docs(code): September 2026 release

[sebsnyk]

Problem

The September 14, 2026 Snyk Code release changes analysis behaviour in ways a reader cannot discover from the current docs. A customer looking up whether their template engine, their Java version, their Java framework, or their Python LLM library is covered gets an answer that is out of date, and a customer whose finding count moves on release day has nothing to read that explains why.

Solution

Each item is documented on the page a reader would already consult for that question, rather than gathered into one release page.

• Template file analysis — added to the Snyk Code section of Technical specifications and guidance, next to Framework support, because it is a cross-language analysis capability rather than a property of any one language. Cross-linked from the AI Engine list on the Snyk Code product page, which is where the other analysis capabilities are enumerated.
• Java SE 25, Java frameworks and libraries, SAP Commerce (Hybris) FlexibleSearch — the Java and Kotlin page, which already carries the supported Java version and the framework list. The FlexibleSearch note sits directly under the list because it qualifies one entry: Java only, and parameter binding is treated as safe.
• LangChain LiteLLM — the Python page framework list, plus one sentence stating that its output is treated as untrusted. LangChain was already listed, so the sentence is what carries the actual change.
• Rule coverage across Java, Kotlin, C#, Go, JavaScript, and PHP — What's new only. There is nothing to enable and no configuration to describe, so it has no home in reference documentation; it exists solely to explain a finding-count movement, which is what What's new is for.
• .gitignore — the Snyk Code feature table entry, and a What's new bullet under both Snyk Code and Snyk Secrets.

The template engine list needs confirming before merge

The page names the capability and states that engine coverage is expanding. It deliberately does not enumerate the supported template engines.

A named list in reference documentation reads as a commitment to every engine on it, and it will be wrong in both directions if it does not match what is live on the day. A reviewer who can confirm the engines that ship should either add the list or confirm that the open-ended wording is what we want to publish. This is the one thing in the PR that cannot be verified from the docs themselves.

Two other claims on that page are worth a second pair of eyes:

• That escaping behaviour is modelled, so default-escaped output is not reported and a raw or unescaped directive is treated as a sink.
• That the reported data flow spans the application code and the template. The page does not claim where in the template a finding is anchored, which is deliberate.

Notes

• Keep this a draft. Merging publishes the pages, and none of the behaviour is live before the release date.
• Apache Commons, okhttp3, and LangChain were already on their lists, so the coverage work shows up as Apache Commons Collections, an explicit LiteLLM statement, and depth that the lists cannot express. Someone should confirm which Java entries are genuinely new before this is quoted elsewhere as new coverage.
• SAP Commerce (Hybris) is listed in the shared Java and Kotlin framework list, but the analysis is Java only. The qualifier under the list is the only thing preventing a Kotlin reader from drawing the wrong conclusion.
• The list additions preserve the existing case-insensitive alphabetical order and the two-column split. The Snyk Code feature table is raw HTML and was edited in place.
• GitBook syncs have reverted merged changes in this repository before. Verify the rendered pages after merge rather than assuming the edits stuck.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[oswaldoh-snyk]

Looks good to me @sebsnyk