Sonatype IQ Server 205 Release Notes

Released July 7, 2026

The IQ 205 release includes multiple changes to our IQ-powered solutions. View the details in each solution’s section below.

Improvements Impacting Multiple Solutions

This release includes the following improvements that impact multiple IQ Server-powered solutions:

.NET Reachability Analysis Extended Across All CI Integrations

.NET Reachability Analysis is now available for the IQ CLI and across supported CI integrations, including Sonatype Platform Plugin for Jenkins, Sonatype for Azure DevOps, Sonatype for Bamboo Data Center, Sonatype for GitHub Actions, and Sonatype for GitLab CI. Each integration provides native configuration options for enabling .NET reachability analysis, including namespace filtering, configurable entry point strategies, and an optional path to the dotnet executable, making it easy to incorporate .NET reachability analysis into existing build pipelines.

Improved Visibility into Embedded Components in Uber JARs

Sonatype IQ Server now identifies and reports open source components embedded within uber JARs using the new Embedded match state. This enhancement gives organizations more complete visibility into the components included in packaged applications, helping security and development teams uncover hidden dependencies, enforce policies more consistently, and improve the accuracy of vulnerability and license risk assessments across their software supply chain.

Automatically Close Stale AutoPRs in Bitbucket Cloud and Bitbucket Data Center

Automated remediation can now automatically close stale pull requests in Bitbucket Cloud and Bitbucket Data Center after a configurable period of inactivity. This enhancement helps teams keep repositories organized by removing outdated remediation pull requests that are no longer relevant, reducing maintenance overhead and allowing developers to focus on active work.

See the IQ Server Configuration help documentation for details on how to configure this option.

Dark Mode Support for Swagger API Docs

Our Swagger API pages now support dark mode, providing a more consistent and comfortable experience for users who prefer dark-themed interfaces. In addition to the new color scheme, improvements to the styling of text, input fields, headers, and authorization dialogs enhance readability and usability, making it easier to explore and interact with APIs during development and testing.

Sonatype Lifecycle

This release includes the following changes for Sonatype Lifecycle:

Enhanced Component End-of-Life Dashboard

The Component End-of-Life dashboard in Enterprise Reporting now provides more actionable insights to help teams identify and prioritize modernization efforts. You can now view the specific component version affected by End-of-Life status, making it easier to determine exactly which dependencies require attention and accelerate upgrade planning. The dashboard also includes a new stage filter, allowing teams to focus on End-of-Life components within specific stages of the software development lifecycle so remediation efforts can be prioritized where they matter most.

To streamline investigation workflows, the dashboard now supports cross-filtering between visualizations, making it easier to move from high-level application data to the affected components with a single selection. Together, these enhancements help security and development teams quickly identify End-of-Life dependencies, understand where they are being used, and focus remediation efforts on the applications and deployment stages that present the greatest risk.

For full details, see the Component End-of-Life dashboard help documentation.

Enhanced Component Identification in the HeroDevs End-of-Life Components Dashboard

Sonatype Lifecycle enhances the HeroDevs End-of-Life Components dashboard with additional component details that make it easier to identify and investigate end-of-life components. The dashboard now displays the full component name or display name, along with the associated Policy ID, giving you more context when reviewing components that are eligible for HeroDevs support. These additions simplify cross-referencing components with policy violations and reduce the effort required to locate the correct component during remediation workflows.

This update also improves the accuracy of the dashboard's Package URLs (PURLs). Generated PURLs now include the component version and correctly handle formatting across supported package ecosystems, including npm, Maven, RubyGems, and NuGet. Improvements include proper handling of scoped npm packages, empty namespaces, Maven packaging qualifiers, and npm alias versions, resulting in standardized, versioned PURLs that are easier to correlate with vulnerability databases, SBOMs, and other tools that support the Package URL specification. The updated PURLs are reflected automatically after the next scheduled HeroDevs reporting pipeline refresh.

Legacy Violation Management API

Sonatype Lifecycle now includes the Legacy Violation Management API, providing a way to automate the management of legacy policy violations and their associated configuration. With REST APIs to list, grant, revoke, and configure legacy violation status at the application and organization levels, teams can integrate legacy violation management into existing workflows, reduce manual administration, and apply governance consistently across large environments. This enhancement makes it easier to manage policy exceptions at scale while supporting repeatable, automated security and compliance processes.

Support for Multiple GitHub Apps per Organization

Sonatype Lifecycle now supports configuring multiple GitHub Apps within a single Lifecycle organization, giving organizations greater flexibility to manage source control integrations across multiple GitHub organizations, business units, or repository groups. This enhancement simplifies administration by allowing teams to add and manage multiple GitHub App configurations without replacing existing integrations, while enabling Lifecycle to automatically select the appropriate app for supported source control operations. The result is a more scalable and resilient integration model that supports complex enterprise environments and reduces the operational overhead of managing GitHub authentication.

For full details, see the GitHub App Authentication for SCM Integration help documentation.

Identify Container Scanner-Initiated Scans in Reports

Sonatype Lifecycle reports now identify scans performed by the Sonatype Container Scanner in the Triggered By field, making it easy to distinguish them from scans performed by other container scanning integrations, such as NeuVector.

With Sonatype Container Scanner now the default container scanning solution, this enhancement provides greater transparency into scan origin, helping teams validate scanning workflows and simplify reporting.

Automatic Application ID Normalization

Sonatype Lifecycle now automatically normalizes application IDs that contain unsupported characters, improving compatibility across integrations without requiring manual updates. This enhancement helps ensure application identifiers are processed consistently throughout Lifecycle.

Enhanced CycloneDX SBOM Metadata for Red Hat Container Images

The Sonatype Container Scanner now captures Red Hat content_sets metadata when scanning Red Hat container images and includes it in generated CycloneDX SBOMs. This enhancement improves the accuracy of vulnerability filtering for Red Hat-based container images by distinguishing between specific Red Hat repositories and content sets. As a result, organizations receive more relevant vulnerability results, allowing security and development teams to prioritize remediation efforts with greater confidence.

Real-Time Source Control Evaluation Status Updates

The Source Control Evaluation REST API’s status endpoint now supports Server-Sent Events (SSE), allowing integrations to receive real-time updates as asynchronous policy evaluations progress. Instead of repeatedly polling the status endpoint for changes, clients can subscribe to live evaluation events and respond as soon as results are available. This enhancement reduces API overhead, simplifies integration development, and delivers a more responsive experience for CI/CD pipelines, developer tools, and other automated workflows.

Sonatype Developer

This release does not include any Developer-specific changes.

Sonatype SBOM Manager

This release does not include any SBOM Manager-specific changes.

Sonatype Repository Firewall

This release includes the following changes for Sonatype Repository Firewall:

Repository Firewall: Support for conda-forge Upstreams

Sonatype Repository Firewall now supports conda-forge as an upstream for conda proxy repositories. You can configure a conda proxy repository to use the conda-forge upstream and apply Repository Firewall policies to packages retrieved from that source, expanding protection to one of the most widely used community-managed conda repositories.

This enhancement gives organizations greater flexibility when adopting conda while maintaining the same security and governance workflows they rely on for other supported package ecosystems. Customers who depend on packages from conda-forge can now confidently proxy that upstream through Repository Firewall and enforce quarantine and policy evaluation before components reach development environments.

New Malware Threat Landscape Dashboard

Sonatype Repository Firewall now includes the Malware Threat Landscape dashboard in Enterprise Reporting, providing organizations with a broader view of malware activity across the open source ecosystem. By surfacing ecosystem-wide malware trends alongside Firewall blocking activity, the dashboard helps security, platform, and engineering teams better understand the evolving threat landscape, assess potential exposure, and demonstrate the value of proactively blocking malicious components before they reach developers.

The dashboard combines high-level metrics with interactive reporting to help teams monitor trends such as newly discovered malware, attack frequency, malware exposure, and Firewall prevention activity. With filtering by ecosystem, threat type, attack vector, and time period, organizations can investigate emerging threats, identify the ecosystems most affected by malware, and use this insight to strengthen software supply chain security strategies and communicate risk more effectively to stakeholders.

For full details, see the Malware Threat Landscape help documentation.

Centralized Waiver Request and Management

Sonatype Repository Firewall now includes a complete in-product waiver management workflow that streamlines how policy exceptions are requested, reviewed, approved, and maintained. Developers can submit waiver requests directly from policy violations, while administrators can review, approve, reject, and renew waivers through a centralized Waivers dashboard. This creates a more structured and transparent approval process, reducing manual coordination and helping ensure policy exceptions receive the appropriate level of oversight.

Waiver Expiration Email Notifications

Sonatype Repository Firewall can now send configurable email notifications before component waivers expire, helping organizations stay ahead of expiring policy exceptions. Administrators can define multiple reminder thresholds and notify individual recipients or role-based groups, giving teams ample time to review, renew, or remove waivers before they expire.

By proactively alerting the right stakeholders, this enhancement helps reduce the risk of unexpected component quarantines or workflow disruptions caused by expired waivers. It also improves governance by making waiver lifecycles more visible, encouraging regular review of policy exceptions, and helping ensure temporary waivers do not remain in place longer than intended.

For full details, see the Waiver Expiration Notifications help documentation.

Expanded Firewall Webhook Events

Sonatype Repository Firewall webhooks now support Violation Alert and Waiver Request events, enabling real-time notifications for repository proxy policies. This enhancement allows organizations to integrate Firewall activity more easily with ticketing systems, messaging platforms, and automated workflows, helping teams respond more quickly to new policy violations and waiver requests while reducing manual monitoring and accelerating security operations.

For full details, see the Firewall Webhooks help documentation.

Repository-Scoped Access to the Firewall Dashboard

The Sonatype Repository Firewall dashboard now supports repository-scoped access, allowing users with read permission on individual proxy repositories to view dashboard data automatically limited to only the repositories they are authorized to access. This enhancement extends Firewall reporting to a broader set of users while preserving access controls, enabling development and operations teams to monitor Firewall activity relevant to their own repositories without exposing data from other parts of the organization.

Improved Quarantine Timeline Visibility

Repository Results tables in Firewall now separate Evaluation Time and Quarantine Time into dedicated columns, providing clearer insight into the lifecycle of evaluated components. This enhancement makes it easier to interpret repository activity at a glance and reduces ambiguity when reviewing Firewall results.

Bug Fixes

Coming Soon

Webhook Relay Support for Source Control Integrations

Sonatype IQ will soon be able to register with the webhook relay service to receive source control webhook events without requiring direct inbound network access. This enhancement will simplify source control integration for organizations with restrictive network environments by eliminating the need to expose IQ Server to inbound webhook traffic. Administrators will also be able to access the generated webhook URL directly from the source control configuration pages, making it easier to configure webhook integrations while improving deployment flexibility and reducing administrative effort.

Live in Cloud; Coming to Self-Hosted 206: New Firewall Success Metrics Dashboard

In version 206, Sonatype Repository Firewall will include a new Firewall Success Metrics dashboard in Enterprise Reporting, giving organizations a clearer understanding of how effectively Firewall protects their software supply chain. By bringing key operational and security insights together in one place, the dashboard helps teams measure the impact of their security policies, identify trends in component risk, and determine whether quarantine workflows are reducing exposure to malicious or vulnerable components. At a glance, teams can monitor metrics such as component evaluations, quarantines, malicious component detections, waivers, and quarantine response times to understand how Firewall is performing over time.

With greater visibility into Firewall activity, security, platform, and engineering teams can make more informed decisions about policy tuning, prioritize response efforts, and demonstrate the value of their software supply chain security program. Interactive filtering and detailed reporting make it easier to investigate quarantine trends, understand why components are blocked, monitor waiver usage, and identify opportunities to reduce review times and continuously improve how open source risk is managed across the organization.

For full details, see the Firewall Success Metrics Dashboard help documentation.