v1.1307.0

1.1307.0 (2026-08-26)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Features

• agent: New experimental snyk agent command — a scanning surface built for AI coding agents, with token-optimized output and ergonomics. snyk agent test runs Snyk Open Source, Code, and Secrets together. (b98420c)
• secrets: snyk secrets test now supports exclusions — add files or paths to the exclude section of your .snyk file to skip them during secrets scanning. (917bbc5)
• container: Container scans now surface image provenance attestations by default, so signed-image provenance metadata appears in results without any extra flag. (0c444b0)
• test: Improves .NET/NuGet scanning — snyk test can now analyze already-restored projects fully offline and no longer requires .NET 6 to be installed. (46cf92c)
• mcp: The full MCP profile now includes Snyk Secrets. (1d2848e)
• code, secrets: SARIF suppressions now include reviewedOn and reviewedBy metadata. (5585ea6)
• aibom: snyk aibom test --severity-threshold now filters the displayed and JSON results by severity, not only the exit code. (a429c2e)

Bug Fixes

• test: Adds support for scanning pnpm v11 pnpm-lock.yaml lockfiles. (a75c5e0)
• test: Fixes a crash (ConcurrentModificationException) when scanning dependencies of Gradle 7.4–8.2 projects. (a0e33f8)
• test: Fixes scanning of projects using Hex versions newer than 1.19. (479431a)
• test: Excludes the .git folder from file discovery, preventing intermittent scan failures caused by changes to .git contents during a scan. (127db7d)
• code: Snyk Code now respects .snyk, .gitignore, and .dcignore exclusions when the path or rule contains special characters such as parentheses (for example Program Files (x86)). (15fb3a4)
• general: Prevents a possible connection leak when the Snyk API returns an error response. (8fd7d65)
• deps: Updates dependencies to fix vulnerabilities:
  • CVE-2026-71557 (fc6181f)
  • Updates the Go runtime to address CVE-2026-46600, CVE-2026-56862, CVE-2026-56853, CVE-2026-56860, CVE-2026-56859, and CVE-2026-56858 (1a1ed04)