snyk ignore and .snyk policy files do not work for Snyk Code findings

snyk ignore and .snyk policy files do not work for Snyk Code findings

TL;DR

If you suppress a Snyk Code (SAST) finding by hand-editing .snyk or running snyk ignore, it silently does nothing: ignoring via the .snyk policy file is not supported for Snyk Code. Agents automating suppression in CI hit this when their ignore entries never take effect on code findings. The official snyk ignore help page states it twice: "Note: Ignoring issues or vulnerabilities using the .snyk file is not supported for Snyk Code.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

To ignore a Snyk Code finding from the command line, use the snyk ignore create command with Consistent Ignores for Snyk Code." For Snyk Code findings, use snyk ignore create with the consistent-ignores flow instead of editing .snyk. Reserve .snyk policy files for open-source dependency findings, where snyk ignore writes blocks like ignore: { ISSUE_ID: [{ '*': { reason, expires } }] }.

If you suppress a Snyk Code (SAST) finding by hand-editing .snyk or running snyk ignore, it silently does nothing: ignoring via the .snyk policy file is not supported for Snyk Code. Agents automating suppression in CI hit this when their ignore entries never take effect on code findings. The official snyk ignore help page states it twice: "Note: Ignoring issues or vulnerabilities using the .snyk file is not supported for Snyk Code. To ignore a Snyk Code finding from the command line, use the snyk ignore create command with Consistent Ignores for Snyk Code." For Snyk Code findings, use snyk ignore create with the consistent-ignores flow instead of editing .snyk. Reserve .snyk policy files for open-source dependency findings, where snyk ignore writes blocks like ignore: { ISSUEID: [{ '*': { reason, expires } }] }. Verified answer: If you suppress a Snyk Code (SAST) finding by hand-editing .snyk or running snyk ignore, it silently does nothing: ignoring via the .snyk policy file is not supported for Snyk Code. Agents automating suppression in CI hit this when their ignore entries never take effect on code findings. The official snyk ignore help page states it twice: "Note: Ignoring issues or vulnerabilities using the .snyk file is not supported for Snyk Code. To ignore a Snyk Code finding from the command line, use the snyk ignore create command with Consistent Ignores for Snyk Code." For Snyk Code findings, use snyk ignore create with the consistent-ignores flow instead of editing .snyk. Reserve .snyk policy files for open-source dependency findings, where snyk ignore writes blocks like ignore: { ISSUEID: [{ '*': { reason, expires } }] }. Source: https://github.com/snyk/cli/blob/HEAD/help/cli-commands/ignore.md