Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 20, 2025

Bumps snyk from 1.1300.2 to 1.1301.0.

Release notes

Sourced from snyk's releases.

v1.1301.0

1.1301.0 (2025-11-12)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Features

  • container: The Snyk CLI now supports scanning Ubuntu Chisel images for vulnerabilities (9328757)
  • container: The Snyk CLI now supports scanning container images with zstd-compressed layers (5080e42)
  • container: Added a new parameter, --include-system-jars, to support scanning of usr/lib JARs (57078b6)
  • test(maven): Initial maven 4 support, testing against the most recent release candidate (88cf47e)
  • test(maven): A new experimental flag --include-provenance that will produce DepGraphs containing purls with checksum qualifiers for each package. Primarily to be used via --print-graph, not yet used in the main testing flow (5b8fe0a)
  • sbom(maven): A new experimental flag --include-provenance that will produce an SBOM with checksum qualifiers in each purl (5b8fe0a)
  • language-server: Automatic selection of the organization for IDEs based on workspace folder (EA). (2cc554e)
  • language-server: Analytics for configuration and folder trust (2cc554e)
  • mcp: Support for writing scan output into a file (2cc554e)
  • mcp: Service Account support (2cc554e)

Bug Fixes

  • general: Fix incorrect error mapping for varying status codes (5829500)
  • general: Some invalid flag combinations are now correctly handled (ca5903b)
  • test: The Snyk CLI now correctly handles optional dependencies without separate package entries (bfcbda7)
  • test: The Snyk CLI now correctly handles aliased packages with nested dependencies (bfcbda7)
  • test: The Snyk CLI now correctly handles bundled dependencies with non-hoisted bundle owners (bfcbda7)
  • test: Fixes issue where sub packages were getting grouped incorrectly, leading to deps getting marked as missing. (b904e8c)
  • test, sbom: Stops misclassifying NX Build project.json as a NuGet project (ff6860f)
  • test(npm): Improve npm alias support (cb37da7)
  • test(npm): The Snyk CLI now correctly handles npm packages with bundled dependencies (7d93b86)
  • test(python): Scanning projects using Python 2.7 will no longer fail with a string formatting error (4effc7f)
  • test(python): Fixed JSON parsing error for Python projects with missing packages (4effc7f)
  • test(maven): Underlying maven commands adjusted slightly to make aggregate projects that encounter issues when rebuilding more likely to succeed (3b72d86)
  • test(dotnet): Fix an issue with NuGet v3 scanner where the netstandard and netcoreapp TargetFrameworks were treated as .netx.x (227b50c)
  • test(dotnet): Fix an issue with NuGet v3 scanner where the pinned dependencies were not discovered (0d9b0c4)
  • container: Fixed a bug where scanning docker images with very large files would result in the CLI crashing with no message (57078b6)
  • container: Fix rare crash when scanning large Docker images (195ed78)
  • container: Fix issue where go binaries in Linux images with complex paths were not properly detected as go binaries when scanning on Windows (be8098b)
  • code: Add missing explicit error handling (755d01f)
  • unmanaged: Ignored vulnerabilities in unmanaged (C/C++) projects are now properly excluded from JSON output when using .snyk policy files. This ensures that snyk-to-html and other tools that consume JSON output will correctly respect vulnerability ignores. (fa808c1)
  • dependencies: Fix CVE-2025-58058 and CVE-2025-11065 (d7e87e2)
  • dependencies: Upgrade golang to 1.24.10 to fix vulnerabilities (c039f99)
  • dependencies: Upgrade to golang 1.24.8 (4dcf97a)
  • dependencies: Upgrade xcode to avoid flaky signing (bdcb991)
  • dependencies: Fix CVE-2025-47913 (a00b0dc)
  • language-server: Various Language Server related fixes (2cc554e)
Commits
  • f472a85 Merge pull request #6322 from snyk/chore/cherry-pick-fixes-for-rc-1.1301.0
  • 3cd9cff chore: automatic integration of language server c23fd4ea5f4e025ea40a999f11296...
  • 6610f14 chore: upgrade os extensions to allow nil actions on the fix
  • b415907 chore: automatic integration of language server 2cc554ec87f0f1b1f8005db11e416...
  • 4347131 docs: synchronizing help from snyk/user-docs
  • d523f16 chore: improve ufm sarif rendering including ignores
  • 57f0dfe Merge pull request #6300 from snyk/tmp/1762956787-release-candidate
  • 6fade45 docs: update release notes
  • e232891 Merge pull request #6299 from snyk/fix/golang_1.24.10
  • c039f99 fix(dependencies): Upgrade golang to 1.24.10 to fix vulnerabilities
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [snyk](https://github.com/snyk/snyk) from 1.1300.2 to 1.1301.0.
- [Release notes](https://github.com/snyk/snyk/releases)
- [Commits](snyk/cli@v1.1300.2...v1.1301.0)

---
updated-dependencies:
- dependency-name: snyk
  dependency-version: 1.1301.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Nov 20, 2025
@coveralls
Copy link

Coverage Status

coverage: 77.778%. remained the same
when pulling 1789bb9 on dependabot/npm_and_yarn/snyk-1.1301.0
into a402974 on master.

@hfreire hfreire self-requested a review November 20, 2025 04:21
@hfreire hfreire merged commit 9f5460e into master Nov 20, 2025
5 checks passed
@hfreire hfreire deleted the dependabot/npm_and_yarn/snyk-1.1301.0 branch November 20, 2025 04:21
@hfreire
Copy link
Contributor

hfreire commented Nov 21, 2025

🎉 This PR is included in version 2.0.81 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code released

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants