Product Updates

Starting November 11, 2026, Snyk API & Web’s Azure DevOps Boards integration authenticates through Microsoft Entra ID instead of Azure DevOps OAuth. Nothing changes in how you use the integration. Only the sign-in and token handling behind it are replaced.

Microsoft is retiring Azure DevOps OAuth on December 1, 2026. Moving to Entra ID keeps your integration working after that date.

If your Snyk API & Web account has the Azure DevOps Boards integration setup, you’ll need to reconnect it once, by November 30, 2026.

Reconnecting keeps your existing setup. Your target settings, the links between findings and Azure DevOps work items, and the work items already created are all preserved. You don’t need to reconnect individual targets.

To keep your setup intact, select Reconnect, not Delete, and keep the same Azure DevOps organization. Deleting the integration or changing the organization removes all target connections, and you’d have to set them up again.

Snyk Continuous Offensive Security can now assess applications that are only reachable inside your own network. Create a Customer Gateway from the CLI or from Settings and run it in your environment with Docker, Kubernetes, or the CLI. The gateway establishes a secure connection between Snyk and your internal infrastructure allowing us to assess your applications.

Assessment depth is the same as for a public target: every authentication method works through the gateway, and greybox assessment is available when repositories are linked.

To learn more, visit Customer Gateway in our user documentation.

Snyk’s pURL API now recognizes Broadcom Tanzu Spring’s enterprise (“commercial”) Spring builds as fixed, not just the open source versions published to Maven Central, for mutual customers who hold a Broadcom Tanzu Spring Enterprise subscription.

Broadcom issues these builds to subscribers, and they contain security fixes for release lines that aren’t publicly patched yet, as well as fixes that will be included in an upcoming open source release. 

Previously, Snyk assessed Spring packages against the open source vulnerable ranges alone, so a version already patched through a Broadcom subscription could still be reported as vulnerable.

Customers with an active Broadcom Tanzu Spring Enterprise subscription using the pURL API will get more accurate results: querying a commercial package version that already has a fix will now correctly recognize it as resolved. No configuration changes are required.

Getting access

Customers with an active Broadcom Tanzu Spring Enterprise subscription who use the pURL API (GET /POST). 

Access is enabled per organization - contact your Snyk account team with the organization(s) to be enabled, and Snyk will enable access once eligibility is confirmed.

Why this matters

Improves vulnerability accuracy by reducing false positives, helping security teams focus on real, unresolved risk.

If you have questions about this change, please reach out to the Snyk Support team. To learn more, see the Enterprise / Commercial Support: Broadcom Tanzu Spring commercial fixes section of the Snyk documentation.

The Kubernetes connector for Insights, the agent (kubernetes-scanner) you deploy in your clusters to send workload configuration to Snyk, is reaching end of life.

What it did: the connector collected the list of images deployed in your clusters (with their IDs and SHAs) and the configuration of your services, such as networking. Snyk Insights used that information to understand what is deployed and which workloads are publicly accessible.

Snyk Insights has since been retired, and nothing in Snyk uses this data anymore.

On Nov 2nd 2026 , Snyk will stop accepting data from the connector. After that date, kubernetes-scanner will log errors when it tries to send data.

The Kubernetes integration (Snyk Controller, also called snyk-monitor) is a separate component and is not affected by this change.

The connector existed to feed Snyk Insights. Since Insights has been retired, the data the connector sends is no longer used, so we are retiring the service that receives it.

Customer's impact:

If you do not run the Kubernetes connector, nothing changes for you.

If you run the Kubernetes connector, After November 2nd, kubernetes-scanner will log errors because Snyk no longer accepts its data. We recommend uninstalling kubernetes-scanner from your clusters in advance to avoid those errors and to free the resources it uses. You can also remove the service account and custom role you created for it.

Read more about it: Kubernetes Connector Documentation

We're happy to announce that we now support Python 3.15. Following its release on October 9, 2026, this support is now generally available (GA). You can now scan your Python 3.15 projects using both the command line interface (CLI) and your source control manager (SCM) integrations.

Python remains one of the most popular and widely used development ecosystems today. To continue supporting the Python community, Snyk now enables you to scan and secure your projects using the latest version of Python.

You can now import and scan your Python 3.15 projects from the CLI or your connected SCM. Please remember: if your project does not have a Python version specified, you need to configure it in the UI to use Python 3.15.

To learn more, visit Snyk for Python in our user documentation.

Snyk API & Web now extends its security header, cookie attribute, and SSL/TLS checks to the Extra Hosts of a target. These checks, which include findings such as "HSTS header not enforced" and "Missing Content Security Policy header", already run against one endpoint of the target URL. As of today, each scan also runs them against one endpoint of every Extra Host configured on the target.

Targets often serve content from more than one host, and each of those hosts is part of the target's overall security posture. By applying these checks to every host configured on a target, each scan now gives you a fuller view of that posture.

With this change, scans of targets with Extra Hosts report security header, cookie attribute, and SSL/TLS findings for those hosts as well, giving you a more complete picture of the target. Because these hosts are now checked, you may see new findings on a target's next scan, even if nothing has changed on the target itself. There is nothing for you to set up: the checks apply automatically to every target with Extra Hosts configured.

If you have any questions about your scans, please reach out to Support.

We are pleased to announce Snyk CLI release, v1.1308.3

Following the compromise of eMudhra intermediate certificate authorities, we strongly advise all customers to upgrade to Snyk CLI v1.1308.3 or later.

This release includes a security update that blocks trust in the affected certificates. Earlier versions may accept forged certificates, potentially allowing an attacker able to intercept network traffic to impersonate a trusted service and read or modify CLI communications.

Please update CLI installations across developer machines, CI/CD pipelines, container images, and elsewhere.

Customers running the legacy CLI exclusively through Node.js should upgrade the Node.js runtime used to execute the CLI to a version that addresses this issue.

This update includes the following:

• Fixed vulnerabilities:

  • Updates the embedded Node.js runtime to 22.23.4 to address CVE-2026-105481, CVE-2026-105482, CVE-2026-106069, CVE-2026-106073, CVE-2026-106074, and CVE-2026-111497

  • Updates the toml library used by snyk fix for Poetry projects to 5.0.1 to address CVE-2026-114141, CVE-2026-114142, CVE-2026-114143, and CVE-2026-114144

To learn more please reference the full release notes. If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

We are pleased to announce Snyk CLI release, v1.1308.2

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• .NET scans no longer fail with NETSDK1067 when SelfContained=true is set in the build environment.

• snyk test --source-dir now returns a clear validation error when used without --reachability=true, instead of ignoring the flag or treating the path as the project directory.

• snyk test --fail-on=patchable now works as expected, rather than failing with an "Unsupported value 'patchable'" error.

• Smoother authentication and scanning in the IDE through Snyk Language Server fixes: an expired token now shows a single re-authenticate prompt instead of several, signing in from one IDE window now signs in your other open windows, and when showing only net new issues the IDE finds the base branch from origin/HEAD and asks you to pick one if none is found, instead of reporting a failed scan.

• Updates the Go runtime to 1.26.10.

• Fixed vulnerabilities:

  • SNYK-JS-TAR-18319500

  • CVE-2026-33532

  • CVE-2026-73055

  • CVE-2026-78663

  • CVE-2026-78669

  • CVE-2026-111943

  • CVE-2026-78659

  • CVE-2026-78660

  • CVE-2026-97032

  • CVE-2026-102941

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

What Changed?

You can now set how often Snyk scans your repositories for secrets using Repo Monitor Configuration .

In "Inventory -> repository -> Settings" or in bulk via "Inventory -> Configure Monitoring", choose Daily, Weekly or Never for Secrets. Set it for a single repository or for many repositories at once.

Secrets also now appear in Inventory. In the All Assets view, each repository shows its Secrets coverage control, the Snyk Projects that contain Secrets results, and the Secrets issues found.

Prerequisites

• Repo Monitor Configuration (EA) enabled via Snyk Preview (for Secrets test configurations)

We are pleased to announce Snyk CLI release, v1.1308.1

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• snyk test --html and --html-file-output no longer require preview features to be enabled, making HTML reports available to everyone.

• The project name is now consistently displayed in the snyk test summary when available.

• Fixed vulnerabilities:

  • CVE-2022-21681

  • CVE-2026-56866

  • CVE-2026-78659

  • CVE-2026-78667

  • CVE-2026-94439

  • CVE-2026-94440

  • CVE-2026-97031

  • CVE-2026-97032

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.