Product Updates

The ADS installer now ships as a signed macOS .pkg and Windows .msi, downloaded from the Settings page. The installer registers a scheduled job on the machine, so Agent Supply Chain Security scans run on their own schedule without needing MDM.

What
The ADS installer now ships as a signed macOS .pkg and Windows .msi, downloaded from the Settings page in Evo.

Why
Deployment no longer means wrapping a downloaded file in your own script, you now get a standard signed installer for macOS or Windows. The installer now stays on the machine in a predictable location. Scan timing is no longer tied to your MDM policy.

How
In Evo, open Settings, choose your products and select Save & Publish. Choose your operating system and architecture, select Download ADS Installer, install the package, then run the installer with your Tenant ID and push key. Your onboarding workflow, MDM policies, tenant and push key are all unchanged. Downloading the installer directly from the CDN remains available.

Things to know
Linux is unchanged. The command line install remains supported and is documented alongside the package flow.

For more information, see the documentation: https://docs.snyk.io/agent-security/evo-by-snyk/agentic-development-security-ads

We are pleased to announce Snyk CLI release, v1.1307.4

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• New experimental snyk studio command that sets up Snyk Studio in supported AI coding tools (Cursor, Claude Code, Codex, Copilot, Gemini, Kiro, and Windsurf), so the code they generate gets scanned in the background as it's written. This direct integration replaces the need for separate setup scripts (https://github.com/snyk/studio-recipes). Run snyk studio install --experimental to get started.

• New snyk fix --agentic filtering flags: --severity-filter to fix only the severities you choose, --breakability-filter to fix only Open Source upgrades with the breakability you choose, and --exclude-ids to fix everything except the issue IDs you list.

• snyk fix --agentic now keeps a failed fix's changes by default so you can review them, rather than reverting automatically. Pass --enable-revert to restore the automatic rollback behavior.

• Fixed an issue where the --iac, --docker, --container, and --code flags on snyk test could be silently dropped for organizations on the unified test API, causing scans to fall through to an open-source test instead (which could fail with "No supported files found" or scan the wrong target). These flags now route to the correct scan again.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Snyk Code priority scores dropped by up to 200 points on September 1, 2026, for findings whose rule had a fix example.

What changed

A finding used to earn 200 of the 1,000 available priority score points when Snyk held a fix example for its rule. The August 17, 2026 release retired fix examples, and the scoring factor went with them. The removal became live on September 1, 2026.

Why

Fix-example availability describes Snyk's content coverage. It says nothing about the risk in your code. Two findings of the same severity could sit 200 points apart because one rule happened to have an example behind it. Priority score should rank findings by how urgently they need fixing, so we removed the factor.

What you saw

Snyk Code findings reordered when the factor came out. Every remaining scoring factor works as it did before, including severity, which still contributes the largest single share at up to 500 points. No finding was added, removed or re-rated.

We should have told you

The August 17 release notes said no action was required. That was wrong, and we apologize. We have added a check so that any future change to priority score appears in the release notes. The priority score documentation now lists the current factors.

Learn more in the Snyk Code priority score documentation.

Atlassian ends support for Atlassian Connect in December 2026. Snyk for Jira has been rebuilt on Forge, Atlassian's current cloud app platform, with all of the same functionality.

No action is required. New installations use the Forge version from September 30, 2026, and existing installations will be migrated during October. Permissions, configuration, ticket creation, and existing Jira issues all carry over unchanged.

For more information, see Snyk for Jira documentation.

You can connect any MCP client, such as Claude, Codex or Cursor, to Evo and ask about your AI estate from the agent you already work in.

What's new. You can now:

• Ask what AI assets Evo has discovered across your code, your developer machines, and your pentest targets

• See how those assets connect, for example which MCP servers an agent uses or which findings came from a target

• Read your policies and the violations open against them

• Create and update policies without leaving your agent

To get started, check out our documentation

We are pleased to announce Snyk CLI release, v1.1307.3

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• snyk test now reports an unreadable .snyk policy file as SNYK-POLICY-0002 with a message identifying the problem, instead of an unspecified error.

• snyk test --all-projects now resolves each project's .snyk policy from that project's own directory, instead of applying the scan root's policy to every project.

• snyk test --scan-all-unmanaged no longer fails with exit code 2 when scanning a directory of JARs with no manifest file.

• Fixed vulnerabilities:

  • CVE-2026-63376

  • CVE-2026-77465

  • SNYK-JS-ADMZIP-19846655

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Snyk Container will begin reporting vulnerabilities from the Go standard library for all customers. Scans of container images built from Go binaries identify the standard library version the binary was compiled with and report known vulnerabilities against it.

Affected images gain a new stdlib dependency in the dependency graph, versioned to the Go release used for the build, for example stdlib@1.25.10. Detection works for standard, stripped, and CGo builds.

No configuration is required, and reporting is enabled automatically for all organizations. Standard library reporting in the Snyk CLI requires v1.1303.2 or later.

This change is scheduled to take effect on October 7, 2026.

Snyk Container reported vulnerabilities in third-party Go dependencies, but not in the Go standard library itself, the HTTP, TLS, JSON, and other libraries that ship with the Go toolchain rather than being installed as dependencies. Those vulnerabilities were visible only indirectly, through distro advisories, so teams shipping Go binaries in containers had no reliable way to see them.

That left two gaps: one between what Snyk Container reported and what Snyk Open Source already reported for the same code, and one in real coverage for any Go application running in a container - this change closes both.

If you scan container images built from Go binaries, your vulnerability counts will increase. Each affected project gains a fixed number of new findings, determined by the Go version the binary was built with. Older Go releases carry more.

Building with a current Go patch release substantially reduces or eliminates these findings. Images built with Go 1.25.13 or later, or Go 1.26.6 or later, report no new vulnerabilities from this change. We recommend reviewing the Go versions used in your build pipelines ahead of the release date.

Considerations and known limitations:

• Snyk does not perform reachability analysis on standard library packages. Snyk reports all known vulnerabilities for the standard library version in your binary, rather than only those in packages your code imports. This is consistent with the approach taken by other container scanners.

• Findings that are not relevant to your application can be ignored in Snyk as usual

For more information, see Application vulnerabilities in Snyk Container and Snyk Open Source in the Snyk user documentation: https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-container/how-snyk-container-works/application-vulnerabilities-in-snyk-container-and-snyk-open-source

Snyk API & Web now lets you upload your organization's internal Certificate Authority (CA), so the certificates it issues are trusted the same way as publicly issued certificates.

What's new

Many enterprises operate their own internal CA to issue certificates for both internal tools and internet-facing applications. Although these certificates aren't signed by a public CA, they should still be included in scans to prevent false positives.

What we're delivering

A method for uploading your Root CA. Each scan of every target then verifies certificates against your CA and the public trust store.

This increases scan accuracy, reduces the overhead of documenting risk acceptance for each affected target, and boosts the overall precision of each scan based on your specific needs and requirements.

We are pleased to announce Snyk CLI release, v1.1307.2

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• Removed an unused experimental feature.

• Fixed vulnerabilities:

  • CVE-2026-84445

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

We are pleased to announce Snyk CLI release, v1.1307.1

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• snyk test again reports SNYK-CLI-0008 and exits with code 3 when a repository contains no supported manifest files, instead of a generic SNYK-CLI-0000 with exit code 2. snyk test --json writes the error document to stdout as expected.

• Restored the moduleName, insights.triageAdvice, and functions_new fields in snyk test --json output, so tooling that consumes those fields works as before.

• .snyk policy files are now handled correctly in the unified test flow. This covers empty, whitespace-only and comment-only policies, date-only timestamps, and other edge cases that could previously cause incorrect results or failures.

• Commands that complete with findings (exit code 1) no longer produce duplicate or corrupt JSON output when an unrelated network error occurs during the run, improving reliability for automated pipelines that parse CLI output.

• The debug-log scrubber now masks secrets consistently and no longer corrupts the surrounding JSON structure, making debug logs safer to share and easier to parse.

• Container scans now surface source repository information for locally built images using BuildKit metadata.

• Fixed vulnerabilities:

  • CVE-2022-25883

  • CVE-2026-84304

  • CVE-2026-84375

  • SNYK-GOLANG-GOLANGORGXCRYPTOSSH-19504090

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.