The Snyk CLI provides the following options when failing your builds:
Only report vulnerabilities of provided level or higher.
Only fail when there are vulnerabilities that can be fixed.
fails when there is at least one vulnerability that can be either upgraded or patched.
fails when there is at least one vulnerability that can be upgraded.
fails when there is at least one vulnerability that can be patched. If vulnerabilities do not have a fix and this option is being used, tests will pass.
The Snyk CLI on its' own does not currently have the capability natively to fail tests on more complex use cases. Here are some ways to achieve more complex pass/fail criteria.
Combining security policies with --severity-threshold
Security policies provide the capability to change a vulnerability's severity if it matches specific criteria when a project is tested against an organization using that policy. You could, for example, change the severity of a vulnerability from high to low, and if performing a snyk test with the CLI with
this previously high severity vulnerability will no longer fail the build.
snyk test, using
--severity-threshold=high, running against an organization with a policy that downgrades this particular vulnerability severity to low
Since we lowered the severity of the original vulnerability with the policy, it no longer breached the severity threshold of high, resulting in a passing test.
The rest of this article discusses use cases using snyk-delta or snyk-filter, which are open source companion tools for the Snyk CLI.
snyk-delta finds the delta of vulnerabilities between the current test and a previously monitored snapshot.
It is available from npmjs.org, and may be pulled into your CI/CD pipeline using
npm install -g snyk-delta
snyk-filter provides for user-defined pass/fail criteria based on any available data in the snyk test JSON output.
It is available from npmjs.org and may be pulled into your CI/CD pipeline using npm install
npm install -g snyk-filter
Fail current build only if new vulnerabilities are being introduced
snyk test --json --print-deps | snyk-delta
Possibly point to a specific snapshot by specifying org + project coordinates
snyk test --json --print-deps | snyk-delta --baselineOrg xxx --baselineProject xxx
snyk-delta --baselineOrg xxx --baselineProject xxx --currentOrg xxx --currentProject xxx
Please refer to the snyk-delta project on GitHub for more information.
Fail build for CVSS score higher than ...
snyk test --json | snyk-filter -f /path/to/example-cvss-9-or-above.yml
Custom criteria and filtering
snyk-filter can utilize any combination of criteria available in the snyk test JSON output.
You may also have different criteria for display from what will fail the build. This allows you to do things like display all vulns in the test output, while failing only on some specific criteria.