snyk.io updates

Snyk Projects now stay in sync with your repository content

undefined, undefined — Mon, 31 Aug 2026 16:00:00 GMT

The "What"

Repo Content Sync keeps your Snyk Projects aligned with what your repositories actually contain. When a change is merged to a branch Snyk monitors, Snyk creates and begins monitoring Projects for newly added manifest, Dockerfile, and configuration files, and deactivates the Projects whose files were removed. A file that is moved or renamed is picked up at its new path, and the Project at the old path is deactivated. Until now, keeping Snyk in step with a repository was a manual step: someone re-imported the repository, or a newly added dependency file simply went unscanned. Repo Content Sync makes repository content itself the trigger, so your Project list reflects the code as it is today rather than as it was at import. Sync covers Code, open source, secrets, infrastructure as code, and container (Dockerfile) Projects, and it works on custom branches as well as default branches.

Repo Content Sync will be rolled out gradually over the next several weeks.

Announcing Snyk CLI v1.1307.0

Matt Dolan, Senior Product Manager — Wed, 26 Aug 2026 15:00:00 GMT

We are pleased to announce the latest stable Snyk CLI release, v1.1307.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

Secrets
- snyk secrets test now supports exclusions — add files or paths to the exclude section of your .snyk file to skip them during secrets scanning.
Container
- Container scans now surface image provenance attestations by default, so signed-image provenance metadata appears in results without any extra flag.
.NET/NuGet
- snyk test can now analyze already-restored .NET/NuGet projects fully offline and no longer requires .NET 6 to be installed.
MCP
- The full Snyk MCP profile now includes Snyk Secrets.
Code & Secrets
- SARIF suppressions now include reviewedOn and reviewedBy metadata.
AI BOM
- snyk aibom test --severity-threshold now filters the displayed and JSON results by severity, not only the exit code.
Agent-optimized CLI
- New experimental snyk agent command space — a scanning surface built for AI coding agents, with token-optimized output and ergonomics. snyk agent test runs Snyk Open Source, Code, and Secrets together.
Additional Reliability and Performance Improvements
- Adds support for scanning pnpm v11 pnpm-lock.yaml lockfiles.
- Fixes a crash when scanning dependencies of Gradle 7.4–8.2 projects.
- Fixes a bug where arguments after -- (for example snyk test . -- -s settings.xml) were treated as scan targets, which could silently drop the Risk Score.
- Fixes scanning of projects using Hex versions newer than 1.19.
- Excludes the .git folder from file discovery, preventing intermittent scan failures caused by changes to .git contents during a scan
- Prevents a possible connection leak when the Snyk API returns an error response.
- Updates dependencies to fix vulnerabilities.

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.

Organization-scoped access in Evo

Ranko Cupovic, Principal Product Manager — Tue, 25 Aug 2026 18:33:00 GMT

Starting August 18, 2026, a user's Evo data is limited to the Snyk Organizations they can read.

Until now, everyone with access to Evo saw every repository, asset, and issue in the Tenant. Evo now reuses your existing Snyk Organization hierarchy, so there is nothing new to model and no migration to run. Nobody loses access until an administrator changes their role.

What's new:

Tenant Viewer now grants read access to the assets and issues in the Organizations the user belongs to, and to nothing outside them
Tenant Member grants no Evo access, letting administrators withhold Evo without removing Snyk platform access
Full-Tenant access continues for Tenant Admin and for the two roles ending in "with Evo access"
Organization names appear alongside repositories, distinguishing the same repository imported into more than one Organization

Note for administrators:

Existing users keep their access, and Tenant Viewers gain scoped read access for the first time. New users join as Tenant Member, which carries no Evo access, so each one needs a role change. Scoped users are read only, and assets without an Organization stay hidden, which today means all Agent Supply Chain Security and Continuous Offensive Security data.

Documentation: Access and authentication

Snyk Code September Update

undefined, undefined — Fri, 21 Aug 2026 08:00:00 GMT

This update is available on September 14, 2026. It improves coverage and precision across Snyk Code: template files are analyzed, Java framework and library support is extended, detection gaps are closed in six languages, and .gitignore no longer hides committed files from analysis.

Template files

Snyk Code analyzes template files and follows data from your application code into the template. Cross-site scripting that only becomes exploitable where the template renders its output is now reported, with the data flow shown from the application through to the template.

Supported engines: Jinja2, Razor, FreeMarker, EJS, Handlebars, Pug, Thymeleaf, Twig, Mustache and Velocity.

Java

Apache CXF — the web services framework, including its HTTP transport.
OkHttp — the HTTP client.
Spring Security OAuth2 Client — OAuth2 and OpenID Connect authentication.
Google OAuth Client and Google API Client — Google authentication and API access.
MSAL4J — Microsoft identity platform authentication.
Apache Commons Collections — collection utilities.
Flyway — database migrations.
JAXB — XML binding.
SAP Commerce (Hybris) — FlexibleSearch queries, with parameter binding recognised as safe.

Coverage for these libraries is added or improved, resulting in improved data flow analysis.

Python

LangChain LiteLLM is recognised as a source of untrusted data.

Java 25

Java 25 source is analyzed.

Rule coverage improvements

Detection coverage is extended for Java, Kotlin, C#, Go, JavaScript and PHP — additional sources, sinks and unsafe API patterns, in particular for cryptography.

Expect additional true positives and fewer false positives.

Files matched by .gitignore

Committed files matched by a .gitignore rule are analyzed.
Secrets committed and later matched by a .gitignore rule are now detected. Git ignores only untracked files, so this brings Snyk Code and Snyk Secrets in line with Git.
These are pre-existing issues in code you already committed.
The change applies across all interfaces and cannot be disabled.

Required for CLI scans. Upgrade to Snyk CLI 1.1307.0 or later, available from 26 August. Earlier versions keep the previous behavior, so CLI results will differ from your SCM and web results. SCM imports and scans need no action.

What is unchanged

Untracked files matched by .gitignore remain excluded from analysis.
.snyk exclude patterns behave as before, and remain the way to exclude a path deliberately.
Severity levels and rule identifiers do not change.

New model risk scoring for AI models in Evo

Ranko Cupovic, Principal Product Manager — Wed, 19 Aug 2026 15:00:00 GMT

Starting August 17, 2026, Evo by Snyk uses a rebuilt model risk score to evaluate the AI models discovered in your organization.

The previous Risk Index is replaced by a single score from 0–1,000 that combines attack success rate with the potential impact of a successful attack, tested against categories including prompt injection, data exfiltration, and insecure code generation. The result is a score that reflects both how easily a model can be compromised and how much damage that compromise could cause — not just whether an attack succeeded.

What's new:

Impact-weighted scoring: Risk scores now factor in the real-world consequence of an attack succeeding, not only its likelihood.
Four severity bands: Scores map to low (0–249), medium (250–499), high (500–749), and critical (750–1,000), so you can triage at a glance.
Broader attack coverage: Testing spans a wider range of direct and indirect attack categories against each discovered model.
Framework-mapped: Findings map to OWASP LLM Top 10, OWASP Agentic Security, MITRE ATLAS, and NIST AI 600-1/100-2e2025, so you can connect model risk to the compliance frameworks you already report against.
Policy-ready from day one: Evo applies default policies across common attack categories automatically, and you can create custom policies scoped to specific attack categories or goals to match your organization's risk tolerance.

If you have policies built on the old Risk Index: those policies remain visible but no longer evaluate under the new scoring. Review and recreate any Risk Index-based policies against the new model risk score to keep enforcement active.

Read more in the Risk intelligence documentation.

Snyk Assist— AI-powered support and guidance, built into Snyk

undefined, undefined — Tue, 18 Aug 2026 04:00:00 GMT

The "What"

Snyk is introducing Snyk Assist — an AI-powered support and guidance assistant available directly inside the Snyk UI.

Snyk Assist answers product, setup, and troubleshooting questions in plain language, grounded in Snyk's own documentation, release notes, and support knowledge articles. It can also retrieve read-only information about your current organization and group, and open a support case without you leaving the conversation.

Assist is available from the top right of the screen on every page, and is always accessible.

Ask questions in plain language: product concepts, account setup, integrations, and day-to-day administration — "How do I set up SSO?", "What permissions does Snyk need for my GitHub org?", "How do I configure ignore rules and approvals?". Answers are grounded in Snyk documentation and tailored to your role, plan tier, and licensed products.
Self-serve troubleshooting: conversational diagnostics drawn from Snyk's support and knowledge articles, so common problems can be resolved without waiting on a ticket.
Information about your account: issue summaries by severity, issue triage and single-issue detail, projects and import targets, collections and container images, scan settings, integrations and their connectivity status, members and their roles, and a project's current ignore rules — for your current organization and group, retrieved with your own permissions.
Support without leaving the conversation: Assist can suggest and create a support case and return the case ID and link. When it detects a capability Snyk does not support today, it can capture that as a feature request.
Vulnerability lookups: look up known vulnerabilities for a package, or a specific package version, against the Snyk Vulnerability Database.

Snyk Assist requires the new Snyk UI. It is available only to users who have the new navigation experience enabled. If you are still on the classic navigation, switch via the user account menu to use Assist.

Snyk Assist is available to Team, Ignite and Enterprise plans.

Unified Navigation, Navigation search and Dark Mode — New Snyk UI Rollout!

undefined, undefined — Mon, 17 Aug 2026 05:00:00 GMT

Snyk is rolling out a redesigned navigation experience!

The classic sidebar — which listed every page across Tenant, Group, and Organization scopes at once — is replaced by a single breadcrumb bar at the top that lets users switch scope in one click via per-level drop-downs.

The left sidebar is condensed to core areas only (Analytics, Inventory, Projects, Issues, Policies, Settings), with all settings-related pages consolidated into one context-aware Settings hub.

The update also adds a "Dark Mode" option (System/Light/Dark) under the user account menu. and a UI/Cmd/Ctrl+K command search to jump directly to any page or setting for easy orientation.

Announcing Snyk CLI v1.1306.4

Matt Dolan, Senior Product Manager — Thu, 13 Aug 2026 15:00:00 GMT

We are pleased to announce Snyk CLI release, v1.1306.4

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

Clearer error messages when the CLI cannot reach a configured proxy. Failures now report the proxy URL the CLI attempted to use, with credentials redacted, along with the specific error code SNYK-CLI-0028, making proxy misconfiguration quicker to diagnose in CI and behind corporate networks.
An updated embedded runtime, moving Node.js from 22.22.2 to 22.23.2 and OpenSSL from 3.5.5 to 3.5.7, which brings in fixes for six high-severity CVEs plus additional OpenSSL security fixes.
Fixed vulnerabilities:
- SNYK-JS-JSYAML-18593780
- CVE-2026-45447
- CVE-2026-48618
- CVE-2026-48933
- CVE-2026-56846
- CVE-2026-56848
- CVE-2026-58043

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Announcing Snyk CLI v1.1306.3

Matt Dolan, Senior Product Manager — Thu, 06 Aug 2026 12:40:00 GMT

We are pleased to announce Snyk CLI release, v1.1306.3

This release contains security fixes. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

Updates bundled dependencies to remediate known vulnerabilities, keeping the CLI current for teams with supply chain policies on the tools running in their pipelines.
Fixed vulnerabilities:
- SNYK-JS-SHESCAPE-18319522 (CVE-2026-14257)
- CVE-2026-69152

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

NTLM Authentication in Snyk API & Web

Ana Pascoal, Product Manager — Wed, 05 Aug 2026 14:30:00 GMT

Snyk API & Web now supports NTLM v2 authentication for Web targets. Security teams can configure NTLM credentials (username, password, domain, workstation) directly in the target settings, enabling authenticated scans of Windows-authenticated applications without requiring separate tools.

Snyk secrets scanner reaches general availability

undefined, undefined — Wed, 05 Aug 2026 13:00:00 GMT

Starting August 4, 2026, Snyk secrets scanner is generally available to help secure your entire SDLC against credential leaks.

Stolen credentials remain a leading initial access vector in security breaches, and the rise of AI-generated code increases the risk of exposing sensitive data. You can now use Snyk secrets scanner to detect hardcoded credentials, API keys, and tokens across your repositories and prevent them from reaching commits or being leaked.

Key capabilities include:

Machine learning driven detection and prevention across your development surfaces.
Secrets detection for both human-written and AI-generated code.
Governance and finding management directly within the Snyk web UI.

For more information, please read the blog and Snyk Secrets documentation

Governed ignores with Ignore Approval Workflow (IAW)

undefined, undefined — Mon, 03 Aug 2026 14:00:00 GMT

Until now, a developer could suppress a Snyk Code finding on their own — directly in the Web UI or IDE — with no review step.

Suppression happened silently and unilaterally, leaving security teams without a gate on what got ignored.

COBOL support for Snyk Code

Sebastian Roth, Senior Product Manager — Fri, 31 Jul 2026 08:00:00 GMT

COBOL support becomes generally available on August 17, 2026. Snyk Code brings SAST to your mainframe applications, scanning fixed-format COBOL across the integrations you already use, so mainframe code receives the same real-time, in-workflow security coverage as the rest of your stack. Detection is tuned with feedback from design-partner environments across large finance and mainframe estates.

What you can do

Scan COBOL applications for security issues alongside your other languages, with no separate workflow.
Catch real, actionable findings, with COBOL engagement in line with mainline languages.
Bring mainframe AppSec into the CLI, IDE, SCM, and PR-check integrations your teams already use.

Scope change at general availability

At general availability, the COBOL preview flag is removed and COBOL scanning runs automatically across all repositories. You may see new findings in repositories that were not scanned during the preview.

For design-partner customers

Thank you for shaping COBOL support during early access.

Snyk Code August Update

undefined, undefined — Thu, 30 Jul 2026 23:00:00 GMT

This update is available on August 17, 2026. It broadens language and framework coverage, adds serverless and LangChain support for Python, and cuts false positives in C++ and C#.

Python

LangChain support — Snyk Code covers applications that use LangChain, flagging unsafe handling of data flowing through the framework.
Serverless support — Snyk Code covers Python applications running on AWS Lambda.
New detection — weak-hash detection and detection of debug features left enabled.

Java

Spring Data coverage — data read through Spring Data repositories is tracked as a taint source, so injection, SSRF, path-traversal, and XSS findings reflect data flowing from the Spring Data layer.
New framework recognition — vert.x, Jolokia, and Spring Cloud Config Client.

Reduced noise

Fewer false positives in C++ DoubleFree and C# Code Injection.

Change to fix examples

Fix examples no longer appear in Fix analysis in the Snyk Web UI, and no longer appear in SARIF output. The issue details, the data flow, and the CWE reference are unchanged.
To remediate a Snyk Code finding, use Snyk Agent Fix. It generates a fix for that specific finding in your own code and verifies the fix by rescanning. See Fix code vulnerabilities automatically.

Overall, this release increases true-positive coverage and reduces false positives.

Announcing Snyk CLI v1.1306.2

undefined, undefined — Mon, 27 Jul 2026 15:27:00 GMT

We are pleased to announce Snyk CLI release, v1.1306.2

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

Improved authentication handling in the Snyk Language Server, which powers Snyk's IDE integrations
Fixed vulnerabilities:
- SNYK-GOLANG-GOOGLEGOLANGORGGRPCINTERNALXDSRBAC-18172577

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Automatic Target Authentication Configuration for Snyk API & Web

Natalia Yurchenko, Senior Product Manager — Thu, 23 Jul 2026 23:00:00 GMT

We are introducing Automatic Target Authentication Configuration for API & Web, an AI-driven feature that streamlines DAST authenticated scan setup.

Announcing Snyk CLI v1.1306.1

Matt Dolan, Senior Product Manager — Thu, 16 Jul 2026 15:00:00 GMT

We are pleased to announce Snyk CLI release, v1.1306.1

This release contains fixes to ensure security. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

Fixed vulnerabilities:
- CVE-2026-41907
- CVE-2026-13149
- CVE-2026-59869
- CVE-2026-59873
- CVE-2026-39244

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Rule Extensions for Snyk Code is now generally available

Sebastian Roth, Senior Product Manager — Wed, 15 Jul 2026 08:00:00 GMT

Extend Snyk Code's security rules with your own code. Add your custom functions to an existing rule so the engine understands your project's specific logic and returns more accurate findings.

Start with custom sanitizers: register your in-house sanitizer functions so Snyk Code recognizes them as valid ways to clean data, and stops flagging the code paths your own security controls already protect.

What you can do

Define and manage custom sanitizers in the in-product UI, with an FQN builder to pinpoint the exact function, or through a public REST API.
Preview the impact of a change in the UI or with the impact-test API before you apply it — see how your findings change before anything reaches your team.
Agent-friendly API: manage and preview rule extensions programmatically, so automation and agents can configure them at scale.
Available to Enterprise customers.

For our closed-beta customers

Thank you for shaping Rule Extensions during the closed beta. There are a few migration steps to complete — please read the documentation.

Announcing Snyk CLI v1.1306.0

Matt Dolan, Senior Product Manager — Thu, 09 Jul 2026 12:30:00 GMT

We are pleased to announce the latest stable Snyk CLI release, v1.1306.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

Doctor
- Adds a new snyk doctor command, giving you a quick way to diagnose common CLI problems by generating a diagnostic report for your system or analyzing debug log output.
Container
- Container scans now detect the Java runtime version across a wider range of JVM base images, and can find vulnerabilities in .NET application dependencies.
Snyk Studio MCP
- The breakability evaluation tool in the Snyk MCP Server is now enabled by default and no longer requires an experimental flag.
SCA Test
- Improves dependency detection for Gradle projects.
Additional Reliability and Performance Improvements
- Shows a warning when a request is automatically retried due to rate limiting, instead of retrying silently.
- Skips the reachability upload when no supported files are present, instead of failing.
- Fixes dependency resolution for Swift Package Manager projects that reference packages by registry identity, so they're correctly matched to their GitHub source for vulnerability scanning.
- Fixes scanning of sbt projects with custom Scala configurations.
- Fixes a bug where scanning Yarn workspaces could report vulnerabilities from a workspace member's dev dependencies as production dependencies, when that member was consumed by a sibling package.
- Updates dependencies to fix vulnerabilities.

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.

Support for Bruno Collections in API Targets

Natalia Yurchenko, Senior Product Manager — Tue, 07 Jul 2026 23:00:00 GMT

Snyk API & Web now provides native support for Bruno collections. You can import your collections directly into the platform to create API Targets without converting files to Postman collections or OpenAPI schemas first.

Snyk Open Source ecosystem coverage update

undefined, undefined — Sun, 28 Jun 2026 23:00:00 GMT

We've expanded Snyk Open Source coverage with improved scanning capabilities. These updates help you close security gaps and manage dependencies more effectively. Key improvements include new support for the uv package manager and enhanced Go scanning for private dependencies.

uv SCM support

The uv package manager is an emerging tool in the Python ecosystem. Following our earlier CLI release, uv is now available in SCM integrations. You can import uv projects and workspaces, use PR Checks, and monitor your code directly from your connected Git repositories. You do not need to use the CLI for these tasks. uv joins pip, Poetry, and Pipenv as the fourth Python ecosystem with native support in Snyk Open Source.

To get started, enable this feature for your Groups and Organizations in Snyk Preview. You can find more details in the Snyk documentation.

Improved Go scanning

Our Go scanning improvements are now generally available. This update features support for private dependencies. Go teams that use private module proxies, such as Artifactory or Nexus, or private repositories via Broker, can now achieve the same depth of scanning available for public modules.

This ensures you have no blind spots in your dependency graph when a module lives behind authentication. We support both brokered and direct connections across all SCM integrations. We are rolling this out to all users over the next two weeks. You can learn how to configure private dependencies in the Snyk documentation.

Snyk Code: July Release, C++ rules, Java library coverage, and JavaScript Insecure Transmission

Nina Kanti, Senior Product Manager — Fri, 26 Jun 2026 15:00:00 GMT

The July release expands Snyk Code coverage for C++ with several new rules and broader native C++ detection, improves detection for several popular Java libraries, and adds a new Insecure Transmission rule for JavaScript and TypeScript. These changes arrive with the July release on 13 July 2026

What's changing

New rules

Log Forging, C++ (CWE-117, high): flags untrusted user input reaching a logging sink, which can let an attacker forge or corrupt log entries.
Improper Privilege Management, C++ (CWE-269, high): flags a privilege-dropping call whose result is not verified; a failed call can leave the process running with elevated privileges.
Missing Authorization, C++ (CWE-862, CWE-732): flags overly permissive file permissions (world-writable or world-executable), and calls that pass root (UID or GID 0) to privilege-escalation or file-ownership functions.
SSL/TLS Certificate Verification Bypass, C++ (CWE-295, medium): detects disabled certificate verification across seven TLS frameworks (OpenSSL, Qt, mbedTLS, libcurl, Boost.Asio, libpq, libpqxx), which exposes connections to man-in-the-middle attacks.
Insecure TLS Configuration, C++ (CWE-327, high): detects insecure TLS configuration, such as enabling outdated TLS versions.
Sensitive Cookie Without Secure Attribute, C++ (CWE-614, low): flags cookies that omit the Secure attribute, either by default or explicitly set to false, leaving them exposed to man-in-the-middle attacks.
Insecure Transmission, JavaScript (CWE-319): detects cleartext transmission over insecure transports beyond HTTP. Initial coverage targets Redis clients (@redis/client, ioredis, redis) connecting over a non-TLS redis:// URL. New rule-key, separate from HttpToHttps.

New C++ coverage

Detection now extended to native C++ for:

Code Injection (CWE-94): across six framework modules: dlopen, LoadLibrary, Lua, CPython, Duktape, QuickJS.
Insecure Storage (CWE-922, info): sqlite, realm, leveldb, rocksdb, lmdb, Qt.
Insecure Cipher (CWE-327): broader native C++ crypto coverage (OpenSSL, Botan, libsodium, libtomcrypt, libgcrypt, Crypto++, mbedTLS).

Expanded Java library coverage

Improved detection for code using these popular Java libraries:

Azure SDK for Java (com.azure:azure-core)
Logback (ch.qos.logback:logback-classic)
Reactor Netty HTTP (io.projectreactor.netty:reactor-netty-http)
Apache Kafka clients (org.apache.kafka:kafka-clients)
Jackson (com.fasterxml.jackson.core: jackson-databind and jackson-core)

Issue alert emails: updating the default

Neha Shenoy, Senior Product Manager — Wed, 24 Jun 2026 04:00:00 GMT

On July 27, 2026, Snyk updates the default setting for issue alert emails to ensure every notification you receive is relevant to your work. These emails alert you to newly detected vulnerabilities and license violations.

Summary of changes

If you have never manually configured your notification preferences, you stop receiving these emails after July 27, 2026. This update moves issue alert notifications to an opt-in model so they only reach you if they are useful to your workflow. If you have already chosen which emails you receive, your preferences do not change and remain preserved exactly as they are.

Manage your preferences

You can keep receiving these emails by saving your preferences before the July 27 deadline, or you can re-enable them at any time afterward. Wherever you can set issue alert notifications, a banner appears in the Snyk web UI. To opt in instantly, click Keep my current selections in the banner.

You can also manually manage your settings:

For personal preferences: Navigate to Account Settings, click Notifications, find the issue alert emails for the relevant Organizations, and save your preference.
For Organizations admins: Navigate to Organization Settings, click Notifications, and update the default for all members of your organization.
For Groups admins: Navigate to Group, click Notifications, and manage issue alert settings across every organization in the Groups from a single page.

Announcing Snyk CLI v1.1305.2

Matt Dolan, Senior Product Manager — Tue, 23 Jun 2026 10:13:00 GMT

We are pleased to announce Snyk CLI release, v1.1305.2.

This release contains fixes and minor improvements. To learn more beyond what is highlighted below, please reference the full release notes.

This update includes the following:

Bumped the Go runtime to version 1.26.4.
Improved MCP logging and addressed security issues in the Snyk MCP Server.
Fixed vulnerabilities:
- CVE-2026-44705
- CVE-2026-45570
- CVE-2026-49982

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these improvements.

Snyk Learn lesson roundup: what’s new in June

Alex Ley, Senior Director, Snyk Learn — Wed, 17 Jun 2026 12:00:00 GMT

This month on Snyk Learn, we’ve added new AI security lessons covering the attacks that target agentic systems: getting agents to run code they shouldn't, poisoning their memory to bend their reasoning, and exploiting the gaps where agents talk to each other!

Security lessons

[New][AI-Sec] Unexpected code execution (RCE) - tricking your agentic systems to execute code!
[New][AI-Sec] Memory and Context Poisoning - how corrupted agent memory can silently reshape reasoning, decisions, and behavior.
[New][AI-Sec] Insecure Inter-Agent Communication - exploiting weak communication protections between agents.
[Updated] Generation of predictable numbers - how intruders can use weaknesses in random number generation to launch more successful attacks.
[Updated] Uncontrolled recursion - how infinite loops can ruin your life and crash your systems.

Expanded framework & language coverage

We’ve also expanded Snyk Learn content to cover more of your tech stack:

New/expanded language support:
- Multiple lessons expanded into Python, Rust, and Ruby for the OWASP Top 10.

Each new/updated lesson above links directly to the relevant content so you can share it with your teams or assign it as part of your training program with the Snyk Learning Management Add-On. Use Snyk Learn to help your security engineers and developers stay ahead of the latest risks!

Bonus Content

Snyk is also publishing videos on AI coding and AI security on our YouTube channel! If you would like to see content like this on Snyk Learn, use the feedback button on Snyk Learn to let us know.