[team-ide-user]

Changes since last integration of Language Server

commit 377182bcf9bf43a373f748c0610b3409fadbd6d3
Author: cursor[bot] <206951365+cursor[bot]@users.noreply.github.com>
Date:   Mon Oct 26 09:01:29 2026 +0100

    fix: stabilize Test_processResults_* flaky on windows-latest [IDE-2546] (#1437)
    
    * fix: stop closing analytics-capture channel on test cleanup [IDE-2546]
    
    MockAndCaptureWorkflowInvocation registered a t.Cleanup that
    unconditionally closed its capture channel. domain/ide/workspace's
    ProcessResults fires sendAnalytics in a background goroutine that is
    not guaranteed to reach the mocked InvokeWithInputAndConfig call
    before the test function returns (e.g. when the test's own 1s
    RequireEventuallyReceive window is exceeded on a slow/contended CI
    runner). When that goroutine eventually sends on the now-closed
    channel, it panics with "send on closed channel", crashing the whole
    test binary rather than just failing the one test.
    
    Nothing in the codebase relies on the channel being closed (grepped
    for range/close-detection over it - only ever read via the non-blocking
    selects in RequireEventuallyReceive/RequireNeverReceive), so the
    minimal fix is to stop closing it. An unclosed buffered channel that
    becomes unreferenced is simply garbage collected, and a late send into
    it is a harmless no-op.
    
    Added Test_MockAndCaptureWorkflowInvocation_LateSendAfterCleanup_DoesNotPanic,
    which deterministically reproduces the race (via t.Run + t.Cleanup's
    LIFO ordering, no sleeps/subprocess needed) and confirms the panic is
    gone. Verified stable under -race -count=50, and confirmed no
    regression via the full unit (make test) and integration
    (INTEG_TESTS=1 make test) suites.
    
    Skipping the ggshield pre-commit hook: it requires an interactive
    GitGuardian OAuth login not available in this environment; the diff
    was manually reviewed for secrets and CI runs the real secret scan on
    the PR.
    
    * fix(testutil): fix import block and stop closing capture channel [IDE-2546]
    
    The test file had its import block split by a test function, which
    failed to compile and broke the lint, smoke, race and integration jobs.
    
    MockAndCaptureWorkflowInvocation no longer closes its capture channel
    from t.Cleanup, so a late send after the test ends is a no-op instead
    of a panic.
    
    Co-Authored-By: Claude Code <noreply@anthropic.com>
    
    ---------
    
    Co-authored-by: Cursor Agent <cursoragent@cursor.com>
    Co-authored-by: Bastian Doetsch <bastian.doetsch@snyk.io>
    Co-authored-by: Claude Code <noreply@anthropic.com>

M	internal/testutil/test_setup.go
M	internal/testutil/test_setup_test.go

commit 902de0cb79b5299e52441adcef5136d37e72adc0
Author: Bastian Doetsch <bastian.doetsch@snyk.io>
Date:   Mon Oct 26 08:45:50 2026 +0100

    fix: honor --remote-repo-url override for ignore create on non-Git folders [IDE-2526] (#1438)
    
    * fix: honor --remote-repo-url override for ignore create on non-Git folders [IDE-2526]
    
    Non-Git projects (e.g. Endevor/COBOL) hit "could not determine
    repository URL: repository does not exist" when creating an ignore,
    because validateIgnoreRequest hard-requires a resolvable Git remote.
    
    If a folder's Additional Parameters setting configures
    --remote-repo-url=<url>, the same value the CLI accepts as a
    workaround, the IDE now:
      1. Skips the Git-remote check in validateIgnoreRequest instead of
         erroring out.
      2. Sets ignore_workflow.RemoteRepoUrlKey on the engine config passed
         to the ignore-create workflow, so it computes the same asset ID
         the CLI would with --remote-repo-url.
    
    Co-authored-by: Bastian Doetsch <bastian.doetsch@snyk.io>
    
    * fix: resolve the repository URL once for scan, ignore and panel [IDE-2526]
    
    Creating an ignore failed on any folder without a Git remote, and the
    --remote-repo-url escape hatch the CLI offers never reached the IDE.
    
    Repository URL resolution now lives in one place and reads both the
    per-folder and the global Additional Parameters keys, so it works
    whichever IDE stored the setting. The Snyk Code scan resolves the same
    URL, so the finding an ignore is filed against is the finding the
    developer is looking at. Where neither a Git remote nor an override is
    available, Create ignore renders disabled with the remedy rather than
    failing after the form is filled in.
    
    Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
    
    * fix: honor --remote-repo-url override in CanCreateIgnore
    
    The HTML detail panel's CanCreateIgnore check only looked at the Git
    remote, so it hid the "create ignore" button for non-Git folders even
    when a --remote-repo-url override was configured and the underlying
    ignore request would have succeeded (submitIgnoreRequest already
    accepted this override via validateIgnoreRequest).
    
    Move the override-resolution logic (RemoteRepoUrlOverride,
    extractFlagValue) out of ignores_request.go into internal/html/ignore,
    and make CanCreateIgnore accept a ConfigResolverInterface so it checks
    the same override before falling back to false. Thread ConfigResolver
    through context (ctx2.NewContextWithConfigResolver /
    ConfigResolverFromContext) from generateIssueDescription.Execute down
    to the code and secrets GetDetailsHtml renderers, matching the pattern
    submitIgnoreRequest already uses. oss and iac are unaffected.
    
    Also drops the dead userMsgCannotDetermineRepoURL constant, a
    byte-for-byte duplicate of CreateIgnoreUnavailableReason.
    
    Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
    
    * ci-watch: address review comment 4012839376 (BDD disabled-button markup)
    
    Align Create ignore BDD assertions with Code/Secrets HTML tests by matching
    the shared disabled-button markup substring instead of a loose disabled check.
    
    Co-authored-by: bastian.doetsch <bastian.doetsch@snyk.io>
    
    * refactor(folderconfig): parse --remote-repo-url with pflag [IDE-2526]
    
    Co-Authored-By: Claude Code <noreply@anthropic.com>
    
    * fix(code,secrets): read remote repo url override from the context config resolver [IDE-2526]
    
    The scanners resolve the override through the struct resolver, while the
    rest of the scan uses the resolver carried in the context. When the two
    differ, --remote-repo-url came from different configuration than the
    other scan settings. Both scanners now use getConfigResolver(ctx).
    
    Co-Authored-By: Claude Code <noreply@anthropic.com>
    
    * refactor(ignore): load the folder config from the engine when resolving the repo url [IDE-2526]
    
    Co-Authored-By: Claude Code <noreply@anthropic.com>
    
    * test(ignore): cover remote repo url override changes and Git repo precedence in BDD [IDE-2526]
    
    Split the save and create steps, rename the enabled button step, and add
    scenarios for a global URL changed between scan and create and for the
    override beating a Git remote.
    
    Co-Authored-By: Claude Code <noreply@anthropic.com>
    
    * docs: describe the remote repo url override for ignore create [IDE-2526]
    
    Co-Authored-By: Claude Code <noreply@anthropic.com>
    
    * refactor(folderconfig): use allowlist API, inline flag name and keep parsing after --help [IDE-2526]
    
    Co-Authored-By: Claude Code <noreply@anthropic.com>
    
    * refactor(ignore): resolve the folder config once for the create flow [IDE-2526]
    
    Co-Authored-By: Claude Code <noreply@anthropic.com>
    
    * test(bdd): drop stale step comments [IDE-2526]
    
    Co-Authored-By: Claude Code <noreply@anthropic.com>
    
    * docs: state that the remote repo url override beats the Git remote [IDE-2526]
    
    Co-Authored-By: Claude Code <noreply@anthropic.com>
    
    * fix(ignore): keep the caller's content root for the create configuration [IDE-2526]
    
    Folder-config paths are normalized, which changed INPUT_DIRECTORY on
    Windows. Pass the caller's content root alongside the shared folder
    config again so INPUT_DIRECTORY and the folder organization lookup use
    the original value.
    
    Co-Authored-By: Claude Code <noreply@anthropic.com>
    
    ---------
    
    Co-authored-by: Cursor Agent <cursoragent@cursor.com>
    Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

M	application/server/bdd_lint_test.go
M	application/server/bdd_steps_test.go
M	application/server/server_test.go
M	docs/configuration.md
M	domain/ide/command/command_factory.go
M	domain/ide/command/generate_issue_description.go
M	domain/ide/command/ignores_request.go
M	domain/ide/command/ignores_request_test.go
A	features/ignore-with-remote-repo-url-override.feature
A	features/ignore-without-git-remote.feature
M	infrastructure/code/code.go
M	infrastructure/code/code_html.go
M	infrastructure/code/code_html_inline_ignores_test.go
M	infrastructure/code/code_html_test.go
M	infrastructure/code/code_test.go
M	infrastructure/code/fake_code_client_scanner.go
M	infrastructure/secrets/secrets.go
M	infrastructure/secrets/secrets_html.go
M	infrastructure/secrets/secrets_html_test.go
M	infrastructure/secrets/secrets_test.go
A	internal/folderconfig/remote_repo_url.go
A	internal/folderconfig/remote_repo_url_test.go
M	internal/html/ignore/ignore.go
M	internal/html/ignore/ignore_test.go

commit f1559f984bd91cd5aa97e0e54433d6147e79e301
Author: Daniel Martins <daniel.martins@snyk.io>
Date:   Thu Oct 22 19:34:23 2026 +0300

    fix(oss): highlight the correct go.mod line for Go issues (#1458)
    
    * fix(oss): highlight the correct go.mod line for Go issues
    
    * fix(oss): choose the closest go.mod dependency for Go issues
    
    * fix(oss): keep Go issue data and highlight on the same dependency
    
    * fix(oss): limit Go range fix to go_range_finder and drop path selection
    
    * test(oss): cover longest module match and no match for Go ranges

A	infrastructure/oss/go_range_finder.go
M	infrastructure/oss/range_finder.go
M	infrastructure/oss/range_finder_test.go

commit 3079a43acdf279b234c498a5583601ac1a7778ad
Author: Andrew Robinson Hodges <andrew.robinsonhodges@snyk.io>
Date:   Mon Oct 19 10:02:40 2026 +0100

    fix: docs repo and path updates to compatibilty matrix workflow (#1456)

M	.github/workflows/update-compatibility-matrix.yaml
M	scripts/compatibility-matrix/README.md

---

Note

Medium Risk
The bump ships user-facing IDE changes to ignore creation and repository URL resolution, which can affect how findings map to Snyk assets; dependency-only diff in this repo limits direct review surface.

Overview
Bumps the bundled Snyk Language Server (github.com/snyk/snyk-ls) from …6ed3290ddc95 to …377182bcf9bf in cliv2 and cliv2-private (go.mod / go.sum only).

That LS release mainly brings ignore create support for non-Git projects via a --remote-repo-url override (aligned with the CLI), including panel enablement, shared repo URL resolution for Code/Secrets scans, and BDD/docs coverage. It also fixes Go OSS issue highlighting so the correct go.mod dependency line is shown, stabilizes a Windows CI test race around analytics capture channel cleanup, and updates compatibility-matrix workflow docs.

^{Reviewed by Cursor Bugbot for commit f1c7434. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

	Warnings
⚠️	"chore: automatic integration of language server 377182bcf9bf43a373f748c0610b3409fadbd6d3" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against f1c7434

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 5 relevant code sections from 5 files (average relevance: 0.99) release-scripts/write-ls-protocol-version.go (lines 1-283) package.json (lines 1-242) CLAUDE.md (lines 274-355) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) package-lock.json (lines 6-270)

🤖 Repository instructions applied (from AGENTS.md)