Product Updates

We're excited to share an improvement to our GitLab integration that ensures Snyk's Pull Request (PR) Check status always reports to the correct pipeline.

Previously, the PR Check status could appear on the wrong pipeline, especially with Merged Result Pipelines. This sometimes prevented GitLab's "Pipelines must succeed" feature from working correctly, potentially alowing insecure merges. With this update, you can now confidently set branch protection rules with Snyk PR Checks and merge with peace of mind.

• Enforce secure merges with confidence: Snyk PR Check status now correctly attaches to the highest-priority pipeline (Merge Result, Merge Request, or Branch). This ensures GitLab's merge gate always has Snyk scan results, so vulnerable code can be blocked reliably.

• Improved clarity for developers: The Snyk status now attaches to the right pipeline, removing confusion about which pipeline reflects the security scan.

This improvement has been rolled out to all customers today, and no explicit action is required. For more details, check our user documentation.

We’ve added support for three new filters to the Export API to help you get more granular data exports. You can now filter your results by Project Tags, Project Type, and Snyk Product.

This update makes it easier to create customized reports and perform analytics by allowing you to filter large datasets based on your specific needs, such as a particular Snyk product or custom project tags.

You can now create more precise data exports for issues and usage events. The new Snyk Product filter supports:

• Snyk IaC

• Snyk Container

• Snyk Code

• Snyk Open Source

To learn more, visit Export API: Specifications, columns, and filters in our user documentation.

We’ve introduced a new is not filter option for Snyk reports, which lets you exclude unwanted items directly within the platform. This feature is now available across a wide range of filters, including groups, organizations, Common Vulnerabilities and Exposures (CVEs), package names, collections, tags, asset names, and owners.

Previously, you had to export Snyk report data and manually filter out unwanted items, which was time-consuming and inefficient. We've improved this by allowing you to exclude items within Snyk, giving you a focused view, and eliminating the need for manual data manipulation outside the platform.

You can now get to the insights you need faster and more efficiently. For example, you can exclude known, low-priority issues to focus on high-severity vulnerabilities, quickly find unassigned assets by filtering for is not, or exclude environments to only see issues related to production. To use the new feature, simply select the desired filter and choose the is not option before entering the value you wish to filter out.

To learn more, visit our user documentation.

We’ve released a new CLI hotfix (v1.1299.1) to address several bugs and improve the overall user experience.

This update includes the following:

• Language Server: We fixed the titles of Snyk Open Source actions in your IDEs to make them clearer.

• Snyk Code: The CLI SARIF outputs now include the missing uploadResults property.

• General: We fixed a bug that was breaking debug logs because of a redaction error.

As this is a targeted hotfix, no other changes in behavior or new features are expected.

Release notes are available here.

We encourage everyone to upgrade to the latest version to ensure stability and benefit from these important fixes.

If you have any questions, please don’t hesitate to reach out to the Snyk support team.

We have released a new version of our Visual Studio Code IDE plugin. This update addresses minor bug fixes and improvements, including:

• Updating the rules trigger for secure at inception workflows

• User documentation link fixes

• Direct publishing of Snyk IDE plugins to OpenVSX marketplaces, including preview versions

• Enabling OS quick fix actions by default

If you have any questions, feel free to reach out to the Snyk support team.

We’ve expanded the Featured Zero-Day Report to include the Shai-Hulud npm supply chain attack, one of the largest compromises in the npm ecosystem to date.

This update enables Enterprise users to:

• Identify exposure to compromised npm packages such as ngx-bootstrap and @ctrl/tinycolor.

• Prioritize remediation and monitor progress directly in the Featured Zero-Day Report.

• Improve visibility and accountability in zero-day response.

This addition strengthens visibility into high-impact zero-day events within Snyk Reports. By integrating the Shai-Hulud supply chain incident, customers can rapidly assess exposure, track remediation, and improve governance during ongoing threat response.

No manual action is required - data updates automatically as new advisories are published. However, running a new scan is recommended to ensure the latest results are reflected.

To learn more, visit the Featured Zero-Day Report documentation or read our blog post, Zero-day extensive NPM package compromise Shai Hulud Supply Chain Attack.

We heard your feedback that it can be hard to keep up with all the changes, so we've introduced new ways to help you find the information that's most relevant to you.

You now see a Subscribe to RSS feed link if you prefer to be notified about every new product update as they are announced. On the left, you can filter product updates using tags like Open Source CLI or MCP to find exactly what you're looking for. We are looking to provide an email subscription service in the new year too.

We know how important it is for you to be aware of new features and changes that impact your work. Our goal is to give you more control and a better way to get the right information at the right time. We also want to ensure our communications are consistent with our Snyk brand for you to enjoy.

The product updates link in the Snyk user interface now takes you directly to this website The red notification dot on the bell icon, in the user interface, will be paused for approximately one week from today, before returning to its usual function of alerting you to new updates. We plan to introduce a search feature for this website in a later phase and we're assessing how best to surface product updates directly in our platform.

Users have reported having duplicated repository count in Inventory for their Azure DevOps repositories. Snyk has developed a fix for this issue which will be applied in all regions on September 17th. No action is required to apply the fix. Users affected by the duplications will see a corresponding decrease in their repository count in the Inventory.

For any questions, don't hesitate to reach out to the Snyk support team.

We’re pleased to announce that Issue Summary Comments and High-Context Inline Comments are now live and enabled by default for all customers using PR Checks with the following Source Code Manager (SCM) integrations:

• GitLab

• Azure Repos

• Bitbucket Server

What’s included:

• Issue Summary Comment for both successful and failed PR checks, covering Snyk Code and Open Source security & license findings.

• Inline Comments for Snyk Code findings, providing high-context feedback directly in the pull request.

To adjust your preferences, head over to Integration Settings in the Snyk UI where you can toggle comments on or off at any time. This release is a big step forward in our mission to make security native to the developer experience. Refer to the user documentation for more details.

At Snyk, our goal is to provide developers with the most secure and reliable tools. To deliver on that promise, we are focusing our support for Ruby Fix PRs on modern, actively supported versions of the language (3.1 and newer).

What's Changing?

As part of this focus, we will be ending support for creating Fix PRs for projects that use end-of-life (EOL) Ruby versions (those below 3.1)

This means that if you are using a Ruby version older than 3.1, you will no longer be able to automatically generate Fix PRs from Snyk.

Why We're Making This Change

• Focus on Security and Reliability: By concentrating on modern Ruby versions, we can ensure the quality and reliability of our Fix PRs, providing you with more accurate and secure fixes.

• Aligning with Ruby's Lifecycle: We're aligning our support with the official Ruby EOL schedule, ensuring that you're always working with supported and secure versions.

What This Means for You

• If you're using Ruby 3.1 or newer, there's no change for you. You will continue to receive Fix PRs as usual.

• If you're using a Ruby version older than 3.1, we encourage you to upgrade. This will not only allow you to continue using our Fix PR feature but also ensure you're benefiting from the latest security updates and performance improvements from the Ruby community.

Timeline

• October 1, 2025: End of Fix PR support for Ruby v2.3.

• February 1, 2026: End of Fix PR support for all Ruby versions below 3.1.

We're excited to continue improving Snyk for Ruby developers and helping you build secure applications.

If you're using Ruby 3.1 or newer, there's no change for you and you will continue to receive Fix PRs as usual. If you're using an older version, we encourage you to upgrade. This will allow you to continue using our Fix PR feature and benefit from the latest security updates and performance improvements from the Ruby community.

To learn more, visit our Snyk User Documentation.