chore: bump GAF and adjust acceptance tests

[robertolopezlopez]

Summary

• Stacks on feat: TOON flags and field selection #7267 (feat/CLI-1861 → chore/CLI-1859-gaf-toon → main).
• Extends snyk test and snyk secrets test TOON acceptance for --full (stdout + file output).
• Adds legacy-route case: feature flags off → human output, no TOON file.
• GAF pin matches chore: bump GAF for TOON scanner summaries #7268 / GAF #767 (297cdc03); --full flag lives in GAF output workflow, not CLI.

What does this PR do?

CLI-1861 integration layer: acceptance coverage for default and --full TOON on native test / secrets test, plus legacy fallback behaviour.

Where should the reviewer start?

• test/jest/acceptance/snyk-test/output-formats/toon.spec.ts
• test/jest/acceptance/snyk-secrets/snyk-secrets-toon.spec.ts

How should this be manually tested?

make build
TEST_SNYK_COMMAND=./binary-releases/snyk-macos-arm64 npx jest --runInBand --runTestsByPath \
  test/jest/acceptance/snyk-test/output-formats/toon.spec.ts \
  test/jest/acceptance/snyk-secrets/snyk-secrets-toon.spec.ts

What's the product update that needs to be communicated to CLI users?

Native snyk test and snyk secrets test TOON output supports --full for expanded SCA fields (via GAF). No CLI flag wiring added here.

Risk assessment

Low — acceptance tests only; no production CLI logic changes.

Relevant tickets

CLI-1860
CLI-1861

---

Note

Low Risk
Dependency pin plus Jest acceptance updates only; TOON behavior comes from GAF, with no new CLI wiring in this PR.

Overview
Bumps go-application-framework (pre-release aligned with GAF #767) and cli-extension-dep-graph/v2 in cliv2 and cliv2-private; no CLI source changes in this diff.

Acceptance tests for snyk test and snyk secrets test TOON output are updated to match the new UFM shape (org, sca / secrets tables instead of a results[N]: envelope). They now cover default vs --toon=full (column sets and the “hint: add --toon=full” line), --toon=false, and stdout vs --toon-file-output when full mode also prints TOON to the terminal.

Adds a case where the legacy test route (risk-score feature flags off) ignores TOON flags: human-readable stdout and no TOON file.

^{Reviewed by Cursor Bugbot for commit 3ff991e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[octavian-snyk]

This is good to go once GAF version is bumped.

[octavian-snyk]

This is good to go into #7267 or #7268. Why is it separate?

[robertolopezlopez]

This is good to go into #7267 or #7268. Why is it separate?

@octavian-snyk #7268 was just the gaf pr associated cli pr. This one was for a different task (CLI-1861). Your thought had crossed my head already. Anyway: I have dropped #7268

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 11 relevant code sections from 7 files (average relevance: 1.00) CLAUDE.md (2 segments, lines 1-65) package.json (lines 1-244) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) package-lock.json (4 segments, lines 6-266) cliv2/pkg/core/main.go (lines 1-188) cliv2/scripts/prepare_licenses.go (lines 1-197) CONTRIBUTING.md (lines 135-311)

🤖 Repository instructions applied (from AGENTS.md)