docs(code): October 2026 release

[sebsnyk]

Problem

The October 26, 2026 Snyk Code release changes what is covered, and a reader cannot find that in the docs. A customer checking whether Spring Data MongoDB, DynamoDB, Commons FileUpload, Bootbox or d3 is supported gets an out-of-date list. Java mass assignment and Ruby SSRF findings appear with no matching rule row. Mako is listed as a supported template engine but is not in this release. Nothing says that Go and TypeScript imports now resolve through go.mod and tsconfig.json.

Solution

One commit per idea:

• Framework lists: Java and Kotlin gains Amazon AWS SDK DynamoDB including the Enhanced Client, Apache Commons FileUpload and Spring Data MongoDB. JavaScript gains Bootbox and d3.
• Rule tables: Java gains the mass assignment row and Ruby gains SSRF.
• Import resolution: the Go, TypeScript and JavaScript pages each state which configuration file Snyk Code reads.
• Mako: removed from the Python page and the template pair table.

Notes

• Draft, because merging publishes. Ready when the release is confirmed for October 26.
• The two new rule rows are appended at the end of their tables, which is where new rules land in the rule_docs/rules.csv order. Check placement against the generated CSV before merging.
• Release working document: Snyk Code October 2026 release. Release ticket: RULES-4447.

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cursor]

AI review

The facts hold up. I verified the security rule mappings against OWASP Top 10 2025 and existing rule tables, confirmed Mako removal across the entire documentation set, and verified that all eight changed pages return 200.

Requesting changes on three style and task-orientation points, left as suggestions you can accept in one click.

Documentation flow and task orientation

Make documentation user centric and focus on the tasks the user performs rather than keeping the information generic. Documentation flows from discovery and onboarding, through implementation and adoption, to troubleshooting and expansion:

• In go.md, the draft states that Snyk Code reads go.mod so data flow across packages is analyzed. Shifting this to the user's task — configuring package imports to trace data flow across packages in their Project — clarifies why the file matters during implementation.
• In javascript/README.md and typescript.md, framing tsconfig.json and jsconfig.json around module resolution and path alias tracing gives the reader an immediate action item for adoption.

Alignment across docs and upcoming releases

I checked factual alignment across the repository for the changes in this pull request:

• Mako deprecation: Verified that discover-snyk/supported-languages/supported-languages-list/python/README.md and discover-snyk/supported-languages/technical-specifications-and-guidance.md were the only two pages referencing Mako. Removing Mako from both files leaves no orphaned references.
• Security rule additions: Verified that CWE-915 in java-rules.md and CWE-918 in ruby-rules.md match the taxonomy in sibling rule pages (ruby-rules.md for CWE-915 and java-rules.md for CWE-918).
• Release impact on other pages: This pull request targets the October 26, 2026 Snyk Code release. When the release goes live, update discover-snyk/whats-new.md to add an October 2026 section summarizing the new framework coverage, security rules, and import resolution features.

Style fixes (folded into the suggestions)

• Use active voice and capitalize Snyk-defined noun Project · discover-snyk/supported-languages/supported-languages-list/go.md:52
• Focus on user task and capitalize Project · discover-snyk/supported-languages/supported-languages-list/javascript/README.md:111
• Focus on user task and align with JavaScript phrasing · discover-snyk/supported-languages/supported-languages-list/typescript.md:45

One thing to confirm

⚠️ The pull request description notes that Java and Kotlin rule placement follows rules.csv. Confirm that the placement matches the generated CSV order before merging.

  

_{Sent by Cursor Automation: PR review for User Docs}

[cursor]

The current head commit 8708414 is reviewed.

  

_{Sent by Cursor Automation: PR review for User Docs}

[VeronicaSnyk]

This is reviewed and approved. Please let me know when do you need ut merged so I can act on it: merge from public until 10:00 am UK time, or move it under the internal repo. Thanks.

[esabou-snyk]

Closing as work will continue on the PR opened in the internal repo. details in the jira