Sonatype IQ Server 198 Release Notes

Self-hosted IQ Server deployments can now leverage OpenID Connect (OIDC), enabling seamless Single Sign-On (SSO) through an external identity provider (IdP) such as Okta, Keycloak, or Auth0.

This enhancement allows organizations to integrate with their existing identity systems to centralize access control and simplify the login experience. Once configured, users will be redirected to your IdP for authentication and returned to Lifecycle with verified credentials.

To get started, you’ll need administrative access and a supported OIDC-compliant IdP. For full configuration steps, see the OIDC Configuration documentation.

Sonatype Lifecycle now includes a policy condition that targets security vulnerabilities without an associated Exploit Prediction Scoring System (EPSS) score. This condition helps teams surface components where exploit prediction data is unavailable, allowing for more comprehensive risk assessment and audit coverage.

When configuring a policy with the EPSS Score (percentage) condition, you can now select the does not exist operator to trigger policy violations when a vulnerability lacks an EPSS score. This is especially useful for organizations adopting conservative security practices or tracking data quality across their components.

For full details, see our policy constraints help documentation.

The Role REST API now includes two new endpoints to support more flexible role management. Administrators can retrieve details for a specific custom role using its ID, and access a role creation template that outlines all available permissions and the required JSON structure for defining a new role.

These additions simplify integration with automation tools and improve clarity when managing role-based access controls across your organization.

A new Role Membership REST API allows administrators to programmatically manage role assignments across global and scoped contexts such as applications, organizations, and repositories.

This new API supports assigning or unassigning users and groups to roles, replacing all members for a given role in bulk, and retrieving role membership mappings. It enables more efficient, automated management of access control and improves visibility into role-based permissions across your organization.

Sonatype Lifecycle now supports automatic closure of stale pull requests in Bitbucket repositories. When enabled, this feature will automatically close pull requests that remain open without being merged or manually closed after a configurable number of days.

This helps teams keep repositories clean and reduces the overhead of managing outdated or inactive pull requests. The retention period is fully customizable to align with your team’s development workflow.

For configuration details, refer to the IQ Configuration documentation.