[robertolopezlopez]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

It integrates changes from snyk/go-application-framework#819 - which itself does chmod on config files for security reasons.

It also bumps the transitive dependencies github.com/klauspost/compress (1.19.2 → 1.20.2) and github.com/go-jose/go-jose/v4 (4.1.4 → 4.1.6) in cliv2 and cliv2-private to clear the HIGH advisories that block the code-analysis Open Source gate (same remediation as #7431 on main).

Where should the reviewer start?

How should this be manually tested?

$ make build
$ cli="$HOME/go/cli/binary-releases/snyk-macos-arm64"
$ test_home $(mktemp -d)
$ cfg="$test_home/.config/configstore/snyk.json"
$ mkdir -p "$(dirname "$cfg")"
$ for mode in 600 644 666 755 400 440; do
      rm -f "$cfg"
      echo '{"api":"dummy-token"}' > "$cfg"
      chmod "$mode" "$cfg"

      HOME="$test_home" XDG_CONFIG_HOME="$test_home/.config" \
          SNYK_DISABLE_ANALYTICS=1 "$cli" --version >/dev/null

      printf '%s -> %s\n' "$mode" "$(stat -f '%Lp' "$cfg")"
  done
$ rm -rf "$test_home"

Expected:

  600 -> 600
  644 -> 600
  666 -> 600
  755 -> 600
  400 -> 400
  440 -> 400

What's the product update that needs to be communicated to CLI users?

---

Note

Medium Risk
Changes on-disk permissions for local config that may hold API tokens; behavior is intentional hardening but can surprise users who relied on world-readable config files.

Overview
Bumps github.com/snyk/go-application-framework from v0.34.1 to v0.34.2 in cliv2 and cliv2-private, with matching go.sum updates. That release pulls in config-store behavior from go-application-framework#819: when the CLI loads config (e.g. snyk.json), overly permissive modes are tightened to 600 while stricter read-only modes (400 / 440) are left unchanged.

The diff has no CLI source edits—only module lockfile changes. Transitive bumps include go-jose/v4 (4.1.4 → 4.1.6) and klauspost/compress (1.19.2 → 1.20.2).

^{Reviewed by Cursor Bugbot for commit b95d86f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

	Warnings
⚠️	There are multiple commits on your branch, please squash them locally before merging!

Generated by 🚫 dangerJS against b95d86f

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 11 relevant code sections from 6 files (average relevance: 0.81) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) CLAUDE.md (3 segments, lines 274-355) package-lock.json (3 segments, lines 6-270) CONTRIBUTING.md (2 segments, lines 1-135) cliv2-private/cmd/cliv2/main.go (lines 1-26) package.json (lines 1-242)

🤖 Repository instructions applied (from AGENTS.md)