SCA Setup with Snyk: Dependency Monitoring and Auto-Fix PR

Imagine: your project has 500+ direct and transitive dependencies. One day you learn about a critical vulnerability (CVE-2024-XXXX) in a popular library. How many hours will it take to find all affected repositories, assess impact, and prepare fixes? Without an automated SCA tool — days. Snyk Open Source solves this: it scans your code, matches package versions against a vulnerability database (Snyk's own + NVD), and outputs the exact path to the vulnerable component — including transitive dependencies.

But the key difference between Snyk and other scanners is not just detection — it's remediation advice: it specifies the exact package version where the vulnerability is fixed and can automatically create a Pull Request with that update. This cuts remediation time from several days to minutes. We use Snyk in projects with hundreds of repositories and tens of thousands of dependencies — a single dashboard shows the whole picture and can block the pipeline when critical vulnerabilities are found.

Snyk supports all popular ecosystems: npm, PyPI, Maven, Go Modules, NuGet, RubyGems, Composer, and container images. Over 200,000 vulnerabilities in the database — updated daily. Integration with GitHub, GitLab, Bitbucket, and CI/CD systems — one click.

Setup and first test

npm install -g snyk snyk auth # opens browser, OAuth via GitHub/Google # Test dependencies snyk test --all-projects # Only production dependencies (excluding devDependencies) snyk test --prod-only # With severity threshold snyk test --severity-threshold=high --fail-on=all 

--fail-on=all is important — without it, Snyk does not fail the pipeline for vulnerabilities that have no fix. The default behavior is --fail-on=upgradable.

GitHub Actions: built-in integration with Security tab

---
- name: Snyk SCA - Open Source
  uses: snyk/actions/node@master
  continue-on-error: true # collect results even if findings exist
  env:
    SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
  with:
    command: test
    args: >
      --org=${{ vars.SNYK_ORG_ID }}
      --severity-threshold=high
      --fail-on=all
      --sarif-file-output=snyk-oss.sarif
- name: Upload to GitHub Security
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: snyk-oss.sarif
- name: Block on Critical
  env:
    SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
  run: |
    snyk test \
      --org=${{ vars.SNYK_ORG_ID }} \
      --severity-threshold=critical \
      --fail-on=all
---

We split into two steps: first collect SARIF for Security tab (even if vulnerabilities found), then separately block the pipeline on the critical threshold.

Monitoring with snyk monitor

snyk test runs once. snyk monitor sends a snapshot to Snyk Cloud and continues monitoring — when a new CVE appears in the database for an already recorded version, an alert is sent.

- name: Snyk Monitor (main branch only)
  if: github.ref == 'refs/heads/main'
  env:
    SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
  run: |
    snyk monitor \
      --org=${{ vars.SNYK_ORG_ID }} \
      --project-name="${{ github.repository }}/${{ matrix.service }}" \
      --tags="env=production,team=backend"

Tags help filter projects in the Snyk UI when you have many repositories.

Snyk vs Trivy for SCA

Snyk wins on fix depth: it doesn't just say "package X has a vulnerability"; it tells you "update X to version 1.2.3 — this fixes the issue". Trivy is excellent for fast container scans, but for SCA in Git repositories, Snyk is 3-4 times more effective in terms of remediation time.

What types of vulnerabilities does Snyk detect?

Snyk covers all CWE vulnerability types: RCE, SQL injection, XSS, Prototype Pollution, Directory Traversal, and more. Over 1,500 vulnerabilities are added monthly. Additionally, Snyk checks license compatibility (e.g., GPL-2.0 in a commercial product).

How does Snyk integrate with existing CI/CD?

Snyk provides official actions for GitHub Actions, images for GitLab CI, Jenkins, CircleCI, and Bitbucket Pipelines. Configuration boils down to setting SNYK_TOKEN and adding one step in the pipeline. For example, for GitLab CI use the snyk/snyk:node image and commands snyk test and snyk monitor. Full documentation is available on the official Snyk website.

The .snyk file for managing exceptions

---
version: v1.25.0
ignore:
  SNYK-JS-LODASH-567746:
    - '*':
        reason: "Prototype pollution only via user-controlled data, WAF blocks this vector"
        expires: 2026-09-01
        created: 2025-06-01
  SNYK-PYTHON-PILLOW-2331901:
    - 'backend > Pillow':
        reason: "Used only for server-side image processing, no user uploads"
        expires: 2026-01-01
patch: {}
---

The expires field is mandatory — it forces periodic review of exceptions. It's better to set a relative term (e.g., 12 months) rather than a specific date.

Automatic dependency updates via Snyk

In the Snyk Dashboard, on the project page, click "Fix this vulnerability". Snyk opens a PR in GitHub/GitLab with the updated package version in the lock file. For npm this is package.json + package-lock.json, for Python — requirements.txt or Pipfile.lock. Important: before merging such a PR, ensure tests pass. Updating a transitive dependency can sometimes break something unexpected.

Supported ecosystems

What's included in a turnkey Snyk setup?

• Connecting repositories to Snyk (GitHub/GitLab/Bitbucket).
• Configuring snyk test in CI/CD (GitHub Actions, GitLab CI, Jenkins).
• Setting up snyk monitor for continuous tracking.
• Developing .snyk with exceptions and policies.
• Documentation on the vulnerability management process.
• Team training (2-hour workshop).

Timeline: basic integration — 2–4 hours; full setup with monitoring and Jira integration — 1 business day. We'll assess your project — reach out for a consultation.