Showing 311 - 320 of 447 updates
We have enhanced Snyk Container's public base image recommendation logic to provide more precise minor, major, and alternative upgrade options, based on the origin repo, flavor, and version of the detected base image. You should start seeing the new upgrade logic as early as November 8, 2024 (with a gradual rollout). If you have questions, please reach out via your account team or support.
Neha Shenoy | Senior Product Manager
Looking for content to train your developers on using Snyk in the IDE? Already a Snyk IDE Pro and want to know how the new features can assist you?
The Snyk Learn team is proud to announce the release of brand new Using Snyk in an IDE courseware. This will assist users in setting up the plugin, authenticating it, and initial configuration.
An important new section demonstrates how the new filter “Net new issues vs all Issues”, coupled with product and severity filters, can be utilized for different workflows such as triage, investigating an issue, or focusing on investigating and fixing only the issues that you are responsible for.
We’re also proud to highlight the new capabilities with DeepCode AI Fix!
We're thrilled to announce an upcoming update to Snyk Code, to be released on Wed, November 13th where we will be adding support for the popular Gin framework for Go! 🚀
This update will allow teams to identify and address potential security vulnerabilities in Gin-based applications and will apply to all rules supported today.
For more details, please reach out to your account team with any questions.
In order to safeguard the security of our services and our customers, Snyk has begun the deprecation of its integration with AWS CodePipeline.
Action Required: To minimize disruption, we recommend that you transition to using AWS CodeBuild and the Snyk CLI as an alternative which will support the same use case and functionality.
Migration Timeline: Effective Oct 30th, 2024, you will no longer be able to add or modify the Snyk plug-in for new or existing pipelines. Existing pipelines will continue to work as-is for 6 months, though we recommend migrating to the new process as soon as possible. To avoid disrupting your CI/CD workflows, you must transition to the Snyk CLI before April 30, 2025. Please refer to the steps in this migration guide to use Snyk CLI with AWS CodeBuild.
We are confident that AWS CodeBuild and the Snyk CLI will meet your requirements.
Mayank Khera | Senior Product Manager
We're excited to announce an improvement to Snyk Code's reporting of Open Redirect vulnerabilities, to be released on Wed, November 6th.
Previously, Open Redirect issues in C# and VB.NET were categorized as high severity, while other languages reported them as Medium severity. Additionally, the descriptions for these vulnerabilities may have varied across languages.
To enhance consistency and provide a better user experience, we've made the following changes:
Consistent Severity: Open Redirect vulnerabilities will now be reported as medium severity across all languages, including C#, VB.NET
Standardized Descriptions: The descriptions for Open Redirect issues will be standardized to ensure clarity and consistency
If you have any questions, please reach out to your account teams.
We are excited to announce that DeepCode AI Fix in the IDE is now GA. As of October 29th, DeepCode AI Fix is available to be turned on at Group/Organization level from:
Settings -> DeepCode AI Fix
The GA release reflects the maturity of DeepCode AI Fix and Snyk's confidence in the fixes it generates and the customer experience. This release has the following improvements based on customer feedback collected throughout the Early Access phase:
Increased coverage of languages from 1 to 8 - with JavaScript, TypeScript, Java and Python being GA and the rest in limited support
New improved IDE experience for VS Code and JetBrains IDEs
Upgraded our internal LLM to improve fix quality and continue to improve quality through labelling and new training methods
Improved our infrastructure to provide faster fixes at scale
You can learn more about DeepCode AI Fix in user documentation and blog post.
We’re excited to announce the introduction of the Cluster Name attribute for image assets in Asset Inventory. This feature enhances visibility into the clusters where runtime images are deployed, streamlining the management of asset security.
What is this feature about?
The new Clusters attribute will automatically capture and display the names of all clusters where an image is deployed. Users can now filter images based on these clusters, making it easier to locate and address security issues. Additional metadata, including timestamps and source information, will also be available for deeper insights.
This feature will be accessible to AppRisk Pro customers. For more details, please refer to our user documentation or reach out to your account team with any questions.
Itay Maor | Senior Manager, Product
We are pleased to announce the latest stable releases for:
As part of these releases, we are happy to conclude the work announced previously:
In addition to significant features, these releases contain multiple fixes. The most important are:
Significantly reduced memory consumption by Snyk Language Server
Improved error handling of particular edge cases of Open Source analysis
Unified and Improved rendering of Issue details panel
Snyk documentation for VS Code and JetBrains were updated to reflect these improvements.
We encourage everyone to upgrade to the newest versions.
We are pleased to announce the latest stable Snyk CLI release v1.1294.0.
We are introducing the following new features in this version. To learn more about bug fixes beyond what is highlighted below, please reference the release notes.
CycloneDX 1.6 SBOM support This new version now supports generating CycloneDX 1.6 SBOMs using the snyk sbom command, providing you with more comprehensive and detailed information about your software components and their dependencies. Read more about the CycloneDX version announcement here.
Improved CLI monitoring of large Cocoapods projects
When doing a snyk monitor on very large Cocoapods applications, the CLI sometimes returned an Invalid String OOM error and the operation would fail. Although this error was rare, we have fixed it so large Cocoapods applications can now be monitored successfully.
Fix for security issue
The Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted (PHP|Gradle) project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk always recommends not scanning untrusted projects.
You can learn more about Snyk CLI release channels in user documentation.
Ezra Tanzer | Director, Product Management
Effective October 23rd, we will release new versions of Snyk IDE plugins for VS Code and JetBrains, with the possibility of seeing only newly introduced issues.
This functionality will reduce noise for developers and allow them to focus on their current changes. Developers will prevent issues early, thus unlocking their CI/CD pipeline and speeding up delivery.
A new IDE plugin setting will control this behavior. In this release, it will be turned off by default, so manual action is required to turn it on.
The logic uses a local Git repository and shows the difference between current findings minus those in a base branch.
Supported Snyk products: Code, Open Source, IaC