[dependabot]

Bumps @snyk/protect from 1.1302.1 to 1.1307.4.

Release notes

Sourced from @​snyk/protect's releases.

v1.1307.4

1.1307.4 (2026-09-23)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Features

• studio: New experimental snyk studio command that sets up Snyk Studio in your AI coding tools (Cursor, Claude Code, Codex, Copilot, Gemini, Kiro, Windsurf), so the code they generate gets scanned in the background as it's written. Run snyk studio install --experimental to get started. (49653c8)
• fix: New snyk fix --agentic flags to narrow down what gets fixed: --severity-filter fixes only the listed severities, --breakability-filter fixes only Open Source upgrades with the listed breakability, and --exclude-ids fixes everything except the listed issue IDs. (35298ae)
• fix: snyk fix --agentic now keeps a failed fix's changes by default so you can review them, and reports the fix as failed. Pass --enable-revert to roll the changes back automatically instead. (35298ae)

Bug Fixes

• test: --iac, --docker, --container and --code no longer get silently dropped for orgs on the unified test API — each now runs the correct scan again instead of an open-source test (which could fail with "No supported files found" or scan the wrong target). (87568ab)

v1.1307.3

1.1307.3 (2026-09-17)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Bug Fixes

• test: Reports an unreadable .snyk policy file as SNYK-POLICY-0002 with a message identifying the problem, instead of an unspecified error. (4ada635)
• test: --all-projects now resolves each project's .snyk policy from that project's own directory, instead of applying the scan root's policy to every project. (f17550f)
• test: --scan-all-unmanaged no longer fails with exit code 2 when scanning a directory of JARs with no manifest file. (4f8643b)
• deps: Updates dependencies to fix vulnerabilities:
  • CVE-2026-63376, CVE-2026-77465 (b93aa46)
  • SNYK-JS-ADMZIP-19846655 (97689ff)

v1.1307.2

1.1307.2 (2026-09-09)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Bug Fixes

• security: Removed an unused experimental feature. (ad487e9)
• deps: Updates dependencies to fix vulnerabilities:
  • CVE-2026-84445 (b7aec1d)

v1.1307.1

1.1307.1 (2026-09-07)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Bug Fixes

• test: snyk test on a repository with no supported manifest files again reports SNYK-CLI-0008 and exits 3, instead of a generic SNYK-CLI-0000 with exit 2. snyk test --json writes the error document to stdout as expected. (50cad38)
• test: Restores moduleName, insights.triageAdvice, and functions_new fields in snyk test --json output. (4ec3d18)
• test: .snyk policy files are now handled correctly in the unified test flow -- empty, whitespace-only and comment-only policies, date-only timestamps, and other edge cases that previously caused incorrect results or failures. (a22a563)

... (truncated)

Commits

• e7e006e Merge pull request #7298 from snyk/release-candidate
• 8be39f1 Merge pull request #7297 from snyk/docs/release-notes-1.1307.4
• 542a7c0 docs: add Snyk Studio and agentic fix changes to 1.1307.4 release notes
• 7298fef Merge pull request #7295 from snyk/hotfix/v1.1307.4
• 0e6c2c7 fix: tidy go.mod after remy/studio bumps and pin GAF to hotfix commit
• adeef14 docs: Update RELEASE_NOTES.md
• ded9b95 fix: pin cli-extension-os-flows to scan-type routing fix [OSF-504]
• b12fde0 chore: bump studio extension to v1.0.3
• 49653c8 chore: [AG-414] add studio extension to CLI
• 35298ae chore: bump remy-cli-extension to v1.45.0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by CircleCI, a new releaser for @​snyk/protect since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #423.