Snyk Code

No entries match these filters. Clear filters

1. changelog Oct 12, 2026 · issue 105

   Snyk Code deepens analysis across 9 languages with new import resolution, a Mass Assignment rule for Spring, and wider detection in Java, Go, Python, Ruby, JS, C#, and PHP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds a suite of new detections: a Mass Assignment rule for Spring applications flagging request data that binds directly onto a database entity; path traversal detection via S3 object keys for Go projects using AWS SDK for Go v2; SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. detection for Go; XML external entity injection detection for Python; deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution., XML external entity injection, and zip slip detection for JavaScript; DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime.-based cross-site scriptingcross-site scriptingCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. detection for JavaScript using Bootbox and d3; path traversal detection for C#; and path traversal detection plus a new server-side request forgeryserver-side request forgeryServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. rule for Ruby.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds or improves coverage for Spring Data MongoDB, AWS SDK for Java (DynamoDB), AWS SDK for Java 2.x (DynamoDB Enhanced Client), and Apache Commons FileUpload in Java analysis.
   • Analyzes template files and serverless applications more accurately and with greater depth, yielding additional findings in projects using template engines or serverless frameworks.
   • Adds a suite of new detections: a Mass Assignment rule for Spring applications flagging request data that binds directly onto a database entity; path traversal detection via S3 object keys for Go projects using AWS SDK for Go v2; SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. detection for Go; XML external entity injection detection for Python; deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution., XML external entity injection, and zip slip detection for JavaScript; DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime.-based cross-site scriptingcross-site scriptingCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. detection for JavaScript using Bootbox and d3; path traversal detection for C#; and path traversal detection plus a new server-side request forgeryserver-side request forgeryServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. rule for Ruby.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

2. changelog Sep 23, 2026 · issue 084

   New snyk studio install --experimental command integrates Snyk scanning directly into AI coding tools like Cursor, Copilot, and Claude Code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Set up Snyk Studio in your AI coding environment so code generated by tools like Cursor or Copilot is scanned for vulnerabilities in the background as you work.
   copy

   $ snyk studio install --experimental

3. changelog Aug 31, 2026 · issue 062

   Snyk repo content sync now covers Code, open source, secrets, IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup., and container Projects on custom and default branches.

   • Repo content sync now covers Code, open source, secrets, infrastructure as code, and container (Dockerfile) Projects — not just a subset of project types.
   • Repo content sync now works on custom branches in addition to default branches.

   2 details in Everything

4. changelog Aug 21, 2026 · issue 052

   Snyk Code gains template-file analysis, 9 new Java libraries, Java 25 support, and .gitignore-committed file scanning.

   • Committed files matched by .gitignore rules are now analyzed by Snyk Code and Snyk Secrets — requires Snyk CLI 1.1307.0 or later for CLI scans; SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. and web scans need no action.
   • .snyk exclude patterns remain the supported way to deliberately exclude a path from analysis.
   • Analyzes template files and traces data flow from application code into the template, reporting XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. vulnerabilities that only become exploitable at render time; supported engines: Jinja2, Razor, FreeMarker, EJS, Handlebars, Pug, Thymeleaf, Twig, Mustache, and Velocity.
   • Adds or improves Java library coverage for Apache CXF (including HTTP transport), OkHttp, Spring Security OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. Client, Google OAuth Client, Google API Client, MSAL4J, Apache Commons Collections, Flyway, JAXB, and SAP Commerce (Hybris) FlexibleSearch queries with safe parameter binding.
   • Recognizes Python LangChain LiteLLM as a source of untrusted data.

   +2 more show less

   • Adds support for analyzing Java 25 source code.
   • Extends detection coverage for Java, Kotlin, C#, Go, JavaScript, and PHP with additional sources, sinks, and unsafe API patterns, particularly for cryptography.

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Committed files matched by a .gitignore rule are now included in analysis across all interfaces and this cannot be disabled. CLI scans require an upgrade to Snyk CLI 1.1307.0 or later; earlier versions retain the previous behavior, causing CLI results to differ from SCM and web results.
5. changelog Aug 3, 2026 · issue 034

   Snyk Code gains Ignore Approval Workflow (IAW): ignores now require reviewer sign-off before taking effect.

   • Adds Ignore Approval Workflow (IAW) so developer-submitted ignores become Pending requests requiring explicit reviewer approval or rejection before being applied.
   • Enables ignore requests to be submitted from the CLI, IDE, or API — a reason is required on every submission.
   • New Ignore Requests page in the web UI lets reviewers approve or reject pending ignore requests in one place.
   • Supports reviewer auto-approval for ignores they create themselves, bypassing the triage queue.
   • Introduces granular ignore permissions (read / create / edit / review / delete) with Collaborators defaulting to request and Admins to review; custom roles supported.

   +1 more show less

   • Exposes ignore-request data via the audit-logs API for full auditability and export.

   6 details in Everything

6. changelog Jul 31, 2026 · issue 031

   Snyk Code adds COBOL SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., Python LangChain & Lambda support, Spring Data taint tracking, and new framework coverage.

   • Adds generally available SAST scanning for fixed-format COBOL, bringing mainframe applications into the same CLI, IDE, SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows., and PR-check workflows used for other languages.
   • Adds Python LangChain support, flagging unsafe data flows through LangChain applications.
   • Adds Python serverless support for applications running on AWS Lambda.
   • Adds weak-hash detection and detection of debug features left enabled.
   • Adds Java Spring Data taint-source tracking, enabling injection, SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., path-traversal, and XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. findings for data flowing from Spring Data repositories.

   +1 more show less

   • Adds framework recognition for vert.x, Jolokia, and Spring Cloud Config Client.

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The COBOL preview flag is removed at general availability; COBOL scanning now runs automatically across all repositories, and new findings may appear in repositories not previously scanned.
   • !Fix examples no longer appear in Fix analysis in the Snyk Web UI and no longer appear in SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output.
7. docs update Jul 24, 2026 · issue 024

   Snyk Code gains Rule Extensions: define custom sanitizers to reduce false positives in taint-flow analysis without leaving the platform.

   • Adds Rule Extensions, letting teams attach custom sanitizer functions to existing Snyk Code security rules to match project-specific context.
   • Supports custom sanitizer definitions per language to reduce false positives in taint-flow analysis across supported rules.
   • Enables impact testing via the API to preview how a proposed Rule Extension would change project findings before applying it.
   • Configures Rule Extensions directly from Group settings in the Snyk Web UI.
   • Introduces dedicated custom-role permissions to control who can manage and test Rule Extensions via the API and Web UI.

   5 details in Everything

8. docs update Jul 24, 2026 · docs issue 004

   Snyk Code gains Rule Extensions: define custom sanitizers to reduce false positives in taint-flow analysis without leaving the platform.

   • Adds Rule Extensions, letting teams attach custom sanitizer functions to existing Snyk Code security rules to match project-specific context.
   • Supports custom sanitizer definitions per language to reduce false positives in taint-flow analysis across supported rules.
   • Enables impact testing via the API to preview how a proposed Rule Extension would change project findings before applying it.
   • Configures Rule Extensions directly from Group settings in the Snyk Web UI.
   • Introduces dedicated custom-role permissions to control who can manage and test Rule Extensions via the API and Web UI.

   5 details in Everything

9. changelog Jul 15, 2026 · issue 016

   Snyk Code Rule Extensions now GA: register custom sanitizers via UI or REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. to eliminate false positives from your own security controls.

   └──▷ HOW TO FIND IT
   Preview how registering a custom sanitizer will change your findings before rolling it out — catch regressions in your rule extensions without affecting the team.
   📍Use the impact-test API endpoint to submit your proposed rule extension and review the diff in findings before applying it.
   Register an in-house sanitizer function by its fully-qualified name so Snyk Code stops flagging code paths already protected by your security controls.
   📍In the Snyk console, go to your Organization Settings › Snyk Code › Rule Extensions, select a rule, and use the FQN builder to add your sanitizer function.
   • Supports custom sanitizer registration — define in-house sanitizer functions so Snyk Code recognizes them as valid data-cleaning paths and stops flagging code already protected by your controls.
   • New in-product UI for defining and managing custom sanitizers, including an FQN (fully-qualified name) builder to pinpoint exact functions.
   • New public REST API for managing and previewing rule extensions programmatically, enabling automation and agent-driven configuration at scale.
   • New impact-test API lets practitioners preview how a rule extension change affects findings before applying it to the team.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Closed-beta customers must complete migration steps before using the GA release of Rule Extensions — see the documentation.