snyk.io updates
snyk.io updates
app.snyk.io/projects

New Docs and Support Portals

 

New

 

 

We are happy to announce a new, dedicated Docs Portal for Snyk user documentation, to give you better and clearer access to our user docs, with enhanced navigation, and integration with learning and solutions documentation:

docs portal.png

We’ve also revamped our Support Portal, to allow quicker and better access to all Snyk KnowledgeBase articles:

Screenshot 2021-09-15 at 07.44.04.png

We’ll continue to invest in User Content, including increased functionality and quality improvements, to help you access the knowledge you need to use Snyk.

Smaller and faster CLI!

 

Improved

 

 

We're happy to announce that we've released a new version of Snyk CLI which is much smaller and faster 🏃‍♀️

New CLI releases are now using Webpack to bundle dependencies into a single package. This greatly reduces its overall download size and makes npm installations almost instant.

Our binary releases are now also compressed, dropping download sizes by a over 50%. Along with savings made by bundling, our binaries went from a whopping ~90MB to ~40MB.

These changes will greatly improve the speed and reliability of Snyk CLI both on your workstations and in your CI/CD pipelines.

To try out the new version, please update your Snyk CLI installation to use the latest version.

For more information, please visit the CLI repo page on GitHub or visit our user documentation.

Identifying malicious packages

 

New

 

 

Snyk now factors whether a vulnerability originates from a malicious package or not into Snyk’s Priority Score, helping you find, prioritize and fix these issues more efficiently. Snyk will also add a warning on the relevant issue card itself to ensure maximum visibility.

More and more software supply chain attacks are leveraging open source packages to spread malicious code. Continue using open source but stay vigilant!

Malicious.png

For more details, please see the Snyk Priority Score docs.

Debian 11 stable and Debian 12 testing support

 

New

 

 

We are pleased to announce that Snyk Container now supports the new Debian 12 (“bookworm”) work-in-progress testing release.

In addition, Snyk has been supporting the testing releases of Debian 11 (“bullseye”) for the past two years, which has now become the new stable Debian 11 release.

See our documentation for more details about supported distributions.

Ignore Snyk IaC issues via the CLI

 

New

 

 

We've just added the ability to ignore Snyk Infrastructure as Code issues via the CLI.

Using the CLI is a common pattern during development of your infrastructure, either running scans locally or as part of your CI/CD pipelines.

You can use the .snyk file to ignore any issues that are not relevant to your deployment, and have these stored as part of your repository to be picked up automatically in any future CLI scans.

See our user documentation to get started.

Auto detect container base images

 

New

 

 

We're excited to announce that the Snyk Container product can now auto detect the base image that you are using and provide recommendations to upgrade to.

This enables you to get remediation advice for the base image, by scanning your container image through the CLI or importing from a container registry.

This means you can now get the same remediation advice without needing to provide the Dockerfile enabling you to easily get vulnerability information from your first scan.

See our user documentation for more details.

Security policies: Ignore action, and CVE and Snyk ID conditions

 

New

 

 

We’ve just added a new action (ignore) and two new conditions (CVE and Snyk ID) to Security Policies.

These new capabilities make it possible to automatically ignore issues based on their CVE, CWE, Snyk ID or exploit maturity, so you can triage your backlog more efficiently.

More information about these new capabilities can be found on our blog.

See our user documentation for more details of security policies.

Jenkins plugin V3

 

Improved

 

 

Happy to announce that we’ve released a new major version of the Jenkins plugin 🎉

The new version supports new functionally and introduces significant improvements to the developer experience.

Here is a list of the main improvements:

Improved performance

Snyk installations are now downloaded from our CDN, e.g. static.snyk.io instead of github.com which decreases the installation time and improves the overall plugin performance.

Improved error handling and status reporting

Added a new option to not fail the step on errors such as failed installs or bad configuration and improved the failure logic so a failing test runs would fail only the current step rather than the entire build.

Credential Binding support

SNYK_TOKEN can now be provided as build environment variable, allowing users to use injected secrets and integrate credential vaults.

Multiple report support

HTML reports now use a date and time or their name, allowing users to run Snyk multiple times in a build to generate multiple reports

Improved documentation

Improved explanation on how the plugin works and usage instructions.

Other improvements and bug fixes

  • Increased minimum supported Jenkins version to 2.222.4
  • Increased minimum supported Snyk CLI version to 1.500.0
  • NodeJS and NPM installations are no longer required to run the step, though you may still need them to test your NodeJS-specific projects
  • All Monitor and stderr output are now forwarded to Console Output and *.debug files are no longer generated

For more info on how to install and use the plugin, see the instructions in the plugin's public repo page.

image.png

Snyk Code Priority Score

 

New

 

 

We are happy to announce that Snyk Code now supports Priority Scores, allowing you to filter and prioritize issues in your Snyk Code projects.

As Snyk Code only includes one project per repo, with potentially thousands of files in the project, you may see a very large list of issues. Assigning Priority Scores to each issue allows you to focus on fixing the most important issues.

Priority scores appear in the same way as for other Snyk products, allowing you to use all Snyk products in a similar manner to review and prioritize issues:

SnykCofe Priority Score.png

For more information, see product documentation.

Snyk Code support for C#

 

New

 

 

We are happy to announce that C# is now fully supported in Snyk Code, adding to existing Snyk Code support for JavaScript, TypeScript, Python and Java.

Csharp.png

C# is the most prominent of the .NET framework languages, and frequently used to write web or enterprise applications. Snyk Code now supports C# and common frameworks such as .NET and .NET Core as well as ASP.NET and ASP.NET Core.

Existing projects will automatically use the new knowledge base when automatic rescan is performed. You can also trigger a rescan for immediate results.

We are working hard to add Snyk Code support for more languages in the coming months.

For more information: