Product Updates

Until now, a developer could suppress a Snyk Code finding on their own — directly in the Web UI or IDE — with no review step.

Suppression happened silently and unilaterally, leaving security teams without a gate on what got ignored.

Ignore Approval Workflow changes that.

An ignore is no longer applied automatically — it becomes a request that only takes effect after a reviewer approves it. Developers submit ignores from where they work; a reviewer approves or rejects from the web; both sides are notified of the outcome. Suppression moves from an ungoverned action to a reviewed, auditable one.

What you can do

• Submit ignore requests from the CLI, IDE, or API — a reason is required, and the ignore is created as Pending rather than applied.

• Review from the web — reviewers with the review permission approve or reject on the Ignore Requests page.

• Auto-approve your own — reviewers can bypass triage for ignores they create themselves.

• Stay notified — reviewers are emailed on new requests and requesters on the outcome.

• Control access with roles — read / create / edit / review / delete permissions; by default Collaborators request and Admins review, with custom roles supported.

• Audit everything — export ignore-request data via the audit-logs API.

COBOL support becomes generally available on August 17, 2026. Snyk Code brings SAST to your mainframe applications, scanning fixed-format COBOL across the integrations you already use, so mainframe code receives the same real-time, in-workflow security coverage as the rest of your stack. Detection is tuned with feedback from design-partner environments across large finance and mainframe estates.

What you can do

• Scan COBOL applications for security issues alongside your other languages, with no separate workflow.

• Catch real, actionable findings, with COBOL engagement in line with mainline languages.

• Bring mainframe AppSec into the CLI, IDE, SCM, and PR-check integrations your teams already use.

Scope change at general availability

At general availability, the COBOL preview flag is removed and COBOL scanning runs automatically across all repositories. You may see new findings in repositories that were not scanned during the preview.

For design-partner customers

Thank you for shaping COBOL support during early access.

Learn more in the COBOL support documentation and the COBOL rules reference.

This update is available on August 17, 2026. It broadens language and framework coverage, adds serverless and LangChain support for Python, and cuts false positives in C++ and C#.

Python

• LangChain support — Snyk Code covers applications that use LangChain, flagging unsafe handling of data flowing through the framework.

• Serverless support — Snyk Code covers Python applications running on AWS Lambda.

• New detection — weak-hash detection and detection of debug features left enabled.

Java

• Spring Data coverage — data read through Spring Data repositories is tracked as a taint source, so injection, SSRF, path-traversal, and XSS findings reflect data flowing from the Spring Data layer.

• New framework recognition — vert.x, Jolokia, and Spring Cloud Config Client.

Reduced noise

• Fewer false positives in C++ DoubleFree and C# Code Injection.

Change to fix examples

• Fix examples no longer appear in Fix analysis in the Snyk Web UI, and no longer appear in SARIF output. The issue details, the data flow, and the CWE reference are unchanged.

• To remediate a Snyk Code finding, use Snyk Agent Fix. It generates a fix for that specific finding in your own code and verifies the fix by rescanning. See Fix code vulnerabilities automatically.

Overall, this release increases true-positive coverage and reduces false positives.

We are pleased to announce Snyk CLI release, v1.1306.2

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• Improved authentication handling in the Snyk Language Server, which powers Snyk's IDE integrations

• Fixed vulnerabilities:

  • SNYK-GOLANG-GOOGLEGOLANGORGGRPCINTERNALXDSRBAC-18172577

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

We are introducing Automatic Target Authentication Configuration for API & Web, an AI-driven feature that streamlines DAST authenticated scan setup.

Scaling DAST across large application portfolios is often hindered by manual authentication tasks, such as recording login sequences, mapping CSS selectors, and configuring 2FA.

This feature eliminates manual hurdles by leveraging LLM automation:

• AI-powered mapping: Automatically generates login sequences and handles 2FA, allowing you to configure authenticated scans in minutes.

• Privacy first: Sensitive credentials are isolated in dedicated fields and are never processed by the LLM.

• Custom control: Refine the AI's behavior with natural-language instructions for complex login scenarios.

Visit the Help Center article to learn more about how it works and view current limitations.

We are pleased to announce Snyk CLI release, v1.1306.1

This release contains fixes to ensure security. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• Fixed vulnerabilities:

  • CVE-2026-41907

  • CVE-2026-13149

  • CVE-2026-59869

  • CVE-2026-59873

  • CVE-2026-39244

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Extend Snyk Code's security rules with your own code. Add your custom functions to an existing rule so the engine understands your project's specific logic and returns more accurate findings.

Start with custom sanitizers: register your in-house sanitizer functions so Snyk Code recognizes them as valid ways to clean data, and stops flagging the code paths your own security controls already protect.

What you can do

• Define and manage custom sanitizers in the in-product UI, with an FQN builder to pinpoint the exact function, or through a public REST API.

• Preview the impact of a change in the UI or with the impact-test API before you apply it — see how your findings change before anything reaches your team.

• Agent-friendly API: manage and preview rule extensions programmatically, so automation and agents can configure them at scale.

• Available to Enterprise customers.

For our closed-beta customers

Thank you for shaping Rule Extensions during the closed beta. There are a few migration steps to complete — please read the documentation.

Learn more in the Rule Extensions documentation and the API reference.

We are pleased to announce the latest stable Snyk CLI release, v1.1306.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• Doctor

  • Adds a new snyk doctor command, giving you a quick way to diagnose common CLI problems by generating a diagnostic report for your system or analyzing debug log output.

• Container

  • Container scans now detect the Java runtime version across a wider range of JVM base images, and can find vulnerabilities in .NET application dependencies.

• Snyk Studio MCP

  • The breakability evaluation tool in the Snyk MCP Server is now enabled by default and no longer requires an experimental flag.

• SCA Test

  • Improves dependency detection for Gradle projects.

• Additional Reliability and Performance Improvements

  • Shows a warning when a request is automatically retried due to rate limiting, instead of retrying silently.

  • Skips the reachability upload when no supported files are present, instead of failing.

  • Fixes dependency resolution for Swift Package Manager projects that reference packages by registry identity, so they're correctly matched to their GitHub source for vulnerability scanning.

  • Fixes scanning of sbt projects with custom Scala configurations.

  • Fixes a bug where scanning Yarn workspaces could report vulnerabilities from a workspace member's dev dependencies as production dependencies, when that member was consumed by a sibling package.

  • Updates dependencies to fix vulnerabilities.

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.

Snyk API & Web now provides native support for Bruno collections. You can import your collections directly into the platform to create API Targets without converting files to Postman collections or OpenAPI schemas first.

For teams using Bruno, this update simplifies API targets setup with several key capabilities:

• Collection Imports: Upload Bruno collections directly using a ZIP file or folder.

• Environment Variable Syncing: Snyk uploads collection environments automatically. The platform scans the import and warns you if any variables are missing required secret values.

• Authentication Support: Use authentication types derived from the collection or custom authentication scripts.

For a step-by-step walkthrough on importing your first collection, refer to the article in our Help Center.

We've expanded Snyk Open Source coverage with improved scanning capabilities. These updates help you close security gaps and manage dependencies more effectively. Key improvements include new support for the uv package manager and enhanced Go scanning for private dependencies.

uv SCM support

The uv package manager is an emerging tool in the Python ecosystem. Following our earlier CLI release, uv is now available in SCM integrations. You can import uv projects and workspaces, use PR Checks, and monitor your code directly from your connected Git repositories. You do not need to use the CLI for these tasks. uv joins pip, Poetry, and Pipenv as the fourth Python ecosystem with native support in Snyk Open Source.

To get started, enable this feature for your Groups and Organizations in Snyk Preview. You can find more details in the Snyk documentation.

Improved Go scanning

Our Go scanning improvements are now generally available. This update features support for private dependencies. Go teams that use private module proxies, such as Artifactory or Nexus, or private repositories via Broker, can now achieve the same depth of scanning available for public modules.

This ensures you have no blind spots in your dependency graph when a module lives behind authentication. We support both brokered and direct connections across all SCM integrations. We are rolling this out to all users over the next two weeks. You can learn how to configure private dependencies in the Snyk documentation.