chore: bump cli-extension-dep-graph to v2.7.2

[calhar-snyk]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Bumps github.com/snyk/cli-extension-dep-graph/v2 from v2.7.1 to v2.7.2 in both cliv2/go.mod and cliv2-private/go.mod (via go get + make tidy).

This brings in snyk/cli-extension-dep-graph#224 (fix(bazel): use query instead of cquery for target discovery):

• Bazel cquery resolves every select() in a target pattern's transitive closure during analysis, even for targets unrelated to the one being resolved. A select() with no //conditions:default branch anywhere under //... (e.g. rules_distroless's dpkg_status) made target discovery fail outright on any host that satisfied neither branch — this crashed the plugin in production on a client's macOS machine.
• Target discovery (findTargets) now uses bazel query (loading phase only, never resolves select()), via a streamed --output=streamed_jsonproto decoder read directly off the process's stdout pipe.
• The deps phase (buildDepGraph) still uses cquery by design (query would flatten selects and over-report platform-specific deps), but gains a --bazel-platforms flag forwarded verbatim to bazel's own --platforms to pin a branch when needed.

Where should the reviewer start?

• cliv2/go.mod / cliv2/go.sum and cliv2-private/go.mod / cliv2-private/go.sum — the version bump itself.
• Full changes are in snyk/cli-extension-dep-graph#224.

How should this be manually tested?

• make build BUILD_MODE=public builds successfully.
• cd cliv2 && make test — full Go unit suite passes.
• Smoke test snyk test / dep-graph generation against a Bazel project affected by the fixed crash (a target pattern whose transitive closure includes a select() with no default branch, e.g. involving rules_distroless' dpkg_status).

What's the product update that needs to be communicated to CLI users?

N/A

Risk assessment (Low | Medium | High)?

Low — dependency bump only, confined to the Bazel target-discovery path in cli-extension-dep-graph. Full Go build and test suite pass; no other code changes in this repo. Access to Bazel dependency resolution is behind a feature flag.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 4 relevant code sections from 3 files (average relevance: 0.95) CLAUDE.md (lines 1-116) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) package-lock.json (2 segments, lines 3416-3677)

🤖 Repository instructions applied (from AGENTS.md)