Snyk

No entries match these filters. Clear filters

1. changelog Oct 29, 2026 · issue 125

   Snyk API & Web now runs security header, cookie attribute, and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS checks against every Extra Host configured on a target⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ BREAKING ON UPGRADE

   • !Scans of targets with Extra Hosts configured will now report new security header, cookie attribute, and SSL/TLS findings for those hosts — existing targets may show new findings on their next scan even if nothing on the target has changed.
2. changelog Oct 14, 2026 · issue 109

   Snyk CLI v1.1308.1 adds a Pending Ignore Request status and filter to the Project Issues page, plus API support for pending ignore status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Review all findings awaiting an ignore approval decision without manually scanning every issue in the Project view.
   📍In the Snyk UI, open a Project › Issues page, then select the Pending Ignore filter (alongside Open and Ignored) to show only findings with a submitted-but-not-yet-approved ignore request.
   • Adds pending as a reportable ignore status in the issues API, enabling programmatic distinction between open, pending, and ignored findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a Pending Ignore Request status indicator on the Project's Issues page and in issue details when a finding is awaiting Ignore Approval Workflow review.
   • Adds a Pending Ignore filter to the Issues list alongside the existing Open and Ignored filters, so reviewers can triage the pending-approval queue without scanning every issue.
   • Adds pending as a reportable ignore status in the issues API, enabling programmatic distinction between open, pending, and ignored findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

3. changelog Oct 2, 2026 · issue 092

   Snyk adds signed macOS .pkg and Windows .msi ADSADSAlternate Data Streams: an NTFS feature that lets a file carry hidden secondary data blobs under the same path, giving cyber tools a place to stash metadata or detect covert storage by malware. installers plus a new Snyk API & Web DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scanning capability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Deploy the ADS agent on a macOS developer machine without MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. by using the new signed installer and your Tenant ID and push key.
   📍In Evo, open Settings, choose your products, and select Save & Publish. Choose macOS and your architecture, then select Download ADS Installer. Install the .pkg, then run the installer with your Tenant ID and push key.
   • Adds signed macOS .pkg and Windows .msi packaged installers for the ADS (Agent Supply Chain Security) agent, downloadable from the Settings page in Evo, eliminating the need to wrap a downloaded file in a custom script.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • The ADS installer registers a scheduled job on the host machine so Agent Supply Chain Security scans run on their own schedule without requiring MDM.
   • Introduces Snyk API & Web, a new dynamic application security testingdynamic application security testingDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. (DAST) scanning capability supporting web targets, API targets (Postman Collection, RAML, Bruno Collection in OpenCollection format), and authentication methods including basic auth, login form, login sequence, two-factor authentication, OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth., Postman, GraphQL, and mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with..
   • Adds signed macOS .pkg and Windows .msi packaged installers for the ADS (Agent Supply Chain Security) agent, downloadable from the Settings page in Evo, eliminating the need to wrap a downloaded file in a custom script.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces Snyk API & Web, a new dynamic application security testingdynamic application security testingDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. (DAST) scanning capability supporting web targets, API targets (Postman Collection, RAML, Bruno Collection in OpenCollection format), and authentication methods including basic auth, login form, login sequence, two-factor authentication, OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth., Postman, GraphQL, and mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with..

   1 more in Everything

4. ADS installer now available as a packaged binary (2026-10-01) Oct 1, 2026 · release notes

   Snyk ADSADSAlternate Data Streams: an NTFS feature that lets a file carry hidden secondary data blobs under the same path, giving cyber tools a place to stash metadata or detect covert storage by malware. installer now available as a signed macOS .pkg and Windows .msi from the Settings page

5. Announcing Snyk CLI v1.1307.4 (2026-09-23) Sep 23, 2026 · release notes

   Adds snyk studio command and --agentic filtering flags to snyk fix.

   └──▷ TRY IT
   Install Snyk Studio in your AI coding tool to scan generated code automatically.
   copy

   $ snyk studio install --experimental

   • snyk studio install --experimental adds a new command that sets up Snyk Studio in supported AI coding tools (Cursor, Claude Code, Codex, Copilot, Gemini, Kiro, and Windsurf) for background scanning of generated code.

   1 detail in Everything

6. changelog Sep 23, 2026 · issue 083

   Snyk: Introduces Evo by Snyk with an MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. surface for agentic security use cases.

   └──▷ TRY IT
   Automatically apply and verify fixes for detected vulnerabilities in an agentic pipeline without manual review steps.
   copy

   $ snyk fix --agentic

   • Migrates Snyk for Jira from Atlassian Connect to Forge, Atlassian's current cloud app platform, ahead of Atlassian's December 2026 end-of-support deadline.

   1 more in Everything

7. changelog Sep 23, 2026 · issue 083

   Snyk's Evo gains an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server so Claude, Codex, or Cursor can query your AI asset estate and manage policies in-agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Apply and verify a vulnerability fix in an agentic CI pipeline without manual review steps.
   copy

   $ snyk fix --agentic

   • Adds the Evo MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. (GA), letting any MCP client — Claude, Codex, Cursor — query discovered AI assets across code, developer machines, and pentest targets, inspect asset relationships (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ which MCP servers an agent uses), and read or write policies without leaving the agent.
   • Adds snyk fix --agentic CLI command, which applies and verifies vulnerability fixes.
   • Adds DNS TXTDNS TXTA DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. record verification as a method to confirm domain ownership for Snyk API & Web targets.
   • Adds Snyk Studio, which embeds security directives into AI-assisted development workflows.
   • Adds an IDE Plugin Compatibility Matrix documenting compatible Snyk CLI version ranges for each IDE plugin version released in the past 12 months.

   5 details in Everything

8. Evo MCP Server now available (2026-09-22) Sep 22, 2026 · release notes

   Snyk Evo now offers a General Availability MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. for agent integration

   • General availability of the evo-mcp-server enabling any MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. client (Claude, Codex, Cursor) to connect to Snyk Evo
   • New capability to query discovered AI assets across code, developer machines, and pentest targets via the MCP interface
   • Ability to visualize asset connections (e.g., which MCP servers an agent uses) through the new server
   • Support for reading policies and open violations directly within the connected MCP client
   • Capability to create and update policies without leaving the MCP agent environment

   5 details in Everything

9. changelog Sep 18, 2026 · issue 078

   Snyk CLI v1.1307.3 adds per-project .snyk policy resolution; API & Web gains custom internal CA upload for DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Upload your organisation's internal Root CA so DAST scans trust internally-issued certificates and avoid false positives on internal or internet-facing targets.
   📍In the Snyk Web UI, go to your organisation settings and navigate to Add a custom CA certificate, then upload your Root CA file so every subsequent scan verifies certificates against it alongside the public trust store.
   • Adds support for uploading your organization's internal Root CA certificate in Snyk API & Web, so certificates it issues are trusted during DAST scans alongside the public trust store.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • snyk test now reports an unreadable .snyk policy file as error code SNYK-POLICY-0002 with a descriptive message instead of an unspecified error.
   • Adds support for uploading your organization's internal Root CA certificate in Snyk API & Web, so certificates it issues are trusted during DAST scans alongside the public trust store.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

10. Announcing Snyk CLI v1.1307.3 Sep 18, 2026 · release notes

    Snyk CLI v1.1307.3 adds structured error reporting for unreadable .snyk policies and per-project policy resolution for --all-projects

    • snyk test now reports an unreadable .snyk policy file as SNYK-POLICY-0002 with a descriptive message instead of an unspecified error

    1 detail in Everything

11. Container: Go standard library vulnerability reporting (2026-09-16) Sep 16, 2026 · release notes

    Snyk Container now reports Go standard library vulnerabilities in container images as stdlib dependencies. Requires Snyk CLI v1.1303.2+ for CLI support.

    • Adds stdlib dependency reporting for Go binaries in container images, identifying the compiled standard library version (e.g., stdlib@1.25.10) and its vulnerabilities.
    • Extends detection to standard, stripped, and CGo builds of Go binaries within containers, closing coverage gaps previously only visible via distro advisories.

    2 details in Everything

12. docs update Sep 15, 2026 · issue 075

    Snyk adds Secrets scanning, a Remediation Agent, custom regex rules, AI/agent access docs, AIBOMAIBOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk. API, and a Unified IDE Configuration Dialog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • New AIBOM API endpoints let practitioners retrieve AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. data via the Snyk API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • New AccessRequests API endpoints expose access-request management programmatically.
    • New Export API endpoints enable programmatic export of scan data.
    • New Findings API endpoints provide direct programmatic access to findings results.
    • Adds Snyk Secrets scanning, which detects hard-coded secrets in SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. repositories and pull requests including during PR checks.

    +5 more show less

    • Adds Custom RegEx for Secrets, allowing organizations to define custom regex rules to detect secrets specific to their environment.
    • Adds a Remediation Agent that automatically generates, applies, and verifies vulnerability fixes in Projects.
    • Adds a Unified IDE Configuration Dialog to configure all Snyk IDE plugins from a single interface.
    • Adds AI and agent access support, including an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, llms.txtllms.txtA proposed convention for a plain-text file placed at a website's root to give LLMs a concise, structured summary of the site's content, helping AI agents navigate it more reliably than parsing raw HTML., Markdown page URLs, and content negotiation so AI assistants and agents can read Snyk documentation.
    • Adds DNS TXTDNS TXTA DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. record domain ownership verification for configuring targets.

    10 details in Everything

13. Custom CA Certificate Support Sep 15, 2026 · release notes

    Snyk DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. now allows uploading an internal Root CA to prevent false positives from untrusted internal certificates.

    • Adds support for uploading a custom Root Certificate Authority (CA) in Snyk API & Web

    1 detail in Everything

14. Announcing Snyk CLI v1.1307.1 Sep 7, 2026 · release notes

    Snyk CLI v1.1307.1 adds source repository info for locally built images and specific error handling fixes.

    • Container scans now surface source repository information for locally built images using BuildKitBuildKitA build engine for Docker images, maintained by Moby, that replaces the legacy Docker builder with parallel layer execution, cache mounts, and secret handling — giving cyber tools faster, more reproducible container builds. metadata.

    1 detail in Everything

15. changelog Sep 5, 2026 · issue 065

    Snyk Assist brings an AI-powered support and guidance assistant — including vulnerability lookups and support case creation — directly into the Snyk UI.

    └──▷ HOW TO FIND IT
    When onboarding a new team and unsure which GitHub permissions Snyk requires, ask Assist in plain language to get a documentation-grounded answer without leaving the product.
    📍In the Snyk UI (new navigation), click the Snyk Assist icon in the top right corner, then type: 'What permissions does Snyk need for my GitHub org?'
    When you need to audit which integrations are connected and their status for your current org, query Snyk Assist instead of navigating through settings screens.
    📍In the Snyk Assist panel, type: 'Show me the integrations and their connectivity status for my current organization.'
    When triaging a dependency and needing quick vulnerability data, ask Snyk Assist to look up known CVEs for a specific package version against the Snyk Vulnerability Database.
    📍In the Snyk Assist panel, type: 'What known vulnerabilities exist for lodash version 4.17.20?'
    • Adds Snyk Assist, an AI-powered assistant accessible from the top right of every page in the new Snyk UI, answering product, setup, and troubleshooting questions grounded in Snyk documentation, release notes, and support knowledge articles — available on Team, Ignite, and Enterprise plans.
    • Enables read-only account information retrieval via Snyk Assist: issue summaries by severity, issue triage and single-issue detail, projects and import targets, collections and container images, scan settings, integrations and their connectivity status, members and their roles, and a project's current ignore rules — scoped to the current organization and group using your existing permissions.
    • Allows Snyk Assist to look up known vulnerabilities for a package or specific package version against the Snyk Vulnerability Database without leaving the UI.
    • Allows Snyk Assist to suggest and create a support case from within the conversation, returning the case ID and link, and to capture unsupported capabilities as feature requests.

    4 details in Everything

16. changelog Aug 31, 2026 · issue 062

    Snyk Repo Content Sync (GA) automatically creates and deactivates Projects as manifest, Dockerfile, and IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. files are added, moved, or removed from monitored branches.

    └──▷ HOW TO FIND IT
    Permanently suppress a deleted Project from being recreated by sync when its source file still exists in the repo.
    📍In the Snyk UI, open the Project you want to remove, click Delete, and in the delete dialog select the option 'exclude it from future scans' before confirming.
    • Introduces Repo Content Sync (GA for Enterprise plans): Snyk automatically creates Projects for newly merged manifest, Dockerfile, and IaC configuration files, and deactivates Projects whose files are removed or renamed — no manual re-import required.
    • Repo Content Sync is on by default for Enterprise organizations with no configuration required; organizations already opted in through Snyk Preview retain their existing setting.

    2 details in Everything

17. Snyk Projects now stay in sync with your repository content (2026-08-31) Aug 31, 2026 · release notes

    Snyk Projects now automatically syncs with repository content (manifests, Dockerfiles, configs) via Repo Content Sync.

    └──▷ HOW TO FIND IT
    Verify project inventory automatically reflects current repository state without manual re-imports.
    📍Check Snyk Projects list in UI or API; new files trigger Project creation, removed files trigger deactivation.
    • Repo Content Sync automatically creates and monitors Snyk Projects for newly added manifest, Dockerfile, and configuration files when merged to monitored branches
    • Deactivates Snyk Projects associated with removed or renamed source files in the repository
    • Sync covers Code, open source, secrets, infrastructure as code, and container (Dockerfile) Projects across default and custom branches

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Upon GA, previously deleted projects that were not removed from SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. might reappear and require permanent deletion via the option to 'exclude it from future scans'
18. Announcing Snyk CLI v1.1307.0 (2026-08-26) Aug 26, 2026 · release notes

    Snyk CLI v1.1307.0 adds snyk agent command, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. suppression metadata, and .snyk exclusions

    └──▷ USE IT
    Run an AI-agent-optimized scan across all domains in one pass.
    shell copy

    snyk agent test

    Filter AI BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. results to only show high severity issues in JSON output.
    shell copy

    snyk aibom test --severity-threshold high

    • snyk agent test runs Snyk Open Source, Code, and Secrets together in a new experimental AI-optimized scanning surface.
    • Adds exclude section support to .snyk config file for skipping paths during snyk secrets test scans.
    • SARIF suppression output now includes reviewedOn and reviewedBy metadata fields for Code & Secrets findings.
    • snyk aibom test --severity-threshold <level> filters displayed and JSON results by severity, not just exit codes.

    4 details in Everything

19. changelog Aug 26, 2026 · issue 057

    Snyk Evo now scopes repository, asset, and issue visibility to a user's Snyk Organizations via existing role hierarchy.

    • The Tenant Viewer role now grants scoped read-only access to assets and issues limited to the Organizations the user belongs to, replacing the previous full-Tenant visibility.
    • The Tenant Member role now carries no Evo access, enabling administrators to withhold Evo without removing a user's broader Snyk platform access.
    • New users default to Tenant Member on join, requiring an explicit role change to gain any Evo access.
    • Organization names now appear alongside repositories in Evo, disambiguating the same repository imported into multiple Organizations.
    • Assets without an assigned Organization — currently all Agent Supply Chain Security and Continuous Offensive Security data — are hidden from scoped users.

    5 details in Everything

20. Organization-scoped access in Evo (2026-08-25) Aug 25, 2026 · release notes

    Evo now scopes user visibility to specific Snyk Organizations via Tenant Viewer and Member roles

    • Tenant Viewer role now grants read access only to assets and issues in Organizations the user belongs to, limiting visibility outside those groups
    • Tenant Member role grants no Evo access, allowing administrators to withhold Evo capabilities without removing broader Snyk platform access
    • Organization names are now displayed alongside repositories in the UI to distinguish imports across multiple Organizations

    3 details in Everything

21. changelog Aug 24, 2026 · issue 055

    Snyk rolls out a redesigned UI with unified navigation, Cmd/Ctrl+K command search, and Dark Mode.

    └──▷ HOW TO FIND IT
    Jump directly to any Snyk page or setting without navigating the sidebar — useful after the sidebar is condensed to core areas only.
    📍In the Snyk UI, press Cmd+K (macOS) or Ctrl+K (Windows/Linux), then type the name of the setting or page you want (e.g. Integrations or Policies) and select the result.
    Enable Dark Mode for a consistent dark-themed experience across Snyk and other dark-mode-enabled cyber tools.
    📍In the Snyk UI, open the user account menu (top-right), navigate to appearance preferences, and select Dark (or System) from the Dark Mode options.
    • Adds Cmd/Ctrl+K navigation search to jump directly to any page or setting without menu-hunting.
    • Introduces Dark Mode (System/Light/Dark) selectable from the user account menu, consistent across all pages.
    • Replaces the classic multi-scope sidebar with a single breadcrumb bar supporting one-click scope switching via per-level drop-downs for Tenant, Group, and Organization.
    • Consolidates all settings-related pages into a single context-aware Settings hub, with the left sidebar condensed to core areas: Analytics, Inventory, Projects, Issues, Policies, and Settings.
    • Users can toggle freely between classic and new navigation via the user account menu.

    5 details in Everything

22. Snyk Code September Update (2026-08-21) Aug 21, 2026 · release notes

    Snyk Code now analyzes template files and committed .gitignore entries; CLI requires v1.1307.0.

    • Adds analysis of template engines (Jinja2, Razor, FreeMarker, EJS, Handlebars, Pug, Thymeleaf, Twig, Mustache, Velocity) to detect cross-site scriptingcross-site scriptingCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. across application-to-template data flows
    • Extends Java framework and library support to include Apache CXF, OkHttp, Spring Security OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. Client, Google OAuth/API Clients, MSAL4J, Apache Commons Collections, Flyway, JAXB, and SAP Commerce (Hybris)
    • Recognizes Python LangChain LiteLLM as a source of untrusted data
    • Enables analysis of Java 25 source code
    • Analyzes committed files matched by .gitignore rules and detects secrets in them, applying across all interfaces

    5 details in Everything

23. changelog Aug 19, 2026 · issue 050

    Evo by Snyk replaces Risk Index with a 0–1,000 impact-weighted model risk score and adds Continuous Offensive Security (COS) capability.

    • Introduces Continuous Offensive Security (COS) in Evo by Snyk, a new offensive scanning capability covering Targets, Scans, and Findings and Reports — with dedicated docs for defining target scope, configuring authentication, managing targets, monitoring scans, and interpreting results.
    • Replaces the previous Risk Index with a new model risk score (0–1,000) that combines attack success rate with impact weighting, tested across prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools., data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., and insecure code generation attack categories.
    • Adds four severity bands to the model risk score: low (0–249), medium (250–499), high (500–749), and critical (750–1,000) for at-a-glance triage.
    • Maps model risk findings to OWASP LLM Top 10OWASP LLM Top 10A ranked list of the ten most critical security risks specific to large language model applications, maintained by OWASP, giving cyber tool developers a shared taxonomy for prioritizing LLM attack surfaces., OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Agentic Security, MITRE ATLASMITRE ATLASA MITRE-maintained knowledge base of adversarial tactics and techniques targeting AI and machine learning systems, modelled on ATT&CK, giving cyber tools a structured taxonomy for AI-specific threat modelling., and NIST AI 600-1/100-2e2025 compliance frameworks via new Framework mappings documentation.
    • Enables custom policies in Evo scoped to specific attack categories or goals, in addition to automatically applied default policies across common attack categories.

    +2 more show less

    • Adds a snyk fix CLI command (new docs page added at commands/fix.md).
    • Introduces a Remediation Agent capability (new docs at agent-security/remediation-agent/remediation-agent.md).

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Policies built on the old Risk Index remain visible but no longer evaluate under the new model risk score — existing Risk Index-based policies must be reviewed and recreated against the new model risk score to keep enforcement active.
24. New model risk scoring for AI models in Evo (2026-08-19) Aug 19, 2026 · release notes

    Snyk Evo GA replaces Risk Index with a new impact-weighted model risk score (0-1000) mapped to OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. and MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. frameworks.

    • Introduces a new impact-weighted model risk score ranging from 0–1,000 that combines attack success rate with potential impact
    • Adds four severity bands (low: 0–249, medium: 250–499, high: 500–749, critical: 750–1,000) for immediate triage
    • Maps findings to OWASP LLM Top 10OWASP LLM Top 10A ranked list of the ten most critical security risks specific to large language model applications, maintained by OWASP, giving cyber tool developers a shared taxonomy for prioritizing LLM attack surfaces., OWASP Agentic Security, MITRE ATLASMITRE ATLASA MITRE-maintained knowledge base of adversarial tactics and techniques targeting AI and machine learning systems, modelled on ATT&CK, giving cyber tools a structured taxonomy for AI-specific threat modelling., and NIST AI 600-1/100-2e2025 frameworks
    • Allows creation of custom policies scoped to specific attack categories or goals for new model risk scoring

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The previous Risk Index is replaced by the new model risk score, and policies built on the old Risk Index remain visible but no longer evaluate under the new scoring.
25. Snyk Assist— AI-powered support and guidance, built into Snyk (2026-08-18) Aug 18, 2026 · release notes

    Snyk Assist adds an AI-powered support and guidance assistant directly in the new Snyk UI for troubleshooting and account info.

    └──▷ HOW TO FIND IT
    Ask natural language questions about SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. setup, permissions, or ignore rules directly in the UI.
    📍Open Snyk Assist (top right) and ask: 'How do I set up SSO?'
    Look up known vulnerabilities for a specific package or version using the built-in assistant.
    📍Open Snyk Assist and ask: 'What are the known vulnerabilities for lodash 4.17.21?'
    • Adds Snyk Assist, an AI-powered support and guidance assistant available directly inside the new Snyk UI.
    • Enables vulnerability lookups against the Snyk Vulnerability Database via the assist interface for packages or specific versions.

    2 details in Everything

26. Unified Navigation, Navigation search and Dark Mode — New Snyk UI Rollout! (2026-08-17) Aug 17, 2026 · release notes

    New Snyk UI adds unified breadcrumb navigation, Cmd/Ctrl+K command search, and Dark Mode.

    └──▷ HOW TO FIND IT
    Quickly locate a specific setting or page in the condensed sidebar without clicking through menus.
    📍Press Cmd+K (Mac) or Ctrl+K (Windows/Linux) to open the navigation search and type your target.
    Enable a dark theme for the Snyk interface to match your other developer tools.
    📍Navigate to User Account menu › select Dark (or System/Light) mode.
    • Cmd/Ctrl+K command search to jump directly to any page or setting
    • Dark Mode option (System/Light/Dark) under the user account menu
    • Unified breadcrumb bar for one-click scope switching across Tenant, Group, and Organization

    3 details in Everything

27. Announcing Snyk CLI v1.1306.4 Aug 13, 2026 · release notes

    Snyk CLI v1.1306.4 improves proxy diagnostics with the attempted URL, redacted credentials, and SNYK-CLI-0028.

28. changelog Aug 6, 2026 · issue 037

    Snyk API & Web adds NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. v2 authentication support, enabling authenticated DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans of Windows-protected internal applications.

    └──▷ HOW TO FIND IT
    Enable authenticated scanning of a Windows NTLM-protected internal application that was previously unscanned.
    📍In the Snyk web UI, go to Target Settings › Authentication tab, locate the Basic Auth / NTLM module, select the NTLM option, and enter the username, password, domain, and workstation credentials for the target application.
29. NTLM Authentication in Snyk API & Web (2026-08-05) Aug 5, 2026 · release notes

    Snyk API & Web adds NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. v2 auth for web targets via UI settings

    └──▷ HOW TO FIND IT
    Scan an internal Windows application protected by NTLM directly from Snyk without external tools.
    📍Navigate to Target Settings › Authentication tab, select the Basic Auth / NTLM module, and choose the NTLM option to configure credentials.
    • Enables authenticated scans of Windows-authenticated applications by supporting NTLM v2 authentication for Web targets

    1 detail in Everything

30. Snyk secrets scanner reaches general availability Aug 5, 2026 · release notes

    Snyk secrets scanner reaches general availability from August 4, 2026, with ML-driven detection across development surfaces.

    • Adds general availability for Snyk secrets scanner to detect hardcoded credentials, API keys, and tokens in repositories.
    • Enables machine learning driven detection of secrets in both human-written and AI-generated code.
    • Provides governance and finding management directly within the Snyk web UI.

    3 details in Everything

31. Governed ignores with Ignore Approval Workflow (IAW) Aug 3, 2026 · release notes

    Governed ignores with Ignore Approval Workflow (IAW) now generally available for Snyk Code.

    • Enables the Ignore Approval Workflow where suppressing a finding becomes a reviewable request rather than an immediate action
    • Adds support for submitting ignore requests directly from the CLI, IDE, or API with a mandatory reason field
    • Creates the Ignore Requests web page for reviewers to approve or reject pending suppressions
    • Supports granular access control via roles (read / create / edit / review / delete) for ignore management

    4 details in Everything

32. docs update Jul 31, 2026 · issue 031

    Snyk Secrets launches with CLI, IDE, SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows., and PR-check scanning for exposed secrets plus custom RegEx support.

    └──▷ TRY IT
    Scan a codebase for exposed secrets from the CLI to catch leaked credentials before they reach production.
    copy

    $ snyk secrets test

    • New Snyk Secrets product scans codebases for exposed secrets across CLI, IDE, SCM, and pull request checks.
    • Supports secrets scanning in Visual Studio Code and JetBrains IDEs.
    • Adds snyk secrets test CLI command to scan codebases for exposed secrets.
    • Integrates secrets scanning directly into SCM (source code management) workflows.
    • Supports Custom RegEx rules for secrets detection, allowing teams to define organisation-specific secret patterns.

    5 details in Everything

33. COBOL support for Snyk Code Jul 31, 2026 · release notes

    Snyk Code announces general availability of fixed-format COBOL scanning from August 17, 2026, across CLI, IDE, SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows., and PR-check integrations.

    • At general availability on August 17, 2026, removes the COBOL preview flag and enables automatic COBOL scanning across all repositories.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !At general availability on August 17, 2026, the COBOL preview flag is removed and scanning runs automatically across all repositories, potentially adding findings in repositories outside the preview.
34. Snyk Code August Update Jul 30, 2026 · release notes

    Snyk Code announces LangChain and AWS Lambda Python coverage plus new detections, available August 17, 2026.

    • LangChain support for Python, flagging unsafe handling of data flowing through the framework
    • Serverless support for Python applications running on AWS Lambda
    • New weak-hash detection
    • New detection for debug features left enabled
    • Spring Data coverage tracking data read through Spring Data repositories as a taint source

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Fix examples no longer appear in Fix analysis in the Snyk Web UI or in SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output
35. changelog Jul 28, 2026 · issue 028

    Snyk DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. gains AI-powered authenticated scan setup and native Bruno collection support for API targets.

    └──▷ HOW TO FIND IT
    Set up an authenticated DAST scan without manually recording login flows — use the AI-powered configuration to handle login sequences and 2FA in minutes.
    📍In the Snyk console, go to your DAST target settings, select Automatic Target Authentication Configuration, enter your credentials in the dedicated credential fields, and optionally provide natural-language instructions for complex login scenarios.
    Onboard a Bruno-based API collection as a Snyk API Target without converting files to Postman or OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth..
    📍In the Snyk console, navigate to API & Web › API Targets › Create Target, select Bruno Collection, and upload your collection as a ZIP file or folder.
    • Adds Automatic Target Authentication Configuration for DAST: AI-driven setup automatically generates login sequences, handles 2FA, and maps CSS selectors, with natural-language instructions for complex scenarios.
    • Supports native Bruno collection imports for API Targets — upload via ZIP or folder without converting to Postman or OpenAPI formats first.
    • Syncs Bruno collection environments automatically and warns when variables are missing required secret values during import.

    3 details in Everything

36. docs update Jul 28, 2026 · docs issue 004
37. docs update Jul 24, 2026 · issue 024

    Snyk launches Snyk Studio (agentic security), Evo AI-SPMAI-SPMAI Security Posture Management: a discipline for continuously discovering, assessing, and remediating risks across AI pipelines, models, and data, giving cyber tools a structured way to govern AI infrastructure the way CSPM governs cloud. platform, Bruno Collection API scanning, and a unified IDE configuration dialog.

    └──▷ HOW TO FIND IT
    Configure a Snyk API and Web scan target using a Bruno Collection for dynamic-auth API security testing.
    📍In the Snyk console, go to Scan & Fix › Snyk API & Web › Targets › Add Target › API Target, select Bruno Collection, upload your OpenCollection file, then go to Configure Authentication › Bruno Collection Authentication to set up dynamic token generation.
    Integrate an AI coding agent with Snyk Studio to enforce security guardrails during agentic development.
    📍In the Snyk console, go to Agent Security › Agentic Security with Snyk Studio, then select the quickstart guide for your agent (e.g., Cursor, Claude Code, or GitHub Copilot) and follow the Directives setup to enable security policies.
    Gain visibility into AI assets and assess risk posture across your AI supply chain using Evo by Snyk.
    📍In the Snyk console, go to Agent Security › Evo by Snyk › AI-SPM › AI Asset Visibility to review discovered AI assets, then navigate to Risk Intelligence to triage findings by severity.
    • Introduces Snyk Studio, an agentic security platform with quickstart guides for 20+ AI coding agents including Cursor, Devin, GitHub Copilot, Claude Code, Gemini CLI, and Amazon Q.
    • Adds Evo by Snyk, a new AI Security Posture Management (AI-SPM) platform surface with inventory, policies & issues, reports, AI asset visibility, and risk intelligence.
    • Launches Agentic Development Security (ADSADSAlternate Data Streams: an NTFS feature that lets a file carry hidden secondary data blobs under the same path, giving cyber tools a place to stash metadata or detect covert storage by malware.) within Evo, covering Agent Supply Chain Security, Agent Behavior Governance, and Trusted Output Assurance.
    • Adds support for scanning API targets using Bruno Collections in OpenCollection format, including dynamic token generation for authentication.
    • Introduces a Unified IDE Configuration Dialog for setting authentication, CLI, trust, and Project defaults across Eclipse, JetBrains, Visual Studio, and VS Code Snyk plugins.

    +2 more show less

    • Adds Snyk Studio usage analytics and distribution-at-scale capabilities for agentic security deployments.
    • Adds integration coverage for Anthropic's Claude Enterprise under the Cloud AI Platforms security category.

    7 details in Everything

38. docs update Jul 24, 2026 · docs issue 004

    Snyk launches Snyk Studio (agentic security), Evo AI-SPMAI-SPMAI Security Posture Management: a discipline for continuously discovering, assessing, and remediating risks across AI pipelines, models, and data, giving cyber tools a structured way to govern AI infrastructure the way CSPM governs cloud. platform, Bruno Collection API scanning, and a unified IDE configuration dialog.

    └──▷ HOW TO FIND IT
    Configure a Snyk API and Web scan target using a Bruno Collection for dynamic-auth API security testing.
    📍In the Snyk console, go to Scan & Fix › Snyk API & Web › Targets › Add Target › API Target, select Bruno Collection, upload your OpenCollection file, then go to Configure Authentication › Bruno Collection Authentication to set up dynamic token generation.
    Integrate an AI coding agent with Snyk Studio to enforce security guardrails during agentic development.
    📍In the Snyk console, go to Agent Security › Agentic Security with Snyk Studio, then select the quickstart guide for your agent (e.g., Cursor, Claude Code, or GitHub Copilot) and follow the Directives setup to enable security policies.
    Gain visibility into AI assets and assess risk posture across your AI supply chain using Evo by Snyk.
    📍In the Snyk console, go to Agent Security › Evo by Snyk › AI-SPM › AI Asset Visibility to review discovered AI assets, then navigate to Risk Intelligence to triage findings by severity.
    • Introduces Snyk Studio, an agentic security platform with quickstart guides for 20+ AI coding agents including Cursor, Devin, GitHub Copilot, Claude Code, Gemini CLI, and Amazon Q.
    • Adds Evo by Snyk, a new AI Security Posture Management (AI-SPM) platform surface with inventory, policies & issues, reports, AI asset visibility, and risk intelligence.
    • Launches Agentic Development Security (ADSADSAlternate Data Streams: an NTFS feature that lets a file carry hidden secondary data blobs under the same path, giving cyber tools a place to stash metadata or detect covert storage by malware.) within Evo, covering Agent Supply Chain Security, Agent Behavior Governance, and Trusted Output Assurance.
    • Adds support for scanning API targets using Bruno Collections in OpenCollection format, including dynamic token generation for authentication.
    • Introduces a Unified IDE Configuration Dialog for setting authentication, CLI, trust, and Project defaults across Eclipse, JetBrains, Visual Studio, and VS Code Snyk plugins.

    +2 more show less

    • Adds Snyk Studio usage analytics and distribution-at-scale capabilities for agentic security deployments.
    • Adds integration coverage for Anthropic's Claude Enterprise under the Cloud AI Platforms security category.

    7 details in Everything

39. Automatic Target Authentication Configuration for Snyk API & Web Jul 23, 2026 · release notes

    Adds AI-driven automatic authentication configuration for Snyk DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans to streamline setup

40. Rule Extensions for Snyk Code is now generally available Jul 15, 2026 · release notes

    Snyk Code makes Rule Extensions generally available to Enterprise customers for custom sanitizers managed through the UI or public REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..

    • Adds Rule Extensions capability to extend Snyk Code's security rules with custom code

    1 detail in Everything

41. Announcing Snyk CLI v1.1306.0 (2026-07-09) Jul 9, 2026 · issue 014

    Snyk CLI v1.1306.0 adds a new snyk doctor diagnostic command, broader Java/JVMJVMThe Java Virtual Machine, a runtime maintained by Oracle (and implemented by others) that executes Java bytecode on any OS, giving cyber tools a portable, garbage-collected environment with a large ecosystem of libraries. and .NET container scanning, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. breakability evaluation on by default.

    └──▷ TRY IT
    Quickly diagnose CLI configuration or environment issues before opening a support ticket.
    copy

    $ snyk doctor

    • New snyk doctor command diagnoses common CLI problems by generating a diagnostic report for your system or analyzing debug log output.
    • Container scans now detect the Java runtime version across a wider range of JVM base images.
    • Container scans can now find vulnerabilities in .NET application dependencies.
    • The breakability evaluation tool in the Snyk MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. is now enabled by default and no longer requires an experimental flag.
    • Shows a warning when a request is automatically retried due to rate limiting, improving visibility into throttled scans.

    5 details in Everything

42. Support for Bruno Collections in API Targets Jul 7, 2026 · release notes

    Snyk adds native Bruno collection imports for API Targets

    • Adds direct import of Bruno collections as API Targets via ZIP file or folder upload
    • Enables automatic environment variable syncing with warnings for missing secret values during Bruno collection import
    • Supports authentication derived from Bruno collections or custom authentication scripts for API Targets

    3 details in Everything

43. Snyk Open Source ecosystem coverage update Jun 28, 2026 · release notes

    Snyk Open Source adds native uv package manager support and private dependency scanning for Go.

    • Adds uv package manager support in SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations, enabled for Groups and Organizations through Snyk Preview.
    • Adds support for Go private dependencies via Broker or direct connections

    2 details in Everything

44. Snyk Code: July Release, C++ rules, Java library coverage, and JavaScript Insecure Transmission (2026-06-26) Jun 26, 2026 · issue 014

    Snyk Code adds 6 new C++ rules, broader C++ native detection, expanded Java library coverage, and a JS/TS Insecure Transmission rule.

    • New C++ rule: Log Forging (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-117, high) — detects untrusted user input reaching logging sinks, enabling log forgery or corruption.
    • New C++ rule: Improper Privilege Management (CWE-269, high) — flags unverified privilege-dropping calls that may leave processes running with elevated privileges.
    • New C++ rule: Missing Authorization (CWE-862/CWE-732) — detects world-writable/world-executable file permissions and root UID/GID passed to privilege-escalation or file-ownership functions.
    • New C++ rule: SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS Certificate Verification Bypass (CWE-295, medium) — detects disabled certificate verification across OpenSSL, Qt, mbedTLS, libcurl, Boost.Asio, libpq, and libpqxx.
    • New C++ rule: Insecure TLS Configuration (CWE-327, high) — detects enablement of outdated TLS versions and other insecure TLS settings.

    +6 more show less

    • New C++ rule: Sensitive Cookie Without Secure Attribute (CWE-614, low) — flags cookies missing the Secure attribute, exposing them to MitM attacks.
    • New JavaScript/TypeScript rule: Insecure Transmission (CWE-319) — detects cleartext transmission beyond HTTP, with initial coverage for Redis clients (@redis/client, ioredis, redis) connecting over non-TLS redis:// URLs.
    • Extended C++ native detection for Code Injection (CWE-94) across dlopen, LoadLibrary, Lua, CPython, Duktape, and QuickJS.
    • Extended C++ native detection for Insecure Storage (CWE-922) across sqlite, realm, leveldb, rocksdb, lmdb, and Qt.
    • Extended C++ native Insecure Cipher (CWE-327) coverage across OpenSSL, Botan, libsodium, libtomcrypt, libgcrypt, Crypto++, and mbedTLS.
    • Expanded Java library detection coverage for Azure SDK (com.azure:azure-core), Logback (ch.qos.logback:logback-classic), Reactor Netty HTTP (io.projectreactor.netty:reactor-netty-http), Apache Kafka clients (org.apache.kafka:kafka-clients), and Jackson (jackson-databind, jackson-core).

    11 details in Everything

45. Snyk Code: July Release, C++ rules, Java library coverage, and JavaScript Insecu Jun 26, 2026 · release notes

    Snyk Code announces C++ rules, broader Java library coverage, and JavaScript Insecure Transmission detection for the July 13, 2026 release.

    • Adds six new C++ detection rules: Log Forging, Improper Privilege Management, Missing Authorization, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS Certificate Verification Bypass, Insecure TLS Configuration, Sensitive Cookie Without Secure Attribute, and expands native C++ coverage for Code Injection, Insecure Storage, and Insecure Cipher.
    • Adds new Insecure Transmission rule-key for JavaScript/TypeScript to detect cleartext transmission over insecure transports (e.g., non-TLS Redis URLs), separate from existing HttpToHttps logic.
    • Expands detection coverage for Java libraries including Azure SDK, Logback, Reactor Netty HTTP, Apache Kafka clients, and Jackson.

    3 details in Everything

46. The New Security Control Point: Governing AI Agents Inside the Execution Loop (2026-06-23) Jun 23, 2026 · issue 001

    Snyk Evo ADSADSAlternate Data Streams: an NTFS feature that lets a file carry hidden secondary data blobs under the same path, giving cyber tools a place to stash metadata or detect covert storage by malware. launches agent behavior governance in Open Preview to observe, detect, and block risky AI agent actions in real time.

    • New agent behavior governance capability (Open Preview) integrates directly into the agent execution loop via PreToolUse and PostToolUse APIs to evaluate actions before and after execution.
    • Session-aware behavioral monitoring tracks the full sequence of agent actions — shell commands, file reads/writes, network requests, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool invocations, and external API calls — across an entire workflow rather than in isolation.
    • Continuous behavioral risk detections identify emerging threats from patterns of agent actions (e.g., sensitive file access combined with network exfiltration) that traditional artifact-based security misses.
    • Real-time governance actions let organizations choose to log findings silently, block policy-violating actions outright, steer agent behavior by injecting security guidance into the workflow, or require explicit human approval before high-risk operations proceed.
    • Human-in-the-loopHuman-in-the-loopHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues. checkpoints can be configured to pause agent execution and request user approval before sensitive, unusual, or high-impact operations.

    5 details in Everything

47. Announcing Agentic Development Security (ADS) (2026-06-23) Jun 23, 2026 · issue 001

    Snyk launches Agentic Development Security (ADSADSAlternate Data Streams: an NTFS feature that lets a file carry hidden secondary data blobs under the same path, giving cyber tools a place to stash metadata or detect covert storage by malware.) to govern AI agent supply chains, behavior, and generated code in real time.

    • New Evo ADS platform continuously discovers and inventories MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, tools, skills, and external services used by AI agents, evaluating each against security signals such as permissions, provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., known vulnerabilities, and organizational policy.
    • Introduces policy-based controls to identify and block unapproved, restricted, or high-risk MCP server components, with remediation guidance surfaced directly to development teams.
    • Adds agent behavior governance operating inside the execution loop — evaluating requested actions against session context, user intent, and policy before they execute, blocking high-risk actions and intercepting policy violations in real time (currently in Open Preview).
    • Enables secure-at-inception checks for AI-generated code via asynchronous, lightweight hooks embedded directly into AI coding workflows, scanning for vulnerabilities, insecure dependencies, infrastructure misconfigurations, and secrets before code reaches a repository or CI pipeline.
    • Optimizes token consumption in AI coding environments by injecting security findings into the agent context windowcontext windowThe maximum amount of text, counted in tokens, a model can take in and produce in one request. Everything the model knows about the task has to fit inside it. only when actionable issues are detected in newly generated code — clean scans incur zero additional context overhead.

    5 details in Everything

48. The full Snyk AI Security Platform, free for open source maintainers (2026-06-18) Jun 18, 2026 · issue 001

    Snyk offers full AI Security Platform free to open source maintainers, plus a new Remediation Agent for merge-ready fixes.

    • Launches Secure Developer Program giving qualifying open source maintainers free access to the full Snyk AI Security Platform, including Snyk Open Source, Snyk Code, Snyk Container, and Snyk IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup..
    • Introduces Snyk Remediation Agent (open preview in the CLI for design partners) that pairs frontier-model reasoning with Snyk's intelligence layer to produce validated, merge-ready fixes for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. issues.

    2 details in Everything

49. Snyk Learn lesson roundup: what’s new in June (2026-06-17) Jun 17, 2026 · issue 014

    Snyk Learn adds three new AI security lessons on agentic RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., memory poisoning, and inter-agent communication.

    • New AI-Sec lesson: Unexpected Code Execution (RCE) — covers how agentic systems can be tricked into executing unauthorized code.
    • New AI-Sec lesson: Memory and Context Poisoning — explains how corrupted agent memory can silently alter AI reasoning and decisions.
    • New AI-Sec lesson: Insecure Inter-Agent Communication — teaches exploitation of weak communication protections between agents.
    • Expanded OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 lesson coverage now available in Python, Rust, and Ruby.

    4 details in Everything

50. Automatically Close Obsolete Open Source Fix PRs with Help from Snyk, Now Generally Available! (2026-06-16) Jun 16, 2026 · issue 014

    Snyk now auto-closes stale Open Source Fix PRs by default, with a configurable daily closure limit.

    • Enables automatic closing of obsolete Open Source Fix PRs for all organizations by default, triggered during recurring tests when the targeted dependency is removed, transitively updated, or manually fixed.
    • Adds a configurable maximum number of obsolete PRs Snyk will close per day, giving teams rate control over automated closures.
    • Allows administrators to opt out of automatic PR closure via the organization settings page.

    3 details in Everything

51. Automatically Close Obsolete Open Source Fix PRs with Help from Snyk, Now Genera Jun 16, 2026 · release notes

    Snyk now auto-closes obsolete open source fix PRs by default and allows configuring the daily limit.

    • Enables automatic closing of outdated Open Source Fix Pull Requests by default for all organizations
    • Adds a configuration option to set the maximum number of obsolete PRs Snyk will close per day

    2 details in Everything

52. Assess secure-at-inception effectiveness with the Prevention report (Early Acces Jun 3, 2026 · release notes

    New Prevention report in Early Access tracks proactive vulnerability fixes across IDE, CLI, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. surfaces.

    • Adds the Early Access Prevention report to track vulnerabilities developers proactively remediate in Snyk Code and Secrets before pull requests or production.
    • Introduces a Fix-by-Developer leaderboard to identify developers who squash vulnerabilities earliest in the lifecycle.

    2 details in Everything

53. Snyk Code: June Update May 28, 2026 · release notes

    Snyk Code announces expanded .NET crypto detection and PHP SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. interfile analysis for June 15, 2026.

    • Adds TLS vulnerability detection (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-326) for .NET HTTP and network stacks including ServicePointManager, HttpClientHandler, WinHttpHandler, SocketsHttpHandler, Kestrel, and SslStream.
    • Broadens Insecure Cipher coverage (CWE-327) for .NET C# and VB to include BouncyCastle third-party library support and flags algorithms such as PAKE, Triple DES, DES, Skipjack, RC4, RC2, MD-5, and SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications..
    • Expands weak-key-size detection (CWE-326) for .NET native standard-library types (ECDHE, ECDH, ECDSAECDSAThe elliptic-curve signature algorithm behind most TLS certificates, blockchains and many hardware keys. It is one of the algorithms post-quantum signatures are meant to replace., RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it., AES GCM, HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it.-SHA1/2/3) and adds third-party support for DH, DHE (BouncyCastle), AES-XTS (BouncyCastle), and CMAC-AES (BouncyCastle).
    • Enables PHP SQL injection interfile taint flow detection through wrapper classes where the sink is defined in a wrapper class (caller → wrapper → mysql_query).

    4 details in Everything

54. More flexibility when exporting table data to CSV with Snyk API & Web May 20, 2026 · release notes

    Expanded field selection for table data export in Snyk API & Web

    • Extends flexibility of the existing Download CSV feature for external analysis and custom reporting.

    1 detail in Everything

55. Announcing Snyk CLI v1.1305.0 May 20, 2026 · release notes

    Snyk CLI v1.1305.0 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation resilience, parallel container monitoring via env var, and experimental MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. breakability tool.

    • Adds --allow-incomplete-sbom flag to snyk sbom command to generate output even when individual projects fail resolution
    • Adds SNYK_REQUEST_CONCURRENCY environment variable to configure parallel dependency request concurrency for snyk container monitor
    • Adds an experimental breakability evaluation tool to the Snyk MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface.

    3 details in Everything

56. Snyk Studio: Introducing Asynchronous, Hooks-Based Guardrails for AI Agents May 11, 2026 · release notes

    Snyk Studio introduces asynchronous hooks-based guardrails in Early Access, with automated installation for supported agentic development environments.

    • Adds a new hooks-based guardrail architecture to Snyk Studio that runs security scans asynchronously in the background, replacing the previous rules-based model.
    • Adds an automated installation script that configures /snyk-fix, /snyk-batch-fix, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, and secure dependency health check skills on supported Agentic Development Environments (ADEs).
    • Enables MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.-based distribution of the Snyk Studio hooks installation script for enterprise-wide deployment on Windows and Mac.

    3 details in Everything

57. Snyk Learn lesson roundup: what’s new in May May 11, 2026 · release notes

    Snyk Learn adds AI Secure Development learning path, Evo interface lesson, and Feedback button on learn.snyk.io

    • Launches the AI Secure Development learning path with new lessons on prompt engineering, AI app development, and securing autonomous workflows.
    • Adds Navigating the Evo Interface lesson to familiarize users with the unified agentic interface in Evo by Snyk.
    • Adds a new Feedback button on learn.snyk.io (login required) to share feedback and topic suggestions.

    3 details in Everything

58. New Analytics Overview Widgets May 8, 2026 · release notes

    New Analytics Overview widgets for PR checks and Snyk Studio Agentic Scans activity.

    • Adds Total PR checks widget to the analytics overview dashboard
    • Adds PR Check success rate widget to the analytics overview dashboard
    • Adds Agentic Scans metric widget from Snyk Studio to the analytics overview
    • Adds Developers running agentic scans metric widget to the analytics overview

    4 details in Everything

59. Expanded Container JVM Support Apr 30, 2026 · release notes

    Snyk Container begins a gradual GA rollout of JVMJVMThe Java Virtual Machine, a runtime maintained by Oracle (and implemented by others) that executes Java bytecode on any OS, giving cyber tools a portable, garbage-collected environment with a large ecosystem of libraries. detection beyond OpenJDK 8 through file fingerprinting in CLI and Container Registry integrations.

    • Adds container vulnerability scanning for Eclipse Temurin and Adoptium OpenJDK distributions that follow the /opt/java/openjdk/release layout.
    • Automatic detection of Java versions in containers using the /opt/java/openjdk/release layout, requiring no manual configuration

    2 details in Everything

60. Identify CISA KEV vulnerabilities for compliance Apr 22, 2026 · release notes

    New CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. filter available in UI issue filters for compliance prioritization

    • Adds a new CISA KEV filter to the UI issue filters on any page where they are available
    • Enables isolation of vulnerabilities within the CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. catalog with a single click

    2 details in Everything

61. Announcing Repo Monitor Configuration Apr 15, 2026 · release notes

    Snyk introduces Repo Monitor Configuration in Early Access for centralized Group Inventory monitoring, bulk repository imports, and on-demand retesting.

    • Adds Repo Monitor Configuration to the Group-level Inventory page for centralized management of repository coverage and monitoring settings
    • Enables view of monitoring status for all products and identification of health status and required actions in a single view
    • Provides bulk import of repositories from the Group Inventory page into specific Snyk Organizations
    • Adds on-demand retesting trigger for specific repositories directly from the Group Inventory page
    • Introduces actionable error resolution guidance for testing failures due to integration issues or entitlements

    5 details in Everything

62. Repo Content Sync in Early Access Apr 13, 2026 · release notes

    Snyk introduces Repo Content Sync in Early Access for Enterprise customers through Snyk Preview, automating project creation and deactivation as SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. files change.

    • Enables native, automated synchronization between Source Code Management (SCM) tools and Snyk to eliminate manual re-imports
    • Automatically detects new files and creates corresponding Snyk projects for manifest, Docker, or configuration files added in the SCM
    • Automatically deactivates Snyk projects when associated manifest files are deleted from the connected SCM

    3 details in Everything

63. Native GraphQL Scanning for Snyk API & Web Apr 10, 2026 · release notes

    Snyk adds native GraphQL scanning to API & Web with introspection schema fetching and dedicated auth settings

    • Adds GraphQL as a supported DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. API target type in Snyk API & Web
    • Enables schema ingestion directly from an introspection endpoint alongside existing URL or file upload options

    2 details in Everything

64. Announcing native uv support for the Snyk CLI Apr 9, 2026 · release notes

    Snyk introduces native uv support in Early Access for CLI test, monitor, and sbom workflows, enabled through Snyk Preview.

    • Extends uv scanning support to the Snyk IDE extensions, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, and GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure.

    1 detail in Everything

65. Test target configuration for smoother scans with Snyk API & Web Apr 9, 2026 · release notes

    New Test configuration option in UI to validate target settings before DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans.

66. Announcing Snyk CLI v1.1304.0 Apr 8, 2026 · release notes

    Snyk CLI v1.1304.0 adds snyk aibom test command for AI-BOMAI-BOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk. validation

    • snyk aibom test command for generating and validating AI-BOMs against tenant policies
    • Agent Red Teaming scanned output now includes a vulnerability summary with exhaustive and eager modes
    • Extended support for Java runtime binary scanning in container scans

    3 details in Everything

67. snyk_package_health_check for Snyk Studio is now available in Full profile Apr 7, 2026 · release notes

    snyk_package_health_check MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tool is generally available by default for npm, PyPI, Maven, NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code., and Golang.

    • snyk_package_health_check is now included in the Snyk Studio Full (default) profile for MCP workflows, enabling AI agents to evaluate open-source packages before they are added to a project.
    • Provides package health guidance across Security, Maintenance, Community, and Popularity, with outcomes Healthy, Review recommended, Not recommended, or Unknown/insufficient data.

    2 details in Everything

68. PR check report is now generally available Apr 7, 2026 · release notes

    PR check report GA adds date-filtered adoption metrics, optimized UI tables, and Export API access for PR scanning data.

    • PR check report moves to general availability
    • Adds Snyk Code errors to the error PR checks
    • Updates display of source code manager (SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows.) icons in the PR scanning adoption by organization table

    3 details in Everything

69. Automatically Close Obsolete Fix Open Source PRs with Help from Snyk Apr 6, 2026 · release notes

    Snyk introduces opt-in Early Access for automatic obsolete Open Source Fix PR closure through Snyk Preview, initially limited to five PRs per day.

    • Adds automatic closing of Open Source Fix PRs during recurring tests if targeted vulnerabilities are no longer present.
    • Adds automatic comments on closed PRs listing the specific resolved issues for team context.

    2 details in Everything

70. Introducing Unified Navigation: A Faster Way to Secure Your Application Stack Apr 6, 2026 · release notes

    Snyk introduces Unified Navigation with grouped menu and context-aware shortcuts.

    • New Grouped Navigation reorganizes the menu by security work type to reduce hunting time.
    • Context-Aware Shortcuts adapt visible items to the current task, reducing clicks from 8+ to 2-3.

    2 details in Everything

71. Active Security Incident Assessment Apr 3, 2026 · release notes

    New Active Security Incident Assessment banner in the Zero Day report tracks exposure and remediation progress.

72. Snyk Learn lesson roundup: what’s new in April Apr 1, 2026 · release notes

    Snyk Learn adds OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 for Agentic Applications lessons and expanded Ruby/Rust coverage.

    • Adds Agentic 01 - Agent goal hijack, Agentic 02 - Agent tool misuse, Agentic 03 - Identity and privilege abuse, and Agentic 04 - Agentic supply chain vulnerabilities lessons for the new OWASP Top 10 for Agentic Applications.
    • Adds Cross-origin resource sharing lesson to the security lessons catalog.
    • Adds Snyk Billing and Credit Usage lesson explaining credit tracking in the Billing module.
    • Updates coverage across ~50 lessons for Ruby.
    • Updates coverage across 30 lessons for Rust.

    5 details in Everything

73. Track your monitored projects with a new analytics widget Mar 31, 2026 · release notes

    New Projects Monitored KPI widget added to Snyk dashboards for tracking monitored project counts.

    • Adds a new Projects Monitored KPI widget in the Widget selector that tracks the total number of projects being continuously monitored.

    1 detail in Everything

74. Updates to finding management permissions at Snyk API & Web Mar 30, 2026 · release notes

    Snyk API & Web adds Change Finding State permission for granular control of finding state and review status.

    • Change Finding State permission introduced for changing a finding's state and review status
    • Change Finding permission scope reduced to managing assignees, labels, and notes

    2 details in Everything

75. Improved License Policy Behavior for Newly Added Licenses Mar 29, 2026 · release notes

    Newly supported licenses in Snyk Open Source now default to severity=None instead of inheriting the Unknown policy setting.

    • severity for newly added licenses now defaults to None, preventing unexpected findings.
    • Newly supported licenses no longer inherit the severity level configured for the Unknown license type in License Policies.

    2 details in Everything

76. Snyk Code - Ruby Interfile GA Mar 26, 2026 · release notes

    Snyk Code announces default interfile data flow analysis for all Ruby projects from April 7, 2026.

    • Enables interfile data flow analysis across multiple files in all Ruby Projects to detect vulnerabilities spanning file boundaries
    • Refreshes the Ruby on Rails ruleset to improve coverage of modern development patterns

    2 details in Everything

77. Snyk Code - COBOL support now available in Snyk Preview Mar 26, 2026 · release notes

    Snyk Code adds COBOL scanning support in Snyk Preview for CICS constructs

    • Integrates COBOL vulnerability data with the existing Snyk web UI for unified management

    1 detail in Everything

78. Snyk API & Web MCP Server Mar 24, 2026 · release notes

    Snyk API & Web MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. adds IDE-native security workflows via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. for onboarding, scanning, and triaging.

    • Adds support for the Model Context Protocol (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) to enable natural language interactions with Snyk directly from AI-native IDEs
    • Enables automated onboarding and configuration of new Snyk targets within the IDE without manual menu navigation
    • Provides AI-assisted generation and implementation of authentication scripts required for deep web (DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces.) scans

    3 details in Everything

79. Announcing Snyk CLI v1.1303.2 Mar 23, 2026 · release notes

    Snyk CLI v1.1303.2 adds --profile for Agent Red Teaming and Go Standard Library support in Container scans.

    • --profile flag in Snyk Evo enables fast, security, and safety attack goals.
    • Go Standard Library coverage added to Snyk Container scans.

    2 details in Everything

80. Enhanced header controls for testing Postman Collections with Snyk API & Web Mar 11, 2026 · release notes

    Adds Custom Headers module to Postman target settings for static vs. testable header control

    • Adds a Custom Headers module in the Scanner tab of Postman target settings to configure specific headers and toggle them as static prerequisites or active attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
    • Displays Custom Headers status (Enabled/Disabled) in the USED SETTINGS module on the Scan results page for Postman targets.

    2 details in Everything

81. Manage DAST authentication with the new Credentials Manager Mar 5, 2026 · release notes

    Snyk API & Web introduces Credentials Manager from March 6, 2026, centralizing DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. authentication credentials for sharing and rotation.

    • Snyk now offers a centralized way to manage DAST authentication credentials via the Credentials Manager, improving secret sharing and rotation workflows.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Secret Obfuscation feature is discontinued and replaced by Credentials Manager.
82. More flexible connection management with broker context Mar 2, 2026 · release notes

    Snyk Universal Broker GA adds broker context for Org/Group-specific SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. credentials

    • Adds broker context support to Universal Broker for Org or Group-scoped connection parameters
    • Enables overwriting SCM credentials at the Organization level via snyk-broker-config tool
    • Universal Broker is now generally available (GA)

    3 details in Everything

83. Learning Programs enters Early Access in Snyk Learn Feb 26, 2026 · release notes

    Snyk Learn introduces Learning Programs in Early Access for Learning Management Add-On customers, with UI-managed education tracks and bulk enrollment.

    • Adds Learning Programs to curate education paths, enroll groups of users through the Snyk Learn Management menu, and track progress with automated email reminders; custom management roles can be created through the Snyk API.
    • Introduces a limit of 300 users per program during Early Access, requiring programs to be created using the UI.

    2 details in Everything

84. Announcing Snyk CLI v1.1303.0 Feb 25, 2026 · release notes

    Snyk CLI v1.1303.0 adds AIBOMAIBOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk. persistence via --upload flag and HTML reports for Redteam.

    • snyk sbom test JSON output now includes isDisputed, severityBasedOn, and alternativeIds fields for richer vulnerability context
    • snyk sbom test adds dependency scope information (e.g., dev vs. production) for Maven and npm projects

    2 details in Everything

85. Announcing snyk_package_health_check for Snyk Studio Feb 25, 2026 · release notes

    Snyk Studio introduces snyk_package_health_check in the Experimental MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. profile to evaluate dependency health before installation.

    • Adds snyk_package_health_check capability for evaluating open-source packages in agentic development workflows.
    • Provides health outcomes across Security, Maintenance, Community, and Popularity dimensions (Healthy, Review recommended, Not recommended, Unknown/insufficient data).
    • Enables policy-driven guardrails for Organizations to require checks, pause on risk, block unsafe packages, or enforce human approval.

    3 details in Everything

86. Risk Exposure Report is now GA Feb 18, 2026 · release notes

    The Risk Exposure Report moves from early access to GA, enabling interactive drill-downs into issues and assets via the Risk Breakdown table.

    • Adds clickable objects in the Risk Breakdown table to drill down into specific issues and assets directly from the report
    • Adds tooltips for risk categories (Baseline Issue, Non Preventable Issue, Preventable Issue, Other New Issue)
    • Adds new viewing options for the Risk Exposure Trend to filter open issues by Snyk product, exploit maturity, and top organizations

    3 details in Everything

87. Improved .NET scanning is now generally available Feb 16, 2026 · release notes

    Snyk begins a gradual GA rollout of improved .NET scanning with native SDK dependency resolution and expanded project support.

    • Improved .NET scanning is now generally available in Snyk.
    • Scanning now uses the native dependency resolution logic of the .NET ecosystem via the dotnet SDK directly.
    • Full support for private packages hosted on brokered connections to Artifactory and Nexus via the Universal Broker.
    • Supports SDK-style projects that build successfully with the dotnet SDK, including global.json, Directory.Build.props, and Directory.Packages.props customization without additional scanning configuration.

    4 details in Everything

88. Secure your OpenAPI targets against BOLA vulnerabilities with Snyk API & Web Feb 12, 2026 · release notes

    Snyk GA adds BOLABOLABroken Object Level Authorization, an API vulnerability class where a server fails to verify that the requesting user owns or may access the object ID they supply, letting attackers read or modify other users' data. detection for OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. targets using AI-driven scanning profiles.

    • Adds Broken Object Level Authorization (BOLA) detection for OpenAPI targets in the general availability release.

    1 detail in Everything

89. Snyk Code - Ruby 4 Support Feb 12, 2026 · release notes

    Snyk Code begins a phased Ruby 4.0 support rollout on February 24, 2026, with parser improvements and enhanced module analysis.

    • Adds general availability support for analyzing Ruby 4.0 codebases, including new syntax and language features from the Ruby 4.0 specification.
    • Enhances the Ruby analysis engine's understanding of module structures to provide more accurate pathing and taint flow detection.

    2 details in Everything

90. Closing the gap between code and runtime with SAST/DAST correlation Feb 11, 2026 · release notes

    Adds automatic SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment./DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. correlation linking DAST findings to exact source code lines

    • Adds AI-based correlation between linked Snyk API & Web targets and Snyk Code projects, connecting DAST findings with matching SAST issues.

    1 detail in Everything

91. Analytics now available for groups and organizations Feb 10, 2026 · release notes

    Analytics dashboards now available at Group and Organization levels with a renamed navigation path

    • Adds Analytics page access at the Group and Organization levels, previously restricted to tenant level

    1 detail in Everything

92. Merge with Confidence: Introducing Breakability Analysis for Pull Requests (Earl Feb 4, 2026 · release notes

    Snyk introduces Breakability Analysis in Early Access through Snyk Preview, adding dependency-upgrade risk scores to supported Snyk pull requests.

    • Adds Breakability (Merge) Risk Score directly within the PR description to assess dependency upgrade safety

    1 detail in Everything

93. Better risk mapping with OWASP Top 10 2025 Feb 2, 2026 · release notes

    Adds OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 (2025) report for mapping and filtering security issues by new rankings

    • Replaces the legacy OWASP Top 10 (2021) report with a new OWASP Top 10 (2025) report in the Reports UI

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The OWASP Top 10 (2021) report is removed from the dropdown; its existing direct URL remains temporarily accessible, while Reports > OWASP Top 10 (2025) opens the replacement report.
94. Snyk Code - February 2026 Update Jan 29, 2026 · release notes

    Snyk Code announces expanded C# 14/.NET 10, Fiber, and Sequelize analysis for rollout on February 23, 2026.

    • Adds analysis support for C# 14 and .NET 10, including VB.NET applications on the .NET 10 framework
    • Improves coverage for grpc-spring based gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. clients in Java and Kotlin.
    • Adds analysis support for the Sequelize library in JavaScript and TypeScript
    • Adds detection support for the Fiber framework in Go
    • Adds analysis support for grpc-swift library in Swift

    +1 more show less

    • Improves coverage for Spring WebFlux and Jax-RS in Kotlin

    6 details in Everything

95. Announcing new versions of Snyk IDE plugins Jan 19, 2026 · release notes

    Snyk IDE plugins add Generally Available automated org selection and a new Unified Settings Page.

    • Makes Automated Org Selection generally available when enabled, selecting an organization from repository and authentication context while respecting manual configuration and the preferred-organization fallback.
    • Begins rolling out a unified plugin settings design across Visual Studio Code, JetBrains, Eclipse, and Visual Studio, with an early opt-in experience.

    2 details in Everything

96. Container: New pruning option for large dependency graphs Jan 14, 2026 · release notes

    Snyk Container now supports scanning enterprise-scale projects with massive dependency graphs by introducing a graph pruning mechanism for CLI users via the --prune-repeated-subdependencies flag.

97. Improved SBOM testing is now available in Early Access 🎉 Jan 14, 2026 · release notes

    Snyk CLI v1.1302.0+ introduces improved snyk sbom test in Early Access, with additional control options and enriched output.

    • snyk sbom test command no longer requires the --experimental flag in CLI v1.1302.0+
    • New CLI options --severity-threshold, --reachability, and --reachability-filter for granular SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. scanning control

    2 details in Everything

98. Container: Improved scanning for stripped and CGo Go binaries Jan 14, 2026 · release notes

    Snyk Container scanning improved for stripped and CGo Go binaries via .go.buildinfo

    • Expanded coverage in Snyk Container to accurately identify dependencies in stripped Go binaries and CGo builds.

    1 detail in Everything

99. Announcing Snyk CLI v1.1302.0 Jan 14, 2026 · release notes

    Snyk CLI v1.1302.0 adds pnpm lockfile support, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Scan capability, and improved Go/OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. container scanning.

    • Adds pnpm lockfile support to Snyk Container image scanning.
    • Integrated MCP Scan into Snyk CLI to test agent-based developer tools like Cursor and Claude Code
    • Added container scan support for cgo and stripped Go binaries
    • Added support for OCI images with manifests missing platform fields
    • Added deb, apk, and rpm support in SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. test

    +3 more show less

    • Added PackageURL information to go.mod dependency graphs for snyk test
    • Improved PackageURLs in SBOM documents for go.mod projects
    • Added support for poetry development dependencies

    8 details in Everything

100. Container: Support for pnpm lockfile scanning Jan 14, 2026 · release notes

     Snyk Container adds automatic pnpm-lock.yaml detection for Node.js applications in container images, bringing container scanning into parity with existing CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations.

101. Improved ecosystem coverage & quality for Snyk Open Source Jan 13, 2026 · release notes

     Snyk Open Source announces staged Yarn 4 and Ruby 4 support across CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations, with PHP 8.5 and Swift 6.2 support still upcoming.

     • Adds Yarn 4 support in CLI v1.1302.0 from January 14, with a gradual SCM rollout during January; Fix PRs and Upgrade PRs are not supported for Yarn workspaces.
     • Announces upcoming support for PHP 8.5 and Swift 6.2 in Snyk Open Source

     2 details in Everything

102. Connect DAST findings to Snyk Learn lessons Jan 9, 2026 · release notes

     Connect DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. findings to Snyk Learn lessons

103. Configure signed requests for API targets in Snyk API & Web Jan 8, 2026 · release notes

     Snyk API & Web adds configurable signed requests for API targets, with feature enablement available through Sales.

     • Enables configuration of signed request methods for API targets to support complex authentication requirements

     1 detail in Everything

104. Configure mutual TLS for target authentication in Snyk API & Web Jan 8, 2026 · release notes

     Snyk API & Web adds client-certificate configuration for mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. on Web, OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth., and Postman targets, enabled through Sales.

     • Adds a CLIENT AUTHENTICATION CERTIFICATE module to the Settings > Authentication tab for Web and API targets to support mutual TLS (mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with.).

     1 detail in Everything

105. Redesigned Snyk Analytics Tenant-Level Experience is now GA Dec 17, 2025 · release notes

     Snyk Analytics GA brings customizable tenant-level dashboards with widget inventory, saved views, and a centralized report catalog.

     • Adds customizable tenant-level landing page in Snyk Analytics with widget inventory for personalized dashboards
     • Adds Saved views feature to allow users to save specific dashboard configurations
     • Adds centralized Report catalog for discovering pre-built reports in Snyk Analytics

     3 details in Everything

106. GitHub Apps are now supported in Docker Hub integrations Dec 15, 2025 · release notes

     Adds GitHub App support for Docker Hub integrations in Snyk Container

     • GitHub Apps are now supported in Docker Hub integrations to attach a Dockerfile directly from GitHub Cloud or GitHub Server App

     1 detail in Everything

107. Snyk Code: Objective C support is now in preview Dec 4, 2025 · release notes

     Snyk Code adds Objective-C support in preview for iOS and macOS scanning

     • Enables vulnerability detection for industry-standard libraries like AFNetworking, Realm, OpenSSL, and Couchbase Lite
     • Enables Objective-C vulnerability analysis for Core Data, Security, SQLite, RNCryptor, and Foundation after opting into Snyk Preview.

     2 details in Everything

108. Snyk Code: December Update Dec 3, 2025 · release notes

     Snyk Code announces Netty and ASPX analysis improvements for its Java, Kotlin, and .NET coverage, arriving December 15.

     • Adds Netty framework analysis to the Snyk Code scanning engine
     • Adds detection of ASPX inline code expression blocks in .NET projects
     • Makes these Java, Kotlin, and .NET analysis improvements available as part of GA language support on December 15.

     3 details in Everything

109. Severity Condition in Group-Level Policies (GA) Nov 25, 2025 · release notes

     General availability of severity conditions in Snyk group-level policies for Code and OS Security.

     • Adds the ability to create severity-based conditions in Code and OS Security group-level policies via the UI
     • Enables granular policy actions (ignoring or changing severity) based on finding severity levels within group policies

     2 details in Everything

110. New Featured Zero Day Report for SH1A-Halud npm Supply Chain Attack Nov 25, 2025 · release notes

     Snyk adds the SHA1-Hulud npm Supply Chain Attack - Nov 2025 Featured Zero Day Report.

111. Announcing support for .NET 10 for Open Source Nov 24, 2025 · release notes

     Snyk adds general availability support for scanning .NET 10 Open Source projects via CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations.

     • Adds .NET 10 support for Open Source vulnerability scanning across Snyk CLI and source code management (SCM) integrations
     • Enables automatic detection of .NET 10 frameworks without manual configuration when scanning projects

     2 details in Everything

112. Announcing new versions of Snyk IDE plugins Nov 24, 2025 · release notes

     Snyk IDE plugins add Automated Org Selection for Visual Studio Code, JetBrains, Eclipse, and Visual Studio.

     • Adds Automated Org Selection feature (Early Access) to Snyk IDE plugins to automatically select the appropriate organization based on repository context and authentication.

     1 detail in Everything

113. Reachability for Snyk CLI and CI/CD integrations, now in Early Access 🎉 Nov 19, 2025 · release notes

     Snyk CLI and CI/CD integrations now support Reachability analysis for Open Source vulnerabilities in Early Access.

114. Announcing Snyk CLI v1.1301.0 Nov 19, 2025 · release notes

     Snyk CLI v1.1301.0 adds Ubuntu Chisel and zstd layer support in container scanning, Maven 4 support, and --include-provenance for SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..

     • --include-system-jars flag allows Snyk Container to scan usr/lib JAR files during container analysis
     • Container scanning now supports Ubuntu Chisel images and zstd-compressed layers
     • Adds initial Maven 4 support to Snyk Open Source test, monitor, and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. commands.
     • --include-provenance flag adds verification checksums to Maven project SBOMs (experimental)
     • Reachability analysis for Snyk CLI and CI/CD integrations enters Early Access for all Open Source customers

     5 details in Everything

115. Snyk Code Update Nov 6, 2025 · release notes

     Snyk Code announces C#13 and .NET 9 SDK support plus broader language coverage, rolling out November 17, 2025.

     • Adds C#13 and .NET 9 SDK support to Snyk Code static analysis.

     1 detail in Everything

116. Improved Package Experience on security.snyk.io 🎉 Nov 5, 2025 · release notes

     Snyk UI adds Snyk Advisor metrics (Popularity, Maintenance, Security, Community) to package pages on security.snyk.io.

117. Test your Maven 4 projects now with RC4 support Nov 3, 2025 · release notes

     Snyk adds general availability support for scanning Maven 4 RC4 projects via CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations

     • Adds Maven 4 RC4 project detection to the Snyk CLI for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. scanning
     • Enables automated vulnerability testing of Maven 4 RC4 repositories in SCM integrations

     2 details in Everything

118. Exploit Maturity - CVSS v4.0 is now in Reporting and Project Page 🎉 Nov 2, 2025 · release notes

     Exploit Maturity (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4.0) values now visible in Reporting columns/filters and Project page Issues Card

     • Adds Exploit Maturity (CVSS v4.0) column to the Reporting experience
     • Adds Exploit Maturity (CVSS v4.0) filter option in the Reporting experience
     • Adds Exploit Maturity (CVSS v4.0) filter option on the Project page Issues Card

     3 details in Everything

119. Snyk Learn launches Learning Impact & Opportunities report into Early Access Oct 28, 2025 · release notes

     Snyk Learn launches Learning Impact & Opportunities reporting in Early Access for Enterprise customers with the Learning Management Add-On.

     • Adds the Learning Impact & Opportunities report to track how training influences code issue remediation and prevention.

     1 detail in Everything

120. New custom time-to-live for export API URLs Oct 27, 2025 · release notes

     Adds url_expiration_seconds to Snyk Export API for configurable presigned URL TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit.

     • Allows setting a custom expiration time for Export API presigned URLs via the url_expiration_seconds attribute (0-3,600 seconds)

     1 detail in Everything

121. Update assets via API and introduction of a new tagging capability Oct 26, 2025 · release notes

     Snyk introduces an Assets API PATCH endpoint and structured key:value tags in Early Access.

     • Adds a new PATCH endpoint to the Snyk Assets API for updating asset attributes like class, labels, and tags
     • Renames existing text-based tags attribute to Labels

     2 details in Everything

122. Python 3.14 support is now available Oct 23, 2025 · release notes

     Snyk adds Python 3.14 scanning through CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations; projects without a specified Python version must select it in the UI.

123. Customize risk acceptance in Snyk API & Web Oct 22, 2025 · release notes

     Snyk API & Web account owners can require Expiration Date, Approver Name, and Approval Date for risk acceptances.

     • Captures all acceptance details in the finding's log for a complete audit trail.

     1 detail in Everything

124. Announcing new versions of Snyk IDE plugins Oct 22, 2025 · release notes

     Snyk’s VS Code extension updates experimental Secure at Inception settings for scan frequency in Cursor, Windsurf, and VS Code.

     • Adds an experimental setting to toggle the frequency of SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. scans against AI-generated code in Cursor, Windsurf, and VS Code as part of the Secure at Inception capability
     • Shows a modal on new installs of the VS Code extension to optionally enable the Secure at Inception capability

     2 details in Everything

125. Improvements to Reachability for Snyk Open Source 🎉 Oct 16, 2025 · release notes

     Snyk Open Source announces Group-level Reachability settings and wider Python and Java coverage for October 20.

     • Enables Reachability analysis for all organizations within a Group using new Group-level settings
     • Expands Reachability vulnerability coverage to over 99% of applicable vulnerabilities in pip, pipenv, and Poetry projects (Early Access for Python)
     • Increases Reachability issue detection for Maven and Gradle projects through improved Java package coverage
     • Optimizes reachability path analysis by capturing only entry points where first-party code calls third-party packages

     4 details in Everything

126. Snyk Code CLI Upload is Generally Available Oct 10, 2025 · release notes

     Snyk Code CLI Upload GA enables uploading scan results from the CLI to the Snyk Web UI for centralized management.

     • Uploads Snyk Code CLI scan results to the Snyk Platform for unified issue management and historical tracking.
     • Enables Organization and Group views for Snyk Code projects scanned through the CLI.

     2 details in Everything

127. Announcing Snyk CLI v1.1300.0 Oct 8, 2025 · release notes

     Snyk CLI v1.1300.0 adds system JAR scanning behind a flag, Maven metaversion resolution, and SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. runAutomationDetails ID

     • Adds support for scanning system JARs in Snyk Container (behind a feature flag).
     • Adds runAutomationDetails to SARIF outputs.
     • Improves Maven project scanning by correctly resolving metaversions (RELEASE/LATEST).
     • Adds TargetOS field to container scan output.

     4 details in Everything

128. You can now use pnpm across Snyk Oct 8, 2025 · release notes

     Snyk adds general availability support for pnpm across CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations.

129. The new Universal Broker is here! Oct 7, 2025 · release notes

     Snyk Universal Broker reaches general availability, allowing multiple integrations through a single client.

130. Improved secrets management in Snyk API & Web Sep 30, 2025 · release notes

     Snyk API & Web adds Mark as sensitive masking and an Account Owner policy for non-retrievable secrets in target settings.

     • Account Owners gain a new module on the Settings > Authentication page to enforce that all designated sensitive information becomes permanently non-retrievable after being saved
     • Users configuring targets can select the Mark as sensitive checkbox for fields like API authentication payload, login forms, basic auth credentials, custom headers/cookies, API parameter values, and Postman environment values to have them automatically masked

     2 details in Everything

131. Faster feedback for broken navigation sequences in Snyk API & Web Sep 30, 2025 · release notes

     Adds fail-fast option for broken DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. navigation sequences in Target Settings.

     • Adds a 'When a navigation sequence fails, fail the scan immediately and notify me' checkbox in the Navigation Sequences module of Target Settings to stop scans on failure.

     1 detail in Everything

132. Filter your Export API data by product and tags Sep 29, 2025 · release notes

     Snyk Export API adds filters for Project Tags, Project Type, and Snyk Product.

133. Find what matters by filtering out what doesn't Sep 29, 2025 · release notes

     Snyk adds is not filter option to reports for excluding items like CVEs and tags directly in the platform

134. Announcing v2.25.0 of Snyk’s Visual Studio Code IDE plugin Sep 18, 2025 · release notes

     Snyk VS Code plugin v2.25.0 publishes to OpenVSX and enables OS quick fixes by default

     • Enables OS quick fix actions by default
     • Direct publishing of Snyk IDE plugins to OpenVSX marketplaces, including preview versions

     2 details in Everything

135. PR Experience for Gitlab, Azure Repos, and BitBucket Server is now Generally Ava Sep 8, 2025 · release notes

     PR Experience for GitLab, Azure Repos, and BitBucket Server is GA with default Issue Summary and Inline Comments.

     • Allows toggling comment visibility via Integration Settings in the Snyk UI

     1 detail in Everything

136. Improvements to Snyk Code’s Repo Breakdown Sep 4, 2025 · release notes

     Snyk Code announces a file-extension breakdown in Code Analysis, rolling out September 22, 2025.

     • Code Analysis popup in Snyk Code displays specific analyzed file extensions (e.g., .js, .jsx, .ts) rather than general language names

     1 detail in Everything

137. Snyk Code: Enhanced Coverage & Rule Documentation Aug 28, 2025 · release notes

     Snyk Code announces Python XXEXXEXML External Entity injection, a class of attack against XML parsers that tricks them into fetching external resources or local files, letting an attacker read sensitive data or trigger server-side request forgery. detection, Javalin coverage, and clearer issue descriptions for rollout on September 15.

     • Adds a Python rule for XML External Entity Injection (XXE).
     • Expands language coverage to include the Javalin web framework for Java and Kotlin
     • Improves JavaScript framework coverage with detection for Angular's ActivatedRoutes and react-router-dom
     • Enhances crypto cipher detection for insecure ciphers in Java, Kotlin, and Scala
     • Granularizes Cleartext Transmission of Sensitive Information findings into specific categories (e.g., unencrypted socket, email, WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output., HTTP)

     5 details in Everything

138. Product update improvements Aug 28, 2025 · release notes

     Snyk announces product-update tag filters and an RSS feed link from September 11; the existing feed URL remains unchanged.

     • Adds an RSS feed link to notify users of new product update announcements as they are published.
     • Enables filtering product updates using tags like Open Source, CLI, or MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. in the new product updates page.

     2 details in Everything

139. Enhancing the Export API with Test Usage Data! Aug 28, 2025 · release notes

     Snyk Export API now includes a new Test Usage Dataset for tracking test environment, outcome, and user data.

     • Adds a new Test Usage Dataset to the Export API containing test timestamps, environments, outcomes, and product usage details.

     1 detail in Everything

140. Inventory Empty State Clarification - Snyk Essentials Aug 28, 2025 · release notes

     Snyk Essentials announces clearer Inventory empty states and tooltips, scheduled to roll out September 3.

     • Adds defined empty state views and informative tooltips to the Snyk Inventory page to explain why field enrichments are missing.

     1 detail in Everything

141. BitBucket Cloud API Key support - Snyk Essentials Aug 28, 2025 · release notes

     Snyk Essentials adds BitBucket Cloud API key authentication for integrations starting September 9, 2025.

142. Enhancements to SAST High-Context Inline Comments in PRs Aug 21, 2025 · release notes

     Snyk adds High-Context Inline Comments with Data Flow support for GitLab and Azure Repos.

143. Announcing Snyk CLI v1.1298.3 Aug 14, 2025 · release notes

     Snyk CLI v1.1298.3 makes the experimental snyk aibom command publicly accessible and adds Gradle 9 scanning support.

     • Makes experimental snyk aibom publicly accessible for identifying AI models and datasets and mapping supply-chain connections through MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface..
     • Adds native Gradle 9 project scanning support, resolving failures from deprecated/removed Gradle CLI flags

     2 details in Everything

144. project_target_file Now Available in Snyk Export API! Aug 13, 2025 · release notes

     Adds project_target_file field to Snyk Export API responses for monorepo ownership clarity.

     • The Snyk Export API now includes the project_target_file response field
     • Customers can migrate workflows from the deprecated Reporting V1 API to the Export API using this new field

     2 details in Everything

145. Disable repository listing in the Container Registry Agent Aug 7, 2025 · release notes

     Snyk Container Registry Agent now supports disabling repository listing via an environment variable

     • Adds SNYK_DISABLE_LIST_REPOS environment variable to the Snyk Container Registry Agent to disable repository listing
     • Implements logic in the agent to return an empty list when SNYK_DISABLE_LIST_REPOS=true, preventing integration errors with registries like GitHub and GitLab that do not support or restrict access to the GET /v2/_catalog endpoint

     2 details in Everything

146. Snyk Agent Fix in PRs is coming to Bitbucket Aug 1, 2025 · release notes

     Snyk Agent Fix announces opt-in Early Access for Bitbucket Cloud, Cloud App, and Server from August 4, 2025, using @snyk /fix and @snyk /apply.

     • Adds @snyk /fix in Bitbucket PR inline comments to generate and display code fix suggestions.
     • Adds @snyk /apply in Bitbucket PR comments to apply a suggested fix as a commit.
     • Adds support for Bitbucket Cloud, Bitbucket Cloud App, and Bitbucket Server in Snyk Agent Fix in PRs

     3 details in Everything

147. Snyk API & Web: Critical Severity Level (coming soon) Jul 31, 2025 · release notes

     Snyk API & Web announces Critical severity: visible in the UI September 2, 2025, with assignment to eligible newly scanned findings from September 16.

     • From September 16, 2025, assigns Critical severity to eligible findings with CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scores of 9.0 or higher; existing findings change only when detected in a new scan after that date.

     1 detail in Everything

148. Announcing Snyk Azure DevOps Task v1.9.0 Jul 28, 2025 · release notes

     Snyk Azure DevOps Task v1.9.0 adds automatic proxy detection

149. Now Generally Available: The 'Snyk Generated Pull Request' Report Jul 24, 2025 · release notes

     Snyk GA release adds Snyk Generated Pull Request report with global package manager filters and per-repo PR tracking tables.

     • Makes the Snyk Generated Pull Request report generally available for organizational and group-level visibility into Snyk-generated manual and auto-fix PRs.
     • Adds a global filter by specific package managers to the new PR report
     • Adds a new table within the drawer view to track PRs created for a specific repository

     3 details in Everything

150. Announcing MCP Visibility in the Developer IDE and CLI Usage Report Jul 24, 2025 · release notes

     Snyk’s Developer IDE and CLI usage report adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. adoption metrics, requiring CLI v1.1298.1 for the new visibility.

     • Adds Top-Level MCP Scan Count metric to the Developer IDE and CLI usage report.
     • Adds a Usage Breakdown Chart to the Developer IDE and CLI usage report visualizing split between CLI, IDE plugins, and Agentic Scans (MCP).
     • Adds an MCP Host Breakdown Chart to the Developer IDE and CLI usage report breaking down Agentic Scans by host application.

     3 details in Everything

151. Snyk Essentials: New SCM asset context - organization & project Jul 24, 2025 · release notes

     Snyk Essentials announces SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. Project and Organization asset context, available beginning July 30.

     • Adds SCM Project enrichment from BitBucket and Azure DevOps to asset data
     • Adds SCM Organization enrichment representing GitHub/ADO organizations, Bitbucket workspaces, and GitLab groups

     2 details in Everything

152. Exciting Update: Introducing the New Snyk Tenant-Level Analytics Experience! Jul 21, 2025 · release notes

     Snyk introduces an opt-in Early Access tenant analytics experience with customizable dashboards and a report catalog for Enterprise users with group reporting permissions.

     • Adds the ability to build customizable analytics dashboards using new widgets.
     • Enables users with group reporting permissions to access tenant-level analytics for all authorized groups.

     2 details in Everything

153. Snyk Code Update Jul 18, 2025 · release notes

     Snyk Code announces mongoose, express-mongo-sanitize, JAX-RS, sqlx, and Slick coverage plus cross-file analysis improvements for August 5, 2025.

     • Adds mongoose framework support for JavaScript/TypeScript detection
     • Adds express-mongo-sanitize library support for JavaScript/TypeScript detection
     • Adds JAX-RS framework support for Java detection
     • Adds sqlx library support for Go detection
     • Adds Slick framework support for Scala detection

     +2 more show less

     • Introduces initial detection coverage for CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-330 (insecure random number generation) in Python
     • Enhances inter-file analysis to track data sanitization across multiple files, reducing false positives

     7 details in Everything

154. Snyk Agent Fix in PRs is coming to Early Access Jul 18, 2025 · release notes

     Snyk Agent Fix announces opt-in Early Access for GitHub pull requests using @snyk /fix and @snyk /apply to generate and commit suggested fixes.

     • Adds @snyk /fix in GitHub PR inline comments to generate and display code fix suggestions.
     • Adds @snyk /apply in GitHub PR comments to apply suggested fixes as a new commit.
     • Adds ability to generate multiple fix suggestions within the same PR for applicable SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. findings

     3 details in Everything

155. Announcing new versions of Snyk IDE plugins Jul 17, 2025 · release notes

     Snyk IDE plugins v2.23.0/v2.15.0 add PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. auth and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support; remove several features.

     • Adds Personal Access Token (PAT) as a supported authentication method across all IDE plugins, in addition to existing OAuth and legacy token methods
     • Enables automatic detection of Snyk VS Code extension to support the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP) in GitHub Copilot for integrated AI security experiences

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Code Quality Findings feature is removed from Snyk Code
     • !JavaScript CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. Library Detection in HTML, JS, and TS files is no longer supported
     • !Container Image Detection in Kubernetes YAML Files is no longer supported
156. Group by Dependency: A New View for Snyk Open Source Jul 16, 2025 · release notes

     Snyk Open Source announces a gradual rollout of the default Group by Dependency view over the next couple of weeks.

     • Enables a new default vulnerability experience that groups issues by dependency across Maven, .NET, npm, Python, Ruby, and Yarn projects

     1 detail in Everything

157. Snyk Essentials: An asset policy template for email notifications on newly disco Jul 16, 2025 · release notes

     Snyk Essentials introduces a new asset policy template for email notifications on newly discovered repositories.

158. Announcing Snyk MCP for Agentic Workflows - Early Access Jul 15, 2025 · release notes

     Snyk MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Early Access adds folder trust, new tools (snyk_aibom, snyk_trust, etc.), and removes --experimental flag in CLI v1.1298.0

     • Adds --disable-trust flag to disable the explicit folder trust mechanism required for MCP scans
     • Introduces new MCP tools: snyk_aibom, snyk_container_scan, snyk_iac_scan, snyk_sbom_scan, and snyk_trust
     • Removes the requirement for the --experimental flag to use Snyk MCP, streamlining CLI invocation

     3 details in Everything

159. Announcing Snyk CLI v1.1298.0 Jul 15, 2025 · release notes

     Snyk CLI v1.1298.0 adds PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. authentication, clearer dependency graphs, improved Maven progress output, and CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale./VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. container scanning.

     • Adds support for Personal Access Token (PAT) authentication in the CLI
     • Improves output and progress indication through the Dverbose flag for long-running Maven test, monitor, and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. scans with dense dependency graphs.
     • Enhanced --print-graph output for Node.js by adding type and classifier information to Node IDs
     • Adds default support for NPM/Yarn package aliases to improve dependency resolution.
     • --gradle-normalize-deps flag now correctly shows all internal dependencies for coordinates with multiple artifacts

     +2 more show less

     • Adds support for scanning RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 10 images using Red Hat's new CSAF/VEX vulnerability data format
     • Adds accurate scanning support for updated Chainguard Wolf image file locations

     7 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Updated glibc requirements for Linux users may break existing installations that do not meet the new baseline.
160. Snyk Code: Support for MCP Server Sources Jul 10, 2025 · release notes

     Snyk Code announces MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server entry-point analysis for Spring AI, FastMCP, and supported JavaScript/Python packages from July 23, 2025.

     • Adds support for MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) server sources as new application entry points in Snyk Code analysis.
     • Extends security coverage to agentic workflows by tracing data entering applications via MCP servers.
     • Recognizes Spring AI (org.springframework.ai) Java framework as a new supported source.
     • Recognizes FastMCP and modelcontextprotocol/typescript-sdk JavaScript libraries as new supported sources.
     • Recognizes FastMCP, modelcontextprotocol/python-sdk, and aiofiles Python packages as new supported sources.

     5 details in Everything

161. Snyk Assist: AI Learning Assistant Jul 9, 2025 · release notes

     Snyk Assist becomes available across Multi-Tenant regions for Learning Management Add-On customers after Group Admin enablement.

162. Snyk Essentials: Automatic Repository Discovery for BitBucket Jun 26, 2025 · release notes

     Snyk Essentials announces a gradual Enterprise rollout of automatic Bitbucket repository discovery from July 16, 2025.

     • Adds automatic discovery for Bitbucket Cloud, Cloud App, and Server organization-level integrations, including brokered setups, for users without a configured Essentials Group-level integration.

     1 detail in Everything

163. Assets API is coming to Early Access Jun 23, 2025 · release notes

     Snyk introduces the Assets API in Early Access for programmatic asset-data retrieval and filtering without manual exports.

164. Snyk Code Consistent Ignores is Generally Available (GA) Jun 19, 2025 · release notes

     Snyk Code Consistent Ignores GA ensures ignores are respected in IDE plugins, CLI, and PR checks

     • Makes Snyk Code Consistent Ignores generally available for all Snyk Code customers; existing Groups and Orgs can enable it in settings, while newly created Groups and Orgs have it enabled by default.

     1 detail in Everything

165. Improved support for Maven default profiles Jun 18, 2025 · release notes

     Snyk announces improved Maven default-profile activation for Open Source SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. scanning, rolling out July 9.

     • Improves Maven dependency resolution in Open Source SCM scans to follow local Maven profile activation rather than considering only activeByDefault=true profiles.

     1 detail in Everything

166. Snyk Code: Enhanced Coverage & Analysis for JavaScript/TypeScript Jun 12, 2025 · release notes

     Snyk Code announces hapi.js and TSOA analysis plus JavaScript/TypeScript improvements from July 7, 2025.

     • Adds analysis for web applications built with the hapi.js and TSOA frameworks, increasing vulnerability coverage for these platforms.
     • Improves recognition of object destructuring in request handlers within the existing Express framework support.

     2 details in Everything

167. New Threshold Defaults for Automatic Fix Pull Requests Jun 4, 2025 · release notes

     Snyk sets a new default risk score of 700 for automatic fix pull requests.

     • New auto-fix PRs use a default risk score threshold of 700 for unconfigured organizations.

     1 detail in Everything

168. Snyk Essentials: Automatic Repository Discovery for GitLab and Azure DevOps May 29, 2025 · release notes

     Plans Automatic Repository Discovery for GitLab and Azure DevOps, rolling out to Enterprise customers from June 9, 2025

169. PR Comments is in Early Access for Bitbucket Server May 29, 2025 · release notes

     PR Comments early access for Bitbucket Server adds issue summary and inline comments to pull requests.

     • Adds Issue Summary Comment for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. via Pull Request Experience section in SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integration settings
     • Adds Inline Comments for SAST findings (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances., Priority Score, Snyk Learn URL) via Pull Request Experience section in SCM integration settings

     2 details in Everything

170. Prioritize SCA Vulnerabilities with "In Direct Dependency" Insights May 29, 2025 · release notes

     Plans an In Direct Dependency column and filter for Snyk Reports, Snowflake Data Share and the Export API on June 5

     • Planned for June 5: adds an In Direct Dependency column to issues-centered reports in Snyk Analytics (Issues Detail, Issues Summary, Vulnerabilities Detail, SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. Management) to identify vulnerable direct dependencies.
     • Planned for June 5: adds an In Direct Dependency filter in Snyk Analytics to narrow down results to vulnerabilities present in direct dependencies.
     • Planned for June 5: adds the In Direct Dependency column and filter to the Snowflake Data Share as part of a new table.
     • Planned for June 5: exposes the In Direct Dependency data via the Export API in the Issues dataset.

     4 details in Everything

171. Issues Summary Report Enhancements May 22, 2025 · release notes

     Plans Issues Summary Report progress indicators, dimension picker, expandable views and default filters for June 3

     • Planned for June 3: #open issues, #new issues, #resolved issues, and MTTR metrics now include a percentage of progress indication in the Issues Summary Report
     • Planned for June 3: added Table Dimension Picker to the Risk Breakdown table for comparative analysis by asset class or introduction category
     • Planned for June 3: added expandable view for the Risk Breakdown table, allowing on-demand drill-down into underlying issues without navigation
     • Planned for June 3: set Issues Severity and Asset Class as default filters in the Issues Summary Report

     4 details in Everything

172. Announcing Conan Support May 15, 2025 · release notes

     Snyk Open Source announces Conan package support through SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. workflows and the package issues API, with GA starting May 22, 2025

     • Announces vulnerability and license intelligence for Conan packages in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. or SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOM workflows, with general availability starting May 22, 2025.

     1 detail in Everything

173. Announcing Snyk CLI v1.1297.0 May 14, 2025 · release notes

     Snyk CLI v1.1297.0 adds direct image.tar scanning and improves Gradle resolution default.

     └──▷ USE IT
     Scan a local Docker tarball for vulnerabilities without loading it into a daemon or specifying the type.
     shell copy

     snyk container test image.tar

     • Adds snyk container test <image>.tar and snyk container monitor <image>.tar to scan tar archives directly without a type prefix

     1 detail in Everything

174. Snyk Code Consistent Ignores support bulk conversion May 9, 2025 · release notes

     Snyk Code Consistent Ignores adds bulk conversion through the UI or API in Early Access

175. Snyk Essentials - Project Context on Assets May 6, 2025 · release notes

     Snyk Essentials adds Project Context on Assets GA with filtering by org and scan details

     • Adds Project Context on Assets feature to view which Snyk Projects and Organizations each asset belongs to.
     • Enables viewing key scanning details for assets, including last scan time and surface (SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. or CLI).
     • Allows filtering assets by associated Snyk Organizations for asset management.

     3 details in Everything

176. PR Experience for GitHub and BitBucket is now Generally Available May 2, 2025 · release notes

     Snyk PR Experience for GitHub and BitBucket GA with issue summary and inline comments

     • Enables Issue Summary Comments for successful and failed PR checks covering Snyk Code and Open Source findings
     • Enables Inline Comments for Snyk Code issue findings directly in pull requests
     • The generally available PR comment features also apply to repositories connected through Bitbucket Cloud App.

     3 details in Everything

177. Addition of Code Details and Description in REST Issues API Apr 29, 2025 · release notes

     REST Issues API adds File Path, Code Region, Commit ID, Key Asset and Description information for issue triage

     • The REST Issues API adds File Path information to trace Snyk Code issues within a specific file.
     • Adds Code Region information identifying the lines and columns where an issue was found.
     • Adds Commit ID information to match Snyk Code issues to their code version.
     • Adds Key Asset information identifying Snyk Code issues with a unique ID per repository.
     • Adds Description information clarifying the nature of an issue for prioritization.

     5 details in Everything

178. Snyk Essentials - Repository Visibility Enrichment Apr 27, 2025 · release notes

     Plans repository Visibility enrichment and a Visibility column in Snyk Essentials for April 29

     • Planned availability April 29: adds a new Visibility asset enrichment type providing repository visibility information (Public/Private/Internal)
     • Planned availability April 29: introduces a new Visibility column in the asset view to display this data
     • Planned availability April 29: enables prioritization and classification of repository assets based on their visibility status

     3 details in Everything

179. Announcing Snyk API & Web! Apr 22, 2025 · release notes

     Probely becomes Snyk API & Web, offering customizable DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scanning, scheduling and blackout periods

     • Probely is renamed Snyk API & Web, a Dynamic Application Security Testing and API Security solution.
     • Snyk API & Web offers customizable scanning configurations, scheduled scanning and partial scanning.

     2 details in Everything

180. Probely's Managed reports available for Enterprise accounts Apr 17, 2025 · release notes

     Plans Managed reports for Probely Enterprise accounts on April 22, supporting saved and scheduled PDF findings reports

     • Planned April 22 release for Probely Enterprise accounts: adds the Reports button on the Findings page for Enterprise accounts, enabling generation of PDF reports from filtered results
     • Planned April 22 release for Probely Enterprise accounts: adds the ability to Save a report with current filters for automatic emailing or manual download
     • Planned April 22 release for Probely Enterprise accounts: adds the ability to Manage previously saved reports for reuse

     3 details in Everything

181. Announcing Snyk CLI v1.1296.2 Apr 16, 2025 · release notes

     Snyk CLI v1.1296.2 adds experimental snyk mcp --experimental command to act as an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server

     └──▷ TRY IT
     Run Snyk CLI in experimental MCP server mode to enable integration with MCP-compatible applications.
     copy

     $ snyk mcp --experimental

     • snyk mcp --experimental is a new subcommand that allows the Snyk CLI to act as an MCP server for integrating Open Source and Code scans into compatible tools.

     1 detail in Everything

182. Reachability for C# is now available in Early Access Apr 14, 2025 · release notes

     Reachability analysis for C# NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. dependencies is now available in Early Access via Snyk Preview.

183. Snyk Essentials: Automatic Repository Discovery for GitHub Cloud App and GitHub Apr 10, 2025 · release notes

     Plans Automatic Repository Discovery for GitHub Cloud App and GitHub Enterprise, rolling out to Enterprise customers from May 5, 2025

     • Planned rollout to Enterprise customers starting May 5, 2025: adds Automatic Repository Discovery to identify imported vs. undiscovered repositories for users without a configured Snyk Essentials Group-level integration.
     • Planned rollout to Enterprise customers starting May 5, 2025: displays discovered repositories in the Snyk Essentials Inventory tab for GitHub Cloud App and GitHub Enterprise Organization-level integrations.

     2 details in Everything

184. Java 21 Support in Snyk Code Apr 10, 2025 · release notes

     Plans Snyk Code GA support for Java 21 across integrations from May 1, 2025

     • Planned GA starting May 1, 2025: enables full project scanning of Java 21 codebases across all integrations as part of General Availability.
     • Planned GA starting May 1, 2025: updates the SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. Analysis Engine to handle Java 21 syntax and semantics, including record patterns and sealed classes.
     • Planned GA starting May 1, 2025: extends the vulnerability ruleset to cover security-relevant classes introduced in Java 21.

     3 details in Everything

185. Python 3.13 support for Snyk Open Source SCM scans Apr 9, 2025 · release notes

     Plans Python 3.13 SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. scanning for pip and pipenv from April 23, 2025

     • From April 23, 2025, pipenv SCM scans use Python 3.13 when specified in the project Pipfile; updated results appear after the next retest.
     • From April 23, 2025, pip SCM scans use Python 3.13 when specified in Organization settings or .snyk files; updated results appear after the next retest.

     2 details in Everything

186. Brand new integration with Gemini Code Assist Apr 9, 2025 · release notes

     New integration with Google Gemini Code Assist allows IDE-embedded Snyk scanning and remediation via @Snyk prompts.

     • Integrates Snyk Code, Snyk Open Source, and Infrastructure as Code scanning into Google Gemini Code Assist.
     • Enables vulnerability prioritization and auto-remediation via DeepCode AI Fix through natural language @Snyk prompts in the IDE.

     2 details in Everything

187. Snyk Code Consistent Ignores is available in Early Access via Snyk Preview Apr 9, 2025 · release notes

     Snyk Code now offers consistent ignore rules across its entire ecosystem in Early Access.

     • In Early Access, Snyk Code ignores apply consistently across branches, integrations and projects within a repository, including IDE plugins, the CLI and native PR checks.

     1 detail in Everything

188. Snyk Essentials: Introducing Inventory Overview Apr 3, 2025 · release notes

     Plans an Inventory Overview tab for Snyk Essentials, rolling out to Enterprise customers from April 9, 2025

     • Rollout to Enterprise customers starting April 9, 2025: adds the Inventory Overview tab in the console to show untested repositories, asset policy coverage gaps, dormant repos with high/critical vulns, and languages with most issues.

     1 detail in Everything

189. User interface updated in Probely Apr 2, 2025 · release notes

     Probely has updated its interface with a side menu, severity badges, and new details panels for main sections.

190. Announcing Snyk CLI v1.1296.1 Mar 27, 2025 · release notes

     Snyk CLI v1.1296.1 adds Poetry 2 support and improves OAuth resilience

     • Increases authentication resilience for OAuth connections

     1 detail in Everything

191. Risk aware Fix PRs for Snyk Open Source Mar 27, 2025 · release notes

     Plans risk-aware Snyk Open Source Fix PR filtering, gradually rolling out April 3–10

192. PR Issue Summary Comment & SAST High-Context Inline Comments for GitLab & Azure Mar 25, 2025 · release notes

     Early Access PR summary and SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. inline comments for GitLab and Azure Repos are available through self-opt-in

     • In Early Access, opt-in PR Issue Summary Comments report security, license and code check counts by severity for GitLab and Azure Repos.
     • In Early Access, opt-in SAST High-Context Inline Comments show findings with CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances., priority score and Snyk Learn links in the SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. interface.

     2 details in Everything

193. Announcing New Reports in Early Access Mar 25, 2025 · release notes

     Enterprise customers gain Early Access reports for CI/CD repository testing and PCI-DSSPCI-DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. readiness

194. Broker Settings Page Update Mar 21, 2025 · release notes

     Moved Broker client commit signing toggle to the main Broker Settings page.

195. Announcing Snyk Visual Studio v2.1.1 Mar 20, 2025 · release notes

     Snyk Visual Studio v2.1.1 adds project.assets.json path to OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. file tree nodes

196. Announcing Snyk CLI v1.1296.0 Mar 13, 2025 · release notes

     Snyk CLI v1.1296.0 adds Kaniko image support, node_modules exclusion in Node.js containers, and SHA1 identity scanning for JAR/WAR/AAR.

     • --scan-all-unmanaged flag now uses SHA1 hashes to identify package identities for JAR, WAR, and AAR files
     • Support for scanning images generated by Kaniko
     • Ability to exclude node_modules directories during scans of Node.js containers

     3 details in Everything

197. Focus on What Matters: Delta Findings is Now Generally Available in Snyk IDE Plu Mar 13, 2025 · release notes

     Delta Findings becomes generally available in Snyk IDE plugins starting March 14, with summary navigation and reference-folder comparison

     • Available starting March 14: introduces General Availability of Delta Findings in Snyk IDE plugins to show only new issues in the current branch
     • Available starting March 14: adds a Summary section for seamless navigation between All and New issues views
     • Available starting March 14: enables reference folder comparison to work against branches or folders in non-Git projects

     3 details in Everything

198. Expanding gRPC Coverage in Snyk Code Mar 13, 2025 · release notes

     Plans expanded gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. taint-flow analysis in Snyk Code starting April 3, 2025

     • Planned rollout starting April 3, 2025: taint flow analysis now includes gRPC data sources to uncover more security issues in gRPC-based applications

     1 detail in Everything

199. New versions of Snyk IDE plugins Mar 13, 2025 · release notes

     Snyk IDE plugins introduce GA Delta Findings and AI Fix across VS Code, JetBrains, Eclipse, and Visual Studio.

     • General Availability of Delta Findings with a new summary view for issue management.
     • AI Fix released in all supported IDEs with enhanced stability and fixes.

     2 details in Everything

200. New available Columns for Snyk Code Issues in Reports Mar 11, 2025 · release notes

     Plans new Snyk Code issue columns in Reports and Snowflake Data Share for Enterprise customers on March 19

     • Available to Enterprise customers March 19: adds File Path column to Snyk Code Issues in Reports for enterprise customers on March 19th, allowing users to trace all issues within a specific file.
     • Available to Enterprise customers March 19: adds Code Region column to Snyk Code Issues in Reports identifying the specific line and column numbers where an issue was found.
     • Available to Enterprise customers March 19: adds Commit ID column to correlate Snyk Code issues with their associated code version in reports and Snowflake Data Share.
     • Available to Enterprise customers March 19: adds Asset Finding ID column to uniquely identify issues within a repository, helping dedupe issues found across multiple targets.

     4 details in Everything

201. Enhanced Open Source Vulnerability Management: Group by Library! Mar 11, 2025 · release notes

     Plans Group by Library for Open Source vulnerability views, progressively rolling out from March 17

     • Progressive rollout starting March 17: adds a Group by Library option to the Open Source project's vulnerability dashboard that organizes issues by the responsible library

     1 detail in Everything

202. Poetry 2 support Mar 10, 2025 · release notes

     Plans Poetry 2 support in Snyk Open Source CLI and SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations from March 26

     • Planned support from March 26; SCM repositories require re-import and CLI users must upgrade: adds detection of Poetry 2 pyproject.toml manifests declaring dependencies via the PEP 621 format in both CLI and SCM integrations

     1 detail in Everything

203. Improvements to ignore types on the project page Mar 6, 2025 · release notes

     Projects page ignore types now support expiration dates and Ignore Permanently is renamed to Won't Fix.

204. Snyk Generated Pull Requests report is now available in Early Access Mar 5, 2025 · release notes

     Early Access Snyk Generated Pull Requests report tracks fix, backlog and upgrade PR outcomes

205. Coming March 17: Snyk Code Support for Spring WebFlux Feb 27, 2025 · release notes

     Plans Snyk Code support for Spring WebFlux APIs and functional endpoints from March 17, 2025

     • Planned availability March 17, 2025: adds recognition of Mono and Flux types in Java code to better understand application behavior.
     • Planned availability March 17, 2025: detects tainted data sources in functional endpoints for improved security analysis of reactive applications.

     2 details in Everything

206. Snyk Learn Reporting Update Feb 24, 2025 · release notes

     Snyk Learn Reports is GA for Enterprise customers, with asynchronous downloads and beta Learn API access

     • Enables asynchronous processing for large report downloads to improve performance for large organizations

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !Free and Team plans lose access to Snyk Learn reporting (previously communicated in August 2024)
207. Rust & Groovy Support in Snyk Code Feb 24, 2025 · release notes

     Plans Early Access Rust and Groovy support in Snyk Code, rolling out through Snyk Preview from March 3

     • Early Access rollout starts March 3 through Snyk Preview: adds Rust language support in Snyk Preview to scan backend web applications for security vulnerabilities in frameworks, HTTP handling, async runtimes, and database interactions.
     • Early Access rollout starts March 3 through Snyk Preview: adds Groovy language support in Snyk Preview to identify security risks in backend web applications using standard libraries and major web frameworks.

     2 details in Everything

208. Changes to some system tags in Snyk Essentials Feb 20, 2025 · release notes

     Plans asset-tag type visibility and removal of selected hard-coded tags in Snyk Essentials on February 26

     • From February 26, 2025, the Inventory and individual asset views will show each asset tag’s type.
     • From February 26, 2025, selected repository-name-based system tags will be removed; users can recreate their desired tagging conditions through asset policies.

     2 details in Everything

209. Expanded Jakarta EE and Java EE Coverage in Snyk Code Feb 13, 2025 · release notes

     Plans expanded Jakarta EE and Java EE detection in Snyk Code for March 1, 2025

     • Planned availability March 1, 2025: adds JMS messaging, WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output., and Mail as new sources of user-controlled data for vulnerability detection in Snyk Code.
     • Planned availability March 1, 2025: extends detection coverage across Jakarta EE components and sinks for enhanced security insights.
     • Planned availability March 1, 2025: enables recognition of sanitizers defined via ConstraintValidator annotations within the same repository.

     3 details in Everything

210. PR Checks for Snyk Code are now Generally Available Feb 11, 2025 · release notes

     Snyk Code PR Checks is GA across supported SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations; failed checks can gate merges through SCM configuration

211. Broker Version Update Feb 7, 2025 · release notes

     Snyk Broker v4.205.1 enables all ACCEPT rule flags by default, requiring opt-out config for specific exclusions.

     └──▷ USE IT
     Opt-out of a specific ACCEPT rule by adding the flag to the Broker config file.
     config copy

     ACCEPT_<FLAGNAME>=false

     • Sets all ACCEPT rule flags to true by default in Broker v4.205.1
     • Allows opting out of specific ACCEPT flags via ACCEPT_<FLAGNAME>=false in client configuration

     2 details in Everything

212. Snyk integration with Google Security Command Center Feb 5, 2025 · release notes

     Early Access integration brings Snyk findings into Google Security Command Center for Enterprise customers

213. Tenant Navigation Update Feb 3, 2025 · release notes

     Enterprise customers gain a new top-level Tenant entity in the left-side navigation to organize Groups and Organizations.

     • Adds a Tenant entry to the left-side hierarchical navigation menu for all Enterprise customers
     • Introduces Tenant-level roles to manage access within the new Tenant entity

     2 details in Everything

214. CVSS 4.0 and Exploit Maturity Support in the REST Issues API Jan 23, 2025 · release notes

     Adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.0 scores and Exploit Maturity fields to the REST Issues API response for granular prioritization.

     • Adds data.severities[].level field to REST Issues API responses to support both CVSS 3.1 and CVSS 4.0 severity levels
     • Adds data.severities[].version field to indicate the CVSS version used for each severity entry
     • Adds Exploit Maturity (Threat Metrics) fields in the REST Issues API response
     • Provides access to all vector data and exploit details for each vulnerability via the REST Issues API

     4 details in Everything

215. New versions of Snyk IDE plugins Jan 13, 2025 · release notes

     Snyk IDE plugins bring Early Access Delta Findings to all supported IDEs and add Visual Studio auto-scanning

     • Delta Findings is available in Early Access across VS Code, JetBrains, Eclipse and Visual Studio.
     • Introduces Auto-scanning capability for the new Visual Studio v2.0.0 plugin
     • Enables automatic API URL detection during OAuth authentication in the IDE plugins

     3 details in Everything

216. The SLA Management Report New Edition Jan 9, 2025 · release notes

     Enhanced SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. reporting with threshold controls, filtering, column customization, and CSV export capabilities.

     • At Risk setting to define when an issue is approaching its SLA breach deadline
     • New SLA filters in the filter picker for SLA status, Time until breach, and Issue age
     • Column picker for Breached and at risk open issues table to add any issue attribute
     • CSV export functionality for report tables
     • Default date range removed (full history view instead of last 90 days)

     5 details in Everything

217. Introducing the Assets Dataset in Snowflake Data Share Dec 19, 2024 · release notes

     Plans an Assets dataset in Snowflake Data Share, available from January 8

218. Artifactory Gatekeeper Plugin 4.0.0 Dec 18, 2024 · release notes

     Snyk Artifactory Gatekeeper Plugin 4.0.0 adds continuous mode and new repo types

     • Adds continuous mode to revoke access to packages if a new vulnerability is discovered
     • Adds support for Ruby Gems, Cocoapods, and NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. repositories
     • Adds support for Artifactory version 7.84 and above

     3 details in Everything

219. Upcoming improvements to Cross-site Request Forgery findings in Snyk code Dec 18, 2024 · release notes

     Plans JavaScript CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. detection improvements in Snyk Code for January 15, 2025

     • Planned release January 15, 2025: adds detection for Cross-site Request Forgery findings using the express-csrf-protect library
     • Planned release January 15, 2025: adds detection of CSRF protections configured in a separate file from the main Express app setup
     • Planned release January 15, 2025: improves accuracy by restricting findings to cases where basic auth or cookie usage is detected

     3 details in Everything

220. More improvements for Gradle scanning - type-safe accessors Dec 18, 2024 · release notes

     Plans type-safe project accessor support for the preview Gradle scanner from January 7, 2025

221. Snyk Reports Enhanced Asset Context Dec 18, 2024 · release notes

     Plans Asset and Application context columns and filters in Snyk Reports from January 8

     • Planned availability January 8: adds Asset name, Parent Asset name, Asset class, Asset type, Asset tags, and Repository freshness columns to Snyk Reports.
     • Planned availability January 8: adds Asset Application, Asset Owner, Asset Category, Asset Catalog Name, and Asset Lifecycle columns to Snyk Reports.
     • Planned availability January 8: adds filtering capabilities for Asset name, Parent Asset name, Asset class, Asset type, Asset tags, Repository freshness, Asset Application, Asset Owner, Asset Category, Asset Catalog Name, and Asset Lifecycle in Snyk Reports.

     3 details in Everything

222. GitHub Server App is now available in Early Access Dec 16, 2024 · release notes

     Snyk adds GitHub Server App integration for GitHub Enterprise Server in Early Access

223. Coming Soon – Hierarchical Navigation Update Dec 11, 2024 · release notes

     Plans Enterprise Tenant navigation with member management and Analytics access for Analytics Early Access customers

     • Planned rollout over the following weeks for Enterprise customers: adds Tenant entry to the left-side navigation menu for Enterprise customers
     • Planned rollout over the following weeks for Enterprise customers: adds new Members page under Tenant for managing users and assigning admin rights
     • Planned rollout over the following weeks for Enterprise customers: adds access to Snyk Analytics from the Tenant nav menu for Early Access customers

     3 details in Everything

224. High-Context Inline Comments are now available in Early Access Dec 9, 2024 · release notes

     Early access for High-Context Inline Comments in Snyk PRs with CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances., priority score, and data flow.

     • In Early Access, opt-in High-Context Inline Comments embed SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. findings directly in supported GitHub and Bitbucket pull requests.

     1 detail in Everything

225. General Availability of GitHub Cloud App Dec 9, 2024 · release notes

     General availability of the GitHub Cloud App integration for Snyk

     • Adds GitHub Cloud App as a supported authentication method, using short-lived tokens instead of Personal Access Tokens (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) or OAuth.
     • Enables role-based, granular access control for the GitHub integration.

     2 details in Everything

226. Visual Studio extension major upgrade Dec 5, 2024 · release notes

     A preview Snyk Visual Studio upgrade adds auto-scanning, IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup., Delta Findings and Learn integration; release is planned for January 9

     • The special preview for Visual Studio 2022 (17.5+) includes auto-scanning, IaC support, Delta Findings and Snyk Learn integration.
     • The preview improves and standardizes the UI, aiming for parity with VS Code and JetBrains extensions; release is planned for January 9.

     2 details in Everything

227. PR Issue Summary Comment is now in Early Access Nov 26, 2024 · release notes

     Snyk PR Issue Summary Comments are now in Early Access for GitHub and Bitbucket SCMs.

     • Adds the Pull request experience section to Snyk SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integration settings to enable PR Issue Summary Comments
     • Enables PR Issue Summary Comments for GitHub OAuth, GitHub Enterprise (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.), GitHub Cloud App, Bitbucket Cloud (PAT), and Bitbucket Cloud App

     2 details in Everything

228. OAuth service accounts in the UI Nov 18, 2024 · release notes

     Adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. service account creation and management directly in the Snyk UI

229. Announcing the New Asset Dashboard Nov 18, 2024 · release notes

     New Asset Dashboard adds global filters, PDF export, and new data widgets for enterprise users.

     • Global filters bar enables slicing the dashboard by asset attributes
     • PDF export allows exporting the full dashboard to PDF format
     • New Asset Class Breakdown, Package manager breakdown, and Application context availability widgets are added
     • Revised Coverage Overview widget provides holistic security product coverage view

     4 details in Everything

230. Vulnerabilities Detail Report Enhancements Nov 7, 2024 · release notes

     Vulnerabilities Detail Report now supports target spread indication and a customizable column picker for prioritization.

     • Adds affected targets count in the main table and target name when drilling down to indicate vulnerability spread across targets
     • Adds a column picker feature to view and prioritize vulnerabilities by NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. score, CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. score, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. score and more

     2 details in Everything

231. Developer IDE and CLI usage Report Enhancements Nov 7, 2024 · release notes

     Snyk IDE usage reports now include developer email addresses and PDF export.

     • Adds developer email address to the Adoption by individual users table in the Developer IDE and CLI usage Report
     • Adds PDF export for the Developer IDE and CLI usage Report

     2 details in Everything

232. Asset Dashboard Upcoming New Edition Nov 5, 2024 · release notes

     Plans a new Asset Dashboard for Enterprise customers from November 18, with global filters, PDF export and new widgets

     • Planned for Enterprise customers from November 18: a global filters bar to slice the dashboard by asset attributes.
     • Planned for Enterprise customers from November 18: a revised Coverage Overview widget for holistic security-product coverage.
     • Planned for Enterprise customers from November 18: Asset Class Breakdown, Package manager breakdown and Application context availability widgets.

     3 details in Everything

233. New IDE courseware for Developers Oct 31, 2024 · release notes

     Release details a training update for Snyk IDE users, highlighting the Net new issues vs all Issues filter and DeepCode AI Fix capabilities via new courseware.

234. Snyk Code upcoming support for Go's Gin Framework Oct 31, 2024 · release notes

     Plans Snyk Code vulnerability-detection support for Go’s Gin framework on November 13

     • Planned for November 13: vulnerability-detection coverage for Go applications using Gin, applying to the rules already supported by Snyk Code.

     1 detail in Everything

235. DeepCode AI Fix in the IDE is now GA Oct 29, 2024 · release notes

     DeepCode AI Fix for the IDE graduates to GA with broader language support and improved quality.

     • DeepCode AI Fix expands language coverage from one to eight: JavaScript, TypeScript, Java and Python are GA, while the remaining languages have limited support.

     1 detail in Everything

236. Announcing Snyk CLI v1.1294.0 Oct 23, 2024 · release notes

     Snyk CLI v1.1294.0 adds CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation support.

237. Improvements to Deepcode AI Fix in JetBrains IDE plugin Oct 17, 2024 · release notes

     Plans up to five DeepCode AI Fix suggestions and direct acceptance in the JetBrains plugin for October 23

     • Planned for October 23: receive and review up to five AI-generated fix suggestions in the Snyk JetBrains IDE plugin.
     • Planned for October 23: accept a suggestion and apply its changes directly to source code in the Snyk JetBrains IDE plugin.

     2 details in Everything

238. Delta findings in VS Code & JetBrains (Early Access) Oct 17, 2024 · release notes

     Plans opt-in Early Access Delta Findings for VS Code and JetBrains from October 23, showing newly introduced issues

     • From October 23, Early Access Delta Findings is planned for VS Code and JetBrains, disabled by default; an IDE setting enables comparison of current findings against a base branch using a local Git repository.

     1 detail in Everything

239. Simplified API Versioning Sep 17, 2024 · release notes

     Plans closed-beta API endpoints after October 17 and date-only versioning for new beta API versions, preserving existing integrations

     • After October 17, new experimental endpoints will be replaced by /closed-beta previews for a limited set of users; these are not suitable for integrations or major workloads.
     • For upcoming new beta API versions, specify the date, such as 2024-08-02, without the ~beta suffix; existing versions and integrations remain unchanged.

     2 details in Everything

240. New filters in the IDE & CLI usage Report Sep 5, 2024 · release notes

     New Environment and Snyk product filters added to the IDE & CLI usage Report.

     • Adds an environment filter to the IDE & CLI usage Report for analyzing adoption in specific coding environments (VS Code, IntelliJ, Visual Studio, Eclipse, CLI)
     • Adds a Snyk product filter to the IDE & CLI usage Report for refining metrics by specific Snyk products

     2 details in Everything

241. New versions of Snyk IDE plugins Aug 29, 2024 · release notes

     Snyk IDE plugins add OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. auth support and severity annotations across VS Code, JetBrains, Eclipse, and VS.

     • Adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 authentication across the listed Snyk IDE releases: VS Code v2.18.1, JetBrains v2.9.0, Eclipse 2.0.2 and Visual Studio 1.1.63; the Visual Studio release supports VS 2022 only.

     1 detail in Everything

242. Announcing Snyk CLI v1.1293.0 Aug 28, 2024 · release notes

     Snyk CLI v1.1293.0 adds snyk config environment, default OAuth, pnpm Early Access, and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup.+ enhancements.

     • Introduces snyk config environment subcommand to set the API endpoint
     • Enables OAuth authentication by default for local users starting from v1.1293.0
     • Adds support for license issues in sbom test output for CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. formats
     • Improves snyk container sbom accuracy by including application dependencies that could previously be omitted, alongside operating-system dependencies.
     • Displays successful rule hits alongside failed rules in IaC+ test results

     +1 more show less

     • Enables Early Access testing and monitoring of pnpm projects via Snyk Preview

     6 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Starting with CLI v1.1293.0, local-user authentication defaults to OAuth.
243. CLI support for pnpm now in Early Access Aug 28, 2024 · release notes

     Snyk CLI adds pnpm project support in Early Access for v1.1293.0+

     • Adds snyk test and snyk monitor capabilities for pnpm projects (versions 7, 8, and 9) when enabled via Snyk Preview.
     • Adds Early Access support for scanning pnpm workspaces using the existing --all-projects CLI option.

     2 details in Everything

244. Introducing Quick Filters for Asset Inventory Aug 22, 2024 · release notes

     Snyk Asset Inventory gains a UI feature called Quick Filters to streamline the process of narrowing down assets using predefined criteria.

245. Announcing general availability of Workspaces, and improved SCM integration accu Aug 19, 2024 · release notes

     Snyk introduces Workspaces GA, rolling out as default for new organizations.

     • Announces General Availability of Workspaces to improve SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integration accuracy and reliability
     • Rolls out ability to manage Workspaces at both the Snyk Organization and Snyk Group level

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Workspaces will be enabled by default for new Snyk Organizations, and existing Organizations will gradually transition; deferral requests must be submitted by September 20, 2024.
246. Early Access of Reachability for JavaScript & TypeScript Aug 6, 2024 · release notes

     Early access for JavaScript/TypeScript reachability analysis in Snyk

     • Adds Reachability badge to Issue details in the UI for npm and Yarn projects.
     • Updates Issues API to return Reachability level for applicable issues.
     • Adds filtering by Reachability in the Projects view to prioritize vulnerable paths.

     3 details in Everything

247. Expanded Snyk Pull Requests Coverage for All SCM Integrations Jul 26, 2024 · release notes

     Snyk PRs (Fix, Backlog, Upgrade) now available for all supported SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations

248. AppRisk - More Application Context Integration Jul 18, 2024 · release notes

     AppRisk Essentials and Pro gain OpsLevel, Atlassian Compass, Harness and Datadog Service Catalog integrations for application context

249. AppRisk - Improved Edit Integration Profile Jul 17, 2024 · release notes

     AppRisk Essentials and Pro add wildcard GitHub organization onboarding and profile edits without resubmitting credentials

     • AppRisk Essentials and Pro users can edit Integration Hub profiles without resubmitting existing credentials; this applies across SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows., App Context, SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., Secrets and Runtime integrations.

     1 detail in Everything

250. Developer IDE and CLI usage report (GA) Jun 28, 2024 · release notes

     The GA Developer IDE and CLI usage report is available through Change Report at Group and Organization levels

     • Enables security teams to identify local development adoption of Snyk testing through IDE plugins and CLI.

     1 detail in Everything

251. Announcing Snyk CLI v1.1292.0 Jun 25, 2024 · release notes

     Snyk CLI v1.1292.0 adds --target-reference for container projects and .NET Early Access scanning.

     • Supports --target-reference CLI option in Snyk Container to create sub-groupings on the Projects page
     • Adds Early Access for improved .NET scanning leveraging deeper ecosystem integration
     • New vulnerabilities receive hand-curated CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4.0 vectors from June 18, 2024; this additive update also applies to earlier CLI versions.

     3 details in Everything

252. API end-of-life process starting July 22nd 2024 Jun 20, 2024 · release notes

     Snyk announces January/July API end-of-life cadences, with the first audit-log and issues migration cycle beginning July 22

     • Announces January and July end-of-life cadences for v1 and non-GA REST endpoints, with advance notice.
     • The first cadence begins July 22, 2024 and covers v1 Group/Org audit logs and experimental Get all Issues by Org/Group endpoints.
     • GA REST Group and Org audit-log endpoints are identified as migration replacements.
     • The GA REST Issues API is identified as the replacement for the experimental issues endpoints.

     4 details in Everything

253. DeepCode AI Fix - Now available in all tenants and JetBrains IDEs Jun 20, 2024 · release notes

     DeepCode AI Fix expands to all tenant regions and JetBrains IDEs through Snyk Preview

     • Enables Snyk Code Fix Suggestions via the Settings -> Snyk Preview UI path for all tenant regions including EU and AU
     • Adds support for DeepCode AI Fix in all JetBrains IDEs, requiring Snyk JetBrains plugin version v2.8.0 or newer

     2 details in Everything

254. EPSS & JIRA Data in Snyk Reporting Jun 19, 2024 · release notes

     Snyk Reports adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. and Jira-integration columns; Jira App data is excluded

     • Adds EPSS Score column to reports for exploitation probability in the next 30 days
     • Adds EPSS Percentile column to reports showing vulnerability ranking by score
     • Adds Has Jira Issue(s) Assigned boolean column to track Jira linkage This covers the Jira integration, not Snyk’s Jira App.
     • Adds Latest Jira Issue column with link to the most recent Jira issue card This covers the Jira integration, not Snyk’s Jira App.
     • Adds Jira Issues List column listing all attached Jira issue keys This covers the Jira integration, not Snyk’s Jira App.

     5 details in Everything

255. Improved security prioritization with CVSS version 4.0 Jun 18, 2024 · release notes

     New vulnerabilities are now assigned CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v4.0 vectors and scores, determining default severity.

     • All new advisories identified by Snyk Open Source include both CVSS v4.0 and CVSS v3.1 severity assessments
     • New issues use CVSS v4.0 score to determine the default severity of the issue

     2 details in Everything

256. API Changelogs are now GA! May 30, 2024 · release notes

     Snyk exposes a changelog for its REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. to track endpoint changes and breaking updates.

     • Adds access to a changelog for Snyk's REST API that outlines affected endpoints, change descriptions, and whether each update is breaking.

     1 detail in Everything

257. Custom PR templates are now GA May 20, 2024 · release notes

     Snyk makes Custom PR templates generally available, allowing customization of title, description, and commit message for Container and OS PRs.

     • Adds Group-level configuration of custom PR templates via an API call
     • Allows repository-level customization of PR titles, descriptions, and commit messages via YAML file upload

     2 details in Everything

258. Introducing SLA Management & Featured Zero-Day Reports May 8, 2024 · release notes

     New SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. Management and Featured Zero-Day reports allow prioritizing issues by compliance deadlines and zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. exposure.

     • Adds the SLA Management report to monitor compliance against custom SLA policies and prioritize issues at risk of breach
     • Adds the Featured Zero-Day report to analyze exposure and track eradication progress for specific zero-day vulnerabilities

     2 details in Everything

259. Improved Import Logs and General Availability May 8, 2024 · release notes

     Snyk Import Logs enters GA with historical data and richer import errors, rolling out incrementally over the coming days

     • General availability of the new Import Logs page provides historical information on what was imported into your Snyk Organization
     • Adds rich error information for several ecosystems – including Go, npm, .Net, Maven, and PIP – supporting troubleshooting and remediation when an import fails

     2 details in Everything

260. Snyk Code Improvements: Support for LLM Sources May 1, 2024 · release notes

     Snyk Code adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. source taint detection for untrusted data from OpenAI/Gemini reaching sensitive functions

     • Adds support for LLM Sources (e.g. OpenAI, Gemini) as tainted inputs in Snyk Code ruleset, reporting when untrusted data reaches a sensitive function

     1 detail in Everything

261. Snyk AppRisk Pro now available May 1, 2024 · release notes

     AppRisk Pro adds Application Analytics and secret-tool integrations, with runtime intelligence sources in closed beta

     • Adds Application Analytics dashboard for macro-level tracking of AppSecAppSecApplication security: the practice of finding and fixing vulnerabilities in software during design, development, and testing. Cyber tools build on AppSec workflows to shift vulnerability detection earlier in the development lifecycle. program performance and risk KPIs
     • Adds integration with Nightfall AI to extend secret detection visibility in Snyk AppRisk
     • Adds integration with GitGuardian to extend secret detection visibility in Snyk AppRisk
     • Adds a closed-beta eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic.-based Snyk runtime sensor for risk prioritization using runtime intelligence.

     4 details in Everything

262. Filter through your audit logs more efficiently with the new GA REST version of Apr 30, 2024 · release notes

     GA REST Audit Logs API gains 1-second time granularity and multiple include/exclude event filters; api.access becomes opt-in

     • Expands GA REST audit log API filtering to support 1-second time granularity ranges instead of daily bounds
     • Enables providing multiple include and exclude event filters in a single API request to reduce noise

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The api.access endpoint no longer automatically returns results; it is now opt-in for users
263. Introducing Semantic Versioning, and Release Channels to Snyk CLI Apr 30, 2024 · release notes

     Snyk CLI adopts Semantic Versioning and introduces preview, rc, and stable release channels starting with v1.1291.0.

     • Adds preview release channel for pre-release builds deployed multiple times a day at https://static.snyk.io/cli/preview/

     1 detail in Everything

264. DeepCode AI Fix - VS Code UX Improvements Apr 24, 2024 · release notes

     DeepCode AI Fix for VS Code now supports autofixable issue counts, fix generation from details panel, fix previews, and guidance to changed code.

     • Adds visibility of how many issues are autofixable in the DeepCode AI Fix VS Code extension
     • Enables previewing possible fixes before they are applied in the VS Code UI
     • Provides guidance to the code that has changed during autofix operations

     3 details in Everything

265. Group Custom Roles are now GA Apr 19, 2024 · release notes

     Enterprise customers gain GA Group-level Custom Roles for fine-grained permission management

     • Adds the ability to create custom roles at the Group level alongside existing Organization-level roles for Enterprise users.

     1 detail in Everything

266. Automated Collections (Early Access) Apr 12, 2024 · release notes

     Early Access Automated Collections groups Projects by Target URL for Enterprise customers

     • Adds Automated Collections toggle under Organization Settings menu for Enterprise customers.
     • Automatically groups Projects with the same Target URL into a collection to filter and report on issues.

     2 details in Everything

267. Configurable Python version in Snyk Open Source SCM scans is now GA! Apr 3, 2024 · release notes

     Snyk Open Source makes Python minor-version selection GA for pip projects scanned through Git integrations

     • Settings > Languages > Python now allows specifying the Python minor version (up to 3.12) for Snyk Open Source SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. scans, replacing the previous hard-coded Python 2.7/3.7 logic.

     1 detail in Everything

268. Snyk AppRisk Essentials: New features and unified UI Mar 28, 2024 · release notes

     Snyk AppRisk Essentials unifies into main UI with aggregate issue counts and image asset support

     • Unifies Snyk AppRisk capabilities into the Snyk platform user interface at the Group level navigation
     • Adds aggregate counts of Snyk Open Source, Code, and Container issues to the Snyk AppRisk asset inventory
     • Adds support for image assets as first-class items in Snyk AppRisk with tagging and policy management

     3 details in Everything

269. Snyk AppRisk - Bring Backstage Data into AppRisk Mar 25, 2024 · release notes

     AppRisk announces Backstage catalog YAML ingestion for repository context in Essentials and Pro

     • Adds support for ingesting Backstage catalog info YAML files to enrich repo assets with organizational metadata
     • Enables filtering the AppRisk asset inventory and building policies based on Backstage metadata

     2 details in Everything

270. Snyk AppRisk - Two new filters in Policy Builder Mar 18, 2024 · release notes

     Snyk AppRisk Policy Builder now allows filtering policies by repository freshness and asset source, enabling more granular security postures for inactive or multi-source environments.

271. New CWE TOP 10 KEV (Known Exploited Vulnerabilities) Report Feb 26, 2024 · release notes

     Adds a new CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. TOP 10 KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. report to prioritize risk using CISA's Known Exploited VulnerabilitiesKnown Exploited VulnerabilitiesCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. catalog.

     • Adds the CWE TOP 10 KEV report for prioritizing remediation based on MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.'s analysis of actively exploited vulnerabilities.

     1 detail in Everything

272. Targets API endpoint release to GA! Feb 26, 2024 · release notes

     Snyk Targets API moves from beta to GA with updated naming, new fields/filters, and beta deprecation.

     • Promotes the Targets API endpoint to General Availability (GA), replacing the deprecated beta version.
     • Updates the API endpoint prefix to align with standards used in other Snyk endpoints.
     • Adds various fields and filters to the Targets API that were previously supported in other Snyk API versions.

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Targets API beta is deprecated but remains usable; it may be removed after 90 days, with further communication. Once removed, requests return HTTP 404 and users must migrate to GA.
273. Snyk Container - Custom base image recommendations is now GA Feb 12, 2024 · release notes

     Enterprise customers gain GA custom base image recommendations in Snyk Container, with API and GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. support

     • Adds API endpoints for all custom base image actions to allow automation
     • Enables definition of custom versioning schemas in the project's settings via browser GUI

     2 details in Everything

274. Snyk AppRisk - Policy Templates Feb 5, 2024 · release notes

     New Policy Templates for Snyk AppRisk

275. Snyk AppRisk - View Only Permission Jan 29, 2024 · release notes

     Snyk AppRisk now supports View Only permissions for team members.

     • Adds View Only permission level for Snyk AppRisk users

     1 detail in Everything

276. The New REST Issues API is now GA Jan 29, 2024 · release notes

     Snyk's New REST Issues API reaches GA, unifying SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself./SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment./IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. issues across projects and orgs.

     • Introduces the General Availability of the Unified Issues API for listing all Snyk issues (SCA, SAST, IaC+) in a single paginated call.
     • Adds new filters to the REST Issues API to allow tailored querying of unified issues.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Experimental REST Issues API versions are scheduled for deprecation in 30 days.
     • !The beta REST Issues API version is scheduled for deprecation in 90 days.
277. Snyk Code - DeepCode AI Fix now supports 7 languages Jan 29, 2024 · release notes

     DeepCode AI Fix adds Java, Python and C/C++, plus limited support for Go, C# and APEX

     • Adds DeepCode AI Fix support for Go (Limited support)
     • Adds DeepCode AI Fix support for C# (Limited support)
     • Adds DeepCode AI Fix support for APEX (Limited support)

     3 details in Everything

278. Snyk Open Source Gradle 8 CLI support Jan 26, 2024 · release notes

     Snyk CLI v1.1273.0+ supports scanning Gradle 8 projects.

279. Configurable Python version in Snyk Open Source SCM scans in Open Beta Dec 19, 2023 · release notes

     Adds configurable Python minor version for SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. scans in Open Beta

280. Announcing Import API Location header change and support for all Snyk environmen Dec 1, 2023 · release notes

     Import API Location header now returns valid URLs across all Snyk regions.

281. "Project Type" filter Nov 27, 2023 · release notes

     Adds a Project Type filter to the Project Listing page in Snyk.

282. GitHub Cloud App available in Open Beta Nov 20, 2023 · release notes

     GitHub Cloud App enters opt-in Open Beta for US customers, with one GitHub Org per Snyk Org

     • Introduces opt-in Open Beta for GitHub Cloud App in the US instance, with role-based granular access control and one GitHub Org per Snyk Org.
     • Provides increased API rate limits for the new GitHub Cloud App integration.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Snyk intends GitHub Cloud App to replace existing OAuth- and PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.-based integrations after planned general availability next year; this announcement does not set a removal date.
283. Removing friction when changing test frequency for Projects in the UI Nov 15, 2023 · release notes

     Bulk Change Test Frequency moved to Project Listing Page in UI

284. Snyk Open Source Improvements: Fixability filters Nov 6, 2023 · release notes

     Snyk Open Source enhances vulnerability triage with a new filter.

285. Support for SPDX in SBOM Test APIs Beta Oct 25, 2023 · release notes

     SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. Test APIs Beta now supports automatic detection and testing of SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. JSON documents alongside existing CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. support

     • Adds automatic detection of SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. format in SBOM Test APIs requests (no manual specification needed)
     • Enables vulnerability testing of SPDX 2.3 JSON documents via the SBOM Test APIs Beta

     2 details in Everything

286. Azure cloud environment scanning is now GA (Snyk IaC) Oct 18, 2023 · release notes

     Enterprise Snyk IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. customers gain GA Azure cloud scanning, resource inventory and subscription onboarding

     • Adds GET /cloud/resources endpoint to view an inventory of Azure resources
     • Supports Azure security from ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. and Terraform template scanning through scanning deployed Azure cloud resources.
     • Allows onboarding of Azure subscriptions via the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and UI for scanning and testing with security rules

     3 details in Everything

287. Expanded ecosystem coverage for SBOM Test APIs Oct 17, 2023 · release notes

     Early Access SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. Test APIs expand CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. ecosystem coverage, including generic purls for unmanaged C/C++

     • Adds support for testing CycloneDX SBOM documents with cargo, cocoapods, composer, gem, golang, hex, maven, npm, nuget, pypi, swift, and generic purl types via the SBOM Test APIs

     1 detail in Everything

288. The New REST Issues API is now in Beta! Oct 13, 2023 · release notes

     Snyk introduces Beta REST Issues API with unified issues across SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself., SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment., Cloud

     • Adds the new New REST Issues API in Beta for unified SCA, SAST, and Cloud issue management
     • Introduces Risk Score and Factors fields to assess risk using broader application and business context

     2 details in Everything

289. Open beta availability of Git repository cloning Sep 27, 2023 · release notes

     Open Beta Git repository cloning rolls out through Snyk Preview over the coming days

     • In Open Beta, temporary shallow Git clones support code security and quality analyses through SCMSCMSource Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. integrations.
     • Over the coming days, the open beta rolls out across Snyk deployments for GitHub, GitHub Enterprise, GitLab, Bitbucket Server, Bitbucket Cloud App, Bitbucket Cloud (Legacy) and Azure Repos, covering import, PR checks and recurring tests.
     • Allows Snyk Organization administrators to enable the new cloning capability via Snyk Preview for all supported SCM integrations and flows.

     3 details in Everything

290. Snyk Code Improvements: C#, Java, Python Sep 15, 2023 · release notes

     Plans Snyk Code severity alignment, Java sanitizer improvements and restored JSP taglib processing over the next two weeks

     • Plans C#, Java and Python severity alignment for consistency over the next two weeks, with similar or fewer findings expected.
     • Plans Java sanitizer improvements, with similar or fewer findings expected.
     • Re-enables Java/JSP taglib directive processing, annotated as released September27; findings may increase.

     3 details in Everything

291. Snyk Code Announcement: GA of Swift and Scala Sep 5, 2023 · release notes

     Plans Snyk Code GA support for Swift and Scala on September 6

     • Plans GA Swift scanning support for all customers from September 6; findings may increase.
     • Plans GA Scala scanning support for all customers from September 6; findings may increase.

     2 details in Everything

292. SBOM Test APIs Sep 5, 2023 · release notes

     Open Beta asynchronous SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. Test APIs support CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. vulnerability testing for npm and Maven

293. Snyk Code Updates: VB.NET to Open Beta and Beta languages in Snyk Preview Aug 25, 2023 · release notes

     Plans VB.NET Open Beta and Snyk Preview access to beta languages from August 28

     • From August 28, VB.NET scanning is planned to enter Open Beta in Snyk Code.
     • From August 28, Snyk Preview will offer upcoming language support; customers not already opted into beta languages must enable it, while existing beta settings carry over.

     2 details in Everything

294. Snyk Container enhancements - Added support for Chainguard Images and Wolfi Aug 24, 2023 · release notes

     Snyk Container expands platform support to include Chainguard Images and the Wolfi (un)distribution for vulnerability scanning.

     • Enables vulnerability identification in Chainguard and Wolfi images via the Snyk Container CLI, Kubernetes Monitor integration, and container registry integrations.

     1 detail in Everything

295. New Risk Score for open source and container issues Aug 17, 2023 · release notes

     Snyk introduces a new Risk Score for open source and container issues in open beta.

296. Support for Bruno Collections in API Targets · issue 014

     Snyk API & Web now supports Bruno collections natively, enabling direct import to create API Targets.

     └──▷ HOW TO FIND IT
     Import a Bruno collection to create an API Target without pre-converting it to Postman or OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. format.
     📍In the Snyk console, go to API & Web › API Targets, select Import Collection, and choose your Bruno collection file.