chore: bump GAF

[robertolopezlopez]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages are release-note ready
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Bumps github.com/snyk/go-application-framework to v0.23.0 in both cliv2 and cliv2-private (GAF PR #739).

GAF v0.23.0 adds generic UFM TOON output: native scan results are encoded through GAF's UfmPresenter using the CLI-1838 contract. The encoder preserves the full FindingData JSON shape and envelope fields (not a product-specific projection), with template-owned rendering and TOON 4.1-compliant quoting/escaping.

This PR is dependency-only — no CLI source changes. It wires the CLI to the released GAF build so TOON output can be exercised end-to-end before any CLI-specific follow-ups.

Where should the reviewer start?

cliv2/go.mod, cliv2/go.sum, cliv2-private/go.mod, cliv2-private/go.sum.

How should this be manually tested?

1. Build the CLI from this branch (make build or your usual local build flow).
2. Run a UFM scan with TOON output selected (e.g. --output-format=toon or the equivalent config for your test target).
3. Confirm the output matches the CLI-1838 contract shape: results envelope, findings rendered as generic TOON (not SCA/Secrets-only projection).
4. Spot-check edge cases covered in GAF:
   • comma-bearing string arrays (e.g. ["Doe, Jane", "Smith"]) decode as two values, not three
   • integers beyond 2^53 retain precision
   • control characters in values and keys render as escaped TOON, not hard failures
5. Compare against an existing format (JSON/SARIF) on the same scan to confirm findings are present and structurally equivalent.

What's the product update that needs to be communicated to CLI users?

CLI users can request UFM scan results in TOON format. Output follows the CLI-1838 contract: a generic, product-agnostic encoding of native findings suitable for machine consumption and round-trip decoding. No CLI flags or commands change in this PR — this is the dependency bump that enables TOON output already routed through GAF's output workflow.

Risk assessment

Low — go.mod / go.sum only across public and private modules. Behaviour change is additive (new output format availability via GAF); no CLI API or command surface changes.

Any background context you want to provide?

Companion to GAF PR #739 / CLI-1826. Earlier draft pins to a branch pseudo-version were replaced with the released v0.23.0 from main after GAF merged.

What are the relevant tickets?

• CLI-1826
• CLI-1838

---

Note

Low Risk
Lockfile-only change; behavior is additive (new output format via GAF) with no CLI API or command surface changes in the diff.

Overview
This PR only updates github.com/snyk/go-application-framework from v0.21.0 to v0.23.0 in cliv2 and cliv2-private (go.mod / go.sum). There are no CLI source edits.

That release pulls in GAF’s generic UFM TOON output path (via UfmPresenter / output workflow), aligned with the CLI-1838 contract: product-agnostic FindingData in a results envelope with TOON 4.1-safe encoding. The CLI already routes scan output through GAF (e.g. output_workflow in cliv2/internal/cliv2), so this bump is what makes TOON available end-to-end when users select that output format—without changing flags or commands in this repo.

^{Reviewed by Cursor Bugbot for commit 1c8bdac. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

	Warnings
⚠️	There are multiple commits on your branch, please squash them locally before merging!

Generated by 🚫 dangerJS against 1c8bdac

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 4 relevant code sections from 4 files (average relevance: 0.97) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) CLAUDE.md (lines 1-65) package.json (lines 1-238) package-lock.json (lines 3668-3925)

🤖 Repository instructions applied (from AGENTS.md)