[iamcristi]

Summary

• Bump version to 0.6.9 in pyproject.toml and uv.lock
• Add the 0.6.9 entry to CHANGELOG.md

Included changes since 0.6.8

• feat: discover MCP servers in VS code extensions #504 Discover MCP servers that VS Code extensions register in code (VS Code only; forks such as Cursor are gated off)
• fix: ADS-1387 discover Copilot CLI session projects #508 Discover GitHub Copilot CLI session projects
• fix: require success:true payload for the hooksConfigured test event #509 Require a success: true payload for the hooksConfigured test event
• fix: bound the Agent Guard forwarder request and fail open on transport errors #512 Bound the Agent Guard forwarder request (60s) and fail open on transport errors
• fix: upgrade pyjwt to 2.15.1 and urllib3 to 2.8.0 for Snyk vulnerabilities #500, fix: upgrade mcp to 1.30.0 for Snyk vulnerability #505, fix: bump transitive multidict to >=6.9.1 for Snyk vulnerability #506 Dependency security fixes (mcp, pyjwt, urllib3, multidict)

Test plan

• uv lock --check passes
• pre-commit run --all-files passes
• Unit tests: 2348 pass. With SNYK_TOKEN unset, test_verify_api fails on a clean origin/main too. 3 test_guard managed-install tests fail locally because /Library/Application Support/ClaudeCode and /etc/codex aren't writable for a non-root user; the code under test is unchanged from main.

---

Note

Low Risk
This diff only updates version metadata and release notes; no application logic changes in the PR itself.

Overview
Prepares the 0.6.9 release by bumping snyk-agent-scan from 0.6.8 to 0.6.9 in pyproject.toml and uv.lock, and adding the 0.6.9 changelog entry.

The new changelog line documents what ships in this tag (already merged on main): VS Code–only discovery of extension-registered MCP servers via registerMcpServerDefinitionProvider, GitHub Copilot CLI session-project discovery, a 60s bound on Agent Guard hook forwarding with fail-open warnings on timeouts/transport errors, stricter guard install validation that requires success: true from the hooksConfigured test (with diagnostics on failure), and security dependency upgrades (mcp, pyjwt, urllib3, multidict).

^{Reviewed by Cursor Bugbot for commit c76f043. Bugbot is set up for automated code reviews on this repo. Configure here.}

[qodo-merge-etso]

PR Summary by Qodo

Prepare the 0.6.9 release metadata and changelog

⚙️ Configuration changes 📝 Documentation 🕐 Less than 10 minutes

AI Description

• Set the package version to 0.6.9.
• Document the discovery, Agent Guard, and dependency security changes included in the release.

High-Level Assessment

A version bump and changelog entry are appropriate for this release-preparation PR; no architectural alternative is warranted. Although the PR description mentions uv.lock, it is not a changed file in the supplied diff.

Files changed (2) +2 / -1

Documentation (1) +1 / -0

CHANGELOG.mdDocument the 0.6.9 release +1/-0

Document the 0.6.9 release

• Adds a release entry covering VS Code and Copilot discovery, Agent Guard hook behavior, and dependency security upgrades.

CHANGELOG.md

Other (1) +1 / -1

pyproject.tomlSet the package version to 0.6.9 +1/-1

Set the package version to 0.6.9

• Changes the project version from 0.6.8 to 0.6.9 for the upcoming release.

pyproject.toml

[qodo-merge-etso]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can hide the parts of a finding you never read, like the evidence or the agent prompt

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗