fix: Bump GAF to gate metacharacter ignore fix behind flag

[danskmt]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages are release-note ready, emphasizing what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Bumps go-application-framework and code-client-go to versions where the ignore-rule/path regex-metacharacter fix is opt-in, gated behind configuration.FF_FILE_FILTER_METACHARACTER_FIX, instead of always on. No code changes in this repo itself — the flag is read and applied inside code-client-go.

Where should the reviewer start?

• cliv2/go.mod / cliv2/go.sum – GAF + code-client-go version bump
• cliv2-private/go.mod / cliv2-private/go.sum – indirect dependency bump
• PR in GAF: fix: Gate ignore-rule metacharacter fix behind an opt-in flag go-application-framework#667

How should this be manually tested?

1. Run the CLI test suite (make test in cliv2) and confirm it passes with the bumped dependencies.
2. Scan a directory containing a path or ignore rule with regex metacharacters (e.g. a folder named build (old)) and confirm exclusion behavior matches legacy behavior by default.

What's the product update that needs to be communicated to CLI users?

Introduces snykFileFilterMetacharacterFix feature flag capability, but no impact at the moment, because we are preserving the current behavior that is in Preview CLI until we can release all the .gitignore related changes in other repos as well (e.g. code-client-go, etc..) as they need to plug the config to the new constructor so they can make use of it.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Incomplete Dependency Update 🟠 [major] The PR description explicitly states that it 'Bumps go-application-framework and code-client-go', but the changes in cliv2/go.mod only include the go-application-framework bump. github.com/snyk/code-client-go remains at v1.27.0 (line 22) in the public module, whereas the private module (cliv2-private/go.mod) already references v1.27.5 (line 218). This discrepancy suggests that the public CLI will not receive the intended opt-in logic for the regex metacharacter fix, as that logic resides within the code-client-go extension which was not updated for the public build. github.com/snyk/go-application-framework v0.8.1

📚 Repository Context Analyzed This review considered 4 relevant code sections from 3 files (average relevance: 0.97) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) package-lock.json (2 segments, lines 19770-19982) CLAUDE.md (lines 1-116)

🤖 Repository instructions applied (from AGENTS.md)