chore: bump remy-cli-extension to v1.42.0

[ShawkyZ]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages are release-note ready, emphasizing what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable) — N/A, no API changes
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary) — N/A, dependency-only bump
• Updates relevant GitBook documentation (PR link: ___) — N/A
• Includes product update to be announced in the next stable release notes

What does this PR do?

Dependency-only bump of github.com/snyk/remy-cli-extension v1.41.1 → v1.42.0 in cliv2-private. No CLI source changes. Only cliv2-private/go.mod + go.sum change; go mod tidy -diff is clean in both cliv2 and cliv2-private (no transitive drift).

Extension change this picks up (v1.41.1..v1.42.0):

• snyk/remy-cli-extension#203 — feat(agent): consume repo AGENTS.md/CLAUDE.md for build/test guidance. Agentic fix now reads a scanned project's root AGENTS.md (or CLAUDE.md fallback) and feeds its build/test/validate/install instructions to the fix agents (SCA, SAST, Container, COS) and the setup step, so the agent uses the repo's documented commands instead of guessing.

Where should the reviewer start?

cliv2-private/go.mod — the single line change (remy-cli-extension v1.41.1 → v1.42.0). The go.sum change is the corresponding checksum update.

How should this be manually tested?

Not required for a dependency-only bump. The behavior change lives in the extension and is covered by its own tests (merged in snyk/remy-cli-extension#203). If desired: run snyk fix --agentic --sca against a repo containing a root AGENTS.md that documents a test command, and confirm the agent uses that command.

What's the product update that needs to be communicated to CLI users?

snyk fix --agentic now honors a project's root AGENTS.md (or CLAUDE.md): if present, its instructions for how to build, test, and validate the project are used by the fix agents instead of being inferred.

Risk assessment (Low | Medium | High)?

Low. Dependency-only version bump, no CLI source changes, go mod tidy -diff clean in both modules, no transitive drift. The extension change is additive (absent AGENTS.md ⇒ unchanged behavior) and gated by the existing folder-trust and sandbox controls.

What are the relevant tickets?

snyk/remy-cli-extension#203

---

Note

Low Risk
Dependency-only bump in the private module; behavior change is additive in the extension and gated by existing agentic fix and trust controls.

Overview
This PR only updates cliv2-private to depend on github.com/snyk/remy-cli-extension v1.42.0 (from v1.41.1), with matching go.sum checksums. There are no CLI source edits in this repo.

That extension release adds behavior for snyk fix --agentic: when a scanned project has a root AGENTS.md (or CLAUDE.md fallback), build/test/validate guidance from that file is passed into the fix agents and setup step instead of inferred commands. Repos without those files should behave as before.

^{Reviewed by Cursor Bugbot for commit a113449. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 5 relevant code sections from 4 files (average relevance: 0.89) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) package.json (lines 1-238) CLAUDE.md (2 segments, lines 1-65) cliv2-private/cmd/cliv2/main.go (lines 1-22)

🤖 Repository instructions applied (from AGENTS.md)