[ca] chore: Update agentic CLI tools (Claude Code 2.1.158, Copilot CLI 1.0.56, GitHub MCP Server v1.1.2) #35883

Summary

Three agentic CLI tools have new stable releases. Versions in pkg/constants/version_constants.go were updated and make recompile succeeded (236 workflows, 0 errors).

No changes needed (already current): Codex 0.135.0, MCP Gateway v0.3.21, Playwright MCP 0.0.75, Playwright CLI 0.1.13, Playwright Browser v1.60.0.

Critical Information

• All updates are point/patch releases with no breaking changes.
• make recompile regenerated 236 lock files (0 errors, 42 pre-existing warnings). Lock files are not committed per project guidelines — only pkg/constants/version_constants.go should be committed.

Update Claude Code

• Previous: 2.1.156 → New: 2.1.158 (intermediate: 2.1.157)

Breaking Changes: None

Impact Assessment

• Risk: Low
• Affects: Claude engine default version pin

Package Links

• NPM Package: https://www.npmjs.com/package/`@anthropic-ai/claude-code`
• Repository: None (no public repo)

Update Copilot CLI

• Previous: 1.0.55 → New: 1.0.56

Breaking Changes: None

Key Features (from --help diff)

• New flag --context <tier> — set the context window tier, overriding persisted setting (choices: default, long_context).
• New flag --extension-sdk-path <directory> — override the bundled @github/copilot-sdk injected into extension subprocesses with a local copilot-sdk/ folder.

Impact Assessment

• Risk: Low
• Affects: Copilot engine default version pin. New context-tier and extension-SDK flags are additive and opt-in.
• Note: Copilot CLI repository is private; analysis based on NPM metadata + installed --help/subcommand output comparison.

Package Links

• NPM Package: https://www.npmjs.com/package/`@github/copilot`
• Repository: https://github.com/github/copilot-cli (private)

Update GitHub MCP Server

• Previous: v1.1.0 → New: v1.1.2 (intermediate: v1.1.1)

Breaking Changes: None

Key Changes

• v1.1.1 (bugfix release for MCP APP Resources):
  • Bump go-sdk to v1.6.1 and drop CrossOriginProtection workaround — deps: bump go-sdk to v1.6.1 and drop CrossOriginProtection workaround github-mcp-server#2564
  • Enable only ifc — I want to enable only ifc github-mcp-server#2565
  • OSS release prep — OSS release prep github-mcp-server#2568
  • Register MCP App UI resources in shared server constructor — Register MCP App UI resources in shared server constructor github-mcp-server#2570
• v1.1.2:
  • Lockdown mode: scope RepoAccessCache per request — Lockdown mode: scope RepoAccessCache per request github-mcp-server#2571

Impact Assessment

• Risk: Low
• Affects: GitHub MCP server Docker image pin. The v1.1.2 lockdown-mode fix (per-request RepoAccessCache scoping) is relevant to gh-aw's lockdown feature (DefaultGitHubLockdown) — a security-positive correctness fix.

Package Links

• Repository: https://github.com/github/github-mcp-server
• Release Notes: https://github.com/github/github-mcp-server/releases
• Specific Releases: https://github.com/github/github-mcp-server/releases/tag/v1.1.1 · https://github.com/github/github-mcp-server/releases/tag/v1.1.2

Recommendations

• Merge priority: Normal. All low-risk patch updates; the GitHub MCP v1.1.2 lockdown fix is the most valuable (security-positive).
• Testing: CI recompile already validates lock-file regeneration. When upgrading Copilot, verify MCPs still load and /models works with PAT auth (per the standing note in version_constants.go).
• Commit: Only pkg/constants/version_constants.go. Do not commit *.lock.yml files.

References:

• §26676902818

Generated by 🔢 CLI Version Checker · opus48 1.3M · ◷

• expires on Jun 1, 2026, 6:35 AM UTC