Changelog
Version 1.0.0 (November 12, 2026)
- Introduced the Sonatype CLI (
sonatype), which checks open source packages against your Sonatype IQ Server policies as your build tools download them
- Added
sonatype fwe run to check the packages that npm, Maven, Gradle, pip, uv and the .NET CLI download, including through the Maven and Gradle wrappers, without changes to project files
- Added block mode, the default, which stops a package that violates policy before it is downloaded and shows the policy, threat level and a link to the details in IQ Server
- Added observe mode to report policy violations without blocking downloads
- Added support for packages served by Sonatype Nexus Repository, JFrog Artifactory and public registries, including NuGet V2 and V3 feeds
- Added a JSON run report for CI pipelines and a dedicated exit code for runs where no package download could be evaluated
- Added warnings when a tool setting would send downloads around policy checks, such as a Maven proxy, a non-default Maven transport or a uv proxy setting
- Added
sonatype setup, a guided first-run setup that connects to IQ Server, stores your credentials and fixes common problems
- Added
sonatype auth to sign in to IQ Server with a password or user token, stored in the macOS Keychain or Windows Credential Manager, or supplied through an environment variable in CI
- Added
sonatype config with user and project configuration files and named profiles for working with more than one IQ Server
- Added
sonatype ca to install, check and remove the local certificate the CLI uses to inspect HTTPS downloads
- Added
sonatype doctor to diagnose configuration, connectivity and tooling problems, and sonatype diagnostic-bundle to create a redacted archive for Sonatype Support
- Added automatic retries when IQ Server limits the rate of policy requests, and a setting to limit concurrent requests
- Added shell completion for bash and zsh
- Added self-contained installers with a bundled Java runtime for macOS (Apple silicon and Intel, signed and notarized), Linux (x86_64 and ARM64) and Windows (x86_64)