhancements<br>- Support for conda-forge upstreams in Repository Firewall.<br>  <br>- Sonatype IQ Server now identifies and reports OSS components embedded in uber JARs using the new Embedded match state, improving visibility into transitive risk and enabling more accurate policy enforcement and vulnerability tracking.<br>  <br>- Sonatype Repository Firewall now includes the Firewall _Success Metrics_ enterprise dashboard, providing visibility into quarantine activity, malicious component trends, and key usage metrics with filters for date range, ecosystem, and quarantine type to help measure security posture over time.<br>  <br>- The _End-of-Life Components_ dashboard now supports cross-filtering by component version and stage, making it easier to isolate and analyze end-of-life components using the same workflow as the Golden Fixes dashboard.<br>  <br>- Automated remediation pull requests now default to GoldenPRs across all ecosystems. To continue receiving non-golden pull requests, enable the `nonGoldenPullRequestsEnabled` API property.<br>  <br>- Reachability analysis now supports .NET components, providing vulnerability reachability insights for NuGet and PE/COFF projects.<br>  <br>- Automated remediation can now automatically close stale pull requests in Bitbucket Cloud and Bitbucket Data Center, helping keep repositories clean.<br>  <br>- Sonatype IQ Server now securely stores GPG signing configuration and masks GPG passphrases during save and retrieval.<br>  <br>- Lifecycle reports now identify scans performed by the Sonatype container scanner in the _Triggered By_ field.<br>  <br>- Application IDs with unsupported characters are now automatically normalized, improving compatibility across integrations and policy evaluation.<br>  <br>- The _Waive Violations_ tooltip now appears only when no automated waivers are configured, reducing unnecessary guidance.<br>  <br>- Waiver expiration information is now displayed consistently on the _Priorities_ and _Component Details_ pages.<br>  <br>- Enhanced the _Re-Evaluate Report_ dialog with clearer descriptions of full and quick re-evaluation options.<br>  <br>- Optimized InnerSource component search by batching dependency-data queries, significantly improving search performance.<br>  <br>Bug Fixes<br>- **NEXUS-52537** \- _View Repository Results_ now routes Docker proxy repositories to the correct container results page, matching the behavior of selecting the repository name directly.<br>  <br>- **INT-9591** \- Container scans now complete successfully when CVE reference URLs are malformed or missing, returning full report links instead of a server error.<br>  <br>- **CLM-38947** \- Reachability markers from manual scans are now preserved during Continuous Monitoring re-evaluation, keeping reachability-scoped auto-waivers intact across monitoring cycles.<br>  <br>- **CLM-37908** \- The younger than N days policy condition now correctly excludes components whose cataloged age is exactly N days from policy violations. | July 1, 2026 | [205](https://help.sonatype.com/en/sonatype-iq-server-205-release-notes.html "Sonatype IQ Server 205 Release Notes") (July 7, 2026)<br>and<br>206 (Coming August 2026) |
| Features / Enhancements<br>- Sonatype Repository Firewall webhooks now support _Violation Alert_ and _Waiver Request_ events, enabling real-time notifications for repository proxy policies.<br>  <br>Bug Fixes<br>- **INT-10303** – Large policy reports can now be retrieved in smaller chunks, improving compatibility with ServiceNow size limitations.<br>  <br>- **CLM-40944** – GitHub App registration for SCM authentication now completes successfully without configuration errors.<br>  <br>- **CLM-39938** – Developer prioritization now loads only the data required for analysis, preventing memory exhaustion on large scans.<br>  <br>- **CLM-38777** – Vulnerability customizations for NeuVector-sourced OS-level findings now load correctly when weakness or severity values are null.<br>  <br>- **CLM-32426** – Source Control settings at the sub-organization and application levels now correctly display _Inherit (Not Configured)_ when no explicit value has been set. | June 24, 2026 | [205](https://help.sonatype.com/en/sonatype-iq-server-205-release-notes.html "Sonatype IQ Server 205 Release Notes") (July 7, 2026) |
| Features / Enhancements<br>- The new _Malware Threat Landscape_ Dashboard provides a centralized view of malware threats across your software supply chain, helping teams quickly identify, analyze, and respond to malicious components.<br>  <br>- The new Legacy Violation Management API enables teams to automate the listing, granting, revoking, and configuration of legacy violation statuses through a supported integration surface.<br>  <br>Bug Fixes<br>- **NEXUS-52941** – The Malware Defense evaluate API now returns malware assessment results when components are identified by hash only, without requiring a `packageUrl`.<br>  <br>- **CLM-39800** – Components with names similar to internal project modules are no longer incorrectly classified as InnerSource components, and previously affected records are automatically corrected during subsequent scans.<br>  <br>- **CLM-37563** – View Dependency Tree now remains available and fully populated after Re-Evaluate Report and Quick Re-Evaluate operations on SBOM-uploaded scans.<br>  <br>- **CLM-35969** – SBOM components with empty license values are now treated as Not Provided and Not Declared, allowing License-None policies to evaluate correctly. | June 17, 2026 | [205](https://help.sonatype.com/en/sonatype-iq-server-205-release-notes.html "Sonatype IQ Server 205 Release Notes") (July 7, 2026) |
| Features / Enhancements<br>- Users with read permission on individual proxy repositories can now access the Firewall Dashboard with data automatically scoped to only their permitted repositories.<br>  <br>- The _Firewall Repository Result_ table now displays separate _Evaluation Time_ and _Quarantine Time_ columns replacing the previous single column that showed evaluation timestamps for all components regardless of quarantine status. The _Quarantine Time_ column displays a date only for currently quarantined components.<br>  <br>- Sonatype Firewall can now send email notifications when Firewall waivers are approaching expiration.<br>  <br>- Firewall administrators can now configure and manage IQ proxy repositories directly from the Firewall through the new _Virtual Repository Managers_ section. This simplifies integration with external repository managers by eliminating manual API configuration.<br>  <br>- A new _Waivers_ tab on the Firewall Dashboard allows administrators to view, filter, and renew policy waivers from a centralized location. Expiration indicators and renewal workflows help teams maintain continuous policy coverage.<br>  <br>- Firewall now provides an in-product waiver request workflow that enables developers to submit waiver requests and administrators to review and manage them through a centralized process.<br>  <br>- The legacy standalone JAR-only IQ Server distribution has been removed following its published sunset date. Customers using the standalone format must migrate to the platform-bundled JReleaser distribution.<br>  <br>- The Swagger API page now renders in dark mode, with improved styling for text, inputs, headers, and authorization dialogs.<br>  <br>- Container scanning now captures Red Hat `content_sets` metadata and includes it in generated CycloneDX BOMs.<br>  <br>- The evaluation status endpoint now supports Server-Sent Events (SSE) for real-time policy evaluation updates.<br>  <br>- The Lifecycle CLI now supports passing SCM repository URL, branch name, and commit hash via environment variables with automatic Git detection as a fallback.<br>  <br>- Auto-remediation pull requests now record whether they were created using a Personal Access Token or GitHub App authentication.<br>  <br>- Database connection pool settings are now fully supported across both on-prem and SaaS deployments. This provides consistent tuning options while maintaining compatibility with existing database configurations.<br>  <br>- IQ Server can now register with the webhook relay service to receive SCM webhook events without requiring direct inbound network access. Administrators can access the generated webhook URL directly from source control configuration pages for streamlined configuration.<br>  <br>- You can now integrate multiple GitHub Apps with a single IQ organization. See the [GitHub App Authentication for SCM help documentation](https://help.sonatype.com/en/github-app-authentication-for-scm-integration.html "GitHub App Authentication for SCM Integration").<br>  <br>Bug Fixes<br>- **NEXUS-52196** – The format filter selection on the Repository Managers page persists correctly when navigating into a repository detail view and returning to the list.<br>  <br>- **NEXUS-52143** – The Firewall container quarantine view now displays only Docker images from repositories where quarantine is actively enabled, excluding audit-only repositories whose images were never blocked.<br>  <br>- **NEXUS-49583** – The _Quarantine Time_ column in container-specific repository results views is now labeled _Evaluation Time_, accurately reflecting that the timestamp represents when the container image was scanned, not when it was quarantined.<br>  <br>- **CLM-40144** – Telemetry processing now limits queue growth and per-scan data collection to prevent excessive memory consumption when HDS is unavailable or responding slowly.<br>  <br>- **CLM-40054** – Go module scanning now ignores `go.sum` files in auxiliary directories to prevent incorrect component matches from bundled tooling, examples, and test assets.<br>  <br>- **CLM-39840** – When an Auto or Golden PR fails because a detected component is not declared as a direct dependency in the manifest file, the Retry button is now disabled with an actionable tooltip explaining that the component must first be added as a direct dependency before a pull request can succeed.<br>  <br>- **CLM-39830** – The policy violations API endpoint now retrieves application component data in a single batch query rather than one database call per violation, eliminating timeouts for policies with millions of violations.<br>  <br>- **CLM-39739** – Component age policies now skip age evaluation for components that are not present in the HDS catalog.<br>  <br>- **CLM-38844** – Audit log entries for license identification and component status changes scoped to non-root organizations are now captured and visible in the application audit log view, including any comments entered at the time of the change.<br>  <br>- **CLM-38729** – SBOM scans now complete successfully when license URLs exceed 200 characters.<br>  <br>- **CLM-38128** – The OIDC option in Firewall product preferences now navigates correctly to the OIDC configuration page.<br>  <br>- **CLM-37954** – Nexus IQ Server now automatically restores missing reference policies at the root organization during upgrades to ensure accurate Firewall malware-risk export results. | June 10, 2026 | [205](https://help.sonatype.com/en/sonatype-iq-server-205-release-notes.html "Sonatype IQ Server 205 Release Notes") (July 7, 2026) |
| These self-hosted patch releases include the following bug fix:<br>- **EI-1273** – Memory usage remains bounded during audit and remediation collection, preventing excessive memory growth and OutOfMemoryError conditions under large workloads. | - | [203.4](https://help.sonatype.com/en/sonatype-iq-server-203-release-notes.html "Sonatype IQ Server 203 - 203.3 Release Notes") (June 9, 2026)<br>and<br>[204.2](https://help.sonatype.com/en/sonatype-iq-server-204-release-notes.html "Sonatype IQ Server 204 Release Notes") (June 9, 2026) |
| These self-hosted patch releases include the following bug fix:<br>- **CLM-40144** – Telemetry processing now limits the number of queued telemetry events, preventing unbounded queue growth that could lead to excessive memory consumption and improve Sonatype Lifecycle stability under sustained telemetry load. | - | [203.3](https://help.sonatype.com/en/sonatype-iq-server-203-release-notes.html "Sonatype IQ Server 203 - 203.3 Release Notes") (June 6, 2026)<br>and<br>[204.1](https://help.sonatype.com/en/sonatype-iq-server-204-release-notes.html "Sonatype IQ Server 204 Release Notes") (June 8, 2026) |
| Features / Enhancements<br>- Redesigned the _Success Metrics_ Enterprise Reporting dashboard by partitioning it into two focused tabs for _Program Health_ and _Remediation Ops_. The update also adds new remediation metrics, industry benchmarks, and executive summary reporting to help teams track program performance more effectively. | June 1, 2026 | [204](https://help.sonatype.com/en/sonatype-iq-server-204-release-notes.html "Sonatype IQ Server 204 Release Notes") (June 2, 2026) |
| Features / Enhancements<br>- A new _Mythos Readiness_ Enterprise Reporting dashboard helps you identify applications that may be affected by privately disclosed vulnerabilities before CVE information becomes publicly available. The report provides application component inventory data, visibility into newer and golden component versions, and flexible filtering to help teams quickly assess potential impact.<br>  <br>  <br>  <br>  - Available immediately for Sonatype IQ cloud customers through a new _Mythos Readiness_ card under _Enterprise Reporting_.<br>    <br>  - Self-hosted customers can access the same data through the updated _Supply Chain Monitoring_ Enterprise Report today, with a dedicated _Mythos Readiness_ card arriving in IQ Server 204. | May 29, 2026 | [205](https://help.sonatype.com/en/sonatype-iq-server-205-release-notes.html "Sonatype IQ Server 205 Release Notes") (July 7, 2026) |
| Features / Enhancements<br>- IQ Cloud now displays an in-product maintenance banner across Lifecycle, Repository Firewall, and SBOM Manager so users can stay informed about upcoming maintenance windows.<br>  <br>- The new Policy Configuration Export API enables programmatic retrieval of policy configurations across organizations, applications, and repositories, with optional inclusion of inherited parent policies.<br>  <br>Bug Fixes<br>- **NEXUS-52635** – Concurrent npm and PyPI proxy requests under PCCS now coalesce across cluster nodes, preventing uncoordinated bursts of evaluate/componentMetadata calls from exhausting IQ Server heap memory. (This fix requires IQ Server 204+ and Nexus Repository 3.92.3+.)<br>  <br>- **NEXUS-52385** – (Included in Self-Hosted 203.2) The IQ Server HDS connection pool size is now configurable to support concurrent npm metadata requests in HA deployments and reduce fallback to stale cache when the default connection limit is reached.<br>  <br>- **CLM-38656** – The _Priorities_ report now displays a _Create PR_ button instead of a stale link when a previously merged pull request's changes are reverted and a new scan detects the reintroduced violation.<br>  <br>- **CLM-35417** – Source control configuration validation now provides specific error messages for invalid repository URLs, authentication failures, and insufficient token permissions to help users quickly identify and correct configuration issues. | May 20, 2026 | [204](https://help.sonatype.com/en/sonatype-iq-server-204-release-notes.html "Sonatype IQ Server 204 Release Notes") (June 2, 2026)<br>and<br>[203.2](https://help.sonatype.com/en/sonatype-iq-server-203-release-notes.html "Sonatype IQ Server 203 - 203.3 Release Notes") (May 25, 2026) |
| Features / Enhancements<br>- Improved startup time for large data migrations between versions and validated database migration consistency.<br>  <br>- Improved Legal Attribution Report generation performance and reliability for large applications with thousands of components.<br>  <br>- SCM pull request commenting is now enabled by default for Sonatype Lifecycle SaaS tenants, allowing automated PR analysis to begin after configuring an SCM integration while preserving existing tenant settings.<br>  <br>Bug Fixes<br>- **NEXUS-52434** – PCCS evaluation results for PyPI and npm proxy repositories are now cached and reused within the configured metadata maximum age window, so a single request to IQ Server serves all subsequent lookups until the cache expires. (Fixed in Nexus Repository 3.92.3)<br>  <br>- **NEXUS-52218** – The Malware Components CSV now removes components whose malicious classifications were retracted or corrected during Automatic Malware Management reconciliation, ensuring unresolved findings reflect current Sonatype threat intelligence.<br>  <br>- **NEXUS-51730** – Repository Manager-scoped Firewall integration users can now retrieve custom quarantine messages without 403 errors or repeated WARN log entries in Nexus Repository. | May 13, 2026 | [204](https://help.sonatype.com/en/sonatype-iq-server-204-release-notes.html "Sonatype IQ Server 204 Release Notes") (June 2, 2026) |
| Features / Enhancements<br>- SBOM Manager component details now include a _Legal_ tab with _Effective_, _Declared_, and _Observed_ license views aligned with Lifecycle and Firewall. Advanced Legal Pack users can also review obligations and manage license overrides directly from SBOM Manager. (Released in 203.1)<br>  <br>- Advanced Search now supports filtering by _Legal_ and _Policy Violations_, making it easier to identify and prioritize compliance risks across applications.<br>  <br>Bug Fixes<br>- **NEXUS-51450** – The _Automatic Malware Management_ task log now reports accurate quarantine states for malicious components detected in Firewall-enabled proxy repositories.<br>  <br>- **CLM-39406** – Saving custom filters in _Success Metrics_ and _Enterprise Reporting_ now succeeds for LDAP users with distinguished names longer than 50 characters.<br>  <br>- **CLM-38233** – Policy name validation during support zip imports now performs a single bulk database query per policy instead of recursive traversal, reducing import times for large organization hierarchies from more than 15 minutes to seconds.<br>  <br>- **CLM-31884** – Session cookies now use `SameSite=Lax` by default, while SAML authentication paths retain `SameSite=None` for IdP callback compatibility. Identity provider configuration review may be required before upgrading.<br>  <br>- **CLM-30626** – Application create and update operations now validate application IDs against existing internal UUIDs to prevent collisions that could cause the application management UI to crash. | May 6, 2026 | [204](https://help.sonatype.com/en/sonatype-iq-server-204-release-notes.html "Sonatype IQ Server 204 Release Notes") (June 2, 2026)<br>and<br>[203.1](https://help.sonatype.com/en/sonatype-iq-server-203-release-notes.html "Sonatype IQ Server 203 - 203.3 Release Notes") (May 14, 2026) |
| Bug Fixes<br>- CLM-38299 – License Threat Group updates now complete successfully without UI hangs by optimizing name validation queries to eliminate excessive database calls in large organizational hierarchies. | April 29, 2026 | [204](https://help.sonatype.com/en/sonatype-iq-server-204-release-notes.html "Sonatype IQ Server 204 Release Notes") (June 2, 2026) |
| Maintenance release | April 23, 2026 | [203](https://help.sonatype.com/en/sonatype-iq-server-203-release-notes.html "Sonatype IQ Server 203 - 203.3 Release Notes") (May 5, 2026) |
| Features / Enhancements<br>- Repository Firewall now sends webhook notifications when repository-level policy waivers expire, enabling proactive management of temporary security exceptions and helping prevent compliance gaps.<br>  <br>- Firewall now supports bulk waivers, allowing users to waive up to 1,000 policy violations in a single operation directly from the _Repository Results_ view. This can also be accomplished using new endpoints in the Firewall API.<br>  <br>- The _Source Header License_ page in Advanced Legal Pack now displays copyright notices within independent scrollable containers, preventing excessive page expansion when components contain large numbers of detected headers and keeping navigation controls visible during review.<br>  <br>- The AI/ML Dashboard in Sonatype Lifecycle _Enterprise Reporting_now includes expanded filtering capabilities to help teams analyze AI component usage with greater precision across their organizations.<br>  <br>- Added support for .NET reachability analysis for NuGet components.<br>  <br>Bug Fixes<br>- **NEXUS-51881** \- Component re-evaluation through Firewall completes successfully when using an H2 database, allowing quarantined components to be released without lock timeout errors.<br>  <br>- **NEXUS-51535** \- Bulk waiver functionality in the Firewall dashboard container view now works correctly, with the waive button fully operational, the date picker displaying without overlapping text, and the back button returning users directly to the Firewall dashboard.<br>  <br>- **NEXUS-51509** \- Concurrent Policy Compliant Component Selection requests for the same PyPI or npm package are now deduplicated, ensuring only one evaluation request reaches Firewall.<br>  <br>- **NEXUS-51485** \- Docker proxy repositories now return Docker Registry API V2-compliant error responses containing the quarantine reason and Firewall report URL directly in the JSON body, making blocked image pulls immediately actionable in standard Docker and Podman clients without requiring additional client-side configuration.<br>  <br>- **CLM-39913** \- Policy evaluations no longer deadlock when database connection pools are exhausted, improving reliability under high-load conditions with concurrent `ClusterLock` and transaction operations.<br>  <br>- **CLM-39405** \- User and role detail pages open correctly for Repository Firewall-only licensed instances, without redirecting to the Firewall dashboard.<br>  <br>- **CLM-36995** \- The Dependency Tree REST API, CycloneDX exports, and SPDX exports include all components shown in the UI dependency tree, including those with unknown match states.<br>  <br>- **CLM-36831** \- SPDX files containing percent-encoded Package URLs, including special characters, are imported into SBOM Manager without double-encoding or UI display issues. The `packageurl-java` library upgrade introduces updated PURL normalization behavior that may affect existing integrations.<br>  <br>- **CLM-38424** \- OIDC token exchange requests route through the HTTP proxy configured via the IQ Server REST API (`/api/v2/config/httpProxyServer`), removing the need for JVM system property-based proxy configuration.<br>  <br>- **CLM-37414** \- Migration from H2 to PostgreSQL requires granting `SET ON PARAMETER``"session_replication_role"` to the importing user prior to running the import, including in managed PostgreSQL environments. | April 22, 2026 | [203](https://help.sonatype.com/en/sonatype-iq-server-203-release-notes.html "Sonatype IQ Server 203 - 203.3 Release Notes") (May 5, 2026) |
| The self-hosted IQ Server version 202.1 release fixes the following bug:<br>- **NEXUS-51881** – Re-evaluating quarantined components with an H2 database no longer times out because transaction handling now avoids creating nested database transactions. | April 22, 2026 | [202.1](https://help.sonatype.com/en/sonatype-iq-server-202-release-notes.html "Sonatype IQ Server 202 - 202.1 Release Notes") (April 21, 2026) |
| Features / Enhancements<br>- Sonatype SBOM Manager now continuously evaluates policies across all SBOM versions for each application rather than only the most recent. This provides broader visibility into risk over time.<br>  <br>A configurable evaluation queue distributes processing across instances and supports tuning through version evaluation windows and queue settings, allowing teams to balance coverage and performance. Complete help documentation for this feature will be published shortly.<br>  <br>- Improved dashboard performance when multiple organizations or application categories are selected.<br>  <br>Bug Fixes<br>- **CLM-38934** – _Vulnerability Lookup_ displays KEV and EPSS data correctly regardless of whether CVE identifiers are entered in uppercase, lowercase, or mixed case.<br>  <br>- **CLM-38699**– Policy conditions combining `DependencyType` with other criteria now correctly evaluate Python packages, which may result in new violations appearing for components that were previously skipped.<br>  <br>- **CLM-38674** – Raw reports now include AI Content policy violation details for troubleshooting and analysis. | April 15, 2026 | [203](https://help.sonatype.com/en/sonatype-iq-server-203-release-notes.html "Sonatype IQ Server 203 - 203.3 Release Notes") (May 5, 2026) |
| Features / Enhancements<br>- Optimized the Developer Priorities API to improve response times under load.<br>  <br>Bug Fixes<br>- **CLM-38690** – Re-evaluating a CycloneDX SBOM report now preserves SBOM-supplied license data for exactly matched components, so _License Detections_ no longer change to _Not Provided_ when no better curated license data exists. | April 13, 2026 | [203](https://help.sonatype.com/en/sonatype-iq-server-203-release-notes.html "Sonatype IQ Server 203 - 203.3 Release Notes") (May 5, 2026) |
| Maintenance release | April 8, 2026 | [203](https://help.sonatype.com/en/sonatype-iq-server-203-release-notes.html "Sonatype IQ Server 203 - 203.3 Release Notes") (May 5, 2026) |
| Bug Fixes<br>- **CLM-38633** – Support ZIP files now include OAuth2, OIDC, Crowd, and tenant metadata configuration details, enabling more efficient troubleshooting of authentication and tenant-related issues while ensuring sensitive data remains obfuscated. | April 3, 2026 | [203](https://help.sonatype.com/en/sonatype-iq-server-203-release-notes.html "Sonatype IQ Server 203 - 203.3 Release Notes") (May 5, 2026) |
| Features / Enhancements<br>- Bitbucket Cloud integrations now require API tokens with scopes as the only supported authentication method, replacing deprecated app passwords and access tokens. For full details, see our [Bitbucket Cloud Configuration help documentation](https://help.sonatype.com/en/bitbucket-cloud-configuration.html "Bitbucket Cloud Configuration").<br>  <br>- Introduced the Best Practices Dashboard in Sonatype Lifecycle, providing a centralized view of feature adoption, integration coverage, and scan activity across applications and stages. The dashboard enables teams to identify gaps in Lifecycle usage, monitor enablement of key capabilities such as CI/CD integration and Golden PRs, and improve consistency in DevSecOps workflows through actionable insights into configuration and scanning practices. For full details, see our [Best Practices Dashboard help documentation.](https://help.sonatype.com/en/best-practices-dashboard.html "Best Practices")<br>  <br>Bug Fixes<br>- **CLM-39124** \- Bitbucket Cloud integrations automatically discover repositories across all accessible workspaces following Bitbucket's API migration from deprecated cross-workspace endpoints to workspace-scoped APIs.<br>  <br>- **CLM-38555** \- CycloneDX SBOM evaluations now accept components containing newer SPDX license identifiers such as SMAIL-GPL and WXwindows without validation errors.<br>  <br>- **CLM-37113** \- Application deletion completes successfully even when approved policy waivers are associated with the application, and historical reports remain accessible throughout the deletion process. | April 2, 2026 | [202](https://help.sonatype.com/en/sonatype-iq-server-202-release-notes.html "Sonatype IQ Server 202 - 202.1 Release Notes") (April 7, 2026) |
| Features / Enhancements<br>- Updated the container scanning engine to prioritize Sonatype vulnerability data, ensuring alignment between container scan results and CLI evaluations. External data sources are now used only as a fallback when Sonatype data is unavailable, improving consistency and reliability across analysis methods. | March 30, 2026 | [202](https://help.sonatype.com/en/sonatype-iq-server-202-release-notes.html "Sonatype IQ Server 202 - 202.1 Release Notes") (April 7, 2026) |
| Bug Fixes<br>- **CLM-38750** \- Reduced excessive INFO and DEBUG logging in `SbomPersistenceServiceProvider` during Applicable Waivers REST API calls, preventing rapid log growth and excessive disk consumption.<br>  <br>- **CLM-38370** \- HDS requests that require a license are no longer sent when the license header is missing or null, eliminating intermittent 402 Invalid License responses for valid tenants. | March 25, 2026 | [202](https://help.sonatype.com/en/sonatype-iq-server-202-release-notes.html "Sonatype IQ Server 202 - 202.1 Release Notes") (April 7, 2026) |
| Features / Enhancements<br>- The built-in _System Administrator_ role now includes audit log access by default, aligning with standard administrative capabilities and eliminating the need to create custom roles for this common task. Existing installations will automatically receive this permission update upon upgrade. | March 18, 2026 | [202](https://help.sonatype.com/en/sonatype-iq-server-202-release-notes.html "Sonatype IQ Server 202 - 202.1 Release Notes") (April 7, 2026) |
| Features / Enhancements<br>- Introduced_Enterprise Reporting_ in Sonatype Repository Firewall, providing centralized dashboards that help organizations understand repository risk exposure, malware protection coverage, and trends affecting their software supply chain security posture.<br>  <br>- Introduced the _Firewall Malware Insights_ Enterprise Reporting dashboard in Sonatype Repository Firewall, providing visibility into malware detected and quarantined across protected repositories. The dashboard enables security and engineering teams to analyze malware trends, severity levels, attack vectors, and quarantine activity to better understand and strengthen software supply chain protection.<br>  <br>Bug Fixes<br>- **NEXUS-50206** – Quarantine counts for Docker repositories are now displayed only when quarantine is enabled, preventing misleading vulnerability status information in the Firewall UI.<br>  <br>- **CLM-38747** – Automated remediation pull requests for Go projects now successfully update direct dependencies in go.mod files, including support for Go 1.21+ projects using toolchain directives.<br>  <br>- **CLM-38213** – Container image scans performed with the CLI now correctly evaluate policy violations across all Lifecycle product licenses, including SBOM Manager and Teams Edition. | March 11, 2026 | [202](https://help.sonatype.com/en/sonatype-iq-server-202-release-notes.html "Sonatype IQ Server 202 - 202.1 Release Notes") (April 7, 2026) |
| Maintenance release | March 4, 2026 | [202](https://help.sonatype.com/en/sonatype-iq-server-202-release-notes.html "Sonatype IQ Server 202 - 202.1 Release Notes") (April 7, 2026) |
| Bug Fixes<br>- **NEXUS-50689** – Updated the `verify` operation to validate the correct license feature, ensuring connection verification succeeds for Sonatype Repository Firewall licenses and only fails when a legitimate license restriction exists.<br>  <br>- **NEXUS-49616** – The Firewall dashboard container waivers view honors organization-specific _View IQ Elements_ permissions as documented.<br>  <br>- **NEXUS-49569** – Firewall scan reports now accurately display policy violations even when Legacy Violations are enabled at the root organization level, providing clear visibility into why components are quarantined.<br>  <br>- **NEXUS-48549** – Enhanced container image error messages to display the specific image identifier (namespace, name, and version) when processing failures occur, making troubleshooting more straightforward.<br>  <br>- **CLM-38607** – Email server configuration is now automatically managed in SaaS environments, ensuring consistent and reliable email delivery across all tenants. | February 25, 2026 | [202](https://help.sonatype.com/en/sonatype-iq-server-202-release-notes.html "Sonatype IQ Server 202 - 202.1 Release Notes") (April 7, 2026) |
| Features / Enhancements<br>- Sonatype Lifecycle Enterprise Reporting now includes a _HeroDevs End-of-Life Components_ dashboard, which provides visibility into open-source components that have reached end-of-life (EOL) and are eligible for HeroDevs support. For full details, see our [HeroDevs End-of-Life Components help documentation](https://help.sonatype.com/en/herodevs-end-of-life-components.html "HeroDevs End of Life Components").<br>  <br>- Improved the _Advanced Search_ user interface by clarifying instructional text to remove Lucene-specific assumptions and updating error messaging to provide more accurate and actionable feedback when an index is not found.<br>  <br>- The _Original BOM_ tab in SBOM Manager now includes a case-insensitive search that scans keys and values across the entire document, highlights matches with navigation controls, auto-expands results, and maintains responsive performance even for large SBOMs through optimized indexing and on-demand search handling.<br>  <br>Bug Fixes<br>- **NEXUS-43058** – Quarantined components now display only safer alternative versions that meet policy requirements, excluding pre-cached versions with security violations from the allowed versions list.<br>  <br>- **CLM-38434** – Policy violation _First Reported_dates now remain stable when reordering or modifying policy conditions, ensuring consistent tracking for compliance reporting and SLA management. | February 18, 2026 | [201](https://help.sonatype.com/en/sonatype-iq-server-201-release-notes.html "Sonatype IQ Server 201 Release Notes") (March 5, 2026) |
| Bug Fixes<br>- **CLM-38370** – IQ SaaS customers should no longer see intermittent 402 invalid license responses.<br>  <br>- **NEXUS-48816** – The _Review Obligations_ button now works as expected for customer with an Advanced Legal Pack license. | February 5, 2026 | [201](https://help.sonatype.com/en/sonatype-iq-server-201-release-notes.html "Sonatype IQ Server 201 Release Notes") (March 5, 2026) |
| Bug Fixes<br>- **NEXUS-47170** – NuGet registry index JSON assets are now excluded from Firewall analysis by expanding the ignore pattern to filter all NuGet feed JSON metadata, ensuring repository reports focus only on actual package artifacts such as .nupkg files.<br>  <br>- **NEXUS-44853** – Improved synchronization handling between Sonatype Repository Firewall and JFrog Artifactory so that out-of-sync states are automatically detected and corrected, ensuring users receive clear and accurate quarantine status messages when downloading components. | February 4, 2026 | [201](https://help.sonatype.com/en/sonatype-iq-server-201-release-notes.html "Sonatype IQ Server 201 Release Notes") (March 5, 2026) |
| **_Upgrade Posture_ and _Rolling Recap_ Enterprise Reports to be Sunset**<br>Data for the _Upgrade Posture_ and _Rolling Recap_ Enterprise Reporting dashboards will no longer be refreshed after **January 2026**. These dashboards will be sunset and removed from Sonatype IQ on **February 23, 2026**.<br>Customers are advised to review their usage of these dashboards and plan accordingly. Additional guidance is provided in the [Sonatype IQ Server Feature Status](https://help.sonatype.com/en/sonatype-iq-server-feature-status.html#sonatype-iq-server-feature-status) section.<br>Bug Fixes<br>- **NEXUS-41977** – The _Repository Managers_ navigation item now expands when selected, and its counter accurately displays the number of repository managers instead of the total number of repositories.<br>  <br>- **NEXUS-49174** – The Firewall Evaluate API no longer requires a SHA1 hash for formats like Conan that use coordinate-based matching, allowing requests to omit the hash field without impacting evaluation.<br>  <br>- **NEXUS-37403** – Components with a null `pathname` in audit batch requests no longer prevent processing of the entire batch, allowing Repository Audit to complete successfully even when encountering malformed assets.<br>  <br>- **CLM-38540** – Deleting applications with more than 1,000 associated reports now uses batched delete requests to avoid exceeding S3 request limits and prevent errors during deletion. (SaaS only)<br>  <br>- **CLM-38452** – Vulnerability lookup results and the vulnerability API now return EPSS scores consistently with application reports, even when a `componentIdentifier` is not provided.<br>  <br>- **CLM-35001** – The `/api/v2/config/sourceControl` endpoint now enforces a non-zero minimum for `pullRequestMonitoringIntervalSeconds`, preventing invalid values from being saved and avoiding startup failures caused by a zero scheduling interval. | January 29, 2026 | [201](https://help.sonatype.com/en/sonatype-iq-server-201-release-notes.html "Sonatype IQ Server 201 Release Notes") (March 5, 2026) |
| Features and Improvements<br>- New _Operational Reporting_ section provides access to [the _React2Shell Impact Report_](https://help.sonatype.com/en/react2shell-impact-report.html "React2Shell Impact Report") for those Lifecycle customers who do not have _Enterprise Reporting_ enabled.<br>  <br>- Improvements to page load times in SaaS environments.<br>  <br>- Sonatype SBOM Manager now includes an _Original BOM_ tab on the SBOM detail page. This tab lets you view the SBOM exactly as it was uploaded.<br>  <br>- **NEXUS-49974 & NEXUS-49955** – The Sonatype Repository Firewall Zscaler integration now validates credentials by performing the required category create, update, and delete operations instead of calling `/adminUsers/me`. This eliminates the need for super admin access.<br>  <br>Bug Fixes<br>- **NEXUS-49650** – Clicking a row in the _Auto Release from Quarantine_ view now opens the _Component Information_ panel as expected.<br>  <br>- **NEXUS-47131** – Long repository names in the Repository Firewall left-hand navigation now display correctly, and the back button from component details reliably returns users to the appropriate prior context in Repository Firewall.<br>  <br>- **CLM-38159** – Reduced query volume and improved component metadata evaluation performance for large component sets when performing policy evaluations for PCCS. (This fix will be made available to self-hosted deployments in release 200.) | January 21, 2026 | 201 (March 5, 2026) |
| Features and Improvements<br>- Components quarantined by age-based policy constraints are now automatically re-evaluated and released once they exceed the defined age threshold, reducing manual intervention and improving development workflow efficiency.<br>  <br>Bug Fixes<br>- **NEXUS-47170** – NuGet registry index JSON assets beyond index.json are now excluded from analysis to prevent unnecessary Component-Unknown entries in repository reports.<br>  <br>- **NEXUS-44585** – Users with repository-level access now see only authorized information without encountering 403 errors on the Firewall landing page or Repository Manager screen.<br>  <br>- **CLM-34494** – IQ Server now provides a clearer error message when database connection fails due to incorrect PostgreSQL credentials. | January 14, 2026 | [200](https://help.sonatype.com/en/sonatype-iq-server-200-release-notes.html "Sonatype IQ Server 200 Release Notes") (February 4, 2026) |
| Bug Fixes<br>- **NEXUS-49569** – Docker policy violations marked as legacy no longer bypass quarantine enforcement when _Allow violations of this policy to be granted legacy status_ is enabled at the root organization level.<br>  <br>- **NEXUS-47285** – The malware remediation task now skips components with empty or null hashes in NuGet proxy repositories, allowing the evaluation batch to continue running without interruption. (Will require Nexus Repository 3.88.0+ to be fully resolved.) | January 7, 2026 | [200](https://help.sonatype.com/en/sonatype-iq-server-200-release-notes.html "Sonatype IQ Server 200 Release Notes") (February 4, 2026) |

## Search results

No results found