v1.1307.0

1.1307.0 (2026-08-26)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Features

• agent: New experimental snyk agent command — a scanning surface built for AI coding agents, with token-optimized output and ergonomics. snyk agent test runs Snyk Open Source, Code, and Secrets together. (b98420c)
• secrets: snyk secrets test now supports exclusions — add files or paths to the exclude section of your .snyk file to skip them during secrets scanning. (917bbc5)
• container: Container scans now surface image provenance attestations by default, so signed-image provenance metadata appears in results without any extra flag. (0c444b0)
• test: Improves .NET/NuGet scanning — snyk test can now analyze already-restored projects fully offline and no longer requires .NET 6 to be installed. (46cf92c)
• mcp: The full MCP profile now includes Snyk Secrets. (1d2848e)
• code, secrets: SARIF suppressions now include reviewedOn and reviewedBy metadata. (5585ea6)
• aibom: snyk aibom test --severity-threshold now filters the displayed and JSON results by severity, not only the exit code. (a429c2e)

Bug Fixes

• test: Adds support for scanning pnpm v11 pnpm-lock.yaml lockfiles. (a75c5e0)
• test: Fixes a crash (ConcurrentModificationException) when scanning dependencies of Gradle 7.4–8.2 projects. (a0e33f8)
• test: Fixes scanning of projects using Hex versions newer than 1.19. (479431a)
• test: Excludes the .git folder from file discovery, preventing intermittent scan failures caused by changes to .git contents during a scan. (127db7d)(15fb3a4))
• general: Prevents a possible connection leak when the Snyk API returns an error response. (8fd7d65)
• deps: Updates dependencies to fix vulnerabilities:
  • CVE-2026-71557 (fc6181f)
  • Updates the Go runtime to address CVE-2026-46600, CVE-2026-56862, CVE-2026-56853, CVE-2026-56860, CVE-2026-56859, and CVE-2026-56858 (1a1ed04)

v1.1306.4

1.1306.4 (2026-08-13)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their
needs. For details please see this documentation

Bug Fixes

• general: Clearer error messages when the CLI cannot reach a configured proxy, including the proxy URL and a specific error code (SNYK-CLI-0028). (a5ebf60)
• deps: Updates dependencies to fix vulnerabilities:
  • SNYK-JS-JSYAML-18593780 (d049816)
  • Updates the embedded Node.js runtime from 22.22.2 to 22.23.2 and OpenSSL from 3.5.5 to 3.5.7, including fixes for six high-severity CVEs: CVE-2026-45447, CVE-2026-48618, CVE-2026-48933, CVE-2026-56846, CVE-2026-56848, and CVE-2026-58043, plus additional OpenSSL security fixes. (bcf5fec)

v1.1306.3

1.1306.3 (2026-08-05)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their
needs. For details please see this documentation

Bug Fixes

• deps: Updates dependencies to fix vulnerabilities:
  • SNYK-JS-SHESCAPE-18319522, CVE-2026-14257 (7366ac1)
  • CVE-2026-69152 (0d18508)

v1.1306.2

1.1306.2 (2026-07-27)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their
needs. For details please see this documentation

Bug Fixes

• language-server: Improved authentication handling in the Snyk Language Server, which powers Snyk's IDE integrations. (3afb07a)
• deps: Updates dependencies to fix vulnerabilities:
  • SNYK-GOLANG-GOOGLEGOLANGORGGRPCINTERNALXDSRBAC-18172577 (11d1660)

v1.1306.1

1.1306.1 (2026-07-16)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their
needs. For details please see this documentation

Bug Fixes

• deps: Updates dependencies to fix vulnerabilities:
  • CVE-2026-41907 (6775c1e)
  • CVE-2026-13149,
    CVE-2026-59869 (7673263)
  • CVE-2026-59873,
    CVE-2026-39244 (9bf7ce7)

v1.1306.0

1.1306.0 (2026-07-09)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Features

• doctor: Adds the snyk doctor command to diagnose common CLI problems: generate a diagnostic report for the current system, or analyze debug log output. (ab56a0e)
• container: Container scans now detect the Java runtime version across a wider range of JVM base images, and can now find vulnerabilities in .NET application dependencies. (5586aac)
• mcp: The breakability evaluation tool in the Snyk MCP Server is now enabled by default and no longer requires an experimental flag. (56a9196)
• test: Improves dependency detection for Gradle projects. (c819b69)
• redteam: The experimental snyk redteam command has been removed from the CLI, following its deprecation (deprecation date May 31, 2026). (c7d0e3e)

Bug Fixes

• general: Shows a warning when a request is automatically retried due to rate limiting, instead of retrying silently. (f803397)
• general: Skips the reachability upload when no supported files are present, instead of failing. (9ba448c)
• test: Fixes dependency resolution for Swift Package Manager projects that reference packages by registry identity, so they're correctly matched to their GitHub source for vulnerability scanning. (64ac442)
• test: Fixes scanning of sbt projects with custom Scala configurations. (5765a12)
• test: Fixes a bug where scanning Yarn workspaces could report vulnerabilities from a workspace member's dev dependencies as if they were production dependencies, when that member was consumed by a sibling package. (ade08e4)
• test: Gracefully handle missing dotnet CLI during NuGet runtime resolution scans (f61edb3)
• deps: Updates dependencies to fix vulnerabilities:
  • CVE-2026-41178 (a1d2e64)
  • CVE-2026-5160 (b8a3659)
  • CVE-2025-64718, CVE-2026-53550 (ed15dd8)
  • CVE-2026-39822, CVE-2026-42505 (5b0e051)

v1.1305.2

1.1305.2 (2026-06-23)

Bug Fixes

• general: bump go version to 1.26.4 (4b97459)
• mcp: mcp logging and security fixes. (9734153)
• dependencies: Updates dependencies to fix vulnerabilities:
  • CVE-2026-44705 (3094112), (26f933c)
  • CVE-2026-45570 (b10f733)
  • CVE-2026-49982 (26f933c)

v1.1305.1

1.1305.1 (2026-06-02)

Bug Fixes

• general: Improve retry behavior when rate limited by respecting the X-RateLimit-Reset header. (2e690df)
• deps: Updates dependencies to fix vulnerabilities:
  • CVE-2026-39827 (e3816fc)
  • CVE-2026-39831 (e3816fc)
  • CVE-2026-33186 in IaC extensions (21b268b)

v1.1305.0

1.1305.0 (2026-05-20)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Features

• sbom: Introduces the --allow-incomplete-sbom flag for snyk sbom, allowing the SBOM to be generated even when individual projects fail to resolve. Failed projects are surfaced as per-project errors alongside the successful results. (29ba128)
• container: Speed up snyk container monitor by sending dependency requests in parallel, configurable via the SNYK_REQUEST_CONCURRENCY environment variable. (186c5fb, 6764f65)
• general: Linux ARM64 and AMD64 binaries are now statically linked by default. (f02b850)
• mcp: Adds an experimental breakability evaluation tool to the Snyk MCP Server. (69806f5)

Bug Fixes

• test: Fixes resolution of aliased npm packages so the alias from the lockfile is used instead of the target package name. (9b0e4d9)
• test: Fixes parsing of Python .whl files when scanning projects with --all-projects. (12ac0db)
• deps: Updates dependencies to fix vulnerabilities:
  • CVE-2026-34165 (1eec8f8)
  • CVE-2026-33762 (1eec8f8)
  • CVE-2025-62718 (0c4bdcc)
  • CVE-2026-6321 (2670813)
  • CVE-2026-6322 (2670813)

v1.1304.3

1.1304.3 (2026-05-13)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Bug Fixes

• dependencies: Updates dependencies to fix vulnerabilities:
  • CVE-2026-45022 (aa226a9)
  • CVE-2026-33814 (1691c3b)
  • CVE-2026-33811 (1691c3b)
  • CVE-2026-39836 (1691c3b)

Known Issues

• container-image: Two vulnerabilities are reported in the snyk/snyk container images via the transitive github.com/gomarkdown/markdown dependency (SNYK-GOLANG-GITHUBCOMGOMARKDOWNMARKDOWNHTML-16066911, SNYK-GOLANG-GITHUBCOMGOMARKDOWNMARKDOWNPARSER-8220052). We have assessed these vulnerabilities and confirmed they do not impact CLI users. A fix is scheduled for the stable release on 2026-05-20.