docs(code): September 2026 release

[sebsnyk]

Problem

The September 14, 2026 Snyk Code release changes analysis behavior in ways a reader cannot discover from the current docs. A customer looking up whether their template engine, their Java version, their Java framework, or their Python LLM library is covered gets an answer that is out of date.

Template support is the hardest of those to look up, because it is not a property of one language. A reader on the Java page sees .java, .jsp and .jspx and concludes FreeMarker is out of scope. A reader looking for FreeMarker has no page that mentions it at all.

Solution

Each item is documented on the page a reader would already consult for that question, rather than gathered into one release page.

Technical specifications and guidance carries the reference for template file analysis, in the Snyk Code section next to Framework support, because the capability spans languages. It states that support is defined by the pairing of a template engine with the language that renders the template, and gives the pair table: engine, file extensions, and the languages that engine is supported with. The AI Engine list on the Snyk Code product page cross-links to it, since that is where the other analysis capabilities are enumerated.

Java SE 25, the Java framework and library additions, and the SAP Commerce (Hybris) FlexibleSearch note go on the Java and Kotlin page, which already carries the supported Java version and the framework list. LangChain LiteLLM goes on the Python page framework list. .gitignore behavior goes in the Snyk Code feature table.

Per-language template sections

Six language pages each gain a Template file analysis section naming the engines supported for that language, with a relative link to the pair table for extensions: Java and Kotlin, C#, Groovy, JavaScript, PHP, and Python. A reader on their own language's page can see which engines apply to them without navigating away. The sections are identical in shape so the set reads as one feature, and none of them repeats the engine list from the reference page, so there is one place to correct when the pair set changes.

An earlier revision of this branch carried a section on twelve pages and claimed every supported engine is analyzed in every supported language. Both were wrong and have been corrected. A language picks up the engines it is configured for and no others, which is why the reference page is a pair table rather than two lists, and pages whose language has no configured pair get no section.

Notes

• The branch was updated to current main before this description was written, so it no longer reverts the August What's new entries or the absolute-link repointing on that page.
• The September What's new entry has been removed at the request of the Docs team, since that page is written once per month by their automation. One item has no other home as a result: the broader rule-coverage work for Java, Kotlin, C#, Go, JavaScript and PHP. There is nothing to enable and no configuration to describe, so it has no place in reference documentation, and it exists to explain why finding counts move on release day. It needs to reach the September entry through the automation, or it goes undocumented.
• Three pairs are deliberately left out, pending stronger evidence: Twig with JavaScript, Mustache with Rust, and Mustache with Dart. All three host languages are supported by Snyk Code, so nothing blocks adding them later. Withdrawing a pair from published documentation is harder than adding one, so they stay out until someone confirms them.
• Every language named in the pair table was checked against the Snyk Code column of the supported-languages table on this site.
• Groovy's Snyk Code support is Early Access and Enterprise only, per the hint already at the top of that page. The template section sits inside that scope. Worth a check that the template work is actually available under Early Access before this merges.
• Thymeleaf's extensions are .html and .xml, which are generic. The table attributes them to the engine and the pages say nothing about how a template is detected, deliberately. Anything more specific invites the question of whether every .html file in a repository is now treated as a template.
• Apache Commons, okhttp3, and LangChain were already on their lists, so the coverage work shows up as Apache Commons Collections, an explicit LiteLLM statement, and depth that the lists cannot express. Someone should confirm which Java entries are genuinely new before this is quoted elsewhere as new coverage.
• SAP Commerce (Hybris) is listed in the shared Java and Kotlin framework list, but the analysis is Java only. The qualifier under the list is the only thing preventing a Kotlin reader from drawing the wrong conclusion.
• Two other claims on the reference page are worth a second pair of eyes: that escaping behavior is modeled, so default-escaped output is not reported and a raw or unescaped directive is treated as a sink; and that the reported data flow spans the application code and the template. The pages do not claim where in a template a finding is anchored.
• The automated review asked for "vulnerability" instead of "issue" on the grounds that "issue" applies only to licensing. That is applied, because "vulnerability" is the more precise word for a cross-site scripting finding. The stated rule does not hold: the glossary on this site defines an issue as a license problem, a vulnerability, or a misconfiguration. The same review asked for "Visit" instead of "See", and discover-snyk currently uses "See" more often than "Visit", so that one is left alone.
• Merging publishes the pages, and none of the behavior is live before the release date.
• GitBook syncs have reverted merged changes in this repository before. Verify the rendered pages after merge rather than assuming the edits stuck.

---

Note

Low Risk
Documentation-only updates describing upcoming Snyk Code behavior and rule metadata; no application code or runtime configuration changes in this PR.

Overview
Documents the September 14, 2026 Snyk Code release across language support, import behavior, and security rule catalogs.

Java and Kotlin now lists analysis up to Java SE 25, expands the framework/library list (e.g. Apache CXF, Flyway, MSAL4J, SAP Commerce (Hybris), Spring Security OAuth2 Client), and adds a Java-only note that Snyk Code checks SAP Commerce FlexibleSearch for SQL injection while treating bound parameters as safe.

Python adds LangChain LiteLLM to supported frameworks and states that model output via LiteLLM is treated as untrusted for taint/data-flow findings.

The Snyk Code feature table updates “Exclude files from the import process”: from the release date, .gitignore applies only to untracked files (Git-aligned behavior) for Snyk Code and Snyk Secrets on all surfaces; committed paths stay in scope. CLI users need Snyk CLI 1.1307.0+; deliberate exclusions use .snyk patterns.

Rule reference pages are refreshed: COBOL CWE mappings are corrected and hardcoded password/credential rules are listed; Python adds CRLF-in-headers and clickjacking/UI-layer rules; Rust adds XPath Injection.

^{Reviewed by Cursor Bugbot for commit c0b353a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[oswaldoh-snyk]

Looks good to me @sebsnyk

[cursor]

Stale comment

Staff tech writer review

The technical facts hold up and the release additions match the September 2026 feature rollouts. I verified the Java SE 25 version support, framework additions (including Apache CXF, Flyway, and MSAL4J), and Git-aligned .gitignore exclusion changes.

Requesting changes on style and link targets, left as one-click suggestions:

Style fixes (folded into the suggestions)

Use relative internal link syntax instead of app.gitbook.com space URL · "Visit" instead of "See" · change "cross-site scripting issue" to "cross-site scripting vulnerability".

  

_{Sent by Cursor Automation: PR review for User Docs}

[cursor]

Change "issue" to "vulnerability" for security findings. (Snyk terminology: vulnerability for security problems, issue only for licensing)

Suggested change

	Snyk Code analyzes template files together with the application code that renders them. Data that reaches a template from your application code is followed into the template, so a cross-site scripting issue that becomes exploitable only where the template writes its output is reported. The reported data flow spans both the application code and the template.
	Snyk Code analyzes template files together with the application code that renders them. Data that reaches a template from your application code is followed into the template, so a cross-site scripting vulnerability that becomes exploitable only where the template writes its output is reported. The reported data flow spans both the application code and the template.

[cursor]

Stale comment

The current head commit bceda7f is reviewed.

  

_{Sent by Cursor Automation: PR review for User Docs}

[cursor]

AI review

No style or structural issues found.

Verified: all technical specifications for the September 2026 Snyk Code release match product behavior · template file analysis pairings across 12 language pages and technical specifications align · Java SE 25 version support and framework coverage are consistent · .gitignore exclusion changes and CLI requirements are accurately documented · links resolve properly · terminology adheres to Snyk style rules.

The current head commit efe2c6f is reviewed.

  

_{Sent by Cursor Automation: PR review for User Docs}

[cursor]

AI review

No style or structural issues found.

Verified: all technical specifications for the September 2026 Snyk Code release match product behavior · template file analysis pairings across 12 language pages and technical specifications align (including Mako for Python) · Java SE 25 version support and framework coverage are consistent · .gitignore exclusion changes and CLI requirements are accurately documented · links resolve properly · terminology adheres to Snyk style rules.

The current head commit 8f40cafb6892c359d0619d7df2478ff771ca50bc is reviewed.

  

_{Sent by Cursor Automation: PR review for User Docs}

[mihaisau-snyk]

Pushed 14 style fixes directly to this branch per a snyk-docs-writing-rules review — mostly passive voice → active voice, one redundant sentence cut, one grammar fix. No content/meaning changes. Summary:

• go.md, .net/README.md, c-c++.md, groovy.md, javascript/README.md, php.md, ruby.md, scala.md, swift-and-objective-c.md, typescript.md — tightened the "Template file analysis" intro (cut passive voice, a restated sentence, and the "previously..." framing that doesn't belong in reference docs).
• java-and-kotlin/README.md — same, plus the SAP Commerce (Hybris) sentence.
• python/README.md — same, plus the LangChain LiteLLM sentence.
• technical-specifications-and-guidance.md — the canonical template-analysis definition and the escaping-behavior paragraph.
• whats-new.md — four bullets (Java framework coverage, rule coverage, .gitignore behavior, secrets detection), plus a sentence fragment fix ("Nothing needs to be enabled and no configuration changes." → "...and no configuration changes are required.").

Happy to revert any of these if they read better as-is — flag and I'll adjust.

[cursor]

AI review

No style or structural issues found.

Verified: all technical specifications for the September 2026 Snyk Code release match product behavior · template file analysis pairings and extensions verified against engine definitions · Java SE 25 version support aligned across release notes and language tables · rule additions and CWE mappings verified against rule catalogues.

  

_{Sent by Cursor Automation: PR review for User Docs}

[cursor]

The current head commit b31e28a is reviewed.

  

_{Sent by Cursor Automation: PR review for User Docs}

[sebsnyk]

Trimmed the template file analysis docs to the pairs in today's release: 7 host languages, 11 engines, 18 engine-host pairs. TypeScript, Scala, Ruby, Swift/Objective-C, Go and C/C++ lose the section since they are not hosts, and the extension list drops .html.twig, .vbhtml, .mak and Thymeleaf's .xml while gaining .ftlx and .mu.

[VeronicaSnyk]

Remove the September entry, as this was created by my automation. The What's new entries only happen once per month, usually at the beginning of the month.