fix(snyk): remediate high-and-above vulnerabilities on feat/CLI-1838

go.mod

@@ -28,19 +28,19 @@ require (
 require (
 	github.com/cenkalti/backoff/v5 v5.0.2
 	github.com/go-git/go-billy/v5 v5.9.0
-	github.com/go-git/go-git/v5 v5.19.1
+	github.com/go-git/go-git/v5 v5.19.2
 	github.com/gofrs/flock v0.12.1
 	github.com/manifoldco/promptui v0.9.0
 	github.com/mattn/go-isatty v0.0.20
 	github.com/oapi-codegen/runtime v1.1.1
 	github.com/patrickmn/go-cache v2.1.0+incompatible
 	github.com/snyk/error-catalog-golang-public v0.0.0-20260806122555-28dc45bbbde6
 	github.com/subosito/gotenv v1.6.0
-	golang.org/x/mod v0.37.0
+	golang.org/x/mod v0.38.0
 	golang.org/x/net v0.57.0
 	golang.org/x/sync v0.22.0
 	golang.org/x/term v0.45.0
-	golang.org/x/text v0.40.0
+	golang.org/x/text v0.41.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -117,9 +117,9 @@ require (
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
-	golang.org/x/crypto v0.54.0 // indirect
+	golang.org/x/crypto v0.56.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/tools v0.48.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )

go.sum

@@ -77,6 +77,8 @@ github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMj
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
 github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
 github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
+github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY=
+github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk=
 github.com/go-openapi/jsonpointer v0.21.1 h1:whnzv/pNXtK2FbX/W9yJfRmE2gsmkfahjMKB0fZvcic=
 github.com/go-openapi/jsonpointer v0.21.1/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
 github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
@@ -304,12 +306,16 @@ golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
 golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
 golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -368,12 +374,16 @@ golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
 golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
 golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
+golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

internal/presenters/testdata/ufm/toon/README.md

@@ -0,0 +1,39 @@
+# UFM TOON contract
+
+Synthetic fixtures: JSON input (`*.json`) and exact TOON output (`*.toon`).
+Use GAF's template engine to render TOON.
+No production encoder dependency.
+
+## Contract
+
+- Use `{"results": [...]}`. Keep the envelope fields shown in the JSON fixtures,
+  including both summaries. Missing or nil envelope values become `null`;
+  empty findings become `[]`.
+- Preserve the `FindingData` JSON: nested fields, omission/null semantics
+  and numeric types. Keep every finding and
+  array order; do not aggregate or generate summary text.
+- Keep `from_line` and optional `to_line` as supplied, including explicit null.
+  Do not rename them or fill in a missing end line.
+- Preserve numbers exactly or return a rendering error.
+
+Follow [TOON spec 4.1](https://github.com/toon-format/spec/blob/d6db4b04303bdea132351ce45aed612311c850b2/SPEC.md):
+use two-space indentation, comma delimiter, UTF-8 and LF separators. No BOM,
+trailing spaces or final newline. Sort object keys recursively by UTF-8 byte
+order before rendering; never sort arrays.
+
+## Regenerate
+
+From this directory, use the [@toon-format/cli](https://toonformat.dev/cli/).
+Replace `sca` with the case to regenerate:
+
+```bash
+jq -S . sca.json | npx --yes @toon-format/cli@4.1.1 --encode -o /tmp/sca.toon
+printf '%s' "$(< /tmp/sca.toon)" > /tmp/sca.toon
+cmp sca.toon /tmp/sca.toon
+```
+
+The `printf` command removes the `@toon-format/cli`'s final newline.
+For contract changes, copy `/tmp/sca.toon` to `sca.toon` and review the diff.
+
+Use the `@toon-format/cli` only for fixtures. Integers outside JavaScript's
+safe range need separate template renderer tests.

internal/presenters/testdata/ufm/toon/empty_sca.json

@@ -0,0 +1,25 @@
+{
+  "results": [
+    {
+      "effectiveSummary": {
+        "count": 0
+      },
+      "errors": null,
+      "executionState": "finished",
+      "findings": [],
+      "outcomeReason": null,
+      "passFail": "pass",
+      "rawSummary": {
+        "count": 0
+      },
+      "testConfiguration": {
+        "scan_config": {
+          "sca": {}
+        }
+      },
+      "testId": "10000000-0000-4000-8000-000000000003",
+      "testSubject": null,
+      "warnings": null
+    }
+  ]
+}

internal/presenters/testdata/ufm/toon/empty_sca.toon

@@ -0,0 +1,16 @@
+results[1]:
+  - effectiveSummary:
+      count: 0
+    errors: null
+    executionState: finished
+    findings: []
+    outcomeReason: null
+    passFail: pass
+    rawSummary:
+      count: 0
+    testConfiguration:
+      scan_config:
+        sca:
+    testId: 10000000-0000-4000-8000-000000000003
+    testSubject: null
+    warnings: null

internal/presenters/testdata/ufm/toon/empty_secrets.json

@@ -0,0 +1,25 @@
+{
+  "results": [
+    {
+      "effectiveSummary": {
+        "count": 0
+      },
+      "errors": null,
+      "executionState": "finished",
+      "findings": [],
+      "outcomeReason": null,
+      "passFail": "pass",
+      "rawSummary": {
+        "count": 0
+      },
+      "testConfiguration": {
+        "scan_config": {
+          "secrets": {}
+        }
+      },
+      "testId": "10000000-0000-4000-8000-000000000004",
+      "testSubject": null,
+      "warnings": null
+    }
+  ]
+}

internal/presenters/testdata/ufm/toon/empty_secrets.toon

@@ -0,0 +1,16 @@
+results[1]:
+  - effectiveSummary:
+      count: 0
+    errors: null
+    executionState: finished
+    findings: []
+    outcomeReason: null
+    passFail: pass
+    rawSummary:
+      count: 0
+    testConfiguration:
+      scan_config:
+        secrets:
+    testId: 10000000-0000-4000-8000-000000000004
+    testSubject: null
+    warnings: null