Product Updates

Snyk API & Web now provides native support for Bruno collections. You can import your collections directly into the platform to create API Targets without converting files to Postman collections or OpenAPI schemas first.

For teams using Bruno, this update simplifies API targets setup with several key capabilities:

• Collection Imports: Upload Bruno collections directly using a ZIP file or folder.

• Environment Variable Syncing: Snyk uploads collection environments automatically. The platform scans the import and warns you if any variables are missing required secret values.

• Authentication Support: Use authentication types derived from the collection or custom authentication scripts.

For a step-by-step walkthrough on importing your first collection, refer to the article in our Help Center.

We are pleased to announce Snyk CLI release, v1.1306.1

This release contains fixes to ensure security. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• Fixed vulnerabilities:

  • CVE-2026-41907

  • CVE-2026-13149

  • CVE-2026-59869

  • CVE-2026-59873

  • CVE-2026-39244

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Extend Snyk Code's security rules with your own code. Add your custom functions to an existing rule so the engine understands your project's specific logic and returns more accurate findings.

Start with custom sanitizers: register your in-house sanitizer functions so Snyk Code recognizes them as valid ways to clean data, and stops flagging the code paths your own security controls already protect.

What you can do

• Define and manage custom sanitizers in the in-product UI, with an FQN builder to pinpoint the exact function, or through a public REST API.

• Preview the impact of a change in the UI or with the impact-test API before you apply it — see how your findings change before anything reaches your team.

• Agent-friendly API: manage and preview rule extensions programmatically, so automation and agents can configure them at scale.

• Available to Enterprise customers.

For our closed-beta customers

Thank you for shaping Rule Extensions during the closed beta. There are a few migration steps to complete — please read the documentation.

Learn more in the Rule Extensions documentation and the API reference.

We are pleased to announce the latest stable Snyk CLI release, v1.1306.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• Doctor

  • Adds a new snyk doctor command, giving you a quick way to diagnose common CLI problems by generating a diagnostic report for your system or analyzing debug log output.

• Container

  • Container scans now detect the Java runtime version across a wider range of JVM base images, and can find vulnerabilities in .NET application dependencies.

• Snyk Studio MCP

  • The breakability evaluation tool in the Snyk MCP Server is now enabled by default and no longer requires an experimental flag.

• SCA Test

  • Improves dependency detection for Gradle projects.

• Additional Reliability and Performance Improvements

  • Shows a warning when a request is automatically retried due to rate limiting, instead of retrying silently.

  • Skips the reachability upload when no supported files are present, instead of failing.

  • Fixes dependency resolution for Swift Package Manager projects that reference packages by registry identity, so they're correctly matched to their GitHub source for vulnerability scanning.

  • Fixes scanning of sbt projects with custom Scala configurations.

  • Fixes a bug where scanning Yarn workspaces could report vulnerabilities from a workspace member's dev dependencies as production dependencies, when that member was consumed by a sibling package.

  • Updates dependencies to fix vulnerabilities.

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.

We've expanded Snyk Open Source coverage with improved scanning capabilities. These updates help you close security gaps and manage dependencies more effectively. Key improvements include new support for the uv package manager and enhanced Go scanning for private dependencies.

uv SCM support

The uv package manager is an emerging tool in the Python ecosystem. Following our earlier CLI release, uv is now available in SCM integrations. You can import uv projects and workspaces, use PR Checks, and monitor your code directly from your connected Git repositories. You do not need to use the CLI for these tasks. uv joins pip, Poetry, and Pipenv as the fourth Python ecosystem with native support in Snyk Open Source.

To get started, enable this feature for your Groups and Organizations in Snyk Preview. You can find more details in the Snyk documentation.

Improved Go scanning

Our Go scanning improvements are now generally available. This update features support for private dependencies. Go teams that use private module proxies, such as Artifactory or Nexus, or private repositories via Broker, can now achieve the same depth of scanning available for public modules.

This ensures you have no blind spots in your dependency graph when a module lives behind authentication. We support both brokered and direct connections across all SCM integrations. We are rolling this out to all users over the next two weeks. You can learn how to configure private dependencies in the Snyk documentation.

The July release expands Snyk Code coverage for C++ with several new rules and broader native C++ detection, improves detection for several popular Java libraries, and adds a new Insecure Transmission rule for JavaScript and TypeScript. These changes arrive with the July release on 13 July 2026

What's changing

New rules

• Log Forging, C++ (CWE-117, high): flags untrusted user input reaching a logging sink, which can let an attacker forge or corrupt log entries.

• Improper Privilege Management, C++ (CWE-269, high): flags a privilege-dropping call whose result is not verified; a failed call can leave the process running with elevated privileges.

• Missing Authorization, C++ (CWE-862, CWE-732): flags overly permissive file permissions (world-writable or world-executable), and calls that pass root (UID or GID 0) to privilege-escalation or file-ownership functions.

• SSL/TLS Certificate Verification Bypass, C++ (CWE-295, medium): detects disabled certificate verification across seven TLS frameworks (OpenSSL, Qt, mbedTLS, libcurl, Boost.Asio, libpq, libpqxx), which exposes connections to man-in-the-middle attacks.

• Insecure TLS Configuration, C++ (CWE-327, high): detects insecure TLS configuration, such as enabling outdated TLS versions.

• Sensitive Cookie Without Secure Attribute, C++ (CWE-614, low): flags cookies that omit the Secure attribute, either by default or explicitly set to false, leaving them exposed to man-in-the-middle attacks.

• Insecure Transmission, JavaScript (CWE-319): detects cleartext transmission over insecure transports beyond HTTP. Initial coverage targets Redis clients (@redis/client, ioredis, redis) connecting over a non-TLS redis:// URL. New rule-key, separate from HttpToHttps.

New C++ coverage

Detection now extended to native C++ for:

• Code Injection (CWE-94): across six framework modules: dlopen, LoadLibrary, Lua, CPython, Duktape, QuickJS.

• Insecure Storage (CWE-922, info): sqlite, realm, leveldb, rocksdb, lmdb, Qt.

• Insecure Cipher (CWE-327): broader native C++ crypto coverage (OpenSSL, Botan, libsodium, libtomcrypt, libgcrypt, Crypto++, mbedTLS).

Expanded Java library coverage

Improved detection for code using these popular Java libraries:

• Azure SDK for Java (com.azure:azure-core)

• Logback (ch.qos.logback:logback-classic)

• Reactor Netty HTTP (io.projectreactor.netty:reactor-netty-http)

• Apache Kafka clients (org.apache.kafka:kafka-clients)

• Jackson (com.fasterxml.jackson.core: jackson-databind and jackson-core)

Important details to note

• C++ customers may see new findings after the July release, in particular from the new rules above.

• TLS rule reclassification: the existing TLS rule (Inadequate Encryption Strength) is moving from CWE-326 to CWE-327 across C++, Groovy, Java, Kotlin, Python, Scala and Swift. Customers with policies or ignores tied to the TLS rule under CWE-326 should review them. The TLS detection has also been refactored, so customers may see a change in the volume of TLS-related findings.

• The C++ Insecure Storage rule is info-level and may increase findings, including some false positives (early triage sampled 50 of 491 new findings: 47 true positives, 3 false positives).

• The JavaScript Insecure Transmission rule ships as a new rule-key, separate from HttpToHttps, so ignore and policy scoping stays clean.

To learn more, visit our Snyk User Documentation.

On July 27, 2026, Snyk updates the default setting for issue alert emails to ensure every notification you receive is relevant to your work. These emails alert you to newly detected vulnerabilities and license violations.

Summary of changes

If you have never manually configured your notification preferences, you stop receiving these emails after July 27, 2026. This update moves issue alert notifications to an opt-in model so they only reach you if they are useful to your workflow. If you have already chosen which emails you receive, your preferences do not change and remain preserved exactly as they are.

Manage your preferences

You can keep receiving these emails by saving your preferences before the July 27 deadline, or you can re-enable them at any time afterward. Wherever you can set issue alert notifications, a banner appears in the Snyk web UI. To opt in instantly, click Keep my current selections in the banner.

You can also manually manage your settings:

• For personal preferences: Navigate to Account Settings, click Notifications, find the issue alert emails for the relevant Organizations, and save your preference.

• For Organizations admins: Navigate to Organization Settings, click Notifications, and update the default for all members of your organization.

• For Groups admins: Navigate to Group, click Notifications, and manage issue alert settings across every organization in the Groups from a single page.

To learn more, visit Manage notifications

We are pleased to announce Snyk CLI release, v1.1305.2.

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• Bumped the Go runtime to version 1.26.4.

• Improved MCP logging and addressed security issues in the Snyk MCP Server.

• Fixed vulnerabilities:

  • CVE-2026-44705

  • CVE-2026-45570

  • CVE-2026-49982

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

This month on Snyk Learn, we’ve added new AI security lessons covering the attacks that target agentic systems: getting agents to run code they shouldn't, poisoning their memory to bend their reasoning, and exploiting the gaps where agents talk to each other!

Security lessons

• [New][AI-Sec] Unexpected code execution (RCE) - tricking your agentic systems to execute code!

• [New][AI-Sec] Memory and Context Poisoning - how corrupted agent memory can silently reshape reasoning, decisions, and behavior.

• [New][AI-Sec] Insecure Inter-Agent Communication - exploiting weak communication protections between agents.

• [Updated] Generation of predictable numbers - how intruders can use weaknesses in random number generation to launch more successful attacks.

• [Updated] Uncontrolled recursion - how infinite loops can ruin your life and crash your systems.

Expanded framework & language coverage

We’ve also expanded Snyk Learn content to cover more of your tech stack:

• New/expanded language support:

  • Multiple lessons expanded into Python, Rust, and Ruby for the OWASP Top 10.

Each new/updated lesson above links directly to the relevant content so you can share it with your teams or assign it as part of your training program with the Snyk Learning Management Add-On.

Use Snyk Learn to help your security engineers and developers stay ahead of the latest risks!

Bonus Content

Snyk is also publishing videos on AI coding and AI security on our YouTube channel! If you would like to see content like this on Snyk Learn, use the feedback button on Snyk Learn to let us know.

Snyk YouTube

A cluttered PR backlog slows everyone down.

Following a successful Early Access, automatic closing of Open Source Fix PRs is now generally available. What's more, this feature will be turned on by default across all of our customers so your team spends less time triaging stale pull requests and more time shipping.

Whether a developer manually applied a fix, removed the dependency, or a transitive update resolved the issue, Snyk catches it during your next recurring test and closes the outdated PR. We also drop a comment on the PR explaining exactly which issues were resolved, so your team always has the right context without the extra noise.

How it works:

• Snyk checks your open Fix PRs during recurring tests.

• If the targeted dependency was removed, updated transitively, or fixed manually, the PR is automatically closed.

• Snyk leaves a comment detailing the resolved issues so your team knows exactly why it was closed.

• A Fix PR is only closed if all issues are resolved—if some remain, Snyk leaves the PR open so nothing falls through the cracks.

What's new at GA: With the general availability rollout, this feature is now enabled by default for all organizations. Administrators who prefer to manage closures manually can opt out from the settings page. You can now also configure the maximum number of obsolete PRs Snyk will close per day. giving you control of your workflow, a top piece of feedback from Early Access.

We hope you enjoy cleaner, more actionable backlogs!