https://cybertoolchain.io/tools/snyk-code New releases and features in Snyk Code, tracked by The Cyber Toolchain. en Mon, 12 Oct 2026 17:00:00 GMT https://updates.snyk.io/snyk-code-october-update/ https://updates.snyk.io/snyk-code-october-update/ Mon, 12 Oct 2026 17:00:00 GMT Snyk Code deepens analysis across 9 languages with new import resolution, a Mass Assignment rule for Spring, and wider detection in Java, Go, Python, Ruby, JS, C#, and PHP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a suite of new detections: a Mass Assignment rule for Spring applications flagging request data that binds directly onto a database entity; path traversal detection via S3 object keys for Go projects using AWS SDK for Go v2; SQL injection detection for Go; XML external entity injection detection for Python; deserialization, XML external entity injection, and zip slip detection for JavaScript; DOM-based cross-site scripting detection for JavaScript using Bootbox and d3; path traversal detection for C#; and path traversal detection plus a new server-side request forgery rule for Ruby.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds or improves coverage for Spring Data MongoDB, AWS SDK for Java (DynamoDB), AWS SDK for Java 2.x (DynamoDB Enhanced Client), and Apache Commons FileUpload in Java analysis. • Analyzes template files and serverless applications more accurately and with greater depth, yielding additional findings in projects using template engines or serverless frameworks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk-code https://updates.snyk.io/announcing-snyk-cli-v1-1307-4/ https://updates.snyk.io/announcing-snyk-cli-v1-1307-4/ Wed, 23 Sep 2026 16:00:00 GMT New `snyk studio install --experimental` command integrates Snyk scanning directly into AI coding tools like Cursor, Copilot, and Claude Code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `snyk studio install --experimental` command to configure Snyk Studio in AI coding tools (Cursor, Claude Code, Codex, Copilot, Gemini, Kiro, and Windsurf), scanning generated code in the background as it is written.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk-code https://updates.snyk.io/repo-content-sync/ https://updates.snyk.io/repo-content-sync/ Mon, 31 Aug 2026 16:00:00 GMT Snyk repo content sync now covers Code, open source, secrets, IaC, and container Projects on custom and default branches. • Repo content sync now covers Code, open source, secrets, infrastructure as code, and container (Dockerfile) Projects — not just a subset of project types. • Repo content sync now works on custom branches in addition to default branches. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk-code https://updates.snyk.io/snyk-code-september-update/ https://updates.snyk.io/snyk-code-september-update/ Fri, 21 Aug 2026 08:00:00 GMT Snyk Code gains template-file analysis, 9 new Java libraries, Java 25 support, and .gitignore-committed file scanning. • Committed files matched by `.gitignore` rules are now analyzed by Snyk Code and Snyk Secrets — requires Snyk CLI 1.1307.0 or later for CLI scans; SCM and web scans need no action. • `.snyk` exclude patterns remain the supported way to deliberately exclude a path from analysis. • Analyzes template files and traces data flow from application code into the template, reporting XSS vulnerabilities that only become exploitable at render time; supported engines: Jinja2, Razor, FreeMarker, EJS, Handlebars, Pug, Thymeleaf, Twig, Mustache, and Velocity. • Adds or improves Java library coverage for Apache CXF (including HTTP transport), OkHttp, Spring Security OAuth2 Client, Google OAuth Client, Google API Client, MSAL4J, Apache Commons Collections, Flyway, JAXB, and SAP Commerce (Hybris) FlexibleSearch queries with safe parameter binding. • Recognizes Python LangChain LiteLLM as a source of untrusted data. • Adds support for analyzing Java 25 source code. • Extends detection coverage for Java, Kotlin, C#, Go, JavaScript, and PHP with additional sources, sinks, and unsafe API patterns, particularly for cryptography. Breaking changes: • Committed files matched by a `.gitignore` rule are now included in analysis across all interfaces and this cannot be disabled. CLI scans require an upgrade to Snyk CLI 1.1307.0 or later; earlier versions retain the previous behavior, causing CLI results to differ from SCM and web results. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk-code https://updates.snyk.io/code-ignore-approval-workflow/ https://updates.snyk.io/code-ignore-approval-workflow/ Mon, 03 Aug 2026 14:00:00 GMT Snyk Code gains Ignore Approval Workflow (IAW): ignores now require reviewer sign-off before taking effect. • Adds Ignore Approval Workflow (IAW) so developer-submitted ignores become Pending requests requiring explicit reviewer approval or rejection before being applied. • Enables ignore requests to be submitted from the CLI, IDE, or API — a reason is required on every submission. • New Ignore Requests page in the web UI lets reviewers approve or reject pending ignore requests in one place. • Supports reviewer auto-approval for ignores they create themselves, bypassing the triage queue. • Introduces granular ignore permissions (read / create / edit / review / delete) with Collaborators defaulting to request and Admins to review; custom roles supported. • Exposes ignore-request data via the audit-logs API for full auditability and export. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk-code https://updates.snyk.io/cobol-support-for-snyk-code/ https://updates.snyk.io/cobol-support-for-snyk-code/ Fri, 31 Jul 2026 08:00:00 GMT Snyk Code adds COBOL SAST, Python LangChain & Lambda support, Spring Data taint tracking, and new framework coverage. • Adds generally available SAST scanning for fixed-format COBOL, bringing mainframe applications into the same CLI, IDE, SCM, and PR-check workflows used for other languages. • Adds Python LangChain support, flagging unsafe data flows through LangChain applications. • Adds Python serverless support for applications running on AWS Lambda. • Adds weak-hash detection and detection of debug features left enabled. • Adds Java Spring Data taint-source tracking, enabling injection, SSRF, path-traversal, and XSS findings for data flowing from Spring Data repositories. • Adds framework recognition for vert.x, Jolokia, and Spring Cloud Config Client. Breaking changes: • The COBOL preview flag is removed at general availability; COBOL scanning now runs automatically across all repositories, and new findings may appear in repositories not previously scanned. • Fix examples no longer appear in Fix analysis in the Snyk Web UI and no longer appear in SARIF output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk-code https://updates.snyk.io/rule-extensions-for-snyk-code-is-now-generally-available/ https://updates.snyk.io/rule-extensions-for-snyk-code-is-now-generally-available/ Wed, 15 Jul 2026 08:00:00 GMT Snyk Code Rule Extensions now GA: register custom sanitizers via UI or REST API to eliminate false positives from your own security controls. • Supports custom sanitizer registration — define in-house sanitizer functions so Snyk Code recognizes them as valid data-cleaning paths and stops flagging code already protected by your controls. • New in-product UI for defining and managing custom sanitizers, including an FQN (fully-qualified name) builder to pinpoint exact functions. • New public REST API for managing and previewing rule extensions programmatically, enabling automation and agent-driven configuration at scale. • New impact-test API lets practitioners preview how a rule extension change affects findings before applying it to the team. Breaking changes: • Closed-beta customers must complete migration steps before using the GA release of Rule Extensions — see the documentation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/snyk-code