1.1309.0-preview.2f1dcd463b2b1f699901fe45188e70c24b243958 (2026-11-03)
The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation
Features
- accept a private key as the client secret in snyk auth (d8b7f5f), closes PKCS#8 snyk/go-application-framework#854
- add the supply chain extension and exit 77 when it isn't enabled (5793e5e)
- exit 69 for snyk sc when the Registry Proxy is unreachable (a71414f)
- log machine ID at start of day (ef0b402)
- map snyk sc Registry Proxy errors to exit codes (961bb01)
- select the configuration profile of a command with --config-profile [CLI-1986] (95a61e8)
- set the typed interaction.persona on analytics events [IDE-2635] (fe8f0c3)
Bug Fixes
- [OSM-3986] bump snyk-gradle-plugin to 7.1.6 (33a19bc)
- allow snyk test --html without preview features, add code test HTML spec and shared HTML checks (927416c)
- bump buildkit to v0.31.2 for CLI-2005 CVEs (a56132e)
- bump cli-extension-axi for hardened hook resolution (4754713)
- bump cli-extension-dep-graph to v2.19.1 (e58fd4b)
- bump cli-extension-dep-graph to v2.19.2 (e7d45ce)
- bump cli-extension-dep-graph to v2.20.1 (67ba874), closes cli-extension-dep-graph#271
- bump klauspost/compress and go-jose/v4 for high CVEs (b95d86f), closes #7431
- bump snyk-mvn-plugin to 4.9.5 [CLI-1949] (5a96558)
- bump snyk-nuget-plugin to 4.5.4 (ec88c97)
- bump snyk-nuget-plugin to 4.5.5 [OSM-3544] (10c6ddc)
- bump snyk-nuget-plugin to 4.5.7 (0cc47c9)
- code review markups (5cf53ba)
- correct versions of nested Go modules in vendored container binaries (c5d1dcb)
- CVE-2026-33532 (4e1beba)
- CVE-2026-73055 improper encoding or escaping (e3d1982)
- CVE-2026-93748 and CVE-2026-93750 (1c5e82a)
- dep: update Node.js to 22.23.4 (cd8286b)
- dep: update Node.js to 22.23.4 (23482f5)
- exclude persona agent name and version from redaction terms (a384a85)
- honour pip extras and PEP 508 environment markers in Python scans (9017841), closes snyk/snyk-python-plugin#385 #386
- iac: update opa to v1.4.2 to address CVE-2025-46569 [IAC-3311] (6346dfc)
- keep Gradle dependencies when dependency verification fails (6e9970f), closes snyk/snyk-gradle-plugin#360
- redact debug log terms as whole words (16b800d)
- remove outdated container app vulns warning (0a0bfe6)
- report the right nested npm copy for lockfile v2/v3 (b67d629)
- show project name in UFM human-readable test summary (665414f)
- snyk scan --source dir without reachability (6c2a547)
- SNYK-JS-TAR-18319500 (44c6f80)
- stop .NET scans failing when SelfContained=true is set [OSM-3994] (e5a9d88)
- stop false-positive Gradle findings on KGP 2.0 projects [OSM-3992] (c9446f7), closes snyk/snyk-gradle-plugin#359
- stop reporting .NET reference assemblies in container scans (a280e2f), closes snyk/snyk-docker-plugin#932
- update Go version (343f4f0)
- update toml to 5.0.1 in snyk-fix (d010390)
- update toml to 5.0.1 in snyk-fix (f07ccba)
- upgrade brace-expansion to fix uncontrolled recursion (a37eb65)
- use a relative target file for uv monitor with an absolute --file (bf371ab)