docs(code): September 2026 release

[sebsnyk]

Problem

The September 14, 2026 Snyk Code release changes analysis behavior in ways a reader cannot discover from the current docs. A customer looking up whether their template engine, their Java version, their Java framework, or their Python LLM library is covered gets an answer that is out of date. A customer whose finding count moves on release day has nothing to read that explains why.

Template support is the hardest of those to look up, because it is not a property of one language. A reader on the Java page sees .java, .jsp and .jspx and concludes FreeMarker is out of scope. A reader looking for FreeMarker has no page that mentions it at all.

Solution

Each item is documented on the page a reader would already consult for that question, rather than gathered into one release page.

Technical specifications and guidance carries the reference for template file analysis, in the Snyk Code section next to Framework support, because the capability spans languages. It states that support is defined by the pairing of a template engine with the language that renders the template, and gives the pair table: engine, file extensions, and the languages that engine is supported with. The AI Engine list on the Snyk Code product page cross-links to it, since that is where the other analysis capabilities are enumerated.

Java SE 25, the Java framework and library additions, and the SAP Commerce (Hybris) FlexibleSearch note go on the Java and Kotlin page, which already carries the supported Java version and the framework list. LangChain LiteLLM goes on the Python page framework list. .gitignore behavior goes in the Snyk Code feature table.

The broader rule coverage work is in What's new only. There is nothing to enable and no configuration to describe, so it has no home in reference documentation. It exists to explain a finding-count movement, which is what What's new is for.

Every language page gets its own template section, and that is most of the diff

Twelve language pages each gain a Template file analysis section naming the engines supported for that language, with a link to the pair table for extensions. A reader on their own language's page can see which engines apply to them without navigating away. The sections are identical in shape so the set reads as one feature, and none of them repeats the engine list from the reference page, so there is one place to correct when the pair set changes.

Twelve pages of the same edit is more churn than a release PR usually carries, and it is separable from the rest of this PR. If a reviewer wants it as its own PR, say so and it will be split. The pair set is unchanged either way.

Languages covered: JavaScript, TypeScript, Java, Kotlin, Scala, Groovy, Python, Ruby, PHP, C#, VB.NET, Go, C/C++, Swift and Objective-C. Java and Kotlin share one section, as do C# and VB.NET, and Swift and Objective-C, matching how those languages are already documented together.

Support is the configured pairs

An earlier revision of this branch said every supported engine is analyzed in every supported language. That is wrong and has been corrected. A language picks up the engines it is configured for and no others, which is why the reference page is a pair table rather than two lists.

Rust and Dart get no section. Snyk Code supports both as languages, and the only engine that would pair with them is held back below, so a section on those pages would have an empty list.

Notes

• Fourteen files. Two carry the release content, twelve are the per-language sections described above.
• Three pairs are deliberately left out, pending stronger evidence: Twig with JavaScript, Mustache with Rust, and Mustache with Dart. All three host languages are supported by Snyk Code, so nothing blocks adding them later. Withdrawing a pair from published documentation is harder than adding one, so they stay out until someone confirms them.
• Every language named in the pair table was checked against the Snyk Code column of the supported-languages table on this site. Nothing was dropped for lack of language support. Groovy, VB.NET and Scala all carry Snyk Code support there, so all three appear.
• Groovy's Snyk Code support is Early Access and Enterprise only, per the hint already at the top of that page. The template section sits inside that scope. Worth a check that the template work is actually available under Early Access before this merges.
• Thymeleaf's extensions are .html and .xml, which are generic. The table attributes them to the engine and the pages say nothing about how a template is detected, deliberately. Anything more specific invites the question of whether every .html file in a repository is now treated as a template.
• Apache Commons, okhttp3, and LangChain were already on their lists, so the coverage work shows up as Apache Commons Collections, an explicit LiteLLM statement, and depth that the lists cannot express. Someone should confirm which Java entries are genuinely new before this is quoted elsewhere as new coverage.
• SAP Commerce (Hybris) is listed in the shared Java and Kotlin framework list, but the analysis is Java only. The qualifier under the list is the only thing preventing a Kotlin reader from drawing the wrong conclusion.
• Two other claims on the reference page are worth a second pair of eyes: that escaping behavior is modeled, so default-escaped output is not reported and a raw or unescaped directive is treated as a sink; and that the reported data flow spans the application code and the template. The pages do not claim where in a template a finding is anchored.
• The automated review asked for "vulnerability" instead of "issue" on the grounds that "issue" applies only to licensing. That is applied, because "vulnerability" is the more precise word for a cross-site scripting finding. The stated rule does not hold: the glossary on this site defines an issue as a license problem, a vulnerability, or a misconfiguration. The same review asked for "Visit" instead of "See", and discover-snyk currently uses "See" more often than "Visit", so that one is left alone.
• Merging publishes the pages, and none of the behavior is live before the release date.
• GitBook syncs have reverted merged changes in this repository before. Verify the rendered pages after merge rather than assuming the edits stuck.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[oswaldoh-snyk]

Looks good to me @sebsnyk

[cursor]

Stale comment

Staff tech writer review

The technical facts hold up and the release additions match the September 2026 feature rollouts. I verified the Java SE 25 version support, framework additions (including Apache CXF, Flyway, and MSAL4J), and Git-aligned .gitignore exclusion changes.

Requesting changes on style and link targets, left as one-click suggestions:

Style fixes (folded into the suggestions)

Use relative internal link syntax instead of app.gitbook.com space URL · "Visit" instead of "See" · change "cross-site scripting issue" to "cross-site scripting vulnerability".

  

_{Sent by Cursor Automation: PR review for User Docs}

[cursor]

Change "issue" to "vulnerability" for security findings. (Snyk terminology: vulnerability for security problems, issue only for licensing)

Suggested change

	Snyk Code analyzes template files together with the application code that renders them. Data that reaches a template from your application code is followed into the template, so a cross-site scripting issue that becomes exploitable only where the template writes its output is reported. The reported data flow spans both the application code and the template.
	Snyk Code analyzes template files together with the application code that renders them. Data that reaches a template from your application code is followed into the template, so a cross-site scripting vulnerability that becomes exploitable only where the template writes its output is reported. The reported data flow spans both the application code and the template.

[cursor]

Use relative internal link and "Visit" instead of "See". (Snyk style rules: relative docs links, "Visit" not "See")

Suggested change

	* Template files: Follows data from your application code into the template that renders it, so cross-site scripting that becomes exploitable only at the point of rendering is reported. See [Template file analysis](https://app.gitbook.com/s/L7HyJj9FsK1W4pNt8Gzl/supported-languages/technical-specifications-and-guidance#template-file-analysis).
	* Template files: Follows data from your application code into the template that renders it, so cross-site scripting that becomes exploitable only at the point of rendering is reported. Visit [Template file analysis](../../../discover-snyk/supported-languages/technical-specifications-and-guidance.md#template-file-analysis).

[cursor]

Stale comment

The current head commit bceda7f is reviewed.

  

_{Sent by Cursor Automation: PR review for User Docs}

[cursor]

AI review

No style or structural issues found.

Verified: all technical specifications for the September 2026 Snyk Code release match product behavior · template file analysis pairings across 12 language pages and technical specifications align · Java SE 25 version support and framework coverage are consistent · .gitignore exclusion changes and CLI requirements are accurately documented · links resolve properly · terminology adheres to Snyk style rules.

The current head commit efe2c6f is reviewed.

  

_{Sent by Cursor Automation: PR review for User Docs}

[cursor]

AI review

No style or structural issues found.

Verified: all technical specifications for the September 2026 Snyk Code release match product behavior · template file analysis pairings across 12 language pages and technical specifications align (including Mako for Python) · Java SE 25 version support and framework coverage are consistent · .gitignore exclusion changes and CLI requirements are accurately documented · links resolve properly · terminology adheres to Snyk style rules.

The current head commit 8f40cafb6892c359d0619d7df2478ff771ca50bc is reviewed.

  

_{Sent by Cursor Automation: PR review for User Docs}