chore: bump extensions for SBOM per-component results

[MoisBrigitte]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages are release-note ready, emphasizing what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable) — none
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___) — n/a
• Includes product update to be announced in the next stable release notes

What does this PR do?

Dependency bumps only, no source changes. Both cliv2 and cliv2-private:

Module	From (current main)	To	Upstream PR
go-application-framework	v0.16.0	v0.16.1-0.20260819102712-53729422c5cd (5372942)	snyk/go-application-framework#707
cli-extension-os-flows	v0.0.0-20260818092349-91c745a9ee7a	v0.0.0-20260819103218-611f8d16dc54 (611f8d1)	snyk/cli-extension-os-flows#270

Together they change how SBOM test results are presented:

• Report one result per component for SBOM tests [OSF-294] cli-extension-os-flows#270 — an SBOM test covers many components but the test API reports it as one test, so the CLI showed a single combined result. It now reports one result per component, matching how snyk test --all-projects reports one result per project.
• fix: render the asset link once below the overall test summary go-application-framework#707 — that split made the asset inventory link print once per component, because the template rendered it inside each result's footer. It now renders once, below the overall test summary.

Draft: both pins are branch commits on unmerged PRs. Needs re-pointing at main pseudo-versions once they land, then it can come out of draft.

Where should the reviewer start?

cliv2/go.mod and cliv2-private/go.mod, plus the corresponding go.sum entries. No source changes.

How should this be manually tested?

Requires an org with SBOM testing and asset inventory enabled:

snyk sbom test --experimental --file=<multi-component-sbom>.json --report

• One result section per component, each with its own header and test summary, then an overall test summary — rather than one combined result.
• View your asset(s) at: … appears exactly once, immediately below the Overall Test Summary box. Before, it appeared once per component, mid-output.

Worth smoke testing that plain snyk test and snyk test --all-projects are unchanged — neither reports an asset, so neither should print that line at all.

What's the product update that needs to be communicated to CLI users?

snyk sbom test now reports one result per component in the SBOM, rather than a single combined result. With --report, the asset inventory link is shown once at the end of the results instead of under every component.

Risk assessment (Low | Medium | High)?

Medium. Two things carry the risk, neither of them in this repo:

• The os-flows half changes the shape of snyk sbom test output — one result per component, and one entry per component in the legacy JSON — so anything parsing that output sees a different structure.
• The GAF half is presentation-only: one template block moves, and a helper reads the link from whichever result carries it. No payload or API change.

Any background context you want to provide?

A modelling gap sits underneath the asset link fix: asset is a property of the test, but the UFM payload is a bare array of results with nowhere to put test-level facts, so it is copied onto every result and then stripped from all but one by the producer. Closing that gap is prepared separately, stacked on these branches — it also needs a change to cli-extension-axi, which parses the payload itself rather than using the framework's decoder. Not part of this PR.

Links to automated tests

Both upstream PRs carry their own coverage:

• GAF: multi_project_with_asset in Test_UfmPresenter_HumanReadable — there was no test for the asset link at all before.
• os-flows: Test_RunSbomFlow_ReportsTestWideLinksOnce and the TestUnifiedFindingPresenter_AssetLink subtests.

Both modules build clean here (go build ./... in cliv2 and cliv2-private).

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

	Warnings
⚠️	"chore: bump go-application-framework and cli-extension-os-flows for SBOM per-component results" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against ae7be42

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 7 relevant code sections from 4 files (average relevance: 1.00) CLAUDE.md (2 segments, lines 229-315) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) package.json (lines 1-236) package-lock.json (3 segments, lines 6-266)

🤖 Repository instructions applied (from AGENTS.md)