Snyk

Application Security

Overview

The Snyk Connector integrates with the Snyk developer-security platform and synchronizes Snyk's organization, project, and security data into the Brinqa platform. It collects code projects, package dependencies, code repositories (targets), open-source (SCA) findings and their definitions, static (SAST) code findings and their definitions, infrastructure-as-code (IaC) violations and their definitions, and finding ignore (suppression) records. Findings are normalized into Brinqa unified data models so that Snyk vulnerability data can be correlated with assets and risk across the platform.

The connector reads data across the full Snyk hierarchy of Groups → Organizations → Projects, using a combination of Snyk's REST API (2024-03-12~experimental) and the legacy v1 API. Optionally it can also pull associated Jira ticket references for issues.

---

Data retrieved from Snyk

Connector Object	Required	Maps to Data Model
Collection	Yes	Collection
Project	Yes	Code Project
Component	Yes	Package
Open Source Issue	Yes	Open Source Finding
Open Source Issue Definition	Yes	Open Source Finding Definition
Violation	Yes	Violation
Violation Definition	Yes	Violation Definition
Static Code Issue	Yes	Static Code Finding
Static Code Issue Definition	Yes	Static Code Finding Definition
Code Repositories	Yes	Code Repository
Ignore	Yes	Ignore

Model relationships

note

For detailed steps on how to view the data retrieved from Snyk in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Snyk from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	Yes	https://api.snyk.io	Snyk API URL
API token	Yes	—	Snyk API token
Active Projects	No	true	Sync only active projects and findings for these projects
Include Jira tickets	No	false	Sync Jira ticket Ids and keys when enabled
Page size	No	100	Maximum number of records to get per API request
Parallel requests	No	min(4, available processors)	Maximum number of parallel API requests
Maximum retries	No	5	Maximum number of API request retries

Authentication

The connector authenticates with a Snyk API token (service account or personal token). The token is supplied through configuration and sent on every request.

Endpoint

The connector validates connectivity by listing the accessible organizations:

Method	URL
GET	{url}/rest/orgs?version=2024-03-12~experimental

Request Headers

Header	Value
Authorization	token {apiToken}
Accept	application/json
User-Agent	BrinqaSynkConnector/{version}

Sample Response

{
  "data": [
    {
      "id": "a060c517-2c12-4ad0-a027-3f1dc8b8f5b8",
      "type": "org",
      "attributes": {
        "name": "My Organization",
        "slug": "my-organization"
      }
    }
  ],
  "links": {
    "next": "/rest/orgs?version=2024-03-12~experimental&starting_after=v1.eyJ..."
  }
}

Response Fields

Field	Type	Description
data[].id	String	Organization identifier
data[].attributes.name	String	Organization display name
data[].attributes.slug	String	Organization slug
links.next	String	Cursor used for pagination (starting_after)

Usage

The API token is read from configuration as a guarded string and added to the Authorization header (prefixed with token ) on every subsequent request. There is no separate token-exchange step — the same static token is reused for all API calls.

Authorization: token <apiToken>

Sync Behavior

Syncs are incremental (delta) wherever the Snyk API supports a date window. When an incremental sync token is present, the connector converts it to a date and passes it as from/to query parameters (yyyy-MM-dd) on the underlying group, organization, project, and issue list calls, so each run retrieves only records within the since window. On the first sync (no token) it performs a full retrieval, and models whose endpoints do not accept a date window are re-fetched in full each run.

---

How to obtain Snyk credentials

Obtain a Snyk API token

For the Snyk connector to use the Snyk API, you must provide an API token. To generate an API token, follow these steps.

1. Log in to your organization's Snyk account.

2. Click the account dropdown and then click Account settings.

   

3. Under Account Settings, click General.

4. Under Auth Token, click the KEY field. You can also click Revoke and Regenerate on the same page to create a new API token to replace an existing one.

   

   Your new API token displays. You can not view the token again after this. Copy and save it to a secure location.

Note: If you do not have the permissions to create an API token, contact your Snyk administrator. For additional information, see Snyk documentation.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Collection

Source Field Name	SDM Attribute
CollectionObject.attributes.name	NAME
CollectionObject.id	UID
Collection→projects relationship (id)	PROJECTS
GroupObject.attributes.name	GROUP_NAME
GroupObject.id	GROUP_ID
OrganizationObject.attributes.name	ORG_NAME
OrganizationObject.attributes.slug	ORG_SLUG
OrganizationObject.id	ORG_ID

Project

Source Field Name	SDM Attribute
ASSET_CATEGORY_CODE_REPOSITORY + ProjectObject.attributes.type	CATEGORIES
Group/org identity + business_criticality, environment, lifecycle, attributes.tags	TAGS
GroupObject.attributes.name	GROUP_NAME
GroupObject.id	GROUP_ID
Instant.now()	LAST_CAPTURED
OrganizationObject.attributes.name	ORG_NAME
OrganizationObject.attributes.slug	ORG_SLUG
OrganizationObject.id	ORG_ID
Project importer relationship → UserObject.attributes.username	IMPORTER
Project owner relationship → UserObject.attributes.username	OWNER
Project target relationship data.id	CODE_REPOS
ProjectObject.attributes.business_criticality	BUSINESS_CRITICALITY
ProjectObject.attributes.environment	ENVIRONMENT
ProjectObject.attributes.lifecycle	LIFECYCLE
ProjectObject.attributes.name	NAME
ProjectObject.attributes.name + attributes.type	DESCRIPTION
ProjectObject.attributes.origin	ORIGIN
ProjectObject.attributes.settings.recurring_tests.frequency	TEST_FREQUENCY
ProjectObject.attributes.status	STATUS
ProjectObject.id	UID
ProjectObject.meta.latest_issue_counts.updated_at	LAST_ASSESSED

Component

Source Field Name	SDM Attribute
ASSET_CATEGORY_PACKAGE + DependencyObject.type	CATEGORIES
DependencyObject.firstPublishedDate	FIRST_SEEN
DependencyObject.isDeprecated	OUTDATED
DependencyObject.latestVersion	LATEST_VERSION
DependencyObject.latestVersionPublishedDate	LAST_SEEN
DependencyObject.licenses[].title	LICENSES
DependencyObject.name + @ + DependencyObject.version	UID
DependencyObject.name@version	NAME
DependencyObject.name@version	DESCRIPTION
DependencyObject.projects[].id	PROJECTS
DependencyObject.version	CURRENT_VERSION
Instant.now()	LAST_CAPTURED

Open Source Issue

Source Field Name	SDM Attribute
derived from active/ignored/patched	PROVIDER_STATUS / SOURCE_STATUS / STATUS / STATUS_CATEGORY
Group/org identity	TAGS, GROUP_ID, GROUP_NAME, ORG_ID, ORG_NAME, ORG_SLUG
Instant.now()	LAST_CAPTURED
issue paths (/issue/{issueId}/paths)	PATH
issue-metadata attributes.created_at	FIRST_FOUND
issue-metadata attributes.updated_at	LAST_FOUND
issue-metadata IssueObject.id	SOURCE_UID
issue.id	ISSUE_ID
issue.isIgnored	IS_IGNORED
issue.isPatched	IS_PATCHED
issue.pkgName@pkgVersions	COMPONENTS
issue.priority.score	PRIORITY_SCORE
issueData.description (parsed PoC/payload sections)	RESULTS
issueData.isMaliciousPackage	MALICIOUS_PACKAGE
Jira issue tickets (/jira-issues)	JIRA_IDS / JIRA_KEYS
MD5(issueData.title, severity, CVE IDs, CWE IDs)	TYPE
MD5(projectId, issue.id)	UID
Parsed from issue.priority.factors[].description	CONFIDENTIALITY_IMPACT, INTEGRITY_IMPACT, AVAILABILITY_IMPACT, SCOPE, EXPLOIT_MATURITY, USER_INTERACTION, PRIVILEGES_REQUIRED, ATTACK_COMPLEXITY, ATTACK_VECTOR, EPSS_SCORE, SOCIAL_TRENDS, DAYS_SINCE_PUBLISHED, REACHABLE, TRANSITIVE_DEPENDENCY, MALICIOUS, BUSINESS_CRITICALITY, PROVIDER_URGENCY, PACKAGE_POPULARITY_SCORE
projectId	PROJECT_ID
projectId + issue.pkgName@pkgVersions	TARGETS

Open Source Issue Definition

Source Field Name	SDM Attribute
derived from CVSS v3 vector via CVSS calculator	CVSS metric attributes
Instant.now()	LAST_CAPTURED
issueData.cvssScore	CVSS_V3_BASE_SCORE
issueData.CVSSv3	CVSS_V3_VECTOR
issueData.description	SOURCE_DESCRIPTION
issueData.description (converted to HTML)	SOURCE_HTML_DESCRIPTION
issueData.description (exploitability sections)	EXPLOITS
issueData.description (parsed overview)	DESCRIPTION
issueData.description (remediation sections)	RECOMMENDATION
issueData.disclosureTime	DISCLOSED_DATE
issueData.exploitMaturity (mapped)	EXPLOIT_MATURITY
issueData.identifiers["CVE"]	CVE_IDS / CVE_RECORDS
issueData.identifiers["CWE"]	CWE_IDS / WEAKNESSES
issueData.language	LANGUAGES
issueData.patches[].urls, issueData.url, parsed references	REFERENCES
issueData.publicationTime	PUBLISHED_DATE
issueData.semver.vulnerable	AFFECTED
issueData.severity	SEVERITY / SOURCE_SEVERITY / SEVERITY_SCORE
issueData.title	NAME
issueObject.fixInfo.fixedIn	FIXED_IN
issueObject.fixInfo.isFixable	FIXABLE
issueObject.fixInfo.isPartiallyFixable	PARTIALLY_FIXABLE
issueObject.fixInfo.isPatchable	PATCHABLE
issueObject.fixInfo.isPinnable	IS_PINNABLE
issueObject.fixInfo.isUpgradable	UPGRADEABLE
issueObject.issueType (mapped vuln/configuration/license)	CATEGORIES
MD5(issueData.title, severity, CVE IDs, CWE IDs)	UID

Violation

Source Field Name	SDM Attribute
derived from active/ignored/patched	PROVIDER_STATUS / SOURCE_STATUS / STATUS / STATUS_CATEGORY
Group/org identity	TAGS, GROUP_ID, GROUP_NAME, ORG_ID, ORG_NAME, ORG_SLUG
Instant.now()	LAST_CAPTURED
issue paths (/issue/{issueId}/paths)	PATH
issue-metadata attributes.created_at	FIRST_FOUND
issue-metadata attributes.updated_at	LAST_FOUND
issue-metadata IssueObject.id	SOURCE_UID
issue.id	ISSUE_ID
issue.isIgnored	IS_IGNORED
issue.isPatched	IS_PATCHED
issue.pkgName@pkgVersions	COMPONENTS
issue.priority.score	PRIORITY_SCORE
issueData.description (parsed PoC/payload sections)	RESULTS
issueData.isMaliciousPackage	MALICIOUS_PACKAGE
Jira issue tickets (/jira-issues)	JIRA_IDS / JIRA_KEYS
MD5(issueData.title, severity, CVE IDs, CWE IDs)	TYPE
MD5(projectId, issue.id)	UID
Parsed from issue.priority.factors[].description	CONFIDENTIALITY_IMPACT, INTEGRITY_IMPACT, AVAILABILITY_IMPACT, SCOPE, EXPLOIT_MATURITY, USER_INTERACTION, PRIVILEGES_REQUIRED, ATTACK_COMPLEXITY, ATTACK_VECTOR, EPSS_SCORE, SOCIAL_TRENDS, DAYS_SINCE_PUBLISHED, REACHABLE, TRANSITIVE_DEPENDENCY, MALICIOUS, BUSINESS_CRITICALITY, PROVIDER_URGENCY, PACKAGE_POPULARITY_SCORE
projectId	PROJECT_ID
projectId + issue.pkgName@pkgVersions	TARGETS

Violation Definition

Source Field Name	SDM Attribute
derived from CVSS v3 vector via CVSS calculator	CVSS metric attributes
Instant.now()	LAST_CAPTURED
issueData.cvssScore	CVSS_V3_BASE_SCORE
issueData.CVSSv3	CVSS_V3_VECTOR
issueData.description	SOURCE_DESCRIPTION
issueData.description (converted to HTML)	SOURCE_HTML_DESCRIPTION
issueData.description (exploitability sections)	EXPLOITS
issueData.description (parsed overview)	DESCRIPTION
issueData.description (remediation sections)	RECOMMENDATION
issueData.disclosureTime	DISCLOSED_DATE
issueData.exploitMaturity (mapped)	EXPLOIT_MATURITY
issueData.identifiers["CVE"]	CVE_IDS / CVE_RECORDS
issueData.identifiers["CWE"]	CWE_IDS / WEAKNESSES
issueData.language	LANGUAGES
issueData.patches[].urls, issueData.url, parsed references	REFERENCES
issueData.publicationTime	PUBLISHED_DATE
issueData.semver.vulnerable	AFFECTED
issueData.severity	SEVERITY / SOURCE_SEVERITY / SEVERITY_SCORE
issueData.title	NAME
issueObject.fixInfo.fixedIn	FIXED_IN
issueObject.fixInfo.isFixable	FIXABLE
issueObject.fixInfo.isPartiallyFixable	PARTIALLY_FIXABLE
issueObject.fixInfo.isPatchable	PATCHABLE
issueObject.fixInfo.isPinnable	IS_PINNABLE
issueObject.fixInfo.isUpgradable	UPGRADEABLE
issueObject.issueType (mapped vuln/configuration/license)	CATEGORIES
MD5(issueData.title, severity, CVE IDs, CWE IDs)	UID

Static Code Issue

Source Field Name	SDM Attribute
attributes.created_at	FIRST_FOUND
attributes.key	ISSUE_KEY
attributes.risk.score.value	RISK_SCORE
attributes.status (and ignored override)	PROVIDER_STATUS / SOURCE_STATUS / STATUS / STATUS_CATEGORY
attributes.updated_at	LAST_FOUND
Group/org identity	TAGS, GROUP_ID, GROUP_NAME, ORG_ID, ORG_NAME, ORG_SLUG
Instant.now()	LAST_CAPTURED
issueDetails.attributes.fingerprint	FINGERPRINT
issueDetails.attributes.fingerprintVersion	FINGERPRINT_VERSION
issueDetails.attributes.ignored	IGNORED
issueDetails.attributes.primaryFilePath	FILE_NAME
issueDetails.attributes.primaryRegion (start/end column & line)	CODE_SNIPPET
issueDetails.attributes.priorityScore	PRIORITY_SCORE
issueDetails.attributes.priorityScoreFactors	PRIORITY_SCORE_FACTORS
IssueObject.id	UID
Jira issue tickets (/jira-issues)	JIRA_IDS / JIRA_KEYS
MD5(attributes.title, severity, CWEs)	TYPE
relationships.scan_item.data.id	TARGETS
relationships.scan_item.data.id	PROJECT_ID

Static Code Issue Definition

Source Field Name	SDM Attribute
attributes.title / issueDetails.attributes.title	DESCRIPTION
Instant.now()	LAST_CAPTURED
issueDetails.attributes.cwe	CWE_IDS / WEAKNESSES
issueDetails.attributes.severity	SEVERITY / SOURCE_SEVERITY / SEVERITY_SCORE
IssueObject.attributes.title	NAME
IssueObject.type / issueDetails.attributes.issueType	CATEGORIES
MD5(attributes.title, severity, CWEs)	UID

Code Repositories

Source Field Name	SDM Attribute
ASSET_CATEGORY_CODE_REPOSITORY	CATEGORIES
attributes.created_at	SOURCE_CREATED_DATE
attributes.is_private	IS_PRIVATE
attributes.url	URL
Instant.now()	LAST_CAPTURED
relationships.integration.data.attributes.integration_type	INTEGRATION_TYPE
relationships.integration.data.id	INTEGRATION_ID
TargetResource.id	UID
TargetResource.id then attributes.display_name	NAME

Ignore

Source Field Name	SDM Attribute
IgnoreObject.created	SOURCE_CREATED_DATE
IgnoreObject.disregardIfFixable	DISREGARD_IF_FIXABLE
IgnoreObject.expires	EXPIRES
IgnoreObject.ignoredBy.name	IGNORED_BY
IgnoreObject.path[].module	PATHS
IgnoreObject.reason	REASON
IgnoreObject.reasonType	REASON_TYPE
Issue ID (ignore map key)	ISSUE_ID
MD5(projectId, issueId, paths)	UID
Organization ID	ORG_ID
Project ID	PROJECT_ID

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Collection

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint (Snyk REST API 2024-03-12~experimental) · Endpoint: GET /rest/orgs/{orgId}/collections

Project

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint (Snyk REST API 2024-03-12~experimental) · Endpoint: GET /rest/orgs/{orgId}/projects
• Default filters: meta.latest_issue_counts=true&meta.latest_dependency_total=true&expand=target; when the Active projects option is enabled, only projects with status active are returned

Component

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint (group/org discovery) + v1 API (dependency listing) · Endpoint: POST /api/v1/org/{orgId}/dependencies

Open Source Issue

Operation options

Option	Type	Default	Description
TRANSACTION_ID	String	—	Sync transaction identifier
includePaths	Boolean	false	Include the introduced-through dependency path tree
severities	String	critical,high,medium,low	Severities to include
types	String	vuln,license	Issue types to include
priorityScore	Range	—	Minimum/maximum priority score filter
excludeGroup	String	—	Group(s) to exclude
excludeOrg	String	—	Organization(s) to exclude
project / projectId	String	—	Restrict sync to a specific project

Delta sync

Supported.

API

• Type: REST endpoint (issue metadata + group/org/project discovery) + v1 API (aggregated issues, paths, Jira tickets) · Endpoint: POST /api/v1/org/{orgId}/project/{projectId}/aggregated-issues

Open Source Issue Definition

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: v1 API (aggregated issues) — built from the same aggregated-issues data as Open Source Issue · Endpoint: POST /api/v1/org/{orgId}/project/{projectId}/aggregated-issues
• Default filters: only non-configuration issue types are emitted; definitions are de-duplicated on the title/severity/CVE/CWE MD5 key

Violation

Operation options

Option	Type	Default	Description
TRANSACTION_ID	String	—	Sync transaction identifier
includePaths	Boolean	false	Include the introduced-through dependency path tree
severities	String	critical,high,medium,low	Severities to include
types	String	vuln,license	Issue types to include
priorityScore	Range	—	Minimum/maximum priority score filter
excludeGroup	String	—	Group(s) to exclude
excludeOrg	String	—	Organization(s) to exclude
project / projectId	String	—	Restrict sync to a specific project

Delta sync

Supported.

API

• Type: REST endpoint (issue metadata) + v1 API (aggregated issues, paths) · Endpoint: POST /api/v1/org/{orgId}/project/{projectId}/aggregated-issues
• Default filters: emitted only for issues whose issueType equals configuration

Violation Definition

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: v1 API (aggregated issues) — built from the same aggregated-issues data as Violation · Endpoint: POST /api/v1/org/{orgId}/project/{projectId}/aggregated-issues
• Default filters: filtered to configuration issue types; definitions are de-duplicated on the title/severity/CVE/CWE MD5 key

Static Code Issue

Operation options

Option	Type	Default	Description
TRANSACTION_ID	String	—	Sync transaction identifier
effectiveSeverityLevel	String	—	Filter by effective severity level
excludeGroup	String	—	Group(s) to exclude
excludeOrg	String	—	Organization(s) to exclude

Delta sync

Supported.

API

• Type: REST endpoint (issues + issue detail) + v1 API (Jira tickets) · Endpoint: GET /rest/orgs/{orgId}/issues?type=code&limit={pageSize}

Static Code Issue Definition

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint (issues + issue detail) — built from the same static-code issue data as Static Code Issue · Endpoint: GET /rest/orgs/{orgId}/issues?type=code
• Default filters: definitions are de-duplicated on the title/severity/CWE MD5 key

Code Repositories

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint (Snyk REST API 2024-03-12~experimental) · Endpoint: GET /rest/orgs/{orgId}/targets

Ignore

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

• Type: REST endpoint (org/project discovery) + v1 API (ignores) · Endpoint: GET /api/v1/org/{orgId}/project/{projectId}/ignores

Changelog

Changelog

The Snyk connector has undergone the following changes:

Version	Description	Migration Steps
3.0.23	Bug Fixes - Hardened open source issue syncs against a rare crash. Background workers that process findings could previously keep running after a sync finished and write to a data store that had already been closed, which could abruptly terminate the connector process. Worker threads are now fully drained before the store is closed, and every sync now starts from a fresh store. - Errors during open source issue processing are no longer silently ignored. A failure now stops the sync and is reported as a connector error, so a run that hits a problem is surfaced as failed instead of appearing to succeed with incomplete data.	N/A
3.0.22	Bug Fixes - Resolved an error that could interrupt a sync when a numeric field returned by Snyk (such as the EPSS score or days-since-published value) was empty or non-numeric. These values are now parsed defensively so findings continue to import without failure.	N/A
3.0.21	New Features - Added optional sync filters that let you narrow which findings are imported. You can now restrict a sync by effective severity level and by a minimum/maximum priority score range, reducing noise and focusing imports on the findings that matter most.	N/A
3.0.20	Improvements - Package (component) assets now record a Last Captured timestamp on each sync, making it easier to track when dependency data was most recently observed.	N/A
3.0.19	New Features - Findings now expose a Source UID attribute carrying Snyk's own issue identifier, and projects now surface their associated components, origin, and test frequency for richer reporting.	N/A
3.0.18	New Features - Added an "Include Jira tickets" connection option. When enabled, the connector syncs linked Jira ticket IDs and keys; this coverage now extends to static code (code analysis) findings in addition to open source findings.	N/A
3.0.17	Improvements - Findings now populate standard lifecycle attributes — Last Captured, Provider Status, and Source Status — and carry their owning group and collection context, improving consistency with other connectors and the accuracy of finding status reporting.	N/A
3.0.16	Improvements - Suppression (Ignore) records now include additional detail, such as the expiration date and whether the suppression should be disregarded when a fix becomes available.	N/A
3.0.15	New Features - Added a new Code Repositories model that synchronizes the source repositories Snyk monitors, including whether each repository is private, so repository inventory can be correlated with findings.	N/A
3.0.14	Improvements - The Malicious Package attribute on open source findings is now represented as a true/false value instead of text, making it easier to filter and report on malicious packages.	• Open Source Issue / Open Source Issue Definition: The Malicious Package attribute changed from a text value to a true/false (Boolean) value. Action: re-sync the affected findings so the stored attribute values are rewritten in the new format.
3.0.13	New Features - Added a new Collection model that synchronizes Snyk collections, capturing how projects are grouped along with their group and organization context. Findings and related models now also carry group and project context for improved correlation.	N/A
3.0.12	New Features - Findings now include detailed risk and exploitability attributes, including EPSS score, exploit maturity, reachability, transitive-dependency indicators, and the full set of CVSS impact factors (attack vector, attack complexity, privileges required, user interaction, scope, and confidentiality/integrity/availability impact).	N/A
3.0.11	Bug Fixes - Corrected the parallel processing of static code findings so that all organizations are handled within a single managed worker pool, improving reliability and resource cleanup during large syncs.	N/A
3.0.10	New Features - Projects now include Snyk's latest issue counts (critical, high, medium, and low) and a Last Assessed timestamp derived from Snyk's most recent scan, giving a quick view of each project's current risk posture.	N/A
3.0.9	New Features - Open source findings now include any linked Jira ticket IDs and keys, making it easier to trace remediation work tracked in Jira.	N/A
3.0.8	Improvements - Static code finding synchronization now runs in parallel using a managed worker pool and a temporary staging store, significantly improving sync performance and scalability for large environments.	N/A
3.0.7	Improvements - Findings and projects now carry additional context attributes, including organization details (ID, name, slug), project ID, environment, lifecycle, and business criticality, enabling richer grouping and reporting.	N/A
3.0.6	Improvements - Finding status and status category are now derived consistently from each finding's actual state (active, ignored, or patched) rather than a fixed value, improving the accuracy of finding status reporting. Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.5	Improvements - Migrated additional issue data to Snyk's REST API and reorganized internal data models for more reliable static code and open source finding synchronization.	• Static Code Issue: The unique identifier for static code findings now uses Snyk's native issue ID instead of a derived hash. Action: purge existing Static Code Issue records and re-sync so findings are re-keyed under their new identifiers and duplicates are avoided.
3.0.4	Improvements - Project synchronization now caches user lookups, avoiding repeated calls for the same owner or importer and improving sync performance. Error and retry handling was also moved to the shared connector framework for more consistent behavior.	N/A
3.0.3	New Features - Added an "Active Projects" connection option (enabled by default) to sync only active projects and their findings. Improvements - Migrated project synchronization to Snyk's REST API, adding new project attributes such as origin, test frequency, and importer.	N/A
3.0.2	Improvements - Streamlined how finding definitions are matched and de-duplicated, removing a redundant name-based identifier to improve consistency.	N/A
3.0.1	New Features - Added two new models, Violation and Violation Definition, to capture Snyk policy violations. - Open source and static code findings now include richer detail, such as priority score and factors, fingerprints, fixed-in versions, malicious-package and pinnable indicators, patched/ignored status, and credit information.	N/A
3.0.0	Overview The Snyk connector integrates with Snyk to synchronize projects, software components, and open source and static code (code analysis) security findings, along with their suppression rules. Category: Application Security Models	N/A