Product Updates

We are excited to announce the Early Access launch of Breakability Analysis for Snyk Pull Requests, furthering our mission to help developers fix vulnerabilities without slowing down innovation.

We understand that the "fear of breaking the build" is a major blocker to keeping dependencies up to date. Updating a library to fix a security issue shouldn't feel like a gamble. That’s why we have introduced a new predictive risk assessment to help you distinguish between a quick fix and a complex upgrade.

Starting today via Snyk Preview, Snyk will analyze proposed dependency upgrades and assign a Breakability (Merge) Risk Score directly within the PR description:

• 🟢 Low Risk (Safe to Merge): We have high confidence the upgrade contains only non-breaking changes (e.g., security patches or EOL runtime drops). These are strong candidates for auto-merging.

• 🟡 Medium Risk: Caution is advised due to ambiguous change log data or environmental factors.

• 🔴 High Risk (Action Required): We have identified likely breaking changes (e.g., API removals) that likely require code refactoring. These should be prioritized for a dedicated sprint.

This insight allows your team to burn down the backlog of "Low Risk" fixes quickly while preventing "High Risk" upgrades from silently breaking your builds.

This feature is available now in Early Access for supported ecosystems. You can enable it for your organization by navigating to Settings > Snyk Preview.

Read more about the assessment here.

Enjoy merging with confidence!

P.S. Please note that at this time, Breakability Analysis involves sending package information, including the current and proposed upgrade version, to an LLM. AI generated content may contain errors and should be reviewed for accuracy before use.

We’ve completed the migration of Snyk Advisor into security.snyk.io, bringing package intelligence directly into the security experience.

Package pages now include Snyk Advisor insights alongside vulnerability data, providing a more complete and consistent view of open-source package health.

What’s new

• Snyk Advisor metrics - Popularity, Maintenance, Security, and Community - now appear directly on package pages for supported ecosystems.

• Package health insights can be explored without leaving security.snyk.io.

• Advisor URLs now redirect to their corresponding package pages on security.snyk.io.
  

These updates make it easier to evaluate open source packages in context, supported by the same trusted data that powers Snyk Advisor.

To explore the updated experience, visit any package page on security.snyk.io. For more details, see Snyk Docs and the Blog post.

We are excited to share that we've made several improvements to how you test CycloneDX and SPDX SBOM files with Snyk, now available in Early Access for Snyk Open Source and Snyk Container.

These changes give you greater feature parity and a more consistent experience across your CLI testing workflows.

Here's what you can expect in Snyk CLI version 1.1302.0 and greater:

• The snyk sbom test command no longer requires the use of the --experimental option.

• You can now use previously unsupported options, including --severity-threshold, --reachability, --reachability-filter. These additions provide more granular control over your SBOM scanning results.

• Findings are returned by default in a human readable output and now include any applicable enrichments such as Reachability, Policy, Ignores, and Fix Advice.

• When you use the --json option, findings will be returned in a new JSON schema.

• We've also introduced clearer error messages, helping you quickly understand and resolve issues if Snyk is unable to test your SBOM file.

To minimize disruption to your workflows, we recommend reviewing your current integration and making any necessary changes prior to updating.

For those using Snyk CLI versions 1.1301.0 and below, the --experimental flag remains supported, and findings are returned in the previous format.

For more details, please refer to our User Docs.

We are pleased to announce the latest stable Snyk CLI release, v1.1302.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• Snyk Container

  • Support for OCI images with manifests missing platform fields

  • Container scan support for cgo and stripped Go binaries

  • Added pnpm lockfile support

• Snyk Open Source

  • Improved PackageURLs in SBOM documents for go.mod projects

  • Added support for deb, apk, and rpm in SBOM test

  • Added PackageURL information to go.mod dependency graphs for snyk test

  • Added support for poetry development dependencies

• Additional changes

  • MCP Scan is now part of the Snyk CLI, allowing you to test the supply chain of agent-based developer tools like Cursor and Claude Code.

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.

We're excited to announce a series of coverage and quality improvements for Snyk Open Source across several key developer ecosystems, rolling out over the coming weeks. Our goal is to help you secure your applications as you evolve and scale them, keeping pace with the latest releases and reliably scanning large, complex projects.

Improved SCA Coverage

We are committed to keeping up with the rapid pace of ecosystem updates. By broadening our support for the latest language versions and library structures, we help ensure your projects remain modern and protected without any friction.

Yarn 4

Snyk now supports Yarn 4 in both the CLI and the SCM integrations.

• Availability: CLI support is available on January 14 in version 1.1302.0, with a gradual SCM rollout throughout January.

• Note: Fix PRs and Upgrade PRs are currently not supported for Yarn workspaces.

• No action required: Projects that previously failed now successfully scan.

Ruby 4

Snyk now supports Ruby 4 in both the CLI and the SCM integrations.

• Availability: Support for both the CLI and SCM becomes available the week of January 21..

• No action required: Since the Ruby version is selected based on your Gemfile, no customer action is needed to begin using this.

PHP 8.5 & Swift 6.2

In addition to the above, we are pleased to announce upcoming support for PHP 8.5 and Swift 6.2 to ensure our users on the bleeding edge of these ecosystems remain secure.

Improved vulnerability coverage

We’ve enhanced our coverage for Go by adding vulnerabilities impacting packages in the Go Standard library to our vulnerability database. Previously, these vulnerabilities were not supported they are now detectable in both the CLI and SCM integrations.

• Availability: SCM and CLI support will become available throughout January.

Improved Quality

Beyond just supporting new versions, we are constantly refining our underlying scanning technology. These "under the hood" improvements focus on making scans faster and more resilient, especially for resource-intensive modern workloads.

Python (pip) Performance Improvements

We've introduced significant performance improvements for Python pip projects using SCM scanning. Previously, large projects—including those using AI and ML libraries such as pytorch—occasionally failed to resolve dependencies during scans. This problem has been resolved, helping you secure your Python applications.

• Availability: SCM rollout is happening throughout January, with CLI support following  in March.

We have released a new CLI hotfix (v1.1301.1) to address bugs and improve the overall user experience:

• Reachability

  • Fixed an issue in test, when using reachability, that caused the fix advice to display incorrectly on certain occasions

  • Resolved a monitor bug with double-dashed arguments when using reachability

• General improvements

  • Improved scanning speed when running test/monitor with reachability

  • Improved SCA scanning through MCP with fewer I/O operations

  • Fixed multiple issues to make Snyk work more smoothly in your code editor

  • Updated dependencies to improve stability and security

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk Support team.

We are excited to share that Reachability for Python will gradually enter General Availability (GA) across all Snyk environments during the period of December 11th, 2025 to January 12th, 2026.

What is Reachability?

If enabled for your Group or Org, Reachability works by scanning your source code and determining whether the code (e.g. a specific function) that makes a vulnerability exploitable is actually reachable, either directly or transitively.

This contextual risk factor can help you prioritize which issues to prevent or fix first, based on the exploitability risk they pose to your applications.

What's changing with this release?

With the GA release of Reachability for Python, Snyk will automatically detect the reachability of issues across all pip, pipenv, and poetry projects.

If you use Reachability today but have not opted into the Snyk Preview of Reachability for Python, you may notice changes in the Risk Score for issues in these projects due to the inclusion of the reachability risk factor.

You can also expect ongoing Reachability improvements to be released twice monthly for all languages in General Availability, helping to regulate false positives and negatives across your projects.

How do I get started?

Not using Reachability yet at all? You can read our User Docs to learn more about how to get started.

We're excited to announce support for .NET 10 for Open Source, which was released on November 11. This update ensures you can securely build and scan your newest .NET applications. We’ve added this support for scans using both our command line interface (CLI) and integrations with source code management (SCM) systems. This feature is now generally available (GA) and supported within our "Improved .NET scanning" capability.

The .NET ecosystem is a top priority for many developers and for us. We are committed to providing quick support for all new major releases, and this update continues that commitment. This allows you to adopt new technology without sacrificing security visibility.

All developers using .NET 10 can immediately begin scanning their projects using the Snyk CLI or their integrated SCM tools—no manual configuration or action is required to enable this feature. Please be aware that simply changing your .NET target framework does not automatically update the associated project dependencies.

Note that RestoreEnablePackagePruning flag introduced in .NET 10 prunes unused system packages from the project. Those dependencies can be including again by setting the RestoreEnablePackagePruning property to false in your project file or Directory.Build.props file.

To learn more, visit our Snyk User Documentation and for more information about see updating the projects, see this help article.

We’re pleased to announce that Reachability for Snyk CLI and CI/CD integrations is now available in Early Access for all Snyk Open Source customers.

As a refresher, Snyk’s Reachability analysis works by scanning your source code and determining whether the code that makes a vulnerability exploitable is reachable, either directly or transitively.

Starting today, you can now use Reachability with the latest Snyk CLI and CI/CD integrations to prevent these contextually relevant and higher risk issues from reaching production.

For more information on how to get started, please take a look our our User Docs.

We are pleased to announce the latest stable Snyk CLI release, v1.1301.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• Snyk Container: Container scanning now supports both Ubuntu Chisel images and zstd-compressed layers, as well as usr/lib JAR files via the `--include-system-jars` parameter.

• Snyk Open Source: Initial support for Maven 4 is available for Open Source's test, monitor and SBOM commands.

• Snyk Open Source: Reachability for Snyk CLI and CI/CD integrations is now available in Early Access for all Snyk Open Source customers.

• Snyk SBOM: A new experimental flag, `--include-provenance`, for Maven projects that includes verification checksums in SBOMs.

• Snyk Studio: Snyk Studio now supports writing scan output into a file, and Service Account support.

• Stability, security, and performance: This release also includes numerous bug fixes and enhancements to improve the overall stability, security, and performance of the CLI.

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team.

We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.