snyk.io updates

Support for Bruno Collections in API Targets

Natalia Yurchenko, Senior Product Manager — Wed, 07 Jul 2027 23:00:00 GMT

Snyk API & Web now provides native support for Bruno collections. You can import your collections directly into the platform to create API Targets without converting files to Postman collections or OpenAPI schemas first.

Announcing Snyk CLI v1.1306.0

Matt Dolan, Senior Product Manager — Thu, 09 Jul 2026 12:30:00 GMT

We are pleased to announce the latest stable Snyk CLI release, v1.1306.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

Doctor
- Adds a new snyk doctor command, giving you a quick way to diagnose common CLI problems by generating a diagnostic report for your system or analyzing debug log output.
Container
- Container scans now detect the Java runtime version across a wider range of JVM base images, and can find vulnerabilities in .NET application dependencies.
Snyk Studio MCP
- The breakability evaluation tool in the Snyk MCP Server is now enabled by default and no longer requires an experimental flag.
SCA Test
- Improves dependency detection for Gradle projects.
Additional Reliability and Performance Improvements
- Shows a warning when a request is automatically retried due to rate limiting, instead of retrying silently.
- Skips the reachability upload when no supported files are present, instead of failing.
- Fixes dependency resolution for Swift Package Manager projects that reference packages by registry identity, so they're correctly matched to their GitHub source for vulnerability scanning.
- Fixes scanning of sbt projects with custom Scala configurations.
- Fixes a bug where scanning Yarn workspaces could report vulnerabilities from a workspace member's dev dependencies as production dependencies, when that member was consumed by a sibling package.
- Updates dependencies to fix vulnerabilities.

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.

Snyk Open Source ecosystem coverage update

undefined, undefined — Sun, 28 Jun 2026 23:00:00 GMT

We've expanded Snyk Open Source coverage with improved scanning capabilities. These updates help you close security gaps and manage dependencies more effectively. Key improvements include new support for the uv package manager and enhanced Go scanning for private dependencies.

uv SCM support

The uv package manager is an emerging tool in the Python ecosystem. Following our earlier CLI release, uv is now available in SCM integrations. You can import uv projects and workspaces, use PR Checks, and monitor your code directly from your connected Git repositories. You do not need to use the CLI for these tasks. uv joins pip, Poetry, and Pipenv as the fourth Python ecosystem with native support in Snyk Open Source.

To get started, enable this feature for your Groups and Organizations in Snyk Preview. You can find more details in the Snyk documentation.

Improved Go scanning

Our Go scanning improvements are now generally available. This update features support for private dependencies. Go teams that use private module proxies, such as Artifactory or Nexus, or private repositories via Broker, can now achieve the same depth of scanning available for public modules.

This ensures you have no blind spots in your dependency graph when a module lives behind authentication. We support both brokered and direct connections across all SCM integrations. We are rolling this out to all users over the next two weeks. You can learn how to configure private dependencies in the Snyk documentation.

Snyk Code: July Release, C++ rules, Java library coverage, and JavaScript Insecure Transmission

Nina Kanti, Senior Product Manager — Fri, 26 Jun 2026 15:00:00 GMT

The July release expands Snyk Code coverage for C++ with several new rules and broader native C++ detection, improves detection for several popular Java libraries, and adds a new Insecure Transmission rule for JavaScript and TypeScript. These changes arrive with the July release on 13 July 2026

What's changing

New rules

Log Forging, C++ (CWE-117, high): flags untrusted user input reaching a logging sink, which can let an attacker forge or corrupt log entries.
Improper Privilege Management, C++ (CWE-269, high): flags a privilege-dropping call whose result is not verified; a failed call can leave the process running with elevated privileges.
Missing Authorization, C++ (CWE-862, CWE-732): flags overly permissive file permissions (world-writable or world-executable), and calls that pass root (UID or GID 0) to privilege-escalation or file-ownership functions.
SSL/TLS Certificate Verification Bypass, C++ (CWE-295, medium): detects disabled certificate verification across seven TLS frameworks (OpenSSL, Qt, mbedTLS, libcurl, Boost.Asio, libpq, libpqxx), which exposes connections to man-in-the-middle attacks.
Insecure TLS Configuration, C++ (CWE-327, high): detects insecure TLS configuration, such as enabling outdated TLS versions.
Sensitive Cookie Without Secure Attribute, C++ (CWE-614, low): flags cookies that omit the Secure attribute, either by default or explicitly set to false, leaving them exposed to man-in-the-middle attacks.
Insecure Transmission, JavaScript (CWE-319): detects cleartext transmission over insecure transports beyond HTTP. Initial coverage targets Redis clients (@redis/client, ioredis, redis) connecting over a non-TLS redis:// URL. New rule-key, separate from HttpToHttps.

New C++ coverage

Detection now extended to native C++ for:

Code Injection (CWE-94): across six framework modules: dlopen, LoadLibrary, Lua, CPython, Duktape, QuickJS.
Insecure Storage (CWE-922, info): sqlite, realm, leveldb, rocksdb, lmdb, Qt.
Insecure Cipher (CWE-327): broader native C++ crypto coverage (OpenSSL, Botan, libsodium, libtomcrypt, libgcrypt, Crypto++, mbedTLS).

Expanded Java library coverage

Improved detection for code using these popular Java libraries:

Azure SDK for Java (com.azure:azure-core)
Logback (ch.qos.logback:logback-classic)
Reactor Netty HTTP (io.projectreactor.netty:reactor-netty-http)
Apache Kafka clients (org.apache.kafka:kafka-clients)
Jackson (com.fasterxml.jackson.core: jackson-databind and jackson-core)

Issue alert emails: updating the default

Neha Shenoy, Senior Product Manager — Wed, 24 Jun 2026 04:00:00 GMT

On July 27, 2026, Snyk updates the default setting for issue alert emails to ensure every notification you receive is relevant to your work. These emails alert you to newly detected vulnerabilities and license violations.

Summary of changes

If you have never manually configured your notification preferences, you stop receiving these emails after July 27, 2026. This update moves issue alert notifications to an opt-in model so they only reach you if they are useful to your workflow. If you have already chosen which emails you receive, your preferences do not change and remain preserved exactly as they are.

Manage your preferences

You can keep receiving these emails by saving your preferences before the July 27 deadline, or you can re-enable them at any time afterward. Wherever you can set issue alert notifications, a banner appears in the Snyk web UI. To opt in instantly, click Keep my current selections in the banner.

You can also manually manage your settings:

For personal preferences: Navigate to Account Settings, click Notifications, find the issue alert emails for the relevant Organizations, and save your preference.
For Organizations admins: Navigate to Organization Settings, click Notifications, and update the default for all members of your organization.
For Groups admins: Navigate to Group, click Notifications, and manage issue alert settings across every organization in the Groups from a single page.

Announcing Snyk CLI v1.1305.2

Matt Dolan, Senior Product Manager — Tue, 23 Jun 2026 10:13:00 GMT

We are pleased to announce Snyk CLI release, v1.1305.2.

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

Bumped the Go runtime to version 1.26.4.
Improved MCP logging and addressed security issues in the Snyk MCP Server.
Fixed vulnerabilities:
- CVE-2026-44705
- CVE-2026-45570
- CVE-2026-49982

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Snyk Learn lesson roundup: what’s new in June

Alex Ley, Senior Director, Snyk Learn — Wed, 17 Jun 2026 12:00:00 GMT

This month on Snyk Learn, we’ve added new AI security lessons covering the attacks that target agentic systems: getting agents to run code they shouldn't, poisoning their memory to bend their reasoning, and exploiting the gaps where agents talk to each other!

Security lessons

[New][AI-Sec] Unexpected code execution (RCE) - tricking your agentic systems to execute code!
[New][AI-Sec] Memory and Context Poisoning - how corrupted agent memory can silently reshape reasoning, decisions, and behavior.
[New][AI-Sec] Insecure Inter-Agent Communication - exploiting weak communication protections between agents.
[Updated] Generation of predictable numbers - how intruders can use weaknesses in random number generation to launch more successful attacks.
[Updated] Uncontrolled recursion - how infinite loops can ruin your life and crash your systems.

Expanded framework & language coverage

We’ve also expanded Snyk Learn content to cover more of your tech stack:

New/expanded language support:
- Multiple lessons expanded into Python, Rust, and Ruby for the OWASP Top 10.

Each new/updated lesson above links directly to the relevant content so you can share it with your teams or assign it as part of your training program with the Snyk Learning Management Add-On. Use Snyk Learn to help your security engineers and developers stay ahead of the latest risks!

Bonus Content

Snyk is also publishing videos on AI coding and AI security on our YouTube channel! If you would like to see content like this on Snyk Learn, use the feedback button on Snyk Learn to let us know.

Automatically Close Obsolete Open Source Fix PRs with Help from Snyk, Now Generally Available!

Ryan McMorrow, Product Lead, Remediation — Tue, 16 Jun 2026 04:00:00 GMT

A cluttered PR backlog slows everyone down.

Following a successful Early Access, automatic closing of Open Source Fix PRs is now generally available. What's more, this feature will be turned on by default across all of our customers so your team spends less time triaging stale pull requests and more time shipping.

Whether a developer manually applied a fix, removed the dependency, or a transitive update resolved the issue, Snyk catches it during your next recurring test and closes the outdated PR. We also drop a comment on the PR explaining exactly which issues were resolved, so your team always has the right context without the extra noise.

How it works:

Snyk checks your open Fix PRs during recurring tests.
If the targeted dependency was removed, updated transitively, or fixed manually, the PR is automatically closed.
Snyk leaves a comment detailing the resolved issues so your team knows exactly why it was closed.
A Fix PR is only closed if all issues are resolved—if some remain, Snyk leaves the PR open so nothing falls through the cracks.

What's new at GA: With the general availability rollout, this feature is now enabled by default for all organizations. Administrators who prefer to manage closures manually can opt out from the settings page. You can now also configure the maximum number of obsolete PRs Snyk will close per day. giving you control of your workflow, a top piece of feedback from Early Access. We hope you enjoy cleaner, more actionable backlogs!

Rescheduling Snyk Code June Update on June 15 to June 22

Nina Kanti, Senior Product Manager — Fri, 12 Jun 2026 14:13:00 GMT

The upcoming improvements for our Snyk Code: June Update will be postponed from June 15 to June 22. We're running a final round of quality validation to make sure these updates deliver the most accurate results. These updates, including broader TLS and cryptographic detection for .NET and expanded PHP SQL injection coverage, will now go live on June 22.

Assess secure-at-inception effectiveness with the Prevention report (Early Access)

Sara Meadzinger, Staff Product Manager — Wed, 03 Jun 2026 04:00:00 GMT

We are thrilled to announce that the Prevention Report is now available in Early Access!

Measuring the true impact of "shifting left" has traditionally been a challenge. We designed the Prevention report to give you clear, actionable visibility into the effectiveness of security adoption directly within your development lifecycle.

This new report tracks the vulnerabilities developers proactively remediate at the point of creation in Snyk Code and Secrets—long before those issues ever reach a pull request or production environment. Data is seamlessly captured in the background as your team works across our developer surfaces, including Snyk Studio (MCP), IDE plugins and extensions, and the CLI.

Announcing Snyk CLI v1.1305.1

Matt Dolan, Senior Product Manager — Tue, 02 Jun 2026 10:24:00 GMT

We are pleased to announce Snyk CLI release, v1.1305.1

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

Improved rate-limit handling: the CLI now respects the X-RateLimit-Reset header when it is rate limited by the API, so retries wait the correct amount of time. This improves the reliability of scans in high-volume and CI/CD environments.
Fixed vulnerabilities:
- CVE-2026-39827
- CVE-2026-39831
- CVE-2026-33186 (IaC extensions)

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Announcing a new Snyk User Docs site structure!

Natasha Ellingford, Senior Technical Writer — Thu, 28 May 2026 17:00:00 GMT

We are excited to announce a redesign of the Snyk User Docs site, introducing a new structure built around site sections.

What's changed?

The docs are now reorganized into six clearly defined site sections:

Discover Snyk: An introduction to the platform, capabilities, and supported languages.
Platform administration: Settings, user management, Org configuration, and more.
Scan, fix, and prevent: Snyk core security scanning, fixing and prevention workflows
Developer tools: CLI, IDE integrations, related tooling, and more
Agent security: Agentic and AI-powered security features.
Snyk data and governance: Data handling, compliance, and policies.

In addition, there are dedicated sections for Getting started guides and Implementation guides to support onboarding and deployment workflows.

Snyk Code: June Update

Nina Kanti, Senior Product Manager — Thu, 28 May 2026 04:00:00 GMT

We're expanding Snyk Code analysis for the .NET (C# and VB) ecosystem with broader detection across TLS configuration, cryptographic algorithms, and third-party crypto libraries. We built these improvements to surface a wider range of crypto-related security issues in .NET codebases while keeping false positives in check. Coverage extends across the standard library and the most common third-party crypto packages, so customers using BouncyCastle see the same depth of detection as native .NET code.

We're also expanding PHP coverage for SQL injection, Snyk Code now detects interfile taint flow when the SQL sink is wrapped in a database-access class. These improvements arrive with the June release on 15 June 2026.

What's changing

New TLS vulnerability detection for .NET (CWE-326)

Snyk Code now identifies insecure TLS protocol configuration across the most common .NET HTTP and network stacks: ServicePointManager, HttpClientHandler, WinHttpHandler, SocketsHttpHandler, Kestrel, and SslStream. Only TLS 1.2 and 1.3 are considered safe. Earlier protocols are flagged as vulnerable, including bitwise flag combinations.

Broader Insecure Cipher coverage for .NET (CWE-327)

Generalised cipher detection for C# and VB, with new third-party support via BouncyCastle. Algorithms now flagged: PAKE, Triple DES, DES, Skipjack, RC4, RC2, MD-5, and SHA-1.

Expanded weak-key-size detection for .NET (CWE-326)

Native standard-library coverage added for ECDHE, ECDH, ECDSA, RSA, AES (GCM), and HMAC-SHA1, HMAC-SHA2, and HMAC-SHA3 across Base, Windows, and Linux .NET types. Third-party support was added for DH, DHE (BouncyCastle), AES-XTS (BouncyCastle), and CMAC-AES (BouncyCastle).

Generalised crypto rule templates for .NET (CWE-326, CWE-327)

The InsecureCipher, TooSmallKeySize, and WeakEccCurve rules have been refactored into unified report templates.

PHP SQL injection interfile taint flow through wrapper classes (CWE-89)

Snyk Code now detects SQL injection where the sink is defined in a wrapper class (single level: caller → wrapper → mysql_query)

Important details to note

You may notice an increase in .NET vulnerability findings after the June release, particularly around TLS misconfiguration and weak cryptographic algorithms.
RC2 is reclassified from TooSmallKeySize to InsecureCipher. Customers with ignores or policies tied to specific rule keys should be aware (Scope is .NET (C# and VB) only).
A small number of CryptoServiceProviders false positives related to read-only KeySize properties will no longer fire. These were never actionable in the first place (Scope is .NET (C# and VB) only).
PHP customers may see new SQL injection findings after the June release, particularly in codebases that route database calls through wrapper classes.

Announcing Agent Fix: New Agentic Workflow & Model Upgrade

David Alessi, Staff Product Manager — Thu, 28 May 2026 03:00:00 GMT

New Model & New Architecture

We're happy to announce we're upgrading Agent Fix to use the Claude family of models enhanced by Snyk's tooling and intelligence. This move delivers the following major improvements:

Security & Functional Enhancements

Agentic Retries: Our new workflow now detects where code suggestions deviate from security best practices. Instead of discarding the result, the system analyzes the failure and injects tailored guidance into the agent's subsequent attempts.
Dynamic Few-Shot Prompting: We now use the same training set used to fine-tune our internal model to dynamically provide secure fix examples for the new model to follow.

Expanded Support

Full Language Coverage: We will enable support for all Snyk Code languages on Day 1, removing previous limitations on language availability.
Comprehensive Rule Support: AI-powered fixes are now available for all supported rules and vulnerability types across the platform.

Measurable Impact

Golden Test Benchmark: Both Sonnet 4.6 and Opus 4.6 saw improved performance against Snyk’s Golden Test benchmark (72.4% to 82.5% and 74.6% to 85.4% respectively) with this new architecture vs. the models on their own.

Check out the blog for more details. This update started rolling out on May 26th and will reach 100% by end of day on May 28th.

OWASP Top 10:2025 Support in Snyk API & Web

Ana Pascoal, Product Manager — Thu, 21 May 2026 08:00:00 GMT

Snyk API & Web now supports the OWASP Top 10:2025 standard for compliance reporting. Users can generate compliance reports against either OWASP 2025 or OWASP 2021 — both versions remain available.

Announcing Snyk CLI v1.1305.0

Matt Dolan, Senior Product Manager — Wed, 20 May 2026 14:15:00 GMT

We are pleased to announce the latest stable Snyk CLI release, v1.1305.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

SBOM
- Introduces the --allow-incomplete-sbom flag for snyk sbom, allowing the SBOM to be generated even when individual projects fail to resolve. Failed projects are surfaced as per-project errors alongside the successful results.
Container
- Speed up snyk container monitor by sending dependency requests in parallel, configurable via the SNYK_REQUEST_CONCURRENCY environment variable.
MCP
- Adds an experimental breakability evaluation tool to the Snyk MCP Server.
Static CLI binaries for Linux
- Linux ARM64 and AMD64 binaries are now statically linked by default.
Additional Reliability and Performance Improvements
- npm package aliases from lockfile now appropriately used in test command.
- Fixes parsing of Python .whl files when scanning projects with --all-projects.
- Updates dependencies to fix vulnerabilities

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.

More flexibility when exporting table data to CSV with Snyk API & Web

Ana Pascoal, Product Manager — Wed, 20 May 2026 12:00:00 GMT

We've improved the recently introduced Download CSV feature to offer greater flexibility when exporting data directly from the Snyk API & Web interface.

Snyk Learn lesson roundup: what’s new in May

undefined, undefined — Mon, 11 May 2026 16:25:00 GMT

This month on Snyk Learn, there are brand new lessons for Evo by Snyk, along with a refreshed "Snyk in an IDE" lesson set. We are also excited to launch the new AI Secure Development learning path, where you will learn to build any app securely using AI while mastering foundational AI-powered security topics such as prompt injection and MCP.

Try the new "Feedback" button on learn.snyk.io (login required) to share feedback and topic suggestions.

Security lessons

[New] Learning Path - AI Secure Development
[New] Getting started with AI development
[New] Prompt engineering
[New] AI app development
[New] Securing your AI app
[New] AI in the Software Development Life Cycle (SDLC)
[New] AI Agents: Securing Autonomous Workflows

Snyk platform lessons

[New] Navigating the Evo Interface - a new lesson to familiarize yourself with the unified agentic interface in Evo by Snyk.
[New] AI Security Posture Management (AI-SPM) - a new lesson that enables users to detect AI assets via AI-BOM scans and enforce governance through Natural Language Policies as well as traditional menu items. We have refreshed the following lessons to ensure all content reflects our current platform and products, also providing a streamlined, role-based learning experience:
[Updated] Using Snyk in an IDE - updated to reflect the Developer’s workflow, including installing the plugin, authenticating, and using real-time scanning to find and fix vulnerabilities without leaving your IDE.
[Updated] Administrating Snyk in an IDE - formerly part of the “Using Snyk in an IDE” course, this lesson now focuses on the Administrator’s workflow, including advanced configuration and governance.

Expanded framework and coding languages coverage

We’ve also expanded Snyk Learn content to cover more of your tech stack:

New/expanded language support:
- Multiple lessons expanded into Python, Rust, and Ruby for the OWASP Top 10 learning path.

Each new/updated lesson above links directly to the relevant content so you can share it with your teams or assign it as part of your training program with the Snyk Learning Management Add-On.

Snyk Studio: Introducing Asynchronous, Hooks-Based Guardrails for AI Agents

Sam Broadaway, Senior Product Manager — Mon, 11 May 2026 16:00:00 GMT

Introducing Hooks-Based Guardrails

Snyk Studio is evolving our agentic guardrails to enable deeper trust in agent-generated code. We are debuting a new asynchronous, hooks-based approach to replace traditional rules-based guardrails, ensuring that security remains deterministic and efficient without slowing down the developer loop.

As agentic development has matured, initial friction points in rules-based models have become apparent. By transitioning to a hooks-based architecture, Snyk Studio resolves these key challenges with the traditional rules-based approach:

Determinism: While agents may occasionally ignore traditional rules, hooks are deterministic, ensuring that defined security scans are executed every time.
Zero Latency: Unlike rules-based models that add visible friction to the developer experience, hooks leverage background scans to provide a low-latency workflow.
Context Window Efficiency: The rules-based approach injected Snyk scan results into the agent's context window, consuming limited token space. Hooks decouple scan execution and results, keeping the context window focused on coding tasks.

Support for Leading ADEs

We have targeted support for the hook-based approach to cover popular Agentic Development Environments (ADEs) across both Windows and macOS. You can now leverage Snyk Studio guardrails in:

Claude Code
Cursor
Gemini CLI
Codex CLI (coming soon)

We also support automatic configuration of the /snyk-fix command, /snyk-batch-fix command, MCP server, and secure dependency health check skill for:

Kiro
Windsurf
Copilot CLI
Copilot VS Code Extension

Scaling for the Enterprise

To simplify adoption, we have released an installation script to automate configuration and deployment. The install script:

Supports Windows and Mac
Can be used via MDM to support distribution at scale
Installs the /snyk-fix command, /snyk-batch-fix command, MCP server, and secure dependency health check skill on: Claude Code, Cursor, Gemini CLI, Codex CLI (coming soon), Kiro, Windsurf, Copilot CLI, and the Copilot VS Code Extension
Installs hooks on: Claude Code, Cursor, Gemini CLI, Codex CLI (coming soon)

Getting Started

See our revamped documentation to get hooks configured and installed in your favorite ADE.

What’s Next

We will continue to expand support for additional ADEs and are working to integrate Snyk Studio distribution directly with Agent Scan and Agent Guard.

New Analytics Overview Widgets

Sara Meadzinger, Staff Product Manager — Fri, 08 May 2026 04:00:00 GMT

We've added several new widgets to the analytics overview to provide better visibility into your security program. These updates include key performance indicators (KPIs) from the Snyk Studio and pull request (PR) check reports directly into your main dashboard.

Announcing Snyk CLI v1.1304.2

Matt Dolan, Senior Product Manager — Wed, 06 May 2026 12:30:00 GMT

We are pleased to announce Snyk CLI release, v1.1304.2

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

Fixed vulnerabilities:
- SNYK-GOLANG-GITHUBCOMAWSAWSSDKGOV2AWSPROTOCOLEVENTSTREAM-16316402
- SNYK-GOLANG-GITHUBCOMAWSAWSSDKGOV2SERVICES3-16316411
- CVE-2026-39892
- CVE-2026-33750
Snyk Studio: Adding missing tools annotations to MCP server

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Improved zero-day report filtering and visibility

Sara Meadzinger, Staff Product Manager — Tue, 05 May 2026 04:00:00 GMT

We’re improving the usability of our zero-day reports to help you manage multiple security incidents more effectively. We expanded the filter bar for selected zero-day events to provide better context when you view data from several incidents at once. Additionally, the Accumulative Issues Backlog trend chart now breaks out each selected incident individually, and we added a new filter to the open issues side panel that allows you to toggle between open and resolved issues.

Expanded Container JVM Support

undefined, undefined — Thu, 30 Apr 2026 20:00:00 GMT

We are pleased to announce expanded JVM support for Snyk Container vulnerability scanning. Previously, detection for unmanaged Java container software was limited to OpenJDK 8 binaries. With this update, customers can now identify vulnerabilities in their container images for Java versions beyond OpenJDK 8.

Announcing Snyk CLI v1.1304.1

Matt Dolan, Senior Product Manager — Mon, 27 Apr 2026 12:30:00 GMT

We are pleased to announce Snyk CLI release, v1.1304.1

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

Improved error handling to prioritize and surface the most relevant error and correct exit code when multiple errors occur during maintenance windows. Exit code behavior is documented here:
- https://docs.snyk.io/developer-tools/snyk-cli/debugging-the-snyk-cli#exit-codes
- https://docs.snyk.io/scan-with-snyk/error-catalog#snyk-0099
Snyk Agent Scan: Improved CI flexibility with an issues ignore option, and added support for Windows x86 and macOS x86 architectures.
Fixed vulnerabilities:
- CVE-2026-4660
- CVE-2026-39883

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Snyk Code - Early May 2026 Update

Sebastian Roth, Senior Product Manager — Thu, 23 Apr 2026 08:00:00 GMT

Starting May 5, 2026, we're updating Snyk Code to improve scanning precision and reduce noise across all supported languages.

Improvements to scanning precision

All languages — Path Traversal severity tuning (CWE-22) Path Traversal findings are now tiered by source risk. Findings from lower-risk sources are automatically reclassified from High/Medium to Low severity, reducing noise while keeping high-risk vectors prominent.

Java, Kotlin, Groovy — Apache Camel framework coverage (CWE-89 / CWE-22 / CWE-611) Apache Camel Exchange HTTP sources are now tracked as taint origins. Applications using Apache Camel will see new findings where HTTP body and header values flow into SQL injection, path traversal, or XXE sinks. Customers using Apache Camel may see an increase in findings.

All languages — Improved .snyk exclude precision .snyk exclude patterns now use full .gitignore-style glob semantics for more expressive and consistent scan scope control. Customers relying on .snyk exclude rules may see changes in scan scope.

Python — Reduced false positives on archive extraction (CWE-22 / CWE-73) Python TarSlip detection is now scoped to genuine archive operations. Previously, any .extract() method call was flagged regardless of context - causing false positives in document parsers, ML pipelines, and custom extraction classes. Findings now only fire when the receiver is a tarfile.open() or zipfile.ZipFile() object. ZipSlip detection via zipfile.ZipFile is also improved. Customers may see a reduction in Python TarSlip findings and new ZipSlip findings where archive contents are extracted without path sanitisation.

Important details to note

All percentage improvements are based on Snyk's curated open-source data set. As part of these updates, you may see a decrease in High and Medium severity counts for Path Traversal as findings move to Low based on source risk tier. Total finding counts remain stable. Customers using Apache Camel may see an increase in findings as new data flows are detected. These changes apply specifically to the languages and CWEs listed above, while other scan areas remain unchanged.