feat: add new consolidated --print-graph flag [CSENG-181]

[snyk-abedonik]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Introduces a new composable --print-graph flag set that supersedes the legacy monolithic flags (--print-effective-graph, --print-effective-graph-with-errors). The old flags remain fully functional during the migration window.

New flags:

Flag	Purpose
--print-graph	Master switch — enables dep-graph output
--effective-graph	Request the pruned/effective dependency graph
--jsonl-output	Emit one JSON object per line (JSONL format)
--print-errors	Include failed-project error entries in the output stream

The core of the change is a new getPrintGraphMode() function that acts as a single source of truth — it reads both new and legacy flags and returns a canonical PrintGraphMode struct. All graph-printing paths across the codebase now derive their behavior from this struct.

Where should the reviewer start?

Start with getPrintGraphMode() and the PrintGraphMode interface in common.ts — everything else follows from there.

How should this be manually tested?

1. Plain graph output (no regression):

snyk test --print-graph

2. Legacy flags still work:

snyk test --print-effective-graph
snyk test --print-effective-graph-with-errors

3. New flags produce equivalent output:

snyk test --print-graph --effective-graph --jsonl-output
snyk test --print-graph --effective-graph --jsonl-output --print-errors

4. Unmanaged ecosystem (C/C++) with JSONL:

snyk test --unmanaged --print-graph --jsonl-output

What's the product update that needs to be communicated to CLI users?

A new composable --print-graph flag family is now available. It replaces --print-effective-graph and --print-effective-graph-with-errors with finer-grained controls (--effective-graph, --jsonl-output, --print-errors). Legacy flags remain supported.

Risk assessment (Low | Medium | High)?

Low. The change is purely additive — no existing flags are removed. Legacy flags continue to work via a backward-compatible shim. Unit tests cover both old and new paths.

Any background context you want to provide?

The legacy flags coupled three orthogonal behaviors (graph mode, output format, error inclusion) into a single switch. CSENG-181 breaks these apart into composable primitives so that the SBOM extension and other consumers can request exactly the output shape they need.

What are the relevant tickets?

CSENG-181

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Mutual Exclusion Bug 🟠 [major] The updated shouldPrintDepGraph function now returns false if mode.effectiveGraph is true. This means that providing both --print-graph and --effective-graph will result in the standard (non-effective) graph being suppressed entirely, which contradicts the 'composable' design mentioned in the PR description. If the user wants the full graph and the pruned graph in the same stream (possible with JSONL), this logic prevents it. const mode = getPrintGraphMode(opts); return mode.printGraphEnabled && !mode.effectiveGraph && !opts['print-deps']; Inconsistent Identifier 🟡 [minor] In sendAndParseResults, when pushing to depGraphPrintJobs, the normalisedTargetFile uses targetFile || displayTargetFile || ''. However, in the fallback path for printDepGraph (non-JSONL), it uses job.legacyTargetLabel. This creates a discrepancy where the JSONL stream identifies a project by its file path, but the standard output identifies it by the project name/label, potentially breaking downstream tools that expect consistent identifiers during the migration. normalisedTargetFile: targetFile || displayTargetFile || '',

📚 Repository Context Analyzed This review considered 28 relevant code sections from 8 files (average relevance: 0.92) help/cli-commands/test.md (2 segments, lines 34-195) help/cli-commands/monitor.md (lines 43-206) packages/snyk-fix/src/types.ts (lines 1-251) package.json (lines 1-223) src/cli/commands/monitor/index.ts (lines 474-636) src/lib/snyk-test/run-test.ts (6 segments, lines 455-647) src/cli/main.ts (2 segments, lines 1-235) ... and 1 more file(s)

[thomasschafer]

We'll also need to update some of the plugins to reflect the new flags too, so that we return effective graphs in the case of --print-graph --effective-graph. For instance, the Maven plugin here will need updating with something like this

-    !!options['print-graph'];
+    (!!options['print-graph'] && !options['effective-graph']);

and likely other changes in that plugin too, along with possibly other plugins.