chore(language-server): integrate LS

[team-ide-user]

Changes since last integration of Language Server

commit 56562b38f1f70c43703d25881e4f1472448b7b51
Author: Michael Martire <62486764+VulnShade@users.noreply.github.com>
Date:   Mon Aug 3 17:01:40 2026 -0400

    chore: add prodsec-orb-runtime context to config.yaml [PRODSEC-10648] (#1394)

M	.circleci/config.yml

commit 65f506fd1ca12d552929d12dae46294ede991f59
Author: Ben Durrans <Benjamin.Durrans@snyk.io>
Date:   Mon Aug 3 12:14:11 2026 +0100

    fix(auth): use GAF IsValidSnykHost for aud-host validation [IDE-1896] (#1381)
    
    * fix(auth): use GAF IsValidSnykHost for aud-host validation [IDE-1896]
    
    Migrate extractAudHost/audHostFromClaim off the deprecated GAF regex host
    check (CONFIG_KEY_ALLOWED_HOST_REGEXP / IsValidAuthHost) onto the new
    parsed-URL validation auth.IsValidSnykHost, reading allowed domains from
    auth.CONFIG_KEY_ALLOWED_HOSTS.
    
    Point go-application-framework at the IDE-1896 PR-branch pseudo-version for
    now (to be repointed at a GAF release once that PR merges, per the GAF
    breaking-changes RFC), and bump cli-extension-os-flows to a compatible
    revision.
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    
    * docs: updated licenses
    
    * test(auth): fix mislabeled aud-host test case, correct fail-closed comment [IDE-1896]
    
    The "attacker host defeats naive suffix match" case (api.evilsnyk.io) passed
    identically before and after this migration, since the superseded regex
    already required a literal dot before the allowed domain — its comment
    misdescribed it as the ticket's attack. Add the actual ticket payload
    (a smuggled path, which the old regex's wildcard segment did match) as its
    own case, and correct the evilsnyk.io case's comment to say what it actually
    proves: the label-boundary rule, not a behavior change.
    
    Also rewrite the fail-closed pre-check comment in extractAudHost: it claimed
    to avoid a repeated config lookup, but IsValidSnykHost re-reads the allowlist
    per claim anyway. The real reason to keep the duplicate check is that an
    unset allowlist is this language server's trust boundary, and the distinct
    log line is the only way to tell "no allowlist configured" apart from a
    per-claim rejection.
    
    * chore(deps): pin go-application-framework to v1.0.0 [IDE-1896]
    
    GAF PR 662 (the IsValidSnykHost host-allowlist change this PR depends
    on) is now released. Replace the pseudo-version pin with the tagged
    release.
    
    * chore: restore local replace directives, drop ticket ref from comment
    
    go mod tidy stripped the commented-out go-application-framework and
    cli-extension-os-flows replace directives used for local cross-repo
    dev; restore them alongside the other two. Also drop a Jira ticket
    reference from a test comment.
    
    ---------
    
    Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Co-authored-by: rrama <rrama@users.noreply.github.com>
    Co-authored-by: Nick Yasnohorodskyi <nikita.yasnohorodskyi@snyk.io>

M	go.mod
M	go.sum
M	infrastructure/authentication/auth_service_impl.go
M	infrastructure/authentication/auth_service_impl_test.go
D	licenses/github.com/BurntSushi/toml/COPYING
A	licenses/github.com/bazelbuild/bazel-gazelle/LICENSE
A	licenses/github.com/bazelbuild/buildtools/LICENSE
A	licenses/github.com/package-url/packageurl-go/LICENSE
R100	licenses/github.com/snyk/cli-extension-dep-graph/LICENSE.md	licenses/github.com/snyk/cli-extension-dep-graph/v2/LICENSE.md
R100	licenses/github.com/snyk/cli-extension-dep-graph/NOTICE.md	licenses/github.com/snyk/cli-extension-dep-graph/v2/NOTICE.md
R100	licenses/golang.org/x/mod/semver/LICENSE	licenses/golang.org/x/mod/LICENSE

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

	Warnings
⚠️	"chore: automatic integration of language server 56562b38f1f70c43703d25881e4f1472448b7b51" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against 9670c82

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Breaking Change: Authentication 🟠 [major] The upgrade to go-application-framework v1.0.0 introduces a breaking change in host validation (IDE-1896). The framework has migrated from regex-based validation (CONFIG_KEY_ALLOWED_HOST_REGEXP) to a parsed-URL list (auth.CONFIG_KEY_ALLOWED_HOSTS). For users in restricted environments or single-tenant setups, this will cause authentication to fail-closed unless their custom domains are explicitly added to the new allowed hosts list. The CLI wrapper should ensure a migration path or default values for common Snyk domains are populated in the configuration. github.com/snyk/go-application-framework v1.0.0

📚 Repository Context Analyzed This review considered 5 relevant code sections from 2 files (average relevance: 0.98) package-lock.json (4 segments, lines 19770-19982) scripts/upgrade-snyk-go-dependencies.go (lines 1-149)

🤖 Repository instructions applied (from AGENTS.md)