fix: Honor environment variables for memory threshold when WithConfiguration is omitted

[robertolopezlopez]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Bumps go-application-framework dependency to pick up GAF #627, so INTERNAL_IN_MEMORY_THRESHOLD_BYTES is honored even when workflow data is created without an explicit WithConfiguration call.

Where should the reviewer start?

How should this be manually tested?

⋊> ~/g/c/cliv2 on fix/CLI-1509 ⨯ INTERNAL_IN_MEMORY_THRESHOLD_BYTES=100 ./binary-releases/snyk-macos-arm64 test -d --log-level=trace
[...]
2026-06-16T11:17:15Z analytics.report:3 - checking if payload is []byte
2026-06-16T11:17:15Z analytics.report:3 - payload is []byte, comparing payload size (1680 bytes) to threshold (100 bytes)
2026-06-16T11:17:15Z analytics.report:3 - payload is larger than threshold, writing it to disk
2026-06-16T11:17:15Z analytics.report:3 - Setting file permissions for file: ***workflow.analytics.report.3626122142
2026-06-16T11:17:15Z analytics.report:3 - Writing payload to file: ***workflow.analytics.report.3626122142
2026-06-16T11:17:15Z analytics.report:3 - Payload written to file: ***workflow.analytics.report.3626122142
2026-06-16T11:17:15Z analytics.report:3 - payload is on disk, nil payload in memory for cleanup
[...]
⋊> ~/g/cli on fix/CLI-1509 ◦ ./binary-releases/snyk-macos-arm64 test -d --log-level=trace
[...]
2026-06-16T11:25:01Z analytics.report:3 - checking if payload is []byte
2026-06-16T11:25:01Z analytics.report:3 - payload is []byte, comparing payload size (1680 bytes) to threshold (536870912 bytes)
2026-06-16T11:25:01Z analytics.report:3 - payload is lower than threshold, keeping it in memory
[...]

What's the product update that needs to be communicated to CLI users?

Setting INTERNAL_IN_MEMORY_THRESHOLD_BYTES now reliably controls when large workflow payloads are kept in memory vs written to the temp directory (default remains 512 MB).

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 4 relevant code sections from 2 files (average relevance: 0.95) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) package-lock.json (3 segments, lines 19755-19977)

🤖 Repository instructions applied (from AGENTS.md)