snyk 1.1044.0 → 1.1045.0

package/dist/cli/784.index.js

@@ -68,6 +68,7 @@ const is_multi_project_scan_1 = __webpack_require__(62435);
 const ecosystems_1 = __webpack_require__(5168);
 const monitor_2 = __webpack_require__(62406);
 const process_command_args_1 = __webpack_require__(52369);
+const feature_flags_1 = __webpack_require__(63011);
 const SEPARATOR = '\n-------------------------------------------------------\n';
 const debug = Debug('snyk');
 const appVulnsReleaseWarningMsg = `${theme.icon.WARNING} Important: Beginning January 24th, 2023, application dependencies in container
@@ -104,13 +105,27 @@ async function monitor(...args0) {
     // TODO remove 'app-vulns' options and warning message once
     // https://github.com/snyk/cli/pull/3433 is merged
     if (options.docker) {
-        if (!options['app-vulns'] || options['exclude-app-vulns']) {
+        // order is important here, we want:
+        // 1) exclude-app-vulns set -> no app vulns
+        // 2) app-vulns set -> app-vulns
+        // 3) neither set -> containerAppVulnsEnabled
+        if (options['exclude-app-vulns']) {
             options['exclude-app-vulns'] = true;
         }
-        // we can't print the warning message with JSON output as that would make
-        // the JSON output invalid.
-        if (!options['app-vulns'] && !options['json']) {
-            console.log(theme.color.status.warn(appVulnsReleaseWarningMsg));
+        else if (options['app-vulns']) {
+            options['exclude-app-vulns'] = false;
+        }
+        else {
+            options['exclude-app-vulns'] = !(await feature_flags_1.hasFeatureFlag('containerCliAppVulnsEnabled', options));
+            // we can't print the warning message with JSON output as that would make
+            // the JSON output invalid.
+            // We also only want to print the message if the user did not overwrite
+            // the default with one of the flags.
+            if (options['exclude-app-vulns'] &&
+                !options['json'] &&
+                !options['sarif']) {
+                console.log(theme.color.status.warn(appVulnsReleaseWarningMsg));
+            }
         }
     }
     // Handles no image arg provided to the container command until