Product Updates

This update will be available on October 26, 2026.

Snyk Code reports significantly more findings in this update. Affected projects will report the additional findings on their next scan.

Snyk Code now analyzes more deeply and more accurately in Java, Kotlin, Go, TypeScript, JavaScript, Python, C#, PHP and Ruby.

Go, TypeScript and JavaScript

Snyk Code reads the Project's own configuration to resolve imports. For Go, it reads go.mod, which defines the module path that a project's packages import each other through. For TypeScript and JavaScript, it reads tsconfig.json and jsconfig.json, which define path aliases.

As a result, Snyk Code now analyzes these projects more accurately and with greater depth.

PHP

Snyk Code corrects boolean typing in PHP analysis. Previously skipped findings now appear across cross-site scripting, path traversal, SQL injection and other checks.

Java

Coverage is added or improved for these libraries:

• Spring Data MongoDB

• AWS SDK for Java, DynamoDB

• AWS SDK for Java 2.x, DynamoDB

• AWS SDK for Java 2.x, DynamoDB Enhanced Client

• Apache Commons FileUpload

Snyk Code adds a Mass Assignment rule for Spring applications. It reports request data that binds directly onto a database entity. Path traversal detection is wider.

More detection

Snyk Code reports additional findings in these areas:

• Python: XML external entity injection.

• JavaScript: deserialization, XML external entity injection and zip slip.

• JavaScript, Bootbox: DOM-based cross-site scripting.

• JavaScript, d3: DOM-based cross-site scripting.

• C#: path traversal.

• Go: SQL injection.

• Go, AWS SDK for Go v2: path traversal through S3 object keys.

• Ruby: path traversal, and a new server-side request forgery rule.

Template file analysis and serverless analysis

Snyk Code analyzes template files and serverless applications more accurately and with greater depth, building on the September update. Both will yield additional findings in projects that use template engines or serverless frameworks.

Learn more in the Snyk Code documentation.

Snyk Code priority scores dropped by up to 200 points on September 1, 2026, for findings whose rule had a fix example.

What changed

A finding used to earn 200 of the 1,000 available priority score points when Snyk held a fix example for its rule. The August 17, 2026 release retired fix examples, and the scoring factor went with them. The removal became live on September 1, 2026.

Why

Fix-example availability describes Snyk's content coverage. It says nothing about the risk in your code. Two findings of the same severity could sit 200 points apart because one rule happened to have an example behind it. Priority score should rank findings by how urgently they need fixing, so we removed the factor.

What you saw

Snyk Code findings reordered when the factor came out. Every remaining scoring factor works as it did before, including severity, which still contributes the largest single share at up to 500 points. No finding was added, removed or re-rated.

We should have told you

The August 17 release notes said no action was required. That was wrong, and we apologize. We have added a check so that any future change to priority score appears in the release notes. The priority score documentation now lists the current factors.

Learn more in the Snyk Code priority score documentation.

Starting August 4, 2026, Snyk secrets scanner is generally available to help secure your entire SDLC against credential leaks.

Stolen credentials remain a leading initial access vector in security breaches, and the rise of AI-generated code increases the risk of exposing sensitive data. You can now use Snyk secrets scanner to detect hardcoded credentials, API keys, and tokens across your repositories and prevent them from reaching commits or being leaked.

Key capabilities include:

• Machine learning driven detection and prevention across your development surfaces.

• Secrets detection for both human-written and AI-generated code.

• Governance and finding management directly within the Snyk web UI.

For more information, please read the blog and Snyk Secrets documentation

Until now, a developer could suppress a Snyk Code finding on their own — directly in the Web UI or IDE — with no review step.

Suppression happened silently and unilaterally, leaving security teams without a gate on what got ignored.

Ignore Approval Workflow changes that.

An ignore is no longer applied automatically — it becomes a request that only takes effect after a reviewer approves it. Developers submit ignores from where they work; a reviewer approves or rejects from the web; both sides are notified of the outcome. Suppression moves from an ungoverned action to a reviewed, auditable one.

What you can do

• Submit ignore requests from the CLI, IDE, or API — a reason is required, and the ignore is created as Pending rather than applied.

• Review from the web — reviewers with the review permission approve or reject on the Ignore Requests page.

• Auto-approve your own — reviewers can bypass triage for ignores they create themselves.

• Stay notified — reviewers are emailed on new requests and requesters on the outcome.

• Control access with roles — read / create / edit / review / delete permissions; by default Collaborators request and Admins review, with custom roles supported.

• Audit everything — export ignore-request data via the audit-logs API.

We are thrilled to announce that the Prevention Report is now available in Early Access!

Measuring the true impact of "shifting left" has traditionally been a challenge. We designed the Prevention report to give you clear, actionable visibility into the effectiveness of security adoption directly within your development lifecycle.

This new report tracks the vulnerabilities developers proactively remediate at the point of creation in Snyk Code and Secrets—long before those issues ever reach a pull request or production environment. Data is seamlessly captured in the background as your team works across our developer surfaces, including Snyk Studio (MCP), IDE plugins and extensions, and the CLI.

The Prevention report enables you to:

• Measure proactive security: Track the total number of raw fixes and monitor your fix rate over time using our new prevention key performance indicators (KPIs).

• Analyze developer workflows: Break down fixes by surface area to understand exactly where your team prefers to resolve issues (MCP, IDE, or CLI).

• Identify trends and champions: Leverage the Fix-by-Developer leaderboard and detailed vulnerability breakdowns to see which types of vulnerabilities developers squash immediately, and which ones are detected but left unfixed.

• Enrich your Analytics Overview: Enable fix-by-surface KPIs and a new fix trends chart directly within your primary Analytics Overview dashboard for a comprehensive view of your security posture.

You can now directly measure the effectiveness of your IDE or MCP-based security efforts. By tracking vulnerabilities remediated early in the development lifecycle, you gain the data needed to prove the success of your security programs and validate your application security strategy.

To learn more, visit our Snyk User Documentation.

New Model & New Architecture

We're happy to announce we're upgrading Agent Fix to use the Claude family of models enhanced by Snyk's tooling and intelligence. This move delivers the following major improvements:

Security & Functional Enhancements

• Agentic Retries: Our new workflow now detects where code suggestions deviate from security best practices. Instead of discarding the result, the system analyzes the failure and injects tailored guidance into the agent's subsequent attempts. 

• Dynamic Few-Shot Prompting: We now use the same training set used to fine-tune our internal model to dynamically provide secure fix examples for the new model to follow. 

Expanded Support

• Full Language Coverage: We will enable support for all Snyk Code languages on Day 1, removing previous limitations on language availability.

• Comprehensive Rule Support: AI-powered fixes are now available for all supported rules and vulnerability types across the platform.

Measurable Impact

• Golden Test Benchmark: Both Sonnet 4.6 and Opus 4.6 saw improved performance against Snyk’s Golden Test benchmark (72.4% to 82.5% and 74.6% to 85.4% respectively) with this new architecture vs. the models on their own.

Check out the blog for more details. This update started rolling out on May 26th and will reach 100% by end of day on May 28th.

We are pleased to announce the release of new stable versions for our IDE plugins.
The new versions are:

• Visual Studio Code v2.31.0

• JetBrains v2.21.0

• Eclipse v3.9.0

• Visual Studio v2.9.0

This release is focused on enhancing stability and reliability, with key updates including:

• Fixed download URL fallback when the CLI is not found

• Fixed race conditions in authentication flows

• Added support for JetBrains 2026.1

Along with additional bug fixes, security updates, and improvements.

Please refer to the changelog for each of our plugins for a more detailed list of additional bug fixes and enhancements. You can learn more about the Snyk IDE plugins in our Learn resources.

If you have any questions, feel free to reach out to the Snyk Support team.

Python is at the heart of the modern AI revolution but for many developers the packaging ecosystem has felt like a bottleneck: burdened by slow installs and fragmented tooling. The emergence of uv has changed that, offering a high-performance alternative that has quickly become the industry standard.

Today, we are excited to announce that Snyk is bringing native support for uv to the Snyk CLI, IDE, and GitHub Actions. This integration ensures that teams can embrace the speed of uv without ever having to trade off on security.

With this update, Snyk enables you to seamlessly integrate uv security scanning directly into your existing Snyk workflows, wherever you are using the CLI.

What’s supported?

Native uv support is currently in Early Access. During this phase, you can use the following commands to secure your uv projects via the CLI:

• snyk test: Scan your uv dependencies for known vulnerabilities.

• snyk monitor: Continuously monitor your project and receive alerts for new risks.

• snyk sbom: Generate a Software Bill of Materials for your uv-based applications.

In addition to the CLI, this support extends to the Snyk IDE extensions, MCP server, and GitHub Actions, providing security coverage wherever you code.

Getting started

If you were part of the closed beta, you can begin using these features immediately on the latest stable release of the CLI (v1.1304). Otherwise, please enable the preview by navigating to the Snyk UI and toggle the feature under Snyk Preview.

What’s next?

We are committed to full-ecosystem support for uv. While this release focuses on the CLI and developer tools, SCM support will follow in the upcoming months.

Documentation

Please see the documentation for more information.

We have released a new version of our Visual Studio Code IDE plugin. This update addresses minor bug fixes and improvements, including:

• Addresses an issue where the CLI installation warning was incorrectly displayed despite the CLI being installed and the plugin functioning correctly.

If you have any questions, feel free to reach out to the Snyk support team.

We have released a new CLI hotfix (v1.1303.1) to address the following:

• IDE plugins: Fixes an issue where customers using our most recent IDE plugins release may encounter scans not triggering when Snyk Code is enabled in their IDE settings

• UI: Fixes an issue where JSON output was rendered twice to disk and to standard output

• MCP: Fixes an issue where Snyk rules were not written locally

Release notes can be found here.

If you have any questions, please don’t hesitate to reach out to the Snyk support team.