Product Updates

We are pleased to announce the latest stable Snyk CLI release, v1.1307.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• Secrets

  • snyk secrets test now supports exclusions — add files or paths to the exclude section of your .snyk file to skip them during secrets scanning.

• Container

  • Container scans now surface image provenance attestations by default, so signed-image provenance metadata appears in results without any extra flag.

• .NET/NuGet

  • snyk test can now analyze already-restored .NET/NuGet projects fully offline and no longer requires .NET 6 to be installed.

• MCP

  • The full Snyk MCP profile now includes Snyk Secrets.

• Code & Secrets

  • SARIF suppressions now include reviewedOn and reviewedBy metadata.

• AI BOM

  • snyk aibom test --severity-threshold now filters the displayed and JSON results by severity, not only the exit code.

• Agent-optimized CLI

  • New experimental snyk agent command space — a scanning surface built for AI coding agents, with token-optimized output and ergonomics. snyk agent test runs Snyk Open Source, Code, and Secrets together.

• Additional Reliability and Performance Improvements

  • Adds support for scanning pnpm v11 pnpm-lock.yaml lockfiles.

  • Fixes a crash when scanning dependencies of Gradle 7.4–8.2 projects.

  • Fixes a bug where arguments after -- (for example snyk test . -- -s settings.xml) were treated as scan targets, which could silently drop the Risk Score.

  • Fixes scanning of projects using Hex versions newer than 1.19.

  • Excludes the .git folder from file discovery, preventing intermittent scan failures caused by changes to .git contents during a scan

  • Prevents a possible connection leak when the Snyk API returns an error response.

  • Updates dependencies to fix vulnerabilities.

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.

Starting August 4, 2026, Snyk secrets scanner is generally available to help secure your entire SDLC against credential leaks.

Stolen credentials remain a leading initial access vector in security breaches, and the rise of AI-generated code increases the risk of exposing sensitive data. You can now use Snyk secrets scanner to detect hardcoded credentials, API keys, and tokens across your repositories and prevent them from reaching commits or being leaked.

Key capabilities include:

• Machine learning driven detection and prevention across your development surfaces.

• Secrets detection for both human-written and AI-generated code.

• Governance and finding management directly within the Snyk web UI.

For more information, please read the blog and Snyk Secrets documentation

Until now, a developer could suppress a Snyk Code finding on their own — directly in the Web UI or IDE — with no review step.

Suppression happened silently and unilaterally, leaving security teams without a gate on what got ignored.

Ignore Approval Workflow changes that.

An ignore is no longer applied automatically — it becomes a request that only takes effect after a reviewer approves it. Developers submit ignores from where they work; a reviewer approves or rejects from the web; both sides are notified of the outcome. Suppression moves from an ungoverned action to a reviewed, auditable one.

What you can do

• Submit ignore requests from the CLI, IDE, or API — a reason is required, and the ignore is created as Pending rather than applied.

• Review from the web — reviewers with the review permission approve or reject on the Ignore Requests page.

• Auto-approve your own — reviewers can bypass triage for ignores they create themselves.

• Stay notified — reviewers are emailed on new requests and requesters on the outcome.

• Control access with roles — read / create / edit / review / delete permissions; by default Collaborators request and Admins review, with custom roles supported.

• Audit everything — export ignore-request data via the audit-logs API.

We are thrilled to announce that the Prevention Report is now available in Early Access!

Measuring the true impact of "shifting left" has traditionally been a challenge. We designed the Prevention report to give you clear, actionable visibility into the effectiveness of security adoption directly within your development lifecycle.

This new report tracks the vulnerabilities developers proactively remediate at the point of creation in Snyk Code and Secrets—long before those issues ever reach a pull request or production environment. Data is seamlessly captured in the background as your team works across our developer surfaces, including Snyk Studio (MCP), IDE plugins and extensions, and the CLI.

The Prevention report enables you to:

• Measure proactive security: Track the total number of raw fixes and monitor your fix rate over time using our new prevention key performance indicators (KPIs).

• Analyze developer workflows: Break down fixes by surface area to understand exactly where your team prefers to resolve issues (MCP, IDE, or CLI).

• Identify trends and champions: Leverage the Fix-by-Developer leaderboard and detailed vulnerability breakdowns to see which types of vulnerabilities developers squash immediately, and which ones are detected but left unfixed.

• Enrich your Analytics Overview: Enable fix-by-surface KPIs and a new fix trends chart directly within your primary Analytics Overview dashboard for a comprehensive view of your security posture.

You can now directly measure the effectiveness of your IDE or MCP-based security efforts. By tracking vulnerabilities remediated early in the development lifecycle, you gain the data needed to prove the success of your security programs and validate your application security strategy.

To learn more, visit our Snyk User Documentation.