feat: use uv depgraph generation in monitor by snyk-will · Pull Request #6529 · snyk/cli

snyk-will · 2026-02-11T14:40:38Z

Pull Request Submission Checklist

Follows CONTRIBUTING guidelines
Commit messages
are release-note ready, emphasizing
what was changed, not how.
Includes detailed description of changes
Contains risk assessment (Low | Medium | High)
Highlights breaking API changes (if applicable)
Links to automated tests covering new functionality
Includes manual testing instructions (if necessary)
Updates relevant GitBook documentation (PR link: ___)
Includes product update to be announced in the next stable release notes

What does this PR do?

For uv monitor Instead of returning a fixed depgraph we now use the go binary calling the depgraph endpoint to generate correct depgraphs for uv projects.

Where should the reviewer start?

How should this be manually tested?

run snyk monitor on a uv project

src/lib/plugins/uv/index.ts

PeterSchafer · 2026-02-19T09:15:25Z

src/lib/plugins/uv/index.ts

+  const result = await execGoCommand(args, { cwd: root });
+
+  if (result.exitCode !== 0) {
+    throw new CLI.GeneralCLIFailureError(extractErrorDetail(result));


Suggestion: This will hide the root error and report it as general failure. It would be better to return the correct error-catalog error. You might need something like this though.

yes this is something we've been thinking about, but out of scope for this particular ticket. We actually have a ticket here to start a discussion with you about how we get the errors back from the go binary properly.

@snyk-tim has a doc here too https://docs.google.com/document/d/1YXHBaYbDdWGRP8-clFfeem7V9wY2dGCT9wYqdj7RZI8/edit?tab=t.0#heading=h.p8i9gu8irles

thomasschafer · 2026-02-19T11:07:25Z

src/lib/plugins/uv/index.ts

+  let depGraphData: DepGraphData;
+  try {
+    depGraphData = JSON.parse(result.stdout);
+  } catch {


Is it worth also adding a debug log for the exact error here, and maybe include stdout too? Then we can see what exactly was returned from the Go binary and why we couldn't parse the JSON

snyk-pr-review-bot · 2026-02-19T16:54:11Z

PR Reviewer Guide 🔍

🧪 PR contains tests
🔒 No security concerns identified
⚡ No major issues detected
📚 Repository Context Analyzed This review considered 11 relevant code sections from 10 files (average relevance: 1.04) cliv2/internal/cliv2/cliv2.go (lines 1-624) cliv2/cmd/cliv2/main.go (2 segments, lines 86-724) src/cli/commands/log4shell.ts (lines 1-313) cliv2/cmd/cliv2/behavior/legacy/validation.go (lines 1-114) src/cli/main.ts (lines 1-516) cliv2/internal/constants/constants.go (lines 1-40) cliv2/cmd/cliv2/errorhandling.go (lines 1-104) ... and 3 more file(s)

github-actions · 2026-02-19T16:57:39Z

	Warnings
⚠️	There are multiple commits on your branch, please squash them locally before merging!

Generated by 🚫 dangerJS against 8112882

thomasschafer · 2026-02-19T17:34:01Z

src/lib/plugins/uv/index.ts

+  } catch (error) {
+    const parseError = error instanceof Error ? error.message : String(error);
+    debug(
+      'Failed to parse dependency information JSON: %s (stdout preview: %s, stderr preview: %s)',


Stdout/stderr might be multiline, maybe want to add some newlines e.g.

Suggested change

'Failed to parse dependency information JSON: %s (stdout preview: %s, stderr preview: %s)',

'Failed to parse dependency information JSON: %s\nstdout preview:\n%s\nstderr preview:\n%s',

snyk-will force-pushed the feat/use-uv-depgrpah branch from 2a0906e to 404f010 Compare February 11, 2026 14:42

snyk-tim reviewed Feb 11, 2026

View reviewed changes

src/lib/plugins/uv/index.ts Show resolved Hide resolved

thomasschafer force-pushed the feat/add-hidden-uv-support branch from 72336bc to f4ce8b5 Compare February 13, 2026 15:50

snyk-will force-pushed the feat/use-uv-depgrpah branch from 34d455c to 8e9142d Compare February 13, 2026 16:01

thomasschafer force-pushed the feat/add-hidden-uv-support branch 7 times, most recently from 79869bb to 8e07531 Compare February 16, 2026 09:29

snyk-will force-pushed the feat/use-uv-depgrpah branch from 401faf6 to f9e10ca Compare February 16, 2026 13:52

snyk-will requested a review from snyk-tim February 16, 2026 15:19

snyk-will marked this pull request as ready for review February 16, 2026 15:19

snyk-will requested review from a team as code owners February 16, 2026 15:19

thomasschafer force-pushed the feat/add-hidden-uv-support branch from 8e07531 to df0d731 Compare February 16, 2026 16:32

snyk-will force-pushed the feat/use-uv-depgrpah branch from c8828c2 to eb32f78 Compare February 16, 2026 16:38

thomasschafer force-pushed the feat/add-hidden-uv-support branch 5 times, most recently from a466bec to 7d1781a Compare February 17, 2026 09:54

snyk-will force-pushed the feat/use-uv-depgrpah branch from eb32f78 to 042d830 Compare February 17, 2026 10:31

thomasschafer force-pushed the feat/add-hidden-uv-support branch from 7d1781a to 09a1979 Compare February 17, 2026 14:03

This comment has been minimized.

Sign in to view

snyk-will force-pushed the feat/use-uv-depgrpah branch from 1ec4efa to 765709e Compare February 18, 2026 09:24

This comment has been minimized.

Sign in to view

snyk-will force-pushed the feat/use-uv-depgrpah branch from 765709e to 81aa36a Compare February 18, 2026 10:03

This comment has been minimized.

Sign in to view

thomasschafer reviewed Feb 18, 2026

View reviewed changes

src/lib/plugins/uv/index.ts Outdated Show resolved Hide resolved

This comment has been minimized.

Sign in to view

thomasschafer force-pushed the feat/add-hidden-uv-support branch 3 times, most recently from 32333c2 to d26bc72 Compare February 19, 2026 08:59

thomasschafer reviewed Feb 19, 2026

View reviewed changes

src/lib/plugins/uv/index.ts Outdated Show resolved Hide resolved

PeterSchafer reviewed Feb 19, 2026

View reviewed changes

snyk-will force-pushed the feat/use-uv-depgrpah branch from 3f972b3 to cb801e4 Compare February 19, 2026 11:02

snyk-will requested review from PeterSchafer and thomasschafer February 19, 2026 11:03

This comment has been minimized.

Sign in to view

thomasschafer reviewed Feb 19, 2026

View reviewed changes

snyk-will force-pushed the feat/use-uv-depgrpah branch from cb801e4 to d03dc2d Compare February 19, 2026 11:30

This comment has been minimized.

Sign in to view

snyk-will force-pushed the feat/use-uv-depgrpah branch from d03dc2d to 90c9981 Compare February 19, 2026 13:20

This comment has been minimized.

Sign in to view

thomasschafer force-pushed the feat/add-hidden-uv-support branch from d26bc72 to 1109d0c Compare February 19, 2026 14:39

feat: use go binary to create uv depgraph

8a6f292

snyk-will force-pushed the feat/use-uv-depgrpah branch from 90c9981 to 8a6f292 Compare February 19, 2026 15:28

This comment has been minimized.

Sign in to view

chore: log

e4abd1e

This comment has been minimized.

Sign in to view

fix: tests

8112882

Base automatically changed from feat/add-hidden-uv-support to main February 19, 2026 16:56

thomasschafer reviewed Feb 19, 2026

View reviewed changes

	'Failed to parse dependency information JSON: %s (stdout preview: %s, stderr preview: %s)',
	'Failed to parse dependency information JSON: %s\nstdout preview:\n%s\nstderr preview:\n%s',

Conversation

snyk-will commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Submission Checklist

What does this PR do?

Where should the reviewer start?

How should this be manually tested?

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

Uh oh!

This comment has been minimized.

Uh oh!

PeterSchafer Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

snyk-will Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

snyk-will Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

thomasschafer Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

snyk-pr-review-bot bot commented Feb 19, 2026

PR Reviewer Guide 🔍

Uh oh!

github-actions bot commented Feb 19, 2026

Uh oh!

thomasschafer Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Comments

snyk-will commented Feb 11, 2026 •

edited

Loading