[alina-d-m]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Updates the secrets extension to the latest version. The latest version of the extension removes the usage of the 'isSecretsEnabled' feature flag in favor (used during CB) of using only the Secrets setting to gate Secrets tests.

Also updates the tests to mock the setting rather than the FF.

Where should the reviewer start?

From the extension's clean-up PR snyk/cli-extension-secrets#96.

How should this be manually tested?

Build the cli and run 'snyk secrets test' with and without the Secrets setting on. If the setting is turned off, 'snyk secrets test' should prevent you from running a Secrets scan.

What's the product update that needs to be communicated to CLI users?

None.

---

Note

Medium Risk
Changes when snyk secrets test is allowed (org setting vs legacy FF); behavior should match product intent but affects all Secrets CLI users at scan start.

Overview
Bumps cli-extension-secrets in cliv2 and cliv2-private so Secrets gating uses the org Secrets setting (REST) instead of the isSecretsEnabled feature flag.

Acceptance tests are aligned with that behavior: the fake server exposes GET /rest/orgs/:orgId/settings/secrets (with and without /api), driven by setOrgSetting('secrets', …). Resilience and secrets HTML/user-journey specs drop INTERNAL_SNYK_FEATURE_FLAG_IS_SECRETS_ENABLED / setFeatureFlag('isSecretsEnabled') and opt in via the org setting. A new HTML test asserts snyk secrets test fails closed (SNYK-CLI-0016, no test job) when the setting is off.

^{Reviewed by Cursor Bugbot for commit 18cdf2f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 27fcd87. Configure here.}

[robertolopezlopez]

approving with some a minor finding - please take care of it

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 7 relevant code sections from 5 files (average relevance: 1.00) CLAUDE.md (3 segments, lines 274-355) package.json (lines 1-242) package-lock.json (lines 6-270) cliv2/pkg/core/main.go (lines 1-192) scripts/upgrade-snyk-go-dependencies.go (lines 1-149)

🤖 Repository instructions applied (from AGENTS.md)