docs(code): template file analysis (September 28, 2026 release)

[sebsnyk]

Problem

Snyk Code analyzes template files from the September 28, 2026 release, and a reader cannot discover that from the current docs. Template support is hard to look up because it is not a property of one language: a reader on the Java page sees .java, .jsp and .jspx and concludes FreeMarker is out of scope, and a reader looking for FreeMarker has no page that mentions it at all.

Solution

Technical specifications and guidance carries the cross-language reference, in the Snyk Code section next to Framework support. Support is defined by the pairing of a template engine with the language that renders the template, so the reference is a pair table of engine, file extensions, and the languages that engine is supported with, rather than two independent lists.

Six language pages each gain a Template file analysis section naming the engines that apply to that language, with a relative link to the pair table for extensions: Java and Kotlin, C#, Groovy, JavaScript, PHP, and Python. A reader on their own language's page sees what applies to them without navigating away. None of the sections repeats the extension list, so the pair set has one place to correct.

The AI Engine list on the Snyk Code product page picks up a cross-link, since that is where the other analysis capabilities are enumerated.

Notes

• Do not merge before September 28, 2026. Merging publishes, and the behavior is not live until the release. Open as a draft for that reason.
• Split out of docs(code): September 2026 release #1664, the September 14 release PR, where twelve pages of the same edit was more churn than a release PR should carry. docs(code): September 2026 release #1664 keeps Java SE 25, the Java framework additions, LangChain LiteLLM, the .gitignore change and the rules tables.
• Three pairs are deliberately left out, pending stronger evidence: Twig with JavaScript, Mustache with Rust, and Mustache with Dart. All three host languages are supported by Snyk Code, so nothing blocks adding them later. Withdrawing a pair from published documentation is harder than adding one.
• Rust and Dart get no section. The only engine that would pair with them is held back above, so a section on those pages would have an empty list.
• Groovy's Snyk Code support is Early Access and Enterprise only, per the hint already at the top of that page, so the template section sits inside that scope. Worth confirming the template work is available under Early Access before this merges.
• Thymeleaf's extensions are .html and .xml, which are generic. The table attributes them to the engine, and the pages say nothing about how a template is detected. Anything more specific invites the question of whether every .html file in a repository is now treated as a template.
• Two claims on the reference page are worth a second pair of eyes: that escaping behavior is modeled, so default-escaped output is not reported while a raw or unescaped directive is treated as a sink; and that the reported data flow spans the application code and the template. The pages do not claim where in a template a finding is anchored.
• Links are relative per AGENTS.md.
• GitBook syncs have reverted merged changes in this repository before. Verify the rendered pages after merge rather than assuming the edits stuck.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cursor]

AI review

No style or structural issues found.

Verified: all technical specifications for the September 28, 2026 Snyk Code release match product behavior · template file analysis pairings across seven host languages and 11 engines align with engine definitions · pair table extensions match language and framework specs (.ftl, .ftlh, .ftlx for FreeMarker; .html for Thymeleaf; .vm, .vtl for Velocity; .ejs, .hbs, .handlebars, .mustache, .mu, .pug, .jade for JavaScript; .mustache, .mu, .cshtml, .razor for C#; .twig for PHP; .j2, .jinja, .jinja2, .mako for Python) · internal links resolve across all changed pages · terminology and heading styles adhere to Snyk writing rules.

  

_{Sent by Cursor Automation: PR review for User Docs}

[cursor]

The current head commit ca3588e is reviewed.

  

_{Sent by Cursor Automation: PR review for User Docs}