Product Updates

We are pleased to announce Snyk CLI release, v1.1307.4

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• New experimental snyk studio command that sets up Snyk Studio in supported AI coding tools (Cursor, Claude Code, Codex, Copilot, Gemini, Kiro, and Windsurf), so the code they generate gets scanned in the background as it's written. This direct integration replaces the need for separate setup scripts (https://github.com/snyk/studio-recipes). Run snyk studio install --experimental to get started.

• New snyk fix --agentic filtering flags: --severity-filter to fix only the severities you choose, --breakability-filter to fix only Open Source upgrades with the breakability you choose, and --exclude-ids to fix everything except the issue IDs you list.

• snyk fix --agentic now keeps a failed fix's changes by default so you can review them, rather than reverting automatically. Pass --enable-revert to restore the automatic rollback behavior.

• Fixed an issue where the --iac, --docker, --container, and --code flags on snyk test could be silently dropped for organizations on the unified test API, causing scans to fall through to an open-source test instead (which could fail with "No supported files found" or scan the wrong target). These flags now route to the correct scan again.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Snyk Code priority scores dropped by up to 200 points on August 17, 2026, for findings whose rule had a fix example.

What changed

A finding used to earn 200 of the 1,000 available priority score points when Snyk held a fix example for its rule. The August 17, 2026 release retired fix examples, and the scoring factor went with them.

Why

Fix-example availability describes Snyk's content coverage. It says nothing about the risk in your code. Two findings of the same severity could sit 200 points apart because one rule happened to have an example behind it. Priority score should rank findings by how urgently they need fixing, so we removed the factor.

What you saw

Snyk Code findings reordered when the factor came out. Every remaining scoring factor works as it did before, including severity, which still contributes the largest single share at up to 500 points. No finding was added, removed or re-rated.

We should have told you

The August 17 release notes said no action was required. That was wrong, and we apologize. We have added a check so that any future change to priority score appears in the release notes.

Learn more in the Snyk Code priority score documentation.

Atlassian ends support for Atlassian Connect in December 2026. Snyk for Jira has been rebuilt on Forge, Atlassian's current cloud app platform, with all of the same functionality.

No action is required. New installations use the Forge version from September 30, 2026, and existing installations will be migrated during October. Permissions, configuration, ticket creation, and existing Jira issues all carry over unchanged.

For more information, see Snyk for Jira documentation.

You can connect any MCP client, such as Claude, Codex or Cursor, to Evo and ask about your AI estate from the agent you already work in.

What's new. You can now:

• Ask what AI assets Evo has discovered across your code, your developer machines, and your pentest targets

• See how those assets connect, for example which MCP servers an agent uses or which findings came from a target

• Read your policies and the violations open against them

• Create and update policies without leaving your agent

To get started, check out our documentation

We are pleased to announce Snyk CLI release, v1.1307.3

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• snyk test now reports an unreadable .snyk policy file as SNYK-POLICY-0002 with a message identifying the problem, instead of an unspecified error.

• snyk test --all-projects now resolves each project's .snyk policy from that project's own directory, instead of applying the scan root's policy to every project.

• snyk test --scan-all-unmanaged no longer fails with exit code 2 when scanning a directory of JARs with no manifest file.

• Fixed vulnerabilities:

  • CVE-2026-63376

  • CVE-2026-77465

  • SNYK-JS-ADMZIP-19846655

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Snyk API & Web now lets you upload your organization's internal Certificate Authority (CA), so the certificates it issues are trusted the same way as publicly issued certificates.

What's new

Many enterprises operate their own internal CA to issue certificates for both internal tools and internet-facing applications. Although these certificates aren't signed by a public CA, they should still be included in scans to prevent false positives.

What we're delivering

A method for uploading your Root CA. Each scan of every target then verifies certificates against your CA and the public trust store.

This increases scan accuracy, reduces the overhead of documenting risk acceptance for each affected target, and boosts the overall precision of each scan based on your specific needs and requirements.

We are pleased to announce Snyk CLI release, v1.1307.2

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• Removed an unused experimental feature.

• Fixed vulnerabilities:

  • CVE-2026-84445

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

We are pleased to announce Snyk CLI release, v1.1307.1

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• snyk test again reports SNYK-CLI-0008 and exits with code 3 when a repository contains no supported manifest files, instead of a generic SNYK-CLI-0000 with exit code 2. snyk test --json writes the error document to stdout as expected.

• Restored the moduleName, insights.triageAdvice, and functions_new fields in snyk test --json output, so tooling that consumes those fields works as before.

• .snyk policy files are now handled correctly in the unified test flow. This covers empty, whitespace-only and comment-only policies, date-only timestamps, and other edge cases that could previously cause incorrect results or failures.

• Commands that complete with findings (exit code 1) no longer produce duplicate or corrupt JSON output when an unrelated network error occurs during the run, improving reliability for automated pipelines that parse CLI output.

• The debug-log scrubber now masks secrets consistently and no longer corrupts the surrounding JSON structure, making debug logs safer to share and easier to parse.

• Container scans now surface source repository information for locally built images using BuildKit metadata.

• Fixed vulnerabilities:

  • CVE-2022-25883

  • CVE-2026-84304

  • CVE-2026-84375

  • SNYK-GOLANG-GOLANGORGXCRYPTOSSH-19504090

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

The "What"

Repo Content Sync keeps your Snyk Projects aligned with what your repositories actually contain. When a change is merged to a branch Snyk monitors, Snyk creates and begins monitoring Projects for newly added manifest, Dockerfile, and configuration files, and deactivates the Projects whose files were removed. A file that is moved or renamed is picked up at its new path, and the Project at the old path is deactivated.

Until now, keeping Snyk in step with a repository was a manual step: someone re-imported the repository, or a newly added dependency file simply went unscanned. Repo Content Sync makes repository content itself the trigger, so your Project list reflects the code as it is today rather than as it was at import.

Sync covers Code, open source, secrets, infrastructure as code, and container (Dockerfile) Projects, and it works on custom branches as well as default branches.

Repo Content Sync will be rolled out gradually over the next several weeks.

The "Why"

A Snyk Project is a point-in-time snapshot of a repository. The moment a developer adds a manifest, a Dockerfile, or an infrastructure-as-code config — or removes one, or renames it — Snyk's view of that repository is out of date, and closing the gap depends on someone remembering to re-import.

The cost lands on both sides of that gap. Coverage decays quietly between imports, so a security team cannot tell the difference between a repository that is clean and one that was never looked at. And when a source file is deleted, its Project lingers as a stale asset, inflating inventory and issue counts that someone then has to explain.

Repo Content Sync removes the manual step. Coverage follows the repository, so what Snyk monitors and what your developers merge stay in step on their own.

The "How"

Repo Content Sync is on by default for organizations on an Enterprise plan. There is nothing to enable and no configuration to change. It is rolling out to Enterprise organizations, so it may reach your organizations over the following weeks. If you already turned it on through Snyk Preview, it stays on and nothing changes for you.

Once it reaches an organization, your Project list moves with your repositories: Projects appear as new scannable files are merged, and Projects are deactivated when their files are removed. Inventory and issue counts shift to match.

Considerations and known limitations:

• A Project you deactivate yourself, through the UI or the API, is not reactivated by sync — manual deactivation is respected.

• If you delete a Project and want it to stay deleted, select the option to exclude it from future scans in the delete dialog; without that, a Project whose source file still exists can be recreated on the next sync.

• Upon GA, if some projects were previously deleted but not removed from SCM, they might reappear and will require a 'permanent' deletion via the option to 'exclude it from future scans.'

For more information check Repo Content Sync Docs

We are pleased to announce the latest stable Snyk CLI release, v1.1307.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• Secrets

  • snyk secrets test now supports exclusions — add files or paths to the exclude section of your .snyk file to skip them during secrets scanning.

• Container

  • Container scans now surface image provenance attestations by default, so signed-image provenance metadata appears in results without any extra flag.

• .NET/NuGet

  • snyk test can now analyze already-restored .NET/NuGet projects fully offline and no longer requires .NET 6 to be installed.

• MCP

  • The full Snyk MCP profile now includes Snyk Secrets.

• Code & Secrets

  • SARIF suppressions now include reviewedOn and reviewedBy metadata.

• AI BOM

  • snyk aibom test --severity-threshold now filters the displayed and JSON results by severity, not only the exit code.

• Agent-optimized CLI

  • New experimental snyk agent command space — a scanning surface built for AI coding agents, with token-optimized output and ergonomics. snyk agent test runs Snyk Open Source, Code, and Secrets together.

• Additional Reliability and Performance Improvements

  • Adds support for scanning pnpm v11 pnpm-lock.yaml lockfiles.

  • Fixes a crash when scanning dependencies of Gradle 7.4–8.2 projects.

  • Fixes a bug where arguments after -- (for example snyk test . -- -s settings.xml) were treated as scan targets, which could silently drop the Risk Score.

  • Fixes scanning of projects using Hex versions newer than 1.19.

  • Excludes the .git folder from file discovery, preventing intermittent scan failures caused by changes to .git contents during a scan

  • Prevents a possible connection leak when the Snyk API returns an error response.

  • Updates dependencies to fix vulnerabilities.

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.