Snyk Code October update: improved analysis and more findings

This update will be available on October 26, 2026.

Snyk Code reports significantly more findings in this update. Affected projects will report the additional findings on their next scan.

Snyk Code now analyzes more deeply and more accurately in Java, Kotlin, Go, TypeScript, JavaScript, Python, C#, PHP and Ruby.

Go, TypeScript and JavaScript

Snyk Code reads the Project's own configuration to resolve imports. For Go, it reads go.mod, which defines the module path that a project's packages import each other through. For TypeScript and JavaScript, it reads tsconfig.json and jsconfig.json, which define path aliases.

As a result, Snyk Code now analyzes these projects more accurately and with greater depth.

PHP

Snyk Code corrects boolean typing in PHP analysis. Previously skipped findings now appear across cross-site scripting, path traversal, SQL injection and other checks.

Java

Coverage is added or improved for these libraries:

• Spring Data MongoDB

• AWS SDK for Java, DynamoDB

• AWS SDK for Java 2.x, DynamoDB

• AWS SDK for Java 2.x, DynamoDB Enhanced Client

• Apache Commons FileUpload

Snyk Code adds a Mass Assignment rule for Spring applications. It reports request data that binds directly onto a database entity. Path traversal detection is wider.

More detection

Snyk Code reports additional findings in these areas:

• Python: XML external entity injection.

• JavaScript: deserialization, XML external entity injection and zip slip.

• JavaScript, Bootbox: DOM-based cross-site scripting.

• JavaScript, d3: DOM-based cross-site scripting.

• C#: path traversal.

• Go: SQL injection.

• Go, AWS SDK for Go v2: path traversal through S3 object keys.

• Ruby: path traversal, and a new server-side request forgery rule.

Template file analysis and serverless analysis

Snyk Code analyzes template files and serverless applications more accurately and with greater depth, building on the September update. Both will yield additional findings in projects that use template engines or serverless frameworks.