fix: load snyk.json only from configstore path

[octavian-snyk]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Noted that if a snyk.json file is present in the working directory and absent from the user’s ~/.config/configstore/ , snyk will use the file from the working directory to authenticate requests.

This PR ensures we have a single source of truth for the snyk.json.

Where should the reviewer start?

snyk/go-application-framework#659

How should this be manually tested?

make build
cd binary-releases
cp ~/.config/configstore/snyk.json .
rm ~/.config/configstore/snyk.json
snyk doctor
# All green
./snyk-macos-arm64 doctor
# Authentication error

What's the product update that needs to be communicated to CLI users?

snyk.json config file present in the working directory will start being ignored.

What are the relevant tickets?

CLI-1124

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Operational Breaking Change 🟠 [major] The update to go-application-framework (v0.7.4 pseudo-version) restricts the loading of snyk.json to the user's configstore path (typically ~/.config/configstore/), deliberately ignoring the current working directory. This is a breaking change for CI/CD pipelines or ephemeral environments that mount authentication configuration as a local file rather than modifying the user's home directory. While documented in the PR description, this will cause immediate authentication failures for such setups without providing a grace period or a clear CLI-level warning. github.com/snyk/go-application-framework v0.7.4-0.20260717090226-5d9e0f2df7ee Use of Pseudo-version 🟡 [minor] The PR updates a core dependency to a timestamped pseudo-version (v0.7.4-0.20260717090226-5d9e0f2df7ee). For critical security software like the Snyk CLI, using unreleased commits rather than tagged releases of internal frameworks reduces build transparency and makes it more difficult to audit the specific framework logic being integrated. github.com/snyk/go-application-framework v0.7.4-0.20260717090226-5d9e0f2df7ee