chore: cherry-pick fixes for v1.1307.1 hotfix release by PeterSchafer · Pull Request #7228 · snyk/cli

PeterSchafer · 2026-09-04T17:39:57Z

Summary

Cherry-picks all fixes listed in CLI-1796 for the v1.1307.1 hotfix release, plus security fixes identified via commit-message keyword scan.

GAF release branch

GAF pointed at release/1.1307 (v0.18.3-0.20260904153233-0e7f03ec6034), based on v0.18.2 with cherry-picked commits:

contributor capture middleware (fix: Update ignore policy option description #703)
regenerate testapi client OSF-479 (feat: release refactored resolve-deps #714)
IANDT-26 response parsing fix (feat: new docker images for maven 3.6.1, gradle 5.4 with Java 11 #718)
IANDT-27 post invoke hook (feat: Update snyk-mvn-plugin #721)

This excludes the TOON/HTML report rendering and other unrelated GAF main changes.

Test plan

CI passes on this branch
Verify snyk test JSON output includes moduleName, triageAdvice, functions_new
Verify .snyk policy edge cases handled correctly
Verify no-testable-projects error code SNYK-CLI-0008
Verify contributor capture is gated behind INTERNAL_SNYK_CONTRIBUTORS_ENABLED
Build and smoke-test the binary

🤖 Generated with Claude Code

Note

Medium Risk
Hotfix touches core exit-code/JSON error paths and bumps many framework extensions; regressions could affect CI scripts that depend on exit codes or JSON streams, though changes are mostly restoring prior behavior.

Overview
v1.1307.1 hotfix cherry-picks regression fixes and security dependency updates, and refreshes release notes for this patch.

snyk test behavior is tightened in the Go v2 core: no supported manifest files again maps to catalog SNYK-CLI-0008 with exit code 3 (via NewNoSupportedFilesFoundError in the exit-code map). Post-run handling uses new IsFailure so exit 1 (findings) and 3 (unsupported projects) are not treated like hard failures—avoiding duplicate/corrupt JSON when a secondary network error occurs. snyk test --json error documents go to stdout instead of stderr in structured mode.

Dependencies bump go-application-framework, cli-extension-axi, cli-extension-os-flows, snyk-ls, and related transitive modules; Node side bumps snyk-docker-plugin to 9.20.0 and pins js-yaml overrides for CVE fixes. NETWORK_REQUEST_RETRY_ALLOWED_PATHS gets CLI defaults merged with user config.

Docs: adds snyk cos help (targets, scans, findings) and adjusts README links for sbom/aibom; acceptance resilience tests disable INTERNAL_SNYK_CONTRIBUTORS_ENABLED to avoid early network calls under slow-server simulation.

^{Reviewed by Cursor Bugbot for commit 57ba3e6. Bugbot is set up for automated code reviews on this repo. Configure here.}

snyk-io · 2026-09-04T17:40:27Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2026-09-04T17:41:19Z

	Warnings
⚠️	Please make changes to `snyk help` text in Gitbook. Changes will be automatically synchronised to Snyk CLI as a scheduled PR. For more information, see: `help/README.md`.
⚠️	There are multiple commits on your branch, please squash them locally before merging!
⚠️	"Merge pull request #7231 from snyk/docs/automatic-gitbook-update-cli-help-chore/cherry-pick-hotfix-1.1307.1" is too long. Keep the first line of your commit message under 72 characters.
⚠️	"chore: automatic integration of language server 83d0e592d905fb1468cae76b74af050f3b5894d8" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against 57ba3e6

cursor

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0fa2c38. Configure here.}

danskmt

I added a comment + 2 observations:

it seems we have set TEST_SNYK_IGNORE_LIST - if the changes are touching one of the ignored tests, I would suggest unsetting this variable and running tests once again.
commits are marked as "unsigned" in this PR

CatalinSnyk · 2026-09-07T08:47:37Z

-* **general**: Prevents a possible connection leak when the Snyk API returns an error response. ([8fd7d65](https://github.com/snyk/snyk/commit/8fd7d6544beab0fe609e823539e6373e058e7239))
+* **test**: `snyk test` on a repository with no supported manifest files again reports `SNYK-CLI-0008` and exits 3, instead of a generic `SNYK-CLI-0000` with exit 2. `snyk test --json` writes the error document to stdout as expected. ([2cbdbda](https://github.com/snyk/snyk/commit/2cbdbda2c572c6631aed05bde8d99a9359c1c63a))
+* **test**: Restores `moduleName`, `insights.triageAdvice`, and `functions_new` fields in `snyk test --json` output. ([8e250c6](https://github.com/snyk/snyk/commit/8e250c614707a67c39e80b01f2307e601d2e4991))
+* **test**: `.snyk` policy files are now handled correctly in the unified test flow -- empty, whitespace-only and comment-only policies, date-only timestamps, and other edge cases that previously caused incorrect results or failures. ([4215104](https://github.com/snyk/snyk/commit/4215104d3c9cf2d57089624d84cd39ce5cf6bbc3))


nit: Not sure if the users know what the unified test flow means. Maybe worth a tweak?

I agree, we could use the release notes from the PR:
snyk test now reads .snyk policy files correctly.

CatalinSnyk · 2026-09-07T09:28:18Z

Huh, the commits are also not signed 😅

Points cliv2 and cliv2-private at the released v0.18.2 tag, which fixes several regex bugs in the debug-log scrubber (secrets not being masked, and scrubbing corrupting the surrounding JSON structure).

`snyk test` in a directory with no supported manifest files reported SNYK-CLI-0008 ("No supported files found") and exited 3. With the unified test API feature flag enabled, routing no longer falls back to the legacy path and the os-flows extension surfaced a generic SNYK-CLI-0000 with "failed to get dependency graph: no testable projects found" and exit 2 instead. CI pipelines scanning repos without testable projects (snyk/homebrew-tap, snyk/scoop-snyk) treat SNYK-CLI-0008 / exit 3 as "nothing to scan", so this was a breaking change for them. The error identity is restored in cli-extension-os-flows (snyk/cli-extension-os-flows#278, bumped here). This side adds the missing exit-code mapping: SNYK-CLI-0008 was never in the central error-catalog map because the legacy TS CLI derived exit 3 itself by substring-matching its own message, so a typed error from Go still fell through to the generic exit 2. Follows the existing aibom.NoSupportedFiles precedent. Also send the `--json` error document to stdout rather than the error stream. The error stream is routed to stderr whenever the default output is structured so that error text cannot corrupt a JSON payload, but this document *is* the structured output, so `snyk test --json` left stdout empty and printed the JSON to stderr. That affected every error on a Go workflow, not just this one, and diverged from both the legacy CLI and the rest of the CLI's own contract (the IaC acceptance tests already expect `"ok": false` on stdout). assertEquivalent returned early when a fixture legitimately submitted nothing, with a comment noting that exit codes "legitimately differ (TS CLI exits 3, os-flows exits 2)". That excused this exact divergence, so the equivalence suite could not catch it despite already running the no-supported-target-files fixture on both paths. It now compares exit codes, skips the per-project comparison when nothing was scanned (stdout is an error payload, not results), and reports a length mismatch instead of indexing past the end of the shorter array. That fixture is the regression guard.

…76b74af050f3b5894d8

`snyk test --json` emits `vulnerabilities[].moduleName`, `vulnerabilities[].insights.triageAdvice` and `vulnerabilities[].functions_new` again for users on the new unified Open Source test flow. All three were present in the legacy output and silently disappeared behind internal_snyk_cli_use_unified_test_api_for_os_cli_test, because nothing on the path from Registry to CLI carried them. Delivered by pinning the two dependencies that carry the fix, in both cliv2 and cliv2-private: go-application-framework v0.18.2 -> v0.19.1 cli-extension-os-flows v0.0.0-20260902112609-53cb856541b8 -> v0.0.0-20260903073306-ad447d86c87d GAF v0.19.1 carries the regenerated testapi client (snyk/go-application-framework#714); os-flows carries the legacy-JSON transform that maps the new fields (snyk/cli-extension-os-flows#279). Ref: OSF-479 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Pins cli-extension-os-flows to 53cb856, the merge of snyk/cli-extension-os-flows#280, which fixes .snyk policy parsing on the unified snyk test flow: empty and comment-only files, legacy's own `ignore: []` default, date-only and zone-less timestamps, tab indentation and null rule bodies, which previously panicked. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Also bumps golang.org/x/crypto to v0.56.0, fixing SNYK-GOLANG-GOLANGORGXCRYPTOSSH-19504090 (HIGH), which blocks CI on this branch.

Points GAF at the release/1.1307 branch (v0.18.3-0.20260904153233-0e7f03ec6034) which includes v0.18.2 (CLI-1732 scrub fix) plus cherry-picked commits: - feat: contributor capture middleware (#703) - chore: regenerate testapi client OSF-479 (#714) - fix: IANDT-26 response parsing (#718) - feat: IANDT-27 post invoke hook (#721) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

GAF 0.17.0 narrowed its default network-retry allow-list to only oauth2/token. Add the paths the CLI relied on as implicit free defaults before that change (test-dep-graph, verify/token, feature_flags/evaluation) so unsafe-method requests to them keep retrying on transient failures. Also includes go.sum cleanup from `make tidy` removing stale checksums for the superseded go-application-framework v0.16.1. Add an acceptance test proving GAF retries feature_flags/evaluation on a transient failure.

Pin back rift-cli-extension, cli-extension-agent-scan, and cli-extension-dep-graph to their release-candidate versions. These were unintentionally upgraded by go mod tidy during the GAF v0.18.2 cherry-pick and are not required by any hotfix change. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Bumps cli-extension-os-flows to v0.0.0-20260903073306-ad447d86c87d to restore moduleName, triageAdvice, and functions_new in snyk test --json output (PR #7184). Rebases the GAF release branch from v0.19.1 (release/1.1307.1) so the pseudo-version satisfies os-flows' minimum version requirement. The new branch is code-identical to release/1.1307 — same cherry-picks (#703, #714, #718, #721), zero diff. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…help-chore/cherry-pick-hotfix-1.1307.1 docs: synchronizing help from snyk/user-docs

snyk-pr-review-bot · 2026-09-07T10:50:01Z

PR Reviewer Guide 🔍

🧪 PR contains tests
🔒 No security concerns identified
⚡ No major issues detected
📚 Repository Context Analyzed This review considered 74 relevant code sections from 7 files (average relevance: 0.85) CLAUDE.md (3 segments, lines 94-229) package-lock.json (6 segments, lines 19450-19745) cliv2/internal/constants/constants.go (lines 1-44) README.md (lines 1-88) help/cli-commands/test.md (2 segments, lines 38-199) cliv2/pkg/core/main.go (lines 1-188) scripts/upgrade-snyk-go-dependencies.go (lines 1-149)
🤖 Repository instructions applied (from `AGENTS.md`)

PeterSchafer requested a review from a team as a code owner September 4, 2026 17:39

PeterSchafer force-pushed the chore/cherry-pick-hotfix-1.1307.1 branch from ee071d6 to 4d0ce40 Compare September 4, 2026 17:40

This comment has been minimized.

Sign in to view

PeterSchafer force-pushed the chore/cherry-pick-hotfix-1.1307.1 branch from 53c9acc to 27fbcb8 Compare September 4, 2026 18:36

This comment has been minimized.

Sign in to view

PeterSchafer force-pushed the chore/cherry-pick-hotfix-1.1307.1 branch from 27fbcb8 to f59aea4 Compare September 4, 2026 18:36

This comment has been minimized.

Sign in to view

PeterSchafer force-pushed the chore/cherry-pick-hotfix-1.1307.1 branch from f59aea4 to 0fa2c38 Compare September 5, 2026 07:19

cursor Bot reviewed Sep 5, 2026

View reviewed changes

Comment thread cliv2/internal/errors/errors.go

Comment thread cliv2/pkg/core/main.go

This comment has been minimized.

Sign in to view

PeterSchafer force-pushed the chore/cherry-pick-hotfix-1.1307.1 branch from 0fa2c38 to b382fd7 Compare September 5, 2026 07:22

This comment has been minimized.

Sign in to view

PeterSchafer force-pushed the chore/cherry-pick-hotfix-1.1307.1 branch from c04322e to ada9025 Compare September 5, 2026 13:15

This comment has been minimized.

Sign in to view

danskmt reviewed Sep 7, 2026

View reviewed changes

Comment thread cliv2/go.mod Outdated

danskmt reviewed Sep 7, 2026

View reviewed changes

MoisBrigitte approved these changes Sep 7, 2026

View reviewed changes

CatalinSnyk reviewed Sep 7, 2026

View reviewed changes

PeterSchafer force-pushed the chore/cherry-pick-hotfix-1.1307.1 branch from ada9025 to 6413a0d Compare September 7, 2026 09:42

chore: bump cli-extension-iac-rules to fix vulnerabilities [IAC-3524]

6055967

nick-y-snyk and others added 2 commits September 7, 2026 11:44

chore: bump go-application-framework to v0.18.2 for CLI-1732 scrub fix

e877c87

Points cliv2 and cliv2-private at the released v0.18.2 tag, which fixes several regex bugs in the debug-log scrubber (secrets not being masked, and scrubbing corrupting the surrounding JSON structure).

This comment has been minimized.

Sign in to view

danskmt and others added 14 commits September 7, 2026 11:44

fix(deps): upgrade bundled semver to 7.5.2 for CVE-2022-25883

8c0632f

chore: automatic integration of language server 83d0e592d905fb1468cae…

8275ee3

…76b74af050f3b5894d8

fix(errors): differentiate none errors better

aae5ecd

chore: update docker to trigger non errors

260b231

chore: bump cli-extension-axi to latest main

3f86547

Also bumps golang.org/x/crypto to v0.56.0, fixing SNYK-GOLANG-GOLANGORGXCRYPTOSSH-19504090 (HIGH), which blocks CI on this branch.

fix: bump gRPC dependency to fix CVE-2026-84304

7e7f63a

fix: bump js-yaml to fix CVE-2026-84375

0f71789

chore: IANDT-27: capture contributors

c6dce0f

PeterSchafer force-pushed the chore/cherry-pick-hotfix-1.1307.1 branch from 6413a0d to 7c78618 Compare September 7, 2026 09:46

This comment has been minimized.

Sign in to view

chore: Update Release Notes

7722213

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

PeterSchafer force-pushed the chore/cherry-pick-hotfix-1.1307.1 branch from 7c78618 to 7722213 Compare September 7, 2026 10:32

PeterSchafer enabled auto-merge September 7, 2026 10:34

This comment has been minimized.

Sign in to view

CatalinSnyk approved these changes Sep 7, 2026

View reviewed changes

team-cli-bot and others added 2 commits September 7, 2026 12:41

docs: synchronizing help from snyk/user-docs

082d692

Merge pull request #7231 from snyk/docs/automatic-gitbook-update-cli-…

57ba3e6

…help-chore/cherry-pick-hotfix-1.1307.1 docs: synchronizing help from snyk/user-docs

PeterSchafer merged commit e5eb3e5 into release-candidate Sep 7, 2026
8 of 9 checks passed

PeterSchafer deleted the chore/cherry-pick-hotfix-1.1307.1 branch September 7, 2026 11:51

Uh oh!

Conversation

PeterSchafer commented Sep 4, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Ticket PRs (8 PRs, 9 commits)

Security fixes (3 commits)

Additional PRs

GAF release branch

Test plan

Uh oh!

snyk-io Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

Uh oh!

danskmt left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

CatalinSnyk Sep 7, 2026

Choose a reason for hiding this comment

Uh oh!

MoisBrigitte Sep 7, 2026

Choose a reason for hiding this comment

Uh oh!

CatalinSnyk commented Sep 7, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

snyk-pr-review-bot Bot commented Sep 7, 2026

PR Reviewer Guide 🔍

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

PeterSchafer commented Sep 4, 2026 •

edited by cursor Bot

Loading

snyk-io Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

danskmt left a comment •

edited

Loading