Product Updates

We are pleased to announce Snyk CLI release, v1.1308.2

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• .NET scans no longer fail with NETSDK1067 when SelfContained=true is set in the build environment.

• snyk test --source-dir now returns a clear validation error when used without --reachability=true, instead of ignoring the flag or treating the path as the project directory.

• snyk test --fail-on=patchable now works as expected, rather than failing with an "Unsupported value 'patchable'" error.

• Smoother authentication and scanning in the IDE through Snyk Language Server fixes: an expired token now shows a single re-authenticate prompt instead of several, signing in from one IDE window now signs in your other open windows, and when showing only net new issues the IDE finds the base branch from origin/HEAD and asks you to pick one if none is found, instead of reporting a failed scan.

• Updates the Go runtime to 1.26.10.

• Fixed vulnerabilities:

  • SNYK-JS-TAR-18319500

  • CVE-2026-33532

  • CVE-2026-73055

  • CVE-2026-78663

  • CVE-2026-78669

  • CVE-2026-111943

  • CVE-2026-78659

  • CVE-2026-78660

  • CVE-2026-97032

  • CVE-2026-102941

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

What Changed?

You can now set how often Snyk scans your repositories for secrets using Repo Monitor Configuration .

In "Inventory -> repository -> Settings" or in bulk via "Inventory -> Configure Monitoring", choose Daily, Weekly or Never for Secrets. Set it for a single repository or for many repositories at once.

Secrets also now appear in Inventory. In the All Assets view, each repository shows its Secrets coverage control, the Snyk Projects that contain Secrets results, and the Secrets issues found.

Prerequisites

• Repo Monitor Configuration (EA) enabled via Snyk Preview (for Secrets test configurations)

We are pleased to announce Snyk CLI release, v1.1308.1

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• snyk test --html and --html-file-output no longer require preview features to be enabled, making HTML reports available to everyone.

• The project name is now consistently displayed in the snyk test summary when available.

• Fixed vulnerabilities:

  • CVE-2022-21681

  • CVE-2026-56866

  • CVE-2026-78659

  • CVE-2026-78667

  • CVE-2026-94439

  • CVE-2026-94440

  • CVE-2026-97031

  • CVE-2026-97032

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

What Changed?

When you submit an ignore request under Ignore Approval Workflow, the issue now shows a clear "Pending Ignore Request" status directly on the Project's Issues page and in the issue details — so you can see at a glance that a request is awaiting review, instead of it looking like any other open issue.

You can also filter your Issues list to show only findings with a pending ignore request, making it easy to see and act on the queue of requests awaiting a decision without scanning every issue.

For API and integration users, the issues API now reports pending as part of an issue's ignore status, so you can distinguish open, pending, and ignored findings programmatically.

This enhancement will be rolled out gradually during the next 2 weeks.

Why we changed it?

Previously, a finding with a submitted-but-not-yet-approved ignore request looked identical to any other open issue.

There was no way to tell that a request was already in pending — which meant developers had no way to check whether their request had registered, and reviewers had no way to see pending requests from the view they already use to triage issues.

What does it mean to you?

If your organization uses Ignore Approval Workflow, pending ignore requests now appear automatically in the Issues page and issue details after your next scan — no configuration needed. The Pending Ignore filter is available alongside the existing Open and Ignored filters. No action is required to adopt this change.

Additional Information about Ignore Approval Workflow

https://docs.snyk.io/scan-fix-and-prevent/fix/prioritize-issues-for-fixing/ignore-issues/ignore-approval-workflow

This update will be available on October 26, 2026.

Snyk Code reports significantly more findings in this update. Affected projects will report the additional findings on their next scan.

Snyk Code now analyzes more deeply and more accurately in Java, Kotlin, Go, TypeScript, JavaScript, Python, C#, PHP and Ruby.

Go, TypeScript and JavaScript

Snyk Code reads the Project's own configuration to resolve imports. For Go, it reads go.mod, which defines the module path that a project's packages import each other through. For TypeScript and JavaScript, it reads tsconfig.json and jsconfig.json, which define path aliases.

As a result, Snyk Code now analyzes these projects more accurately and with greater depth.

PHP

Snyk Code corrects boolean typing in PHP analysis. Previously skipped findings now appear across cross-site scripting, path traversal, SQL injection and other checks.

Java

Coverage is added or improved for these libraries:

• Spring Data MongoDB

• AWS SDK for Java, DynamoDB

• AWS SDK for Java 2.x, DynamoDB

• AWS SDK for Java 2.x, DynamoDB Enhanced Client

• Apache Commons FileUpload

• Google Cloud Big Query

Snyk Code adds a Mass Assignment rule for Spring applications. It reports request data that binds directly onto a database entity. Path traversal detection is wider.

More detection

Snyk Code reports additional findings in these areas:

• Python: XML external entity injection.

• JavaScript: deserialization, XML external entity injection and zip slip.

• JavaScript, Bootbox: DOM-based cross-site scripting.

• JavaScript, d3: DOM-based cross-site scripting.

• C#: path traversal.

• Go: SQL injection.

• Go, AWS SDK for Go v2: path traversal through S3 object keys.

• Ruby: path traversal, and a new server-side request forgery rule.

Template file analysis and serverless analysis

Snyk Code analyzes template files and serverless applications more accurately and with greater depth, building on the September update. Both will yield additional findings in projects that use template engines or serverless frameworks.

Learn more in the Snyk Code documentation.

We are pleased to announce the latest stable Snyk CLI release, v1.1308.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• HTML Reports

  • snyk code test and snyk secrets test can now generate an HTML report. Use --html to print it to stdout, or --html-file-output=<path> to write it to a file. This replaces the need for a separate snyk-to-html tool in most cases. Support for snyk test will be available in v1.1308.1.

• Agent Scan (experimental)

  • The experimental snyk agent-scan command now reports risk indicators instead of issue codes. If you post-process its --json output, update your scripts to the new format.

• Additional Reliability and Performance Improvements

  • Maven and Gradle SBOMs, and --print-graph, no longer stall on large multi-module builds and now finish seconds after the build tool exits. On projects with dependency cycles, the output may contain extra pruned: cyclic placeholder nodes. No packages or dependency edges are dropped.

  • Gradle projects with very deep inter-module dependency chains no longer fail with a stack overflow.

  • Projects built with Gradle 4.0 to 4.6 no longer fail to scan.

  • .NET scans fall back to legacy scanning when the .NET SDK isn't installed. They also handle projects restored in a different build directory, and work when global NuGet source-mapping rules are configured.

  • .NET scans no longer fail with NU1101 on SDK installs that lack the app host pack, such as distro-packaged SDKs.

  • .NET projects whose PackageReference uses a lowercase version attribute are now parsed correctly.

  • Updates dependencies to fix vulnerabilities

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.

The ADS installer now ships as a signed macOS .pkg and Windows .msi, downloaded from the Settings page. The installer registers a scheduled job on the machine, so Agent Supply Chain Security scans run on their own schedule without needing MDM.

What
The ADS installer now ships as a signed macOS .pkg and Windows .msi, downloaded from the Settings page in Evo.

Why
Deployment no longer means wrapping a downloaded file in your own script, you now get a standard signed installer for macOS or Windows. The installer now stays on the machine in a predictable location. Scan timing is no longer tied to your MDM policy.

How
In Evo, open Settings, choose your products and select Save & Publish. Choose your operating system and architecture, select Download ADS Installer, install the package, then run the installer with your Tenant ID and push key. Your onboarding workflow, MDM policies, tenant and push key are all unchanged. Downloading the installer directly from the CDN remains available.

Things to know
Linux is unchanged. The command line install remains supported and is documented alongside the package flow.

For more information, see the documentation: https://docs.snyk.io/agent-security/evo-by-snyk/agentic-development-security-ads

We are pleased to announce Snyk CLI release, v1.1307.4

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• New experimental snyk studio command that sets up Snyk Studio in supported AI coding tools (Cursor, Claude Code, Codex, Copilot, Gemini, Kiro, and Windsurf), so the code they generate gets scanned in the background as it's written. This direct integration replaces the need for separate setup scripts (https://github.com/snyk/studio-recipes). Run snyk studio install --experimental to get started.

• New snyk fix --agentic filtering flags: --severity-filter to fix only the severities you choose, --breakability-filter to fix only Open Source upgrades with the breakability you choose, and --exclude-ids to fix everything except the issue IDs you list.

• snyk fix --agentic now keeps a failed fix's changes by default so you can review them, rather than reverting automatically. Pass --enable-revert to restore the automatic rollback behavior.

• Fixed an issue where the --iac, --docker, --container, and --code flags on snyk test could be silently dropped for organizations on the unified test API, causing scans to fall through to an open-source test instead (which could fail with "No supported files found" or scan the wrong target). These flags now route to the correct scan again.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Snyk Code priority scores dropped by up to 200 points on September 1, 2026, for findings whose rule had a fix example.

What changed

A finding used to earn 200 of the 1,000 available priority score points when Snyk held a fix example for its rule. The August 17, 2026 release retired fix examples, and the scoring factor went with them. The removal became live on September 1, 2026.

Why

Fix-example availability describes Snyk's content coverage. It says nothing about the risk in your code. Two findings of the same severity could sit 200 points apart because one rule happened to have an example behind it. Priority score should rank findings by how urgently they need fixing, so we removed the factor.

What you saw

Snyk Code findings reordered when the factor came out. Every remaining scoring factor works as it did before, including severity, which still contributes the largest single share at up to 500 points. No finding was added, removed or re-rated.

We should have told you

The August 17 release notes said no action was required. That was wrong, and we apologize. We have added a check so that any future change to priority score appears in the release notes. The priority score documentation now lists the current factors.

Learn more in the Snyk Code priority score documentation.

Atlassian ends support for Atlassian Connect in December 2026. Snyk for Jira has been rebuilt on Forge, Atlassian's current cloud app platform, with all of the same functionality.

No action is required. New installations use the Forge version from September 30, 2026, and existing installations will be migrated during October. Permissions, configuration, ticket creation, and existing Jira issues all carry over unchanged.

For more information, see Snyk for Jira documentation.