Track Resolved Issues
Track Resolved Issues
Release 195 (September 2025)
| Issue ID | Description |
|---|---|
| CLM-35753 | The /api/v2/securityOverrides REST API now handles cases where component identifiers are null, preventing a NullPointerException from occurring when retrieving security vulnerability override data. |
| CLM-35272 | Proprietary component matching no longer applies to the scanned file’s name or path during third-party analysis, preventing scan failures caused by filename conflicts with configured regular expressions. |
Release 194 (August 2025)
| Issue ID | Description |
|---|---|
| CLM-26944 | The OpenAPI spec at /api/v2/endpoints/public now correctly shows the response format for the GET /api/v2/applications endpoint. It also properly lists the publicId and includeCategories query parameters. |
| CLM-35315 | When scanning a binary first without -ra and then again with -ra, the second scan now correctly includes reachability data in the report. |
Release 193 (July 2025)
| Issue ID | Description |
|---|---|
| CLM-34705 | Added additional debug logging to the Auto Pull Request process to capture detailed reasons when remediations cannot be applied. |
| CLM-32926 | Renaming or moving an organization with sub-organizations now completes successfully when using the H2 database without triggering table lock timeouts or UI errors. |
| CLM-31557 | When IQ Server is started, stopped, and started again in quick succession, the system now correctly detects and prevents multiple IQ instances from running at the same time. |
| CLM-30594 | Added more detailed logging to data retention processes to improve visibility into report purging behavior. |
| CLM-30371 | The licensing screen no longer displays duplicate entries for Sonatype Repository Firewall or lists “Lifecycle Cloud” for self-hosted licenses. |
| CLM-24916 | The ALP dashboard now accurately counts components as "reviewed" only when their actual review status is set to Reviewed. This eliminates discrepancies between the dashboard summary and the Application Obligations page. |
| NEXUS-47507 | Accessing the Orgs and Policies and Repository Manager sections in the Lifecycle UI now completes significantly faster. |
Release 192 (June 2025)
| Issue ID | Description |
|---|---|
| CLM-34990 | Sonatype Lifecycle now avoids generating filenames over 1000 characters during SBOM export, which allows for successful SBOM scanning and policy evaluation. |
| CLM-34858 | The Dashboard now loads as expected when the application count exceeds 65,000 in Sonatype Lifecycle using PostgreSQL. |
Release 191 (May 2025)
| Issue ID | Description |
|---|---|
| CLM-34788 | Application report files are now retained until after policy evaluation, preventing premature deletion and potential errors. This change ensures the report.cache directory can be deleted without encountering file access issues. |
| CLM-34786 | The system no longer makes calls to the HDS when an invalid product license is detected. This change prevents the occurrence of spurious "402 Payment Required" errors for SaaS tenants with valid licenses. |
| CLM-34766 | Pull request comments are now successfully created in Bitbucket Server for organizations with Latin-1 special characters in their names. This fix ensures that the payload for pull request comments uses UTF-8 encoding, resolving issues with automated PRs generated by Lifecycle. |
| CLM-34690 | The BitbucketV1ApiClient.isBranchOnServer method now constructs SCM repository request URLs with correctly formatted query parameters. This ensures proper communication with Bitbucket's API and resolves issues where parameters were incorrectly appended. |
| CLM-34561 | The ThirdPartyScanResultsProcessor now aborts scan processing and displays an error to the user when critical exceptions, such as disk/IO errors, are encountered. This change prevents the system from getting stuck in a processing loop and generating excessively large log files in such scenarios. |
| CLM-34530 | The Expiry Date in the Component Waivers popover, which appears on the Policy Violations tab within the Component Details page, now correctly displays the waiver's expiration date. This fix ensures that the expiry time is properly included in the PolicyWaiverResource DTO mapping. |
| CLM-34522 | When FIPS mode is enabled, the system now logs an error. This enhancement provides improved visibility and aids in diagnosing potential issues related to FIPS compliance. |
| CLM-32347 | The system now gracefully handles ConnectTimeoutException errors that may occur during startup due to HTTP proxy misconfigurations or issues. |
| SBOM-1344 | Binary scan exports now include the Sonatype hash in the original SBOM. The filtered SBOM used for continuous monitoring also includes the hash for accurate component identification. |
Release 190 (April 2025)
| Issue ID | Description |
|---|---|
| NEXUS-46679 | The Malware Defense Evaluate API now works as expected for deployments using an H2 database. |
| SDEV-1958 | Reverted some user interface changes to the Priorities page. |
Release 189 (April 2025)
| Issue ID | Description |
|---|---|
| CLM-34525 | Firewall's LDAP configuration now functions correctly with a Firewall-only license. |
| CLM-34445 | Users must now have CONFIGURE_SYSTEM permissions to create and view success metrics reports. |
| CLM-34331 | The Nexus IQ Server Alpine image now includes curl, ensuring successful health checks. |
| CLM-34168 | CycloneDX files exported from IQ Server now correctly handle the WXwindows license, allowing successful re-importation and scanning. |
| CLM-31307 | IQ Server upgrades from version 175 to 176 and later no longer generate excessive WARN log messages related to policy waiver comparisons across different component formats. |
| CLM-30536 | Users can now navigate back to the "Review Obligations" view from the license view within scan reports. |
| CLM-30372 | CLI scans performed by users with the "Application Evaluator" role no longer fail with "Could not fetch IQ params for application" errors due to insufficient permissions. |
Release 188 (March 2025)
| Issue ID | Description |
|---|---|
| CLM-34067 | Policy violations without migrated PolicyViolationConstraintFacts are correctly handled, and users will no longer experience an internal error in the violations dashboard. |
| CLM-33993 | Improved SCM integration error handling to prevent connection attempts and null pointer exceptions when configuration is invalid. |
| CLM-33991 | Deleting a user via REST API with no active IQ browser session now succeeds as expected. |
| CLM-31655 | Azure DevOps plugin log no longer shows unexpected invalid cookie header information. |
| CLM-31489 | Skip validation for SPDX scans now works as expected. |
| CLM-31394 | When the violations dashboard is disabled, users now see a descriptive alert in the user interface. |
| CLM-29686 | Added explanatory tooltips to the Daily Automated Pull Request activity table. |
Release 187 (February 2025)
| Issue ID | Description |
|---|---|
| CLM-34075 | Waivers created for a specific security vulnerability and matcher strategy are no longer incorrectly marked as "unapplied waivers" on unrelated violation. |
| CLM-33553 | Backslashes in package names no longer cause an InvalidPackageURLException during application scans, ensuring proper handling of invalid entries in bom.json. |
| CLM-33047 | Policy violation constraint facts now load properly so that requesting success metrics for certain applications no longer results in a 500 error. |
| CLM-32350 | The Success Metrics report header now correctly reflects the configured successMetricsStageId instead of always displaying all stages. |
| CLM-29183 | The IQ CLI now correctly processes pnpm-lock.yaml files inside archives without throwing a "Not a directory" error. |
| CLM-29148 | You can now configure the maximum number of PostgreSQL connections for on-premises Nexus IQ Server installations using the maxConnections property in the database section of your config.yml. |
| NEXUS-45401 | Resolved an issue that was causing some features of Firewall to not be available when also using SBOM Manager for some license types. |
Release 186 (January 2025)
| Issue ID | Description |
|---|---|
| CLM-33896 | This release fixes a bug in release 185 that could cause deadlocking to occur under heavy usage causing the application to become unresponsive. |
| CLM-32560 | The insight_brain_ods.lock table no longer contains excess records after we optimized the cluster lock mechanism with PostgreSQL Advisory Locks. |
| CLM-32392 | Improved the performance and reliability of IQ HA support zip generation by optimizing the handling of large file systems. |
Release 185 (December 2024)
| Issue ID | Description |
|---|---|
| CLM-32827 | Addressed an issue where large numbers of membership mappings could cause high PostgreSQL database CPU usage. Added an index for PostgreSQL databases to improve membership mapping queries. |
| CLM-32249 | The SBOM Manager and Lifecycle PDF Exports now include the timezone info with both Created on and Analyzed on dates. |
| CLM-30691 | Fixed an issue where the Data Insights dashboard failed to load for some users who upgraded from IQ Server versions prior to 173. |
| SBOM-164 | Clarified in documentation that SBOMs cannot use UTF-16. You will need to convert them to UTF-8 for them to be properly ingested. |
Release 184 (November 2024)
| Issue ID | Description |
|---|---|
| CLM-30501 | Slow UI load while selecting between policies |
| CLM-32991 | Exporting an application report now works as expected; users should no longer see an "invalid PackageURL name" error. |
| NEXUS-44665 | Support Cargo in Repository Firewall Evaluation REST API |
Release 183 (October 2024)
| Issue ID | Description |
|---|---|
| CLM-22285 | Unable to authenticate with Crowd when running Java 11 |
| CLM-31559 | Reduce memory load of PolicyViolationDAO.getUnfixed() |
| CLM-29910 | Slow performance loading UI when large numbers of applications have a notification override for a policy |
| CLM-30498 | Component Claim REST API needs validation on the required fields |
| CLM-31661 | Status check on SCM gets stuck in waiting stage, during a PR from feature to default branch, though the policy evaluation runs |
Release 182 (September 2024)
| Issue ID | Description |
|---|---|
| CLM-31091 | Deadlock between "Startup license data updater" and search index update task |
Release 181 (August 2024)
| Issue ID | Description |
|---|---|
| CLM-31415 | IQ Server shuts down when processing pull request comment |
| CLM-31147 | SimilarWaivers API throws nullPointerException |
Release 180 (August 2024)
| Issue ID | Description |
|---|---|
| CLM-30754 | Update to target Java 17 binaries for the IQ CLI and IQ Server. |
| CLM-30565 | Performance issues navigating the Legal Menu obligations with large application. |
| CLM-29383 | Support zip may attempt to include an unlimited number of cluster_log files. |
| CLM-25312 | Violation Details remain in the loading state when viewing violation details in an old report. |
| CLM-30305 | The user assigned to owner/developer for a repository instance on IQ cannot see the repositories under Orgs & policies. |
| CLM-30882 | Policies assigned to more than one category are not inherited by applications assigned to one category. |
| CLM-25548 | 'View Transitive Violation' does not provide a list of violated components from an inner source component. |
| NEXUS-42059 | Policy Compliant Component Selection no longer results in a socket timeout when requesting a PyPi component with many versions. |
| CLM-30841 | PolicyViolationDAO.getUnfixed() method leads to OutOfMemoryError |
Release 179 (July 2024)
| Issue ID | Description |
|---|---|
| CLM-30821 | IER DataInsight reports are empty after upgrade to v177 |
| CLM-29783 | Dev dependencies in poetry.lock/pyproject.toml files are incorrectly detected |
| INT-8227 | Support layer tar files containing files with absolute paths |
| INT-8241 | IQ 175 on Windows not detecting components inside docker tar file created with cli 26.0 |
Release 178 (June 2024)
| Issue ID | Description |
|---|---|
| CLM-30755 | PR commenting tests failing with "out of range of int" error |
| CLM-29127 | Exporting an SBOM Escapes Package URL Query Parameters |
| CLM-30446 | Repository report is using incorrect permissions check for adding waivers |
| CLM-30533 | SBOM scanning produces empty report due to container component InvalidComponentIdentifierException The following coordinates are missing for given format: [namespace] |
| CLM-30491 | SBOM scan with more than 65535 component ids fails with "PreparedStatement can have at most 65,535 parameters" while fetching policy evaluation via the CLI |
| CLM-29674 | Not enough information to identify why Automated Remediate Pull Request is or is not working |
| CLM-30336 | Improve the IQ upgrade process: ERROR: column "legacy_violation_enabled" of relation "organization" already exists |
| CLM-29116 | CycloneDX export is generating invalid purls with incorrect escaping |
Release 177 (June 2024)
| Issue ID | Description |
|---|---|
| INT-7742 | IQ CLI does not provide means to bypass proxy when using --proxy flag |
Release 176 (May 2024)
| Issue ID | Description |
|---|---|
| CLM-29612 | Unable to analyze CycloneDX SBOM generated from IQ |
| CLM-29765 | The "Request Waiver" button no longer shows up for a user who has Policy Admin and Developer roles |
| CLM-29585 | Promote Scan Rest API sometimes removes the transitive/direct dependency icons from the promoted report |
Release 175 (April 2024)
| Issue ID | Description |
|---|---|
| CLM-29616 | Analysis of a Docker image saved as a tar file results in “Component-Unknown” |
| CLM-29430 | "null" is shown before the root organization name |
| CLM-29339 | OutOfMemoryError possible in com.sonatype.insight.brain.search.index.IndexService.updateIndex because it loads all of search_index_change table into heap |
| CLM-29971 | Per Repository Policy Management does not work with Repository Firewall license {also referred to as Issue ID NEXUS-42040} |
Release 174 (March 2024)
| Issue ID | Description |
|---|---|
| CLM-28910 | Scanning SBOM fails with java.lang.illegalStateException: Duplicate key |
| CLM-29382 | "/api/v2/applications" can be slow when requesting all applications |
| CLM-29558 | H2 DB Export emitting invalid SQL for firewall_metrics table |
| CLM-29431 | IER missing userFirstName for LDAP realm |
Release 173 (February 2024)
| Issue ID | Description |
|---|---|
| CLM-29328 | Higher heap usage leading to OOMs |
| CLM-28889 | IndexOutOfBoundsException for length 0 for some users with specific app and org permissions |
| CLM-29264 | IER data leakage |
| CLM-26122 | Upgrading IQ instance using helm chart fails with liveness probe failure |
| CLM-28364 | IQ HA fluentd logs output one JSON message object per line of a stack trace |
| CLM-28366 | IQ HA fluentd request logs do not log elapased time like regular request.log |
Release 171 (January 2024)
| Issue ID | Description |
|---|---|
| CLM-26912 | Advanced Search: READ permission set on an N-level organization may not work |
| CLM-28126 | Add podAnnotations to helm charts |
| CLM-28352 | Container scan of SELinux enabled image does not work |
| CLM-14238 | CycloneDX license expressions |
| CLM-28057 | Waiver on Component Name (all versions) - name based wild card matching, doesn't work. |
| CLM-28671 | Not clear what the intended reporting should be for dependencyManagement section only declared dependencies |
Release 170 (December 2023)
| Issue ID | Description |
|---|---|
| CLM-27990 | Support zip generator scans entire cluster directory for logs, resulting in very slow performance |
| CLM-28090 | Upgrade cyclonedx-core-java to 8.0.0 for latest license data |
| CLM-28462 | Poetry Scan Handle Null When Package Has No Dependencies |
| CLM-27992 | "GET /api/v2/policyViolations" may cause Out-Of-MemoryError |
| CLM-25553 | Report fails load, seemingly, due to a large bom.json |
| CLM-26176 | Content Security Policy (CSP) Header Not Set (/saml/login) |
Release 169 (November 2023)
| Issue ID | Description |
|---|---|
| CLM-28142 | Third-Party Scans fail in IQ 168 (CycloneDX, Sonatype Container) when running with H2 |
| CLM-27724 | Error parsing third-party scan file |
| CLM-26111 | defaultHostUrl requires a trailing slash when importing applications from GitLab into our LifeCycle organizations |
| CLM-27022 | "Import Applications" with a Host URL without trailing slash causes a 500 response |
| CLM-27893 | Missing database index in insight_brain_third_party_scans causes poor performance |
| CLM-27857 | SPDX 2.2 file inside component causes Nexus Azure DevOps scan to fail pipeline |
| CLM-27973 | Do Not Validate Name In Hierarchy For Policy Update If Policy Name Is Same |
| CLM-27064 | GitLab SCM Integration giving error 500 |
Release 168 (October 2023)
| Issue ID | Description |
|---|---|
| CLM-25664 | Repository view with Developer access is not available unless assigned with at least 2 organizations |
| CLM-26937 | The waving a violation documentation seems out of date |
| CLM-27407 | Increase column length for table saml_group column name |
| CLM-27408 | Viewing Conan proxy repository report can cause "javax.persistence.NonUniqueResultException" with a 500 response. |
| CLM-27430 | Scan Report History API throws NotFoundException for purged reports |
| CLM-27605 | Bitbucket the repository name is case insensitive, so we should not be validating them case sensitively |
| CLM-27478 | Increase the 500-char limit |
| CLM-27328 | Bulk import API stalling for sequential import |
| CLM-24795 | Data retention is not visible if the user has no access to the parent org. |