You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Snyk has created this PR to upgrade snyk from 1.278.1 to 1.1306.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 1221 versions ahead of your current version.
The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation
Features
doctor: Adds the snyk doctor command to diagnose common CLI problems: generate a diagnostic report for the current system, or analyze debug log output. (ab56a0e)
container: Container scans now detect the Java runtime version across a wider range of JVM base images, and can now find vulnerabilities in .NET application dependencies. (5586aac)
mcp: The breakability evaluation tool in the Snyk MCP Server is now enabled by default and no longer requires an experimental flag. (56a9196)
test: Improves dependency detection for Gradle projects. (c819b69)
redteam: The experimental snyk redteam command has been removed from the CLI, following its deprecation (deprecation date May 31, 2026). (c7d0e3e)
Bug Fixes
general: Shows a warning when a request is automatically retried due to rate limiting, instead of retrying silently. (f803397)
general: Skips the reachability upload when no supported files are present, instead of failing. (9ba448c)
test: Fixes dependency resolution for Swift Package Manager projects that reference packages by registry identity, so they're correctly matched to their GitHub source for vulnerability scanning. (64ac442)
test: Fixes scanning of sbt projects with custom Scala configurations. (5765a12)
test: Fixes a bug where scanning Yarn workspaces could report vulnerabilities from a workspace member's dev dependencies as if they were production dependencies, when that member was consumed by a sibling package. (ade08e4)
The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation
Features
sbom: Introduces the --allow-incomplete-sbom flag for snyk sbom, allowing the SBOM to be generated even when individual projects fail to resolve. Failed projects are surfaced as per-project errors alongside the successful results. (29ba128)
container: Speed up snyk container monitor by sending dependency requests in parallel, configurable via the SNYK_REQUEST_CONCURRENCY environment variable. (186c5fb, 6764f65)
general: Linux ARM64 and AMD64 binaries are now statically linked by default. (f02b850)
mcp: Adds an experimental breakability evaluation tool to the Snyk MCP Server. (69806f5)
Bug Fixes
test: Fixes resolution of aliased npm packages so the alias from the lockfile is used instead of the target package name. (9b0e4d9)
test: Fixes parsing of Python .whl files when scanning projects with --all-projects. (12ac0db)
deps: Updates dependencies to fix vulnerabilities:
The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation
Bug Fixes
dependencies: Updates dependencies to fix vulnerabilities:
The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation
The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation
Bug Fixes
general: Improved error handling to prioritize and surface the most relevant error and derive the correct exit code when multiple errors occur during CLI execution. (b505a96)
The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation
Features
aibom: Introduces the snyk aibom test command. (2978044)
test, monitor, sbom: Introduce --maven-skip-wrapper flag to force the use of a globally installed mvn command. (0ee90ca, ff31066)
general: Introduce explicit configuration for network retry max-attempts. (1fbdf38)
container: Add deprecation warnings for -shaded-jars-depth and non-numeric values for --nested-jars-depth. (321b6f5)
container: Extend support for java runtime binary scanning (b60473a)
mcp: Improves auto-enable behavior for Snyk Code, promotes package health checks to stable. (5f5898f)
redteam: Adds a vulnerability summary to scanned output. (52eaf5a)
redteam: Add --json flag support for list commands, exhaustive and eager modes. (e962c4d)
Bug Fixes
general: Fix printing JSON output on stdout when only --json-file-output is specified. (32f65f0)
test: Fixes an issue where no files were uploaded when using --skip-unresolved. (71ca761)
test: Prevents scan failures when Maven builds succeed with non-fatal errors. (b30db97)
test: Fixes Go PackageURL generation and import path normalization for projects using replace directives. (7c7a366, ee7d72b)
test: Improves SDK detection when host and SDK versions differ. (96d0817)
test: Ensures project names are populated when scanning NuGet projects from repository root. (c043553)
container: Snyk Container scans of tar files on Windows should now report vulnerabilities for Python application package files. (9b86790)
container: Override packages with inaccurate pom.properties files (b60473a)
test: Ensure Yarn workspace pacakges matches are actual members defined in the root package.json. (0dd6581)
test: Fix increased scan times when testing Golang projects. (f2f5ba2)
code: Snyk Code scans now return clearer error message and exit codes when testing unsupported projects (6f5b4e3)
test: Fix a bug where aliased packages were being resolved with the target name insted of the alias for yarn projects. (dcbec6f)
test: Fix a bug where Python packages with . characters in their name were incorrectly parsed to include - characters. (9a2a36e)
deps: Updates dependencies to fix vulnerabilities:
This is a very large major version upgrade for the Snyk CLI, spanning over a thousand releases and several years. Due to the significant time and version gap, this upgrade is considered high-risk and will likely introduce breaking changes to CI/CD pipelines and local development workflows.
Key Breaking Changes & Considerations:
Linux Environment Requirements: Effective from version 1.1298.0, the minimum required GNU C Library (glibc) version was increased for Linux environments. This is a critical change that could break builds on older Linux distributions.
Default Authentication Method: Starting with version 1.1293.0, the CLI defaults to OAuth 2.0 for authentication, which is a change from the previous token-based method. Scripts and integrations relying on the old authentication flow may fail and require updates.
End-of-Support: The starting version 1.278.1 is significantly outdated and falls outside of Snyk's 12-month support policy for CLI versions.
Configuration Changes: A new snyk config environment command was introduced for a more consistent way to configure API endpoints, which may affect setups for on-premise or regional instances.
Recommendation:
Given the scale of this upgrade, it is crucial to thoroughly test all Snyk CLI commands used in your workflows. Pay special attention to authentication methods in CI/CD pipelines and the compatibility of your Linux build environments. Reviewing the release notes on GitHub is strongly recommended to understand the hundreds of features, fixes, and minor changes introduced between these versions.
Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade snyk from 1.278.1 to 1.1306.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 1221 versions ahead of your current version.
The recommended version was released 22 days ago.
Issues fixed by the recommended upgrade:
SNYK-JS-IP-6240864
SNYK-JS-LODASHSET-1320032
SNYK-JS-PARSEPATH-2936439
SNYK-JS-NCONF-2395478
SNYK-JS-NETMASK-1089716
SNYK-JS-NETMASK-6056519
SNYK-JS-PACRESOLVER-1564857
SNYK-JS-IP-12704893
SNYK-JS-SNYKGRADLEPLUGIN-8248487
SNYK-JS-IP-12761655
SNYK-JS-TMP-16881240
SNYK-JS-TMP-17315641
SNYK-JS-IP-7148531
SNYK-JS-JSZIP-1251497
SNYK-JS-JSZIP-3188562
SNYK-JS-PARSEURL-2935944
SNYK-JS-PARSEURL-2935947
SNYK-JS-PARSEURL-2936249
SNYK-JS-TMP-16881240
SNYK-JS-TMP-17315641
SNYK-JS-SNYKPHPPLUGIN-8248485
SNYK-JS-PARSEURL-2942134
SNYK-JS-PARSEURL-3023021
SNYK-JS-PARSEURL-3024398
SNYK-JS-SNYK-3037342
SNYK-JS-SNYK-3038622
SNYK-JS-SNYK-3111871
SNYK-JS-SNYKDOCKERPLUGIN-3039679
SNYK-JS-SNYKGOPLUGIN-3037316
SNYK-JS-SNYKGRADLEPLUGIN-3038624
SNYK-JS-SNYKMVNPLUGIN-3038623
SNYK-JS-SNYKPYTHONPLUGIN-3039677
SNYK-JS-SNYKSBTPLUGIN-3038626
SNYK-JS-SNYKSNYKCOCOAPODSPLUGIN-3038625
SNYK-JS-TMP-11501554
SNYK-JS-TMP-11501554
SNYK-JS-DOTPROP-543489
SNYK-JS-SNYK-10497607
SNYK-JS-WORDWRAP-3149973
Breaking Change Risk
Release notes
Package name: snyk
1.1306.0 (2026-07-09)
The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation
Features
snyk doctorcommand to diagnose common CLI problems: generate a diagnostic report for the current system, or analyze debug log output. (ab56a0e)snyk redteamcommand has been removed from the CLI, following its deprecation (deprecation date May 31, 2026). (c7d0e3e)Bug Fixes
1.1305.2 (2026-06-23)
Bug Fixes
1.1305.1 (2026-06-02)
Bug Fixes
X-RateLimit-Resetheader. (2e690df)1.1305.0 (2026-05-20)
The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation
Features
--allow-incomplete-sbomflag forsnyk sbom, allowing the SBOM to be generated even when individual projects fail to resolve. Failed projects are surfaced as per-project errors alongside the successful results. (29ba128)snyk container monitorby sending dependency requests in parallel, configurable via theSNYK_REQUEST_CONCURRENCYenvironment variable. (186c5fb, 6764f65)Bug Fixes
.whlfiles when scanning projects with--all-projects. (12ac0db)1.1304.3 (2026-05-13)
The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation
Bug Fixes
Known Issues
snyk/snykcontainer images via the transitivegithub.qkg1.top/gomarkdown/markdowndependency (SNYK-GOLANG-GITHUBCOMGOMARKDOWNMARKDOWNHTML-16066911, SNYK-GOLANG-GITHUBCOMGOMARKDOWNMARKDOWNPARSER-8220052). We have assessed these vulnerabilities and confirmed they do not impact CLI users. A fix is scheduled for the stable release on2026-05-20.1.1304.2 (2026-05-06)
The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation
Bug Fixes
1.1304.1 (2026-04-27)
The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation
Bug Fixes
1.1304.0 (2026-04-09)
The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation
Features
snyk aibom testcommand. (2978044)--maven-skip-wrapperflag to force the use of a globally installedmvncommand. (0ee90ca, ff31066)max-attempts. (1fbdf38)-shaded-jars-depthand non-numeric values for--nested-jars-depth. (321b6f5)--jsonflag support for list commands,exhaustiveandeagermodes. (e962c4d)Bug Fixes
--json-file-outputis specified. (32f65f0)--skip-unresolved. (71ca761)replacedirectives. (7c7a366, ee7d72b)package.json. (0dd6581).characters in their name were incorrectly parsed to include-characters. (9a2a36e)