snyk.io updates

Announcing Snyk CLI v1.1308.3

Matt Dolan, Senior Product Manager — Fri, 23 Oct 2026 11:00:00 GMT

We are pleased to announce Snyk CLI release, v1.1308.3

Following the compromise of eMudhra intermediate certificate authorities, we strongly advise all customers to upgrade to Snyk CLI v1.1308.3 or later.

This release includes a security update that blocks trust in the affected certificates. Earlier versions may accept forged certificates, potentially allowing an attacker able to intercept network traffic to impersonate a trusted service and read or modify CLI communications.

Please update CLI installations across developer machines, CI/CD pipelines, container images, and elsewhere.

Customers running the legacy CLI exclusively through Node.js should upgrade the Node.js runtime used to execute the CLI to a version that addresses this issue.

This update includes the following:

Fixed vulnerabilities:
- Updates the embedded Node.js runtime to 22.23.4 to address CVE-2026-105481, CVE-2026-105482, CVE-2026-106069, CVE-2026-106073, CVE-2026-106074, and CVE-2026-111497
- Updates the toml library used by snyk fix for Poetry projects to 5.0.1 to address CVE-2026-114141, CVE-2026-114142, CVE-2026-114143, and CVE-2026-114144

To learn more please reference the full release notes. If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Announcing Snyk CLI v1.1308.2

Matt Dolan, Senior Product Manager — Wed, 21 Oct 2026 16:00:00 GMT

We are pleased to announce Snyk CLI release, v1.1308.2

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

.NET scans no longer fail with NETSDK1067 when SelfContained=true is set in the build environment.
snyk test --source-dir now returns a clear validation error when used without --reachability=true, instead of ignoring the flag or treating the path as the project directory.
snyk test --fail-on=patchable now works as expected, rather than failing with an "Unsupported value 'patchable'" error.
Smoother authentication and scanning in the IDE through Snyk Language Server fixes: an expired token now shows a single re-authenticate prompt instead of several, signing in from one IDE window now signs in your other open windows, and when showing only net new issues the IDE finds the base branch from origin/HEAD and asks you to pick one if none is found, instead of reporting a failed scan.
Updates the Go runtime to 1.26.10.
Fixed vulnerabilities:

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Added Secrets in Inventory and centrally manage Secrets scan frequency

undefined, undefined — Mon, 19 Oct 2026 07:00:00 GMT

What Changed?

You can now set how often Snyk scans your repositories for secrets using Repo Monitor Configuration .

In "Inventory -> repository -> Settings" or in bulk via "Inventory -> Configure Monitoring", choose Daily, Weekly or Never for Secrets. Set it for a single repository or for many repositories at once.

Secrets also now appear in Inventory. In the All Assets view, each repository shows its Secrets coverage control, the Snyk Projects that contain Secrets results, and the Secrets issues found.

Prerequisites

Repo Monitor Configuration (EA) enabled via Snyk Preview (for Secrets test configurations)

Announcing Snyk CLI v1.1308.1

Matt Dolan, Senior Product Manager — Wed, 14 Oct 2026 14:22:00 GMT

We are pleased to announce Snyk CLI release, v1.1308.1

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

snyk test --html and --html-file-output no longer require preview features to be enabled, making HTML reports available to everyone.
The project name is now consistently displayed in the snyk test summary when available.
Fixed vulnerabilities:

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Pending ignore requests are now visible on the Project's Issues page

undefined, undefined — Tue, 13 Oct 2026 07:00:00 GMT

What Changed?

When you submit an ignore request under Ignore Approval Workflow, the issue now shows a clear "Pending Ignore Request" status directly on the Project's Issues page and in the issue details — so you can see at a glance that a request is awaiting review, instead of it looking like any other open issue.

You can also filter your Issues list to show only findings with a pending ignore request, making it easy to see and act on the queue of requests awaiting a decision without scanning every issue.

For API and integration users, the issues API now reports pending as part of an issue's ignore status, so you can distinguish open, pending, and ignored findings programmatically.

This enhancement will be rolled out gradually during the next 2 weeks.

Snyk Code October update

undefined, undefined — Mon, 12 Oct 2026 17:00:00 GMT

This update will be available on October 26, 2026.

Snyk Code reports significantly more findings in this update. Affected projects will report the additional findings on their next scan.

Snyk Code now analyzes more deeply and more accurately in Java, Kotlin, Go, TypeScript, JavaScript, Python, C#, PHP and Ruby.

Go, TypeScript and JavaScript

Snyk Code reads the Project's own configuration to resolve imports. For Go, it reads go.mod, which defines the module path that a project's packages import each other through. For TypeScript and JavaScript, it reads tsconfig.json and jsconfig.json, which define path aliases.

As a result, Snyk Code now analyzes these projects more accurately and with greater depth.

PHP

Snyk Code corrects boolean typing in PHP analysis. Previously skipped findings now appear across cross-site scripting, path traversal, SQL injection and other checks.

Java

Coverage is added or improved for these libraries:

Spring Data MongoDB
AWS SDK for Java, DynamoDB
AWS SDK for Java 2.x, DynamoDB
AWS SDK for Java 2.x, DynamoDB Enhanced Client
Apache Commons FileUpload
Google Cloud Big Query

Snyk Code adds a Mass Assignment rule for Spring applications. It reports request data that binds directly onto a database entity. Path traversal detection is wider.

More detection

Snyk Code reports additional findings in these areas:

Python: XML external entity injection.
JavaScript: deserialization, XML external entity injection and zip slip.
JavaScript, Bootbox: DOM-based cross-site scripting.
JavaScript, d3: DOM-based cross-site scripting.
C#: path traversal.
Go: SQL injection.
Go, AWS SDK for Go v2: path traversal through S3 object keys.
Ruby: path traversal, and a new server-side request forgery rule.

Template file analysis and serverless analysis

Snyk Code analyzes template files and serverless applications more accurately and with greater depth, building on the September update. Both will yield additional findings in projects that use template engines or serverless frameworks.

Announcing Snyk CLI v1.1308.0

Matt Dolan, Senior Product Manager — Thu, 08 Oct 2026 12:00:00 GMT

We are pleased to announce the latest stable Snyk CLI release, v1.1308.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

HTML Reports
- snyk code test and snyk secrets test can now generate an HTML report. Use --html to print it to stdout, or --html-file-output=<path> to write it to a file. This replaces the need for a separate snyk-to-html tool in most cases. Support for snyk test will be available in v1.1308.1.
Agent Scan (experimental)
- The experimental snyk agent-scan command now reports risk indicators instead of issue codes. If you post-process its --json output, update your scripts to the new format.
Additional Reliability and Performance Improvements
- Maven and Gradle SBOMs, and --print-graph, no longer stall on large multi-module builds and now finish seconds after the build tool exits. On projects with dependency cycles, the output may contain extra pruned: cyclic placeholder nodes. No packages or dependency edges are dropped.
- Gradle projects with very deep inter-module dependency chains no longer fail with a stack overflow.
- Projects built with Gradle 4.0 to 4.6 no longer fail to scan.
- .NET scans fall back to legacy scanning when the .NET SDK isn't installed. They also handle projects restored in a different build directory, and work when global NuGet source-mapping rules are configured.
- .NET scans no longer fail with NU1101 on SDK installs that lack the app host pack, such as distro-packaged SDKs.
- .NET projects whose PackageReference uses a lowercase version attribute are now parsed correctly.
- Updates dependencies to fix vulnerabilities

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.

ADS installer now available as a packaged binary

Nina Kanti, Senior Product Manager — Thu, 01 Oct 2026 12:00:00 GMT

The ADS installer now ships as a signed macOS .pkg and Windows .msi, downloaded from the Settings page. The installer registers a scheduled job on the machine, so Agent Supply Chain Security scans run on their own schedule without needing MDM.

What The ADS installer now ships as a signed macOS .pkg and Windows .msi, downloaded from the Settings page in Evo.

Why Deployment no longer means wrapping a downloaded file in your own script, you now get a standard signed installer for macOS or Windows. The installer now stays on the machine in a predictable location. Scan timing is no longer tied to your MDM policy.

How In Evo, open Settings, choose your products and select Save & Publish. Choose your operating system and architecture, select Download ADS Installer, install the package, then run the installer with your Tenant ID and push key. Your onboarding workflow, MDM policies, tenant and push key are all unchanged. Downloading the installer directly from the CDN remains available.

Things to know Linux is unchanged. The command line install remains supported and is documented alongside the package flow.

For more information, see the documentation: https://docs.snyk.io/agent-security/evo-by-snyk/agentic-development-security-ads

Announcing Snyk CLI v1.1307.4

Matt Dolan, Senior Product Manager — Wed, 23 Sep 2026 16:00:00 GMT

We are pleased to announce Snyk CLI release, v1.1307.4

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

New experimental snyk studio command that sets up Snyk Studio in supported AI coding tools (Cursor, Claude Code, Codex, Copilot, Gemini, Kiro, and Windsurf), so the code they generate gets scanned in the background as it's written. This direct integration replaces the need for separate setup scripts (https://github.com/snyk/studio-recipes). Run snyk studio install --experimental to get started.
New snyk fix --agentic filtering flags: --severity-filter to fix only the severities you choose, --breakability-filter to fix only Open Source upgrades with the breakability you choose, and --exclude-ids to fix everything except the issue IDs you list.
snyk fix --agentic now keeps a failed fix's changes by default so you can review them, rather than reverting automatically. Pass --enable-revert to restore the automatic rollback behavior.
Fixed an issue where the --iac, --docker, --container, and --code flags on snyk test could be silently dropped for organizations on the unified test API, causing scans to fall through to an open-source test instead (which could fail with "No supported files found" or scan the wrong target). These flags now route to the correct scan again.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

A change to the Snyk Code Priority Score

Sebastian Roth, Senior Product Manager — Wed, 23 Sep 2026 15:00:00 GMT

Snyk Code priority scores dropped by up to 200 points on September 1, 2026, for findings whose rule had a fix example.

What changed

A finding used to earn 200 of the 1,000 available priority score points when Snyk held a fix example for its rule. The August 17, 2026 release retired fix examples, and the scoring factor went with them. The removal became live on September 1, 2026.

Why

Fix-example availability describes Snyk's content coverage. It says nothing about the risk in your code. Two findings of the same severity could sit 200 points apart because one rule happened to have an example behind it. Priority score should rank findings by how urgently they need fixing, so we removed the factor.

What you saw

Snyk Code findings reordered when the factor came out. Every remaining scoring factor works as it did before, including severity, which still contributes the largest single share at up to 500 points. No finding was added, removed or re-rated.

We should have told you

The August 17 release notes said no action was required. That was wrong, and we apologize. We have added a check so that any future change to priority score appears in the release notes. The priority score documentation now lists the current factors.

Learn more in the Snyk Code priority score documentation.

Snyk for Jira moves from Atlassian Connect to Forge

undefined, undefined — Wed, 23 Sep 2026 03:00:00 GMT

Atlassian ends support for Atlassian Connect in December 2026. Snyk for Jira has been rebuilt on Forge, Atlassian's current cloud app platform, with all of the same functionality.

No action is required. New installations use the Forge version from September 30, 2026, and existing installations will be migrated during October. Permissions, configuration, ticket creation, and existing Jira issues all carry over unchanged.

For more information, see Snyk for Jira documentation.

Evo MCP Server now available

Nina Kanti, Senior Product Manager — Tue, 22 Sep 2026 18:00:00 GMT

You can connect any MCP client, such as Claude, Codex or Cursor, to Evo and ask about your AI estate from the agent you already work in.

What's new. You can now:

Ask what AI assets Evo has discovered across your code, your developer machines, and your pentest targets
See how those assets connect, for example which MCP servers an agent uses or which findings came from a target
Read your policies and the violations open against them
Create and update policies without leaving your agent

To get started, check out our documentation

Announcing Snyk CLI v1.1307.3

Matt Dolan, Senior Product Manager — Fri, 18 Sep 2026 08:00:00 GMT

We are pleased to announce Snyk CLI release, v1.1307.3

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

snyk test now reports an unreadable .snyk policy file as SNYK-POLICY-0002 with a message identifying the problem, instead of an unspecified error.
snyk test --all-projects now resolves each project's .snyk policy from that project's own directory, instead of applying the scan root's policy to every project.
snyk test --scan-all-unmanaged no longer fails with exit code 2 when scanning a directory of JARs with no manifest file.
Fixed vulnerabilities:
- CVE-2026-63376
- CVE-2026-77465
- SNYK-JS-ADMZIP-19846655

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Container: Go standard library vulnerability reporting

undefined, undefined — Wed, 16 Sep 2026 04:00:00 GMT

Snyk Container will begin reporting vulnerabilities from the Go standard library for all customers. Scans of container images built from Go binaries identify the standard library version the binary was compiled with and report known vulnerabilities against it.

Affected images gain a new stdlib dependency in the dependency graph, versioned to the Go release used for the build, for example stdlib@1.25.10. Detection works for standard, stripped, and CGo builds.

No configuration is required, and reporting is enabled automatically for all organizations. Standard library reporting in the Snyk CLI requires v1.1303.2 or later.

This change is scheduled to take effect on October 7, 2026.

Custom CA Certificate Support

undefined, undefined — Tue, 15 Sep 2026 23:00:00 GMT

Snyk API & Web now lets you upload your organization's internal Certificate Authority (CA), so the certificates it issues are trusted the same way as publicly issued certificates.

What's new

Many enterprises operate their own internal CA to issue certificates for both internal tools and internet-facing applications. Although these certificates aren't signed by a public CA, they should still be included in scans to prevent false positives.

What we're delivering

A method for uploading your Root CA. Each scan of every target then verifies certificates against your CA and the public trust store.

This increases scan accuracy, reduces the overhead of documenting risk acceptance for each affected target, and boosts the overall precision of each scan based on your specific needs and requirements.

Announcing Snyk CLI v1.1307.2

Matt Dolan, Senior Product Manager — Wed, 09 Sep 2026 15:00:00 GMT

We are pleased to announce Snyk CLI release, v1.1307.2

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

Removed an unused experimental feature.
Fixed vulnerabilities:
- CVE-2026-84445

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Announcing Snyk CLI v1.1307.1

Matt Dolan, Senior Product Manager — Mon, 07 Sep 2026 15:00:00 GMT

We are pleased to announce Snyk CLI release, v1.1307.1

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

snyk test again reports SNYK-CLI-0008 and exits with code 3 when a repository contains no supported manifest files, instead of a generic SNYK-CLI-0000 with exit code 2. snyk test --json writes the error document to stdout as expected.
Restored the moduleName, insights.triageAdvice, and functions_new fields in snyk test --json output, so tooling that consumes those fields works as before.
.snyk policy files are now handled correctly in the unified test flow. This covers empty, whitespace-only and comment-only policies, date-only timestamps, and other edge cases that could previously cause incorrect results or failures.
Commands that complete with findings (exit code 1) no longer produce duplicate or corrupt JSON output when an unrelated network error occurs during the run, improving reliability for automated pipelines that parse CLI output.
The debug-log scrubber now masks secrets consistently and no longer corrupts the surrounding JSON structure, making debug logs safer to share and easier to parse.
Container scans now surface source repository information for locally built images using BuildKit metadata.
Fixed vulnerabilities:
- CVE-2022-25883
- CVE-2026-84304
- CVE-2026-84375
- SNYK-GOLANG-GOLANGORGXCRYPTOSSH-19504090

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Snyk Projects now stay in sync with your repository content

undefined, undefined — Mon, 31 Aug 2026 16:00:00 GMT

The "What"

Repo Content Sync keeps your Snyk Projects aligned with what your repositories actually contain. When a change is merged to a branch Snyk monitors, Snyk creates and begins monitoring Projects for newly added manifest, Dockerfile, and configuration files, and deactivates the Projects whose files were removed. A file that is moved or renamed is picked up at its new path, and the Project at the old path is deactivated. Until now, keeping Snyk in step with a repository was a manual step: someone re-imported the repository, or a newly added dependency file simply went unscanned. Repo Content Sync makes repository content itself the trigger, so your Project list reflects the code as it is today rather than as it was at import. Sync covers Code, open source, secrets, infrastructure as code, and container (Dockerfile) Projects, and it works on custom branches as well as default branches.

Repo Content Sync will be rolled out gradually over the next several weeks.

Announcing Snyk CLI v1.1307.0

Matt Dolan, Senior Product Manager — Wed, 26 Aug 2026 15:00:00 GMT

We are pleased to announce the latest stable Snyk CLI release, v1.1307.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

Secrets
- snyk secrets test now supports exclusions — add files or paths to the exclude section of your .snyk file to skip them during secrets scanning.
Container
- Container scans now surface image provenance attestations by default, so signed-image provenance metadata appears in results without any extra flag.
.NET/NuGet
- snyk test can now analyze already-restored .NET/NuGet projects fully offline and no longer requires .NET 6 to be installed.
MCP
- The full Snyk MCP profile now includes Snyk Secrets.
Code & Secrets
- SARIF suppressions now include reviewedOn and reviewedBy metadata.
AI BOM
- snyk aibom test --severity-threshold now filters the displayed and JSON results by severity, not only the exit code.
Agent-optimized CLI
- New experimental snyk agent command space — a scanning surface built for AI coding agents, with token-optimized output and ergonomics. snyk agent test runs Snyk Open Source, Code, and Secrets together.
Additional Reliability and Performance Improvements
- Adds support for scanning pnpm v11 pnpm-lock.yaml lockfiles.
- Fixes a crash when scanning dependencies of Gradle 7.4–8.2 projects.
- Fixes a bug where arguments after -- (for example snyk test . -- -s settings.xml) were treated as scan targets, which could silently drop the Risk Score.
- Fixes scanning of projects using Hex versions newer than 1.19.
- Excludes the .git folder from file discovery, preventing intermittent scan failures caused by changes to .git contents during a scan
- Prevents a possible connection leak when the Snyk API returns an error response.
- Updates dependencies to fix vulnerabilities.

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.

Organization-scoped access in Evo

Ranko Cupovic, Principal Product Manager — Tue, 25 Aug 2026 18:33:00 GMT

Starting August 18, 2026, a user's Evo data is limited to the Snyk Organizations they can read.

Until now, everyone with access to Evo saw every repository, asset, and issue in the Tenant. Evo now reuses your existing Snyk Organization hierarchy, so there is nothing new to model and no migration to run. Nobody loses access until an administrator changes their role.

What's new:

Tenant Viewer now grants read access to the assets and issues in the Organizations the user belongs to, and to nothing outside them
Tenant Member grants no Evo access, letting administrators withhold Evo without removing Snyk platform access
Full-Tenant access continues for Tenant Admin and for the two roles ending in "with Evo access"
Organization names appear alongside repositories, distinguishing the same repository imported into more than one Organization

Note for administrators:

Existing users keep their access, and Tenant Viewers gain scoped read access for the first time. New users join as Tenant Member, which carries no Evo access, so each one needs a role change. Scoped users are read only, and assets without an Organization stay hidden, which today means all Agent Supply Chain Security and Continuous Offensive Security data.

Documentation: Access and authentication

Snyk Code September Update

undefined, undefined — Fri, 21 Aug 2026 08:00:00 GMT

This update is available on September 14, 2026. It improves coverage and precision across Snyk Code: template files are analyzed, Java framework and library support is extended, detection gaps are closed in six languages, and .gitignore no longer hides committed files from analysis.

Template files

Snyk Code analyzes template files and follows data from your application code into the template. Cross-site scripting that only becomes exploitable where the template renders its output is now reported, with the data flow shown from the application through to the template.

Supported engines: Jinja2, Razor, FreeMarker, EJS, Handlebars, Pug, Thymeleaf, Twig, Mustache and Velocity.

Java

Apache CXF — the web services framework, including its HTTP transport.
OkHttp — the HTTP client.
Spring Security OAuth2 Client — OAuth2 and OpenID Connect authentication.
Google OAuth Client and Google API Client — Google authentication and API access.
MSAL4J — Microsoft identity platform authentication.
Apache Commons Collections — collection utilities.
Flyway — database migrations.
JAXB — XML binding.
SAP Commerce (Hybris) — FlexibleSearch queries, with parameter binding recognised as safe.

Coverage for these libraries is added or improved, resulting in improved data flow analysis.

Python

LangChain LiteLLM is recognised as a source of untrusted data.

Java 25

Java 25 source is analyzed.

Rule coverage improvements

Detection coverage is extended for Java, Kotlin, C#, Go, JavaScript and PHP — additional sources, sinks and unsafe API patterns, in particular for cryptography.

Expect additional true positives and fewer false positives.

Files matched by .gitignore

Committed files matched by a .gitignore rule are analyzed.
Secrets committed and later matched by a .gitignore rule are now detected. Git ignores only untracked files, so this brings Snyk Code and Snyk Secrets in line with Git.
These are pre-existing issues in code you already committed.
The change applies across all interfaces and cannot be disabled.

Required for CLI scans. Upgrade to Snyk CLI 1.1307.0 or later, available from 26 August. Earlier versions keep the previous behavior, so CLI results will differ from your SCM and web results. SCM imports and scans need no action.

What is unchanged

Untracked files matched by .gitignore remain excluded from analysis.
.snyk exclude patterns behave as before, and remain the way to exclude a path deliberately.
Severity levels and rule identifiers do not change.

New model risk scoring for AI models in Evo

Ranko Cupovic, Principal Product Manager — Wed, 19 Aug 2026 15:00:00 GMT

Starting August 17, 2026, Evo by Snyk uses a rebuilt model risk score to evaluate the AI models discovered in your organization.

The previous Risk Index is replaced by a single score from 0–1,000 that combines attack success rate with the potential impact of a successful attack, tested against categories including prompt injection, data exfiltration, and insecure code generation. The result is a score that reflects both how easily a model can be compromised and how much damage that compromise could cause — not just whether an attack succeeded.

What's new:

Impact-weighted scoring: Risk scores now factor in the real-world consequence of an attack succeeding, not only its likelihood.
Four severity bands: Scores map to low (0–249), medium (250–499), high (500–749), and critical (750–1,000), so you can triage at a glance.
Broader attack coverage: Testing spans a wider range of direct and indirect attack categories against each discovered model.
Framework-mapped: Findings map to OWASP LLM Top 10, OWASP Agentic Security, MITRE ATLAS, and NIST AI 600-1/100-2e2025, so you can connect model risk to the compliance frameworks you already report against.
Policy-ready from day one: Evo applies default policies across common attack categories automatically, and you can create custom policies scoped to specific attack categories or goals to match your organization's risk tolerance.

If you have policies built on the old Risk Index: those policies remain visible but no longer evaluate under the new scoring. Review and recreate any Risk Index-based policies against the new model risk score to keep enforcement active.

Read more in the Risk intelligence documentation.

Snyk Assist— AI-powered support and guidance, built into Snyk

undefined, undefined — Tue, 18 Aug 2026 04:00:00 GMT

The "What"

Snyk is introducing Snyk Assist — an AI-powered support and guidance assistant available directly inside the Snyk UI.

Snyk Assist answers product, setup, and troubleshooting questions in plain language, grounded in Snyk's own documentation, release notes, and support knowledge articles. It can also retrieve read-only information about your current organization and group, and open a support case without you leaving the conversation.

Assist is available from the top right of the screen on every page, and is always accessible.

Ask questions in plain language: product concepts, account setup, integrations, and day-to-day administration — "How do I set up SSO?", "What permissions does Snyk need for my GitHub org?", "How do I configure ignore rules and approvals?". Answers are grounded in Snyk documentation and tailored to your role, plan tier, and licensed products.
Self-serve troubleshooting: conversational diagnostics drawn from Snyk's support and knowledge articles, so common problems can be resolved without waiting on a ticket.
Information about your account: issue summaries by severity, issue triage and single-issue detail, projects and import targets, collections and container images, scan settings, integrations and their connectivity status, members and their roles, and a project's current ignore rules — for your current organization and group, retrieved with your own permissions.
Support without leaving the conversation: Assist can suggest and create a support case and return the case ID and link. When it detects a capability Snyk does not support today, it can capture that as a feature request.
Vulnerability lookups: look up known vulnerabilities for a package, or a specific package version, against the Snyk Vulnerability Database.

Snyk Assist requires the new Snyk UI. It is available only to users who have the new navigation experience enabled. If you are still on the classic navigation, switch via the user account menu to use Assist.

Snyk Assist is available to Team, Ignite and Enterprise plans.

Unified Navigation, Navigation search and Dark Mode — New Snyk UI Rollout!

undefined, undefined — Mon, 17 Aug 2026 05:00:00 GMT

Snyk is rolling out a redesigned navigation experience!

The classic sidebar — which listed every page across Tenant, Group, and Organization scopes at once — is replaced by a single breadcrumb bar at the top that lets users switch scope in one click via per-level drop-downs.

The left sidebar is condensed to core areas only (Analytics, Inventory, Projects, Issues, Policies, Settings), with all settings-related pages consolidated into one context-aware Settings hub.

The update also adds a "Dark Mode" option (System/Light/Dark) under the user account menu. and a UI/Cmd/Ctrl+K command search to jump directly to any page or setting for easy orientation.

Announcing Snyk CLI v1.1306.4

Matt Dolan, Senior Product Manager — Thu, 13 Aug 2026 15:00:00 GMT

We are pleased to announce Snyk CLI release, v1.1306.4

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

Clearer error messages when the CLI cannot reach a configured proxy. Failures now report the proxy URL the CLI attempted to use, with credentials redacted, along with the specific error code SNYK-CLI-0028, making proxy misconfiguration quicker to diagnose in CI and behind corporate networks.
An updated embedded runtime, moving Node.js from 22.22.2 to 22.23.2 and OpenSSL from 3.5.5 to 3.5.7, which brings in fixes for six high-severity CVEs plus additional OpenSSL security fixes.
Fixed vulnerabilities:
- SNYK-JS-JSYAML-18593780
- CVE-2026-45447
- CVE-2026-48618
- CVE-2026-48933
- CVE-2026-56846
- CVE-2026-56848
- CVE-2026-58043

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.