Product Updates

Snyk’s pURL API now recognizes Broadcom Tanzu Spring’s enterprise (“commercial”) Spring builds as fixed, not just the open source versions published to Maven Central, for mutual customers who hold a Broadcom Tanzu Spring Enterprise subscription.

Broadcom issues these builds to subscribers, and they contain security fixes for release lines that aren’t publicly patched yet, as well as fixes that will be included in an upcoming open source release. 

Previously, Snyk assessed Spring packages against the open source vulnerable ranges alone, so a version already patched through a Broadcom subscription could still be reported as vulnerable.

Customers with an active Broadcom Tanzu Spring Enterprise subscription using the pURL API will get more accurate results: querying a commercial package version that already has a fix will now correctly recognize it as resolved. No configuration changes are required.

Getting access

Customers with an active Broadcom Tanzu Spring Enterprise subscription who use the pURL API (GET /POST). 

Access is enabled per organization - contact your Snyk account team with the organization(s) to be enabled, and Snyk will enable access once eligibility is confirmed.

Why this matters

Improves vulnerability accuracy by reducing false positives, helping security teams focus on real, unresolved risk.

If you have questions about this change, please reach out to the Snyk Support team. To learn more, see the Enterprise / Commercial Support: Broadcom Tanzu Spring commercial fixes section of the Snyk documentation.

We're happy to announce that we now support Python 3.15. Following its release on October 9, 2026, this support is now generally available (GA). You can now scan your Python 3.15 projects using both the command line interface (CLI) and your source control manager (SCM) integrations.

Python remains one of the most popular and widely used development ecosystems today. To continue supporting the Python community, Snyk now enables you to scan and secure your projects using the latest version of Python.

You can now import and scan your Python 3.15 projects from the CLI or your connected SCM. Please remember: if your project does not have a Python version specified, you need to configure it in the UI to use Python 3.15.

To learn more, visit Snyk for Python in our user documentation.

We are pleased to announce Snyk CLI release, v1.1308.2

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• .NET scans no longer fail with NETSDK1067 when SelfContained=true is set in the build environment.

• snyk test --source-dir now returns a clear validation error when used without --reachability=true, instead of ignoring the flag or treating the path as the project directory.

• snyk test --fail-on=patchable now works as expected, rather than failing with an "Unsupported value 'patchable'" error.

• Smoother authentication and scanning in the IDE through Snyk Language Server fixes: an expired token now shows a single re-authenticate prompt instead of several, signing in from one IDE window now signs in your other open windows, and when showing only net new issues the IDE finds the base branch from origin/HEAD and asks you to pick one if none is found, instead of reporting a failed scan.

• Updates the Go runtime to 1.26.10.

• Fixed vulnerabilities:

  • SNYK-JS-TAR-18319500

  • CVE-2026-33532

  • CVE-2026-73055

  • CVE-2026-78663

  • CVE-2026-78669

  • CVE-2026-111943

  • CVE-2026-78659

  • CVE-2026-78660

  • CVE-2026-97032

  • CVE-2026-102941

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

We are pleased to announce Snyk CLI release, v1.1308.1

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• snyk test --html and --html-file-output no longer require preview features to be enabled, making HTML reports available to everyone.

• The project name is now consistently displayed in the snyk test summary when available.

• Fixed vulnerabilities:

  • CVE-2022-21681

  • CVE-2026-56866

  • CVE-2026-78659

  • CVE-2026-78667

  • CVE-2026-94439

  • CVE-2026-94440

  • CVE-2026-97031

  • CVE-2026-97032

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

We are pleased to announce the latest stable Snyk CLI release, v1.1308.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• HTML Reports

  • snyk code test and snyk secrets test can now generate an HTML report. Use --html to print it to stdout, or --html-file-output=<path> to write it to a file. This replaces the need for a separate snyk-to-html tool in most cases. Support for snyk test will be available in v1.1308.1.

• Agent Scan (experimental)

  • The experimental snyk agent-scan command now reports risk indicators instead of issue codes. If you post-process its --json output, update your scripts to the new format.

• Additional Reliability and Performance Improvements

  • Maven and Gradle SBOMs, and --print-graph, no longer stall on large multi-module builds and now finish seconds after the build tool exits. On projects with dependency cycles, the output may contain extra pruned: cyclic placeholder nodes. No packages or dependency edges are dropped.

  • Gradle projects with very deep inter-module dependency chains no longer fail with a stack overflow.

  • Projects built with Gradle 4.0 to 4.6 no longer fail to scan.

  • .NET scans fall back to legacy scanning when the .NET SDK isn't installed. They also handle projects restored in a different build directory, and work when global NuGet source-mapping rules are configured.

  • .NET scans no longer fail with NU1101 on SDK installs that lack the app host pack, such as distro-packaged SDKs.

  • .NET projects whose PackageReference uses a lowercase version attribute are now parsed correctly.

  • Updates dependencies to fix vulnerabilities

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.

We are pleased to announce Snyk CLI release, v1.1307.3

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• snyk test now reports an unreadable .snyk policy file as SNYK-POLICY-0002 with a message identifying the problem, instead of an unspecified error.

• snyk test --all-projects now resolves each project's .snyk policy from that project's own directory, instead of applying the scan root's policy to every project.

• snyk test --scan-all-unmanaged no longer fails with exit code 2 when scanning a directory of JARs with no manifest file.

• Fixed vulnerabilities:

  • CVE-2026-63376

  • CVE-2026-77465

  • SNYK-JS-ADMZIP-19846655

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

We are pleased to announce Snyk CLI release, v1.1307.1

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• snyk test again reports SNYK-CLI-0008 and exits with code 3 when a repository contains no supported manifest files, instead of a generic SNYK-CLI-0000 with exit code 2. snyk test --json writes the error document to stdout as expected.

• Restored the moduleName, insights.triageAdvice, and functions_new fields in snyk test --json output, so tooling that consumes those fields works as before.

• .snyk policy files are now handled correctly in the unified test flow. This covers empty, whitespace-only and comment-only policies, date-only timestamps, and other edge cases that could previously cause incorrect results or failures.

• Commands that complete with findings (exit code 1) no longer produce duplicate or corrupt JSON output when an unrelated network error occurs during the run, improving reliability for automated pipelines that parse CLI output.

• The debug-log scrubber now masks secrets consistently and no longer corrupts the surrounding JSON structure, making debug logs safer to share and easier to parse.

• Container scans now surface source repository information for locally built images using BuildKit metadata.

• Fixed vulnerabilities:

  • CVE-2022-25883

  • CVE-2026-84304

  • CVE-2026-84375

  • SNYK-GOLANG-GOLANGORGXCRYPTOSSH-19504090

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

We are pleased to announce the latest stable Snyk CLI release, v1.1307.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• Secrets

  • snyk secrets test now supports exclusions — add files or paths to the exclude section of your .snyk file to skip them during secrets scanning.

• Container

  • Container scans now surface image provenance attestations by default, so signed-image provenance metadata appears in results without any extra flag.

• .NET/NuGet

  • snyk test can now analyze already-restored .NET/NuGet projects fully offline and no longer requires .NET 6 to be installed.

• MCP

  • The full Snyk MCP profile now includes Snyk Secrets.

• Code & Secrets

  • SARIF suppressions now include reviewedOn and reviewedBy metadata.

• AI BOM

  • snyk aibom test --severity-threshold now filters the displayed and JSON results by severity, not only the exit code.

• Agent-optimized CLI

  • New experimental snyk agent command space — a scanning surface built for AI coding agents, with token-optimized output and ergonomics. snyk agent test runs Snyk Open Source, Code, and Secrets together.

• Additional Reliability and Performance Improvements

  • Adds support for scanning pnpm v11 pnpm-lock.yaml lockfiles.

  • Fixes a crash when scanning dependencies of Gradle 7.4–8.2 projects.

  • Fixes a bug where arguments after -- (for example snyk test . -- -s settings.xml) were treated as scan targets, which could silently drop the Risk Score.

  • Fixes scanning of projects using Hex versions newer than 1.19.

  • Excludes the .git folder from file discovery, preventing intermittent scan failures caused by changes to .git contents during a scan

  • Prevents a possible connection leak when the Snyk API returns an error response.

  • Updates dependencies to fix vulnerabilities.

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.

We are pleased to announce the latest stable Snyk CLI release, v1.1306.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• Doctor

  • Adds a new snyk doctor command, giving you a quick way to diagnose common CLI problems by generating a diagnostic report for your system or analyzing debug log output.

• Container

  • Container scans now detect the Java runtime version across a wider range of JVM base images, and can find vulnerabilities in .NET application dependencies.

• Snyk Studio MCP

  • The breakability evaluation tool in the Snyk MCP Server is now enabled by default and no longer requires an experimental flag.

• SCA Test

  • Improves dependency detection for Gradle projects.

• Additional Reliability and Performance Improvements

  • Shows a warning when a request is automatically retried due to rate limiting, instead of retrying silently.

  • Skips the reachability upload when no supported files are present, instead of failing.

  • Fixes dependency resolution for Swift Package Manager projects that reference packages by registry identity, so they're correctly matched to their GitHub source for vulnerability scanning.

  • Fixes scanning of sbt projects with custom Scala configurations.

  • Fixes a bug where scanning Yarn workspaces could report vulnerabilities from a workspace member's dev dependencies as production dependencies, when that member was consumed by a sibling package.

  • Updates dependencies to fix vulnerabilities.

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.

We've expanded Snyk Open Source coverage with improved scanning capabilities. These updates help you close security gaps and manage dependencies more effectively. Key improvements include new support for the uv package manager and enhanced Go scanning for private dependencies.

uv SCM support

The uv package manager is an emerging tool in the Python ecosystem. Following our earlier CLI release, uv is now available in SCM integrations. You can import uv projects and workspaces, use PR Checks, and monitor your code directly from your connected Git repositories. You do not need to use the CLI for these tasks. uv joins pip, Poetry, and Pipenv as the fourth Python ecosystem with native support in Snyk Open Source.

To get started, enable this feature for your Groups and Organizations in Snyk Preview. You can find more details in the Snyk documentation.

Improved Go scanning

Our Go scanning improvements are now generally available. This update features support for private dependencies. Go teams that use private module proxies, such as Artifactory or Nexus, or private repositories via Broker, can now achieve the same depth of scanning available for public modules.

This ensures you have no blind spots in your dependency graph when a module lives behind authentication. We support both brokered and direct connections across all SCM integrations. We are rolling this out to all users over the next two weeks. You can learn how to configure private dependencies in the Snyk documentation.