fix(cli): prevent handled errors from producing duplicate output [CLI-1765] by bdemeo12 · Pull Request #7130 · snyk/cli

bdemeo12 · 2026-08-13T18:12:17Z

Pull Request Submission Checklist

Follows CONTRIBUTING guidelines
Commit messages
are release-note ready, emphasizing
what was changed, not how.
Includes detailed description of changes
Contains risk assessment (Low | Medium | High)
Highlights breaking API changes (if applicable) — none
Links to automated tests covering new functionality
Includes manual testing instructions (if necessary)
Updates relevant GitBook documentation (PR link: ___) — n/a, no user-facing docs change
Includes product update to be announced in the next stable release notes

What does this PR do?

Fixes:

json output being unparseable because an extra error was printed after the result. This happens when the CLI receives an error (aside from exit status 1), it prints it — so once teardown joins the exit error together with the handled network errors, the result is no longer exit status 1 and gets printed after the real output.

Also pins snyk-docker-plugin to 9.20.0 so CI exercises the failure being fixed. (Original PR: #7047 + discussion: https://snyksec.atlassian.net/servicedesk/customer/portal/64/CLIA-1576)

Where should the reviewer start?

cliv2/pkg/core/main.go — shouldSuppressDisplay and the third return value from processError, then the guarded displayError call in tearDown.

Then cliv2/pkg/core/main_test.go for the two new cases in Test_processError and the new Test_shouldSuppressDisplay.

How should this be manually tested?

Against an image whose provenance fetch fails (SDP version 9.20.0 +):

snyk container test <image> --json > out.json
jq . out.json

The container.spec.ts acceptance job is the automated equivalent — it fails on 9.20.0 without this fix, which is why the pin is included here.

What's the product update that needs to be communicated to CLI users?

n/a

snyk-io · 2026-08-13T18:12:45Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

bdemeo12 · 2026-08-13T18:53:30Z

This PR originates from: #7047

bdemeo12 · 2026-08-14T20:22:28Z

+
+		for _, err := range unwrappedErrs {
+			var exitErr *exec.ExitError
+			if errors.As(err, &exitErr) && exitErr.ExitCode() < constants.SNYK_EXIT_CODE_ERROR {


An exit code below SNYK_EXIT_CODE_ERROR means the command worked and anything alongside it is noise

I found a second reproduction after this PR was opened: running snyk code test can successfully return findings while an auxiliary organization-slug lookup returns 403. The scan returns ErrorWithExitCode{1}, which is then joined with the captured Forbidden error and printed after the results.

This implementation appears to fix the Container case (exec.ExitError{1}), but not this Code case because the early suppression only checks exec.ExitError. Could we determine suppression from the original command error before joining, covering both error types?

bdemeo12 · 2026-08-14T20:22:56Z

+//
+// Joined errors match no direct type assertion, so they are unwrapped and checked
+// one at a time.
+func shouldSuppressDisplay(err error) bool {


All errors are combined here:

cli/cliv2/pkg/core/main.go

Line 771 in cbc275e

resultErrorList = append([]error{resultError}, resultErrorList...)

shouldSuppressDisplay returns true when there's nothing to show:

cli/cliv2/pkg/core/main.go

Line 504 in cbc275e

if shouldSuppressDisplay(err) {

Previously displayError checked the error's type directly. it didnt account for a combined error, so it fell through to the printing code and emitted a second JSON object.:

cli/cliv2/pkg/core/main.go

Line 462 in 26f0543

if isExitError || isErrorWithCode || errorHasBeenShown(err) {

Now this check suppresses the display err by returning early, before the printing

The Code reproduction also makes me think the original error is the better place to make this decision. Before processError, we know whether the command returned exec.ExitError or ErrorWithExitCode; after joining, we have to infer that recursively and risk suppressing unrelated sibling errors.

I think we could calculate suppression from the original error in tearDown func, before processError joins anything?

suppressDisplay := shouldSuppressDisplay(err) if err != nil { allErrors, outputError = processError(err, errorList) // If processError selected a different error, such as maintenance or the // captured cause of TS_CLI_TERMINATED, that error still needs displaying. suppressDisplay = suppressDisplay && errors.Is(outputError, err) } if !suppressDisplay { displayError(outputError, ...) }

shouldSuppressDisplay could then retain the simple direct checks for exec.ExitError, ErrorWithExitCode, and already-displayed errors. This covers both cases while avoiding recursive unwrapping.

bdemeo12 · 2026-08-17T00:35:44Z

    "snyk-config": "^5.0.0",
    "snyk-cpp-plugin": "^2.24.3",
-    "snyk-docker-plugin": "9.19.0",
+    "snyk-docker-plugin": "9.20.0",


bumped SDP to use as an acceptance test

Errors are joined before they reach displayError, and a joined error matched none of its direct type assertions, so an already-handled error was printed after the command's real output - emitting a second JSON object and breaking JSON.parse(stdout). displayError now unwraps joined errors and checks them one at a time. Pins snyk-docker-plugin to 9.20.0 so CI exercises the failure being fixed. CLI-1765 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…765] Evaluate suppression on the original command error (exec.ExitError or ErrorWithExitCode, exit code < SNYK_EXIT_CODE_ERROR) instead of the joined error, covering the snyk code test case, and guard with errors.Is so a promoted error is still displayed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

github-actions · 2026-08-18T15:36:42Z

	Warnings
⚠️	There are multiple commits on your branch, please squash them locally before merging!
⚠️	"[fix(cli): prevent handled errors from producing duplicate output CLI-1765](#7130)" is too long. Keep the first line of your commit message under 72 characters.
⚠️	"Merge remote-tracking branch 'origin/main' into CLI-1765/prevent-duplicate-error-output" is too long. Keep the first line of your commit message under 72 characters.
⚠️	"Merge branch 'main' of github.com:snyk/cli into CLI-1765/prevent-duplicate-error-output" is too long. Keep the first line of your commit message under 72 characters.
⚠️	"[fix(cli): decide error suppression from the original exit code CLI-1765](https://api.github.com/repos/snyk/cli/git/commits/e0ef82686807ad624443322b8ab6ed86fae5f447)" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against 9f9f557

CatalinSnyk · 2026-08-21T15:35:49Z

 	})
 }

+func Test_shouldSuppressDisplay(t *testing.T) {


suggestion: Could we also use the ticket mentioned tests here? They assert that both exec.ExitError and ErrorWithExitCode remain the returned outputError, while the auxiliary error remains in allErrors. I think it better shows the separate concern for the user facing output and analytics error list.

Yes! Added!

CatalinSnyk · 2026-08-21T15:38:48Z

 	if err != nil {
 		allErrors, outputError = processError(err, errorList)

+		// Determine suppression from the original exit code


suggestion: I think we can keep this responsibility inside processError instead of returning a joined display error and having carrying a suppression state suppression?

processError already returns both allErrors and outputError. We can keep the joined errors in allErrors for the analytics payload, but return the original command error as outputError when the selected result still contains it. Something like this is what I'm thinking currently:

mostRelevant := cli_errors.FindMostRelevantError(allErrors) if commandOwnsOutput(originalError) && errors.Is(mostRelevant, originalError) { outputError = originalError } else { outputError = mostRelevant }

commandOwnsOutput could match the two original command-result types: exec.ExitError and ErrorWithExitCode.

Yes! processError now owns this! Thanks for the help!

…icate-error-output

snyk-pr-review-bot · 2026-08-24T18:40:49Z

PR Reviewer Guide 🔍

🧪 PR contains tests
🔒 No security concerns identified
⚡ No major issues detected
📚 Repository Context Analyzed This review considered 11 relevant code sections from 7 files (average relevance: 0.90) cliv2/pkg/core/errorhandling.go (lines 1-110) package.json (lines 1-236) cliv2/pkg/core/main.go (4 segments, lines 1-188) cliv2/pkg/core/exitcode.go (lines 1-197) src/cli/main.ts (lines 1-236) cliv2/pkg/core/logheaderfooter.go (lines 1-251) package-lock.json (2 segments, lines 6-266)
🤖 Repository instructions applied (from `AGENTS.md`)

This was referenced Aug 13, 2026

feat(container): surface provenance attestations behind feature flag [PRIM-100] #7047

Closed

test: isolate CLI-1765 Go fix from the snyk-docker-plugin bump #7131

Closed

bdemeo12 force-pushed the CLI-1765/prevent-duplicate-error-output branch from 125499b to cf9231f Compare August 14, 2026 14:30

bdemeo12 commented Aug 14, 2026

View reviewed changes

bdemeo12 force-pushed the CLI-1765/prevent-duplicate-error-output branch from 668cf76 to bc48bab Compare August 17, 2026 00:33

bdemeo12 commented Aug 17, 2026

View reviewed changes

bdemeo12 force-pushed the CLI-1765/prevent-duplicate-error-output branch from bc48bab to 33b1438 Compare August 17, 2026 01:08

bdemeo12 marked this pull request as ready for review August 17, 2026 01:59

bdemeo12 requested a review from a team as a code owner August 17, 2026 01:59

This comment has been minimized.

Sign in to view

Merge branch 'main' into CLI-1765/prevent-duplicate-error-output

1319e14

This comment has been minimized.

Sign in to view

CatalinSnyk reviewed Aug 21, 2026

View reviewed changes

bdemeo12 added 2 commits August 21, 2026 16:07

Merge branch 'main' of github.com:snyk/cli into CLI-1765/prevent-dupl…

7a04196

…icate-error-output

chore: address review comments

4505014

This comment has been minimized.

Sign in to view

chore: fix gofmt comment spacing in main.go

4656aeb

This comment has been minimized.

Sign in to view

Merge remote-tracking branch 'origin/main' into CLI-1765/prevent-dupl…

9f9f557

…icate-error-output

Uh oh!

Conversation

bdemeo12 commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Submission Checklist

What does this PR do?

Where should the reviewer start?

How should this be manually tested?

What's the product update that needs to be communicated to CLI users?

Uh oh!

snyk-io Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

bdemeo12 commented Aug 13, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

github-actions Bot commented Aug 18, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

CatalinSnyk Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

snyk-pr-review-bot Bot commented Aug 24, 2026

PR Reviewer Guide 🔍

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bdemeo12 commented Aug 13, 2026 •

edited

Loading

snyk-io Bot commented Aug 13, 2026 •

edited

Loading

github-actions Bot commented Aug 18, 2026 •

edited by atlassian Bot

Loading

CatalinSnyk Aug 21, 2026 •

edited

Loading