feat: allow secrets exclusions [PS-715]

[ancasnyk]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: docs: document .snyk exclusions for Snyk Secrets (PS-772) user-docs#1610)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Updates the secrets extension to a new version which supports setting .snyk exclusions for secrets

Where should the reviewer start?

How should this be manually tested?

run snyk secrets test in a folder with a .snyk file that contains a secrets section under exclude in the .snyk file

What's the product update that needs to be communicated to CLI users?

Users are able to exclude files from secrets scanning by adding them to a new "excludes.secrets" section in the .snyk file

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[CatalinSnyk]

Suggestion: Could we maybe add some acceptance test? I think it could be something similar to

cli/test/jest/acceptance/snyk-code/snyk-code-user-journey.spec.ts

Line 1012 in 4599673

it('should support .snyk file filtering', async () => {

[github-actions]

	Warnings
⚠️	There are multiple commits on your branch, please squash them locally before merging!

Generated by 🚫 dangerJS against 21cef7d

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 13 relevant code sections from 7 files (average relevance: 1.00) package.json (lines 1-236) package-lock.json (7 segments, lines 6-266) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) CLAUDE.md (lines 94-229) CONTRIBUTING.md (lines 135-311) help/cli-commands/secrets-test.md (lines 1-96) dangerfile.js (lines 1-111)

🤖 Repository instructions applied (from AGENTS.md)