chore: update snyk-docker-plugin to v9.6.5

[d3vco]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: https://app.gitbook.com/o/-M4tdxG8qotLgGZnLpFR/s/-MdwVZ6HOZriajCf5nXH/~/changes/10393/)
• Includes product update to be announced in the next stable release notes

What does this PR do?

This PR updates snyk-docker-plugin from 9.6.0 to 9.6.5. This brings in these changes:

Features:

• improve Dockerfile attribution and base image exclusion
• enable Kaniko archive

Bug Fixes:

• prevent temp directory leak in node-modules-utils

Sub-dependency updates:

• update snyk-nodejs-lockfile-parser

Where should the reviewer start?

Review the package.json and package-lock.json files.

How should this be manually tested?

What's the product update that needs to be communicated to CLI users?

• Support for Kaniko Archives: A bug has been resolved enabling scanning container images built with Kaniko and saved as archives. This was previously advertised as supported (e.g. docs) but the bug prevented this in practice.
• Improved Dockerfile Attribution: A fix in snyk-docker-plugin improves how vulnerabilities are attributed to Dockerfile instructions. By addressing a bug in how package names and their transitive dependencies are mapped, the CLI will more accurately differentiate between vulnerabilities introduced by the Dockerfile (e.g., via RUN apt-get install) versus those inherited from the base image. This fix also enables the --exclude-base-image-vulns flag in snyk container monitor. A change will be submitted to the CLI docs to reflect this.

Risk assessment

Low

What are the relevant tickets?

https://snyksec.atlassian.net/browse/CN-568
https://snyksec.atlassian.net/browse/CN-942

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Runtime Dependency Regression 🔴 [critical] Several core dependencies, including @octokit/rest, asynckit, combined-stream, and node-fetch, have been incorrectly marked with "dev": true. Since these are listed under dependencies in the root package.json, marking them as dev in the lockfile ensures they will be excluded during production installs (e.g., when building the CLI binary or Docker image). This will result in MODULE_NOT_FOUND errors at runtime. For example, @octokit/rest is used by the packages/cli-alert workspace. "dev": true, "license": "MIT", "dependencies": { "@octokit/types": "^6.0.3" } }, "node_modules/@octokit/core": { "version": "3.5.1", "dev": true, "license": "MIT", "dependencies": { "@octokit/auth-token": "^2.4.4", "@octokit/graphql": "^4.5.8", "@octokit/request": "^5.6.0", "@octokit/request-error": "^2.0.5", "@octokit/types": "^6.0.3", "before-after-hook": "^2.2.0", "universal-user-agent": "^6.0.0" } }, "node_modules/@octokit/core/node_modules/@octokit/request-error": { "version": "2.1.0", "dev": true, "license": "MIT", "dependencies": { "@octokit/types": "^6.0.3", "deprecation": "^2.0.0", "once": "^1.4.0" } }, "node_modules/@octokit/core/node_modules/universal-user-agent": { "version": "6.0.0", "dev": true, "license": "ISC" }, "node_modules/@octokit/endpoint": { "version": "6.0.12", "dev": true, "license": "MIT", "dependencies": { "@octokit/types": "^6.0.3", "is-plain-object": "^5.0.0", "universal-user-agent": "^6.0.0" } }, "node_modules/@octokit/endpoint/node_modules/universal-user-agent": { "version": "6.0.0", "dev": true, "license": "ISC" }, "node_modules/@octokit/graphql": { "version": "4.6.4", "dev": true, "license": "MIT", "dependencies": { "@octokit/request": "^5.6.0", "@octokit/types": "^6.0.3", "universal-user-agent": "^6.0.0" } }, "node_modules/@octokit/graphql/node_modules/universal-user-agent": { "version": "6.0.0", "dev": true, "license": "ISC" }, "node_modules/@octokit/openapi-types": { "version": "12.11.0", "dev": true, "license": "MIT" }, "node_modules/@octokit/plugin-paginate-rest": { "version": "2.21.3", "dev": true, "license": "MIT", "dependencies": { "@octokit/types": "^6.40.0" }, "peerDependencies": { "@octokit/core": ">=2" } }, "node_modules/@octokit/plugin-request-log": { "version": "1.0.4", "dev": true, "license": "MIT", "peerDependencies": { "@octokit/core": ">=3" } }, "node_modules/@octokit/plugin-rest-endpoint-methods": { "version": "5.16.2", "dev": true, "license": "MIT", "dependencies": { "@octokit/types": "^6.39.0", "deprecation": "^2.3.1" }, "peerDependencies": { "@octokit/core": ">=3" } }, "node_modules/@octokit/request": { "version": "5.6.1", "dev": true, "license": "MIT", "dependencies": { "@octokit/endpoint": "^6.0.1", "@octokit/request-error": "^2.1.0", "@octokit/types": "^6.16.1", "is-plain-object": "^5.0.0", "node-fetch": "^2.6.1", "universal-user-agent": "^6.0.0" } }, "node_modules/@octokit/request-error": { "version": "1.2.1", "dev": true, "license": "MIT", "dependencies": { "@octokit/types": "^2.0.0", "deprecation": "^2.0.0", "once": "^1.4.0" } }, "node_modules/@octokit/request-error/node_modules/@octokit/types": { "version": "2.16.2", "dev": true, "license": "MIT", "dependencies": { "@types/node": ">= 8" } }, "node_modules/@octokit/request/node_modules/@octokit/request-error": { "version": "2.1.0", "dev": true, "license": "MIT", "dependencies": { "@octokit/types": "^6.0.3", "deprecation": "^2.0.0", "once": "^1.4.0" } }, "node_modules/@octokit/request/node_modules/universal-user-agent": { "version": "6.0.0", "dev": true, "license": "ISC" }, "node_modules/@octokit/rest": { "version": "18.12.0", "dev": true, "license": "MIT", "dependencies": { "@octokit/core": "^3.5.1", "@octokit/plugin-paginate-rest": "^2.16.8", "@octokit/plugin-request-log": "^1.0.4", "@octokit/plugin-rest-endpoint-methods": "^5.12.0" } }, "node_modules/@octokit/types": { "version": "6.41.0", "dev": true, Missing Dependencies 🟠 [major] The package @pagerduty/pdjs and @slack/types have been removed from the lockfile. However, the in-file context for packages/cli-alert shows it still explicitly depends on @pagerduty/pdjs. Removing these from the lockfile while they are still referenced by workspace packages will cause installation failures or broken workspace builds. "node_modules/@pkgjs/parseargs": {

📚 Repository Context Analyzed This review considered 10 relevant code sections from 2 files (average relevance: 0.64) package-lock.json (9 segments, lines 18928-19151) package.json (lines 1-224)