# Sonatype Lifecycle & Firewall **URL:** https://community.sonatype.com/c/sonatype-lifecycle-firewall/7.md [Latest](https://community.sonatype.com/latest.md) · [Categories](https://community.sonatype.com/categories.md) · [Tags](https://community.sonatype.com/tags.md) --- ## [Auth Error](https://community.sonatype.com/t/auth-error/16633)
**Author:** [@jonathan.solan](https://community.sonatype.com/u/jonathan.solan)\ **Replies:** 3\ **Last updated:** [September 16, 2026, 3:16pm UTC](https://community.sonatype.com/t/auth-error/16633 "2026-09-16T15:16:10Z")
In version 207.1, I encounter the following error when logging in via SAML. The certificate has been updated on the Entra ID side and re-imported. When the “Validate Response Signature” setting is set to False, I am abl… --- ## [Optimizing Waiver Process](https://community.sonatype.com/t/optimizing-waiver-process/16488)
**Author:** [@jonathan.solan](https://community.sonatype.com/u/jonathan.solan)\ **Replies:** 3\ **Last updated:** [July 28, 2026, 3:44pm UTC](https://community.sonatype.com/t/optimizing-waiver-process/16488 "2026-07-28T15:44:42Z")
Our organization is deploying a tool called Airflow on AWS. The tool involves a list of restrictions, and our library firewall correctly blocks some of them. Currently, we authorize these libraries by issuing a waiver t… --- ## [Batch Deletion of expired waivers](https://community.sonatype.com/t/batch-deletion-of-expired-waivers/16437)
**Author:** [@martyn.angus1](https://community.sonatype.com/u/martyn.angus1)\ **Replies:** 1\ **Last updated:** [June 29, 2026, 4:08pm UTC](https://community.sonatype.com/t/batch-deletion-of-expired-waivers/16437 "2026-06-29T16:08:04Z")
i have a number of waivers that have expired and wondered if there were a way i could batch delete with waiver id’s. --- ## [Package Coverage Issue](https://community.sonatype.com/t/package-coverage-issue/15838)
**Author:** [@Menna\_Ahmed](https://community.sonatype.com/u/Menna_Ahmed)\ **Replies:** 2\ **Last updated:** [June 22, 2026, 1:23pm UTC](https://community.sonatype.com/t/package-coverage-issue/15838 "2026-06-22T13:23:32Z")
Hi there, I’m facing an issue with Sonatype Lifecycle when scanning with pnpm. When the target file is pnpm-lock.yaml, the scan seems to only report direct dependencies and doesn’t capture most transitive packages. For … --- ## [IQ Firewall: Database update frequency and coverage of new libraries against recent threats](https://community.sonatype.com/t/iq-firewall-database-update-frequency-and-coverage-of-new-libraries-against-recent-threats/16401)
**Author:** [@jonathan.solan](https://community.sonatype.com/u/jonathan.solan)\ **Replies:** 4\ **Last updated:** [June 9, 2026, 8:00pm UTC](https://community.sonatype.com/t/iq-firewall-database-update-frequency-and-coverage-of-new-libraries-against-recent-threats/16401 "2026-06-09T20:00:26Z")
Hello everyone. I understand there are currently many attacks targeting the latest library versions. My question is: how often is the IQ Firewall database updated with respect to libraries, and how often are new librar… --- ## [Sonatype Firewall Pro now available for third-party users!](https://community.sonatype.com/t/sonatype-firewall-pro-now-available-for-third-party-users/16393)
**Author:** [@andres](https://community.sonatype.com/u/andres)\ **Replies:** 0\ **Last updated:** [May 28, 2026, 2:20pm UTC](https://community.sonatype.com/t/sonatype-firewall-pro-now-available-for-third-party-users/16393 "2026-05-28T14:20:32Z")
Firewall Pro is now generally available We’re excited to announce that Sonatype Firewall Pro is now generally available. Firewall Pro helps teams protect third-party repository environments from malicious open source pa… --- ## [how to use remote tcp socket instead of local unix socket for nexus iq container image scan for pulling neuvector image from private registry](https://community.sonatype.com/t/how-to-use-remote-tcp-socket-instead-of-local-unix-socket-for-nexus-iq-container-image-scan-for-pulling-neuvector-image-from-private-registry/16271)
**Author:** [@pepoga](https://community.sonatype.com/u/pepoga)\ **Replies:** 1\ **Last updated:** [April 21, 2026, 4:17pm UTC](https://community.sonatype.com/t/how-to-use-remote-tcp-socket-instead-of-local-unix-socket-for-nexus-iq-container-image-scan-for-pulling-neuvector-image-from-private-registry/16271 "2026-04-21T16:17:29Z")
how to use remote tcp socket instead of local unix socket for nexus iq container image scan for pulling neuvector image from private registry? Using jenkins plugin. getting the error docker pull privateregistry.com/neuv… --- ## [Bom scan does not generate a report](https://community.sonatype.com/t/bom-scan-does-not-generate-a-report/16097)
**Author:** [@Fabio\_Victoriano](https://community.sonatype.com/u/Fabio_Victoriano)\ **Replies:** 3\ **Last updated:** [March 11, 2026, 2:20pm UTC](https://community.sonatype.com/t/bom-scan-does-not-generate-a-report/16097 "2026-03-11T14:20:16Z")
Description: We have a centralized CI pipeline (Azure DevOps) setup that runs across our solutions. As part of the CI process, we perform a Sonatype scan using the NexusIqPipelineTask. The task uses, on the scanTargets … --- ## [The only file for Open Source scans with Golang is NOT supported](https://community.sonatype.com/t/the-only-file-for-open-source-scans-with-golang-is-not-supported/11491)
**Author:** [@jake.coddington](https://community.sonatype.com/u/jake.coddington)\ **Replies:** 16\ **Last updated:** [August 29, 2025, 3:22pm UTC](https://community.sonatype.com/t/the-only-file-for-open-source-scans-with-golang-is-not-supported/11491 "2025-08-29T15:22:18Z")
https://help.sonatype.com/iqserver/analysis/go-application-analysis According to this page go.sum may be used for dependency scanning, but is not recommended. I think it should be removed from this help page if it is no… --- ## [New Guide: Firewall's Policy Compliant Component Selection for npm](https://community.sonatype.com/t/new-guide-firewalls-policy-compliant-component-selection-for-npm/7626)
**Author:** [@mfrost](https://community.sonatype.com/u/mfrost)\ **Replies:** 4\ **Last updated:** [July 16, 2025, 12:59pm UTC](https://community.sonatype.com/t/new-guide-firewalls-policy-compliant-component-selection-for-npm/7626 "2025-07-16T12:59:18Z")
The Technical Content team is excited to announce the release of a brand new guide, "Firewall’s Policy Compliant Component Selection for npm." To protect against unknown, suspicious, and malicious components, Nexus Fire… --- ## [How to configure the idle session timeout for Nexus IQ?](https://community.sonatype.com/t/how-to-configure-the-idle-session-timeout-for-nexus-iq/7693)
**Author:** [@pepoga](https://community.sonatype.com/u/pepoga)\ **Replies:** 2\ **Last updated:** [May 5, 2025, 2:23pm UTC](https://community.sonatype.com/t/how-to-configure-the-idle-session-timeout-for-nexus-iq/7693 "2025-05-05T14:23:41Z")
Is it possible to configure a custom time other than the default 30 minutes for Nexus IQ idle session timeout? If so, how? --- ## [Sonatype Repository Firewall Is About to Get Even Better!](https://community.sonatype.com/t/sonatype-repository-firewall-is-about-to-get-even-better/14863)
**Author:** [@mfrost](https://community.sonatype.com/u/mfrost)\ **Replies:** 2\ **Last updated:** [May 2, 2025, 5:20pm UTC](https://community.sonatype.com/t/sonatype-repository-firewall-is-about-to-get-even-better/14863 "2025-05-02T17:20:06Z")
We’ve added some awesome new features to Repository Firewall to help you tackle open source malware earlier and more easily—whether you’re coding at your workstation, working with containers, or experimenting with AI. H… --- ## [Announcing a New Integration with GitLab Ultimate!](https://community.sonatype.com/t/announcing-a-new-integration-with-gitlab-ultimate/13716)
**Author:** [@mfrost](https://community.sonatype.com/u/mfrost)\ **Replies:** 2\ **Last updated:** [April 7, 2025, 5:38pm UTC](https://community.sonatype.com/t/announcing-a-new-integration-with-gitlab-ultimate/13716 "2025-04-07T17:38:41Z")
We’re excited to announce our new integration with GitLab Ultimate! With this update, you can now view detailed vulnerability findings from Lifecycle scans right in your GitLab Vulnerability Report. Plus, your project’s … --- ## [Package.json scan in Nexus IQ](https://community.sonatype.com/t/package-json-scan-in-nexus-iq/14526)
**Author:** [@Balaji\_PS](https://community.sonatype.com/u/Balaji_PS)\ **Replies:** 0\ **Last updated:** [March 3, 2025, 5:48pm UTC](https://community.sonatype.com/t/package-json-scan-in-nexus-iq/14526 "2025-03-03T17:48:46Z")
I am getting 0 components identified when we scan package.json file but not for all package.json file. So for some, it is working . so, need to know why some package.json file is not getting scanned in Nexus IQ. what nee… --- ## [Phantom components found during IQ scans?](https://community.sonatype.com/t/phantom-components-found-during-iq-scans/14221)
**Author:** [@djb](https://community.sonatype.com/u/djb)\ **Replies:** 1\ **Last updated:** [February 13, 2025, 1:49pm UTC](https://community.sonatype.com/t/phantom-components-found-during-iq-scans/14221 "2025-02-13T13:49:45Z")
I have experienced numerous phantom components throughout my time scanning projects with IQ. Components that do not appear to exist within the project’s code, its dependencies, or sub-dependencies. Why is this, and what … --- ## [Dependency Tree for Python projects](https://community.sonatype.com/t/dependency-tree-for-python-projects/14161)
**Author:** [@peter.drienko](https://community.sonatype.com/u/peter.drienko)\ **Replies:** 1\ **Last updated:** [January 16, 2025, 4:09pm UTC](https://community.sonatype.com/t/dependency-tree-for-python-projects/14161 "2025-01-16T16:09:03Z")
Hi, Does Nexus IQ currently support Dependency Tree for Python projects? If not, when do you plan to implement it? Contrary to a simple requirements.txt file, poetry.lock contains dependency information about transient… --- ## [NPM Component-Unknown: How long does Sonatype take to register new versions of packages?](https://community.sonatype.com/t/npm-component-unknown-how-long-does-sonatype-take-to-register-new-versions-of-packages/14062)
**Author:** [@djb](https://community.sonatype.com/u/djb)\ **Replies:** 1\ **Last updated:** [December 19, 2024, 12:57pm UTC](https://community.sonatype.com/t/npm-component-unknown-how-long-does-sonatype-take-to-register-new-versions-of-packages/14062 "2024-12-19T12:57:21Z")
As titled, how long does Sonatype take to register a new version of a component? I had previously heard or read that it takes minutes, at least with Maven, and had assumed it was somewhere in the same ballpark with NPM. … --- ## [Archiving Strategy for sonatype lifecycle](https://community.sonatype.com/t/archiving-strategy-for-sonatype-lifecycle/13607)
**Author:** [@jai\_vishvas](https://community.sonatype.com/u/jai_vishvas)\ **Replies:** 1\ **Last updated:** [October 7, 2024, 4:17pm UTC](https://community.sonatype.com/t/archiving-strategy-for-sonatype-lifecycle/13607 "2024-10-07T16:17:20Z")
Hi Can we delete the trash fodler content in Nexus IQ server to claim space? Thanks Jai --- ## [Nexus IQ CLI - GPG signature key is expired](https://community.sonatype.com/t/nexus-iq-cli-gpg-signature-key-is-expired/10515)
**Author:** [@pav.g](https://community.sonatype.com/u/pav.g)\ **Replies:** 7\ **Last updated:** [October 1, 2024, 1:53pm UTC](https://community.sonatype.com/t/nexus-iq-cli-gpg-signature-key-is-expired/10515 "2024-10-01T13:53:16Z")
Attempting to install nexus iq cli on ubuntu but facing the below error GPG error: https://repo.sonatype.com/repository/sonatype-apt-hosted stable InRelease: The following signatures were invalid: EXPKEYSIG 68930BE5F3F2… --- ## [How to setup SSL certs for Nexus IQ CLI Installed using linux binary](https://community.sonatype.com/t/how-to-setup-ssl-certs-for-nexus-iq-cli-installed-using-linux-binary/13519)
**Author:** [@hkaur6](https://community.sonatype.com/u/hkaur6)\ **Replies:** 1\ **Last updated:** [September 30, 2024, 5:48pm UTC](https://community.sonatype.com/t/how-to-setup-ssl-certs-for-nexus-iq-cli-installed-using-linux-binary/13519 "2024-09-30T17:48:26Z")
I am a beginner to sonatype products, currently exploring lifecycle scanning capabilities. While attempting to scan a code repo using nexus-iq-cli I run into SSL related errors. I am unable to find documentation for res… --- ## [Repository Firewall Best Practices: Policy Compliant Component Selection](https://community.sonatype.com/t/repository-firewall-best-practices-policy-compliant-component-selection/12225)
**Author:** [@jzora](https://community.sonatype.com/u/jzora)\ **Replies:** 6\ **Last updated:** [September 24, 2024, 3:29pm UTC](https://community.sonatype.com/t/repository-firewall-best-practices-policy-compliant-component-selection/12225 "2024-09-24T15:29:25Z")
Protecting yourself from software supply chain attack with Sonatype Repository Firewall is a bit of a balancing act. Quarantining components protects you from risk, but it also creates some development friction. Quaranti… --- ## [Automated Pull Requests vs Policy Compliant Component Selection](https://community.sonatype.com/t/automated-pull-requests-vs-policy-compliant-component-selection/13361)
**Author:** [@jeff.wise](https://community.sonatype.com/u/jeff.wise)\ **Replies:** 1\ **Last updated:** [September 3, 2024, 10:40pm UTC](https://community.sonatype.com/t/automated-pull-requests-vs-policy-compliant-component-selection/13361 "2024-09-03T22:40:58Z")
When it comes to automating version updates to remediate vulnerabilities, Sonatype appears to offer two conflicting solutions: Automated Pull Requests Requires version pinning Policy Compliant Component Selection R… --- ## [Nexus -\> SIEM integration](https://community.sonatype.com/t/nexus-siem-integration/10093)
**Author:** [@emptyformforme](https://community.sonatype.com/u/emptyformforme)\ **Replies:** 1\ **Last updated:** [August 26, 2024, 8:20am UTC](https://community.sonatype.com/t/nexus-siem-integration/10093 "2024-08-26T08:20:02Z")
Hello. I am learning to use Nexus, and I’d like to pass its logs to ELK. In settings I didn’t find SIEM connectors. Are there any? Or I need to pass logs to stdout (for example) and then process them with my own connect… --- ## [Failed to scan nexusiq artifacts](https://community.sonatype.com/t/failed-to-scan-nexusiq-artifacts/12654)
**Author:** [@venkat.sannamuri](https://community.sonatype.com/u/venkat.sannamuri)\ **Replies:** 4\ **Last updated:** [July 17, 2024, 4:41pm UTC](https://community.sonatype.com/t/failed-to-scan-nexusiq-artifacts/12654 "2024-07-17T16:41:49Z")
We are currently working on developing a Java -21 application and encountering an error while scanning artifacts in NexusIQ. Can any faced similar issue? our nexusiq version is 175. Could not parse class file Controlle… --- ## [Realtime Containerscanning](https://community.sonatype.com/t/realtime-containerscanning/12898)
**Author:** [@eriks](https://community.sonatype.com/u/eriks)\ **Replies:** 0\ **Last updated:** [July 12, 2024, 2:33pm UTC](https://community.sonatype.com/t/realtime-containerscanning/12898 "2024-07-12T14:33:52Z")
Hello all, we wanna use Nexus Container Registry & Nexus Firewall to Proxy registries like DockerHub or Quay.io and also scan the layers of the Images in Realtime, is that possible in the same way how it works with Arti… --- ## [Sonatype doesn't get npm package license from package repo](https://community.sonatype.com/t/sonatype-doesnt-get-npm-package-license-from-package-repo/12850)
**Author:** [@pri](https://community.sonatype.com/u/pri)\ **Replies:** 0\ **Last updated:** [July 3, 2024, 9:44am UTC](https://community.sonatype.com/t/sonatype-doesnt-get-npm-package-license-from-package-repo/12850 "2024-07-03T09:44:49Z")
Is there a way to inform Sonatype about npm package licenses if they are not included within the package? We’re using redoc to generate API reference documentation. Among the packages that redoc depends on, there are a … --- ## [Shaded Vulnerability Detection Data](https://community.sonatype.com/t/shaded-vulnerability-detection-data/12694)
**Author:** [@rspooner](https://community.sonatype.com/u/rspooner)\ **Replies:** 9\ **Last updated:** [July 1, 2024, 10:49pm UTC](https://community.sonatype.com/t/shaded-vulnerability-detection-data/12694 "2024-07-01T22:49:41Z")
NOTE: This is an ongoing release. Stay tuned to this community post for updates and educational materials. The initial release of the highest severity vulnerabilities with a CVSS of 10 will begin on Monday, September 9,… --- ## [Data Insights Tab Absent After IQ Firewall Upgrade from 174 to 178](https://community.sonatype.com/t/data-insights-tab-absent-after-iq-firewall-upgrade-from-174-to-178/12820)
**Author:** [@aaron.white](https://community.sonatype.com/u/aaron.white)\ **Replies:** 1\ **Last updated:** [June 27, 2024, 7:09pm UTC](https://community.sonatype.com/t/data-insights-tab-absent-after-iq-firewall-upgrade-from-174-to-178/12820 "2024-06-27T19:09:37Z")
The Data Insights tab is absent after upgrading to 178. Is this expected behavior? Or is this a sign of a corrupt installation? All other functionality appears normal. Note: we only have a license for Firewall not Lif… --- ## [Update policies using API](https://community.sonatype.com/t/update-policies-using-api/7516)
**Author:** [@nikhil.nagesh.chodankar](https://community.sonatype.com/u/nikhil.nagesh.chodankar)\ **Replies:** 9\ **Last updated:** [June 11, 2024, 3:27pm UTC](https://community.sonatype.com/t/update-policies-using-api/7516 "2024-06-11T15:27:36Z")
I wanted to ask if we can update the policies of Nexus IQ Server using APIs? Our current version is 103. --- ## [Tip Tuesday: Zero-Day Vulnerability Best Practices](https://community.sonatype.com/t/tip-tuesday-zero-day-vulnerability-best-practices/12674)
**Author:** [@mfrost](https://community.sonatype.com/u/mfrost)\ **Replies:** 0\ **Last updated:** [June 4, 2024, 3:09pm UTC](https://community.sonatype.com/t/tip-tuesday-zero-day-vulnerability-best-practices/12674 "2024-06-04T15:09:22Z")
Welcome back to Tip Tuesday, where we share a helpful tip from our Sonatype team to help you find more success with Sonatype solutions. A zero-day event is when a previously unknown vulnerability is discovered in a popu… [Next page](https://community.sonatype.com/c/sonatype-lifecycle-firewall/7.md?page=1)