1.1309.0-preview.85d89346ce8b25831c2d8cce1e9adb62e7e886fc (2026-11-10)
The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation
Features
- accept a private key as the client secret in snyk auth (d8b7f5f), closes PKCS#8 snyk/go-application-framework#854
- add experimental install and uninstall commands (CLI-2066) (cc12709)
- add the supply chain extension and exit 77 when it isn't enabled (5793e5e)
- allow setting the tenant at the platform level (1abf953)
- exit 69 for snyk sc when the Registry Proxy is unreachable (a71414f)
- file size limit raised to 50MB for secrets scanner [PS-895] (83b317d)
- log machine ID at start of day (ef0b402)
- map snyk sc Registry Proxy errors to exit codes (961bb01)
- read the snyk auth secret from stdin (fe2a785)
- select the configuration profile of a command with --config-profile [CLI-1986] (95a61e8)
- set the typed interaction.persona on analytics events [IDE-2635] (fe8f0c3)
- support sbt 2 projects in snyk test and snyk monitor (4a5b392)
Bug Fixes
- [OSM-3986] bump snyk-gradle-plugin to 7.1.6 (33a19bc)
- allow snyk test --html without preview features, add code test HTML spec and shared HTML checks (927416c)
- auth: upgrade open to 11 for CVE-2026-119025 (1ca93ab)
- bump buildkit to v0.31.2 for CLI-2005 CVEs (130ecc2)
- bump buildkit to v0.31.2 for CLI-2005 CVEs (a56132e)
- bump cli-extension-axi for hardened hook resolution (4754713)
- bump cli-extension-dep-graph to v2.19.1 (e58fd4b)
- bump cli-extension-dep-graph to v2.19.2 (e7d45ce)
- bump cli-extension-dep-graph to v2.20.1 (67ba874), closes cli-extension-dep-graph#271
- bump klauspost/compress and go-jose/v4 for high CVEs (df49f1b), closes #7431
- bump klauspost/compress and go-jose/v4 for high CVEs (b95d86f), closes #7431
- bump snyk-mvn-plugin to 4.9.5 [CLI-1949] (c783fee)
- bump snyk-mvn-plugin to 4.9.5 [CLI-1949] (5a96558)
- bump snyk-nuget-plugin to 4.5.4 (ec88c97)
- bump snyk-nuget-plugin to 4.5.5 [OSM-3544] (10c6ddc)
- bump snyk-nuget-plugin to 4.5.7 (0cc47c9)
- code review markups (5cf53ba)
- correct versions of nested Go modules in vendored container binaries (c5d1dcb)
- CVE-2026-33532 (4e1beba)
- CVE-2026-73055 improper encoding or escaping (e3d1982)
- CVE-2026-93748 and CVE-2026-93750 (1c5e82a)
- deps: bump golang.org/x/net for CVE-2026-78661 (9857f31)
- dep: update Node.js to 22.23.4 (23482f5)
- exclude persona agent name and version from redaction terms (b38e7f6)
- exclude persona agent name and version from redaction terms (a384a85)
- honour pip extras and PEP 508 environment markers in Python scans (9017841), closes snyk/snyk-python-plugin#385 #386
- iac: update opa to v1.4.2 to address CVE-2025-46569 [IAC-3311] (1269988)
- iac: update opa to v1.4.2 to address CVE-2025-46569 [IAC-3311] (6346dfc)
- keep Gradle dependencies when dependency verification fails (6e9970f), closes snyk/snyk-gradle-plugin#360
- Maven scans no longer break on JVM GC log lines [OSM-3378] (f5a8c1d), closes snyk/snyk-mvn-plugin#239
- npm scans now include peer deps of dependencies [OSM-3794] (ae14e1a), closes snyk/nodejs-lockfile-parser#316
- Print the CLI version without any network calls (0b62ca8)
- redact debug log terms as whole words (16b800d)
- remove outdated container app vulns warning (0a0bfe6)
- report Gradle modules once without a root build file [OSM-3958] (7b75622)
- report the right nested npm copy for lockfile v2/v3 (b67d629)
- scrub the secrets of the selected configuration profile from the debug log [CLI-2078] (688957d)
- show project name in UFM human-readable test summary (665414f)
- snyk scan --source dir without reachability (6c2a547)
- SNYK-JS-TAR-18319500 (44c6f80)
- speed up .NET scans with many projects [OSM-3983] (9f788ce)
- stop .NET scans failing when SelfContained=true is set [OSM-3994] (e5a9d88)
- stop false-positive Gradle findings on KGP 2.0 projects [OSM-3992] (c9446f7), closes snyk/snyk-gradle-plugin#359
- stop reporting .NET reference assemblies in container scans (a280e2f), closes snyk/snyk-docker-plugin#932
- update Go version (343f4f0)
- update toml to 5.0.1 in snyk-fix (f07ccba)
- upgrade brace-expansion to fix uncontrolled recursion (a37eb65)
- use a relative target file for uv monitor with an absolute --file (bf371ab)