Snyk Code November update

This update will be available on November 23, 2026.

Snyk Code reports additional findings in this update. Affected projects will report them on their next scan.

Newer language versions

Snyk Code supports PHP up to 8.5 and Swift up to 6.4. JavaScript and TypeScript analysis covers current syntax, including using declarations.

Kong plugins

Snyk Code analyzes Kong Gateway plugins written in Python, JavaScript, TypeScript and Go. It reports additional findings, such as command injection, where request data reaches a shell command.

More detection

Snyk Code reports additional findings in these areas:

• Python: cross-site request forgery protection in Django, response handling in Flask, and JWT signature verification.

• JavaScript: command injection and prototype pollution.

• PHP: cookie security settings.

• Java: SQL injection.

Fewer false positives

Snyk Code reports fewer false positives in Kotlin, JavaScript, Python and Java.

Refinements

Go, TypeScript and JavaScript: Snyk Code reads the project's own configuration to resolve imports. It now follows data across a project's own packages and modules, and analyzes these projects more deeply and more accurately.