Repository navigation
[ca] Update CLI/MCP versions: Claude Code, Codex, GitHub MCP Server, MCP Gateway #54168
Description
Overview
Routine CLI/MCP version check found 4 updates. Constants updated in pkg/constants/version_constants.go, make fmt (Go portion) and make recompile completed successfully (286/286 workflows recompiled). All 8 Docker images tracked in pkg/cli/docker_images.go (Actionlint, Syft, Grype, Grant, Zizmor, Poutine, RunnerGuard, Yamllint) are unchanged — both version tag and registry digest match the current pins, no action needed. Playwright MCP, Playwright CLI, Playwright Browser, Copilot CLI, Gemini CLI, Pi, and threat-detect are also unchanged.
Key updates
| Tool | Constant | Old | New | Risk |
|---|---|---|---|---|
| Claude Code | DefaultClaudeCodeVersion |
2.1.233 | 2.1.237 | Low |
| OpenAI Codex | DefaultCodexVersion |
0.147.0 | 0.148.0 | Low |
| GitHub MCP Server | DefaultGitHubMCPServerVersion |
v1.9.0 | v1.10.0 | Medium (security-hardening release) |
| MCP Gateway | DefaultMCPGatewayVersion |
v0.4.9 | v0.4.10 | Low |
Claude Code CLI: 2.1.233 → 2.1.237
No public GitHub repository exists for Claude Code, so this is based on NPM registry metadata only (published 2026-08-14 → 2026-08-19). The npm package (@anthropic-ai/claude-code) ships only a thin wrapper (cli-wrapper.cjs, install.cjs, platform binary stub) with no bundled CHANGELOG — the actual CLI binary is fetched at install/update time, so no changelog content is available. --help output was captured for reference but the installed binary reports 2.1.233 (self-updating wrapper); no new top-level flags were observable from the static package contents.
- Impact assessment: Low risk, routine point release.
- Source:
npm view@anthropic-ai/claude-codeversion/npm view@anthropic-ai/claude-code--json.
OpenAI Codex CLI: 0.147.0 → 0.148.0
Changelog (rust-v0.147.0 → rust-v0.148.0)
New Features
- Export complete TUI conversations to Markdown with
/export, either to the clipboard or a new file. (Add Markdown conversation export to the TUI openai/codex#37358) - Fork sessions with
codex exec fork, and archive or restore sessions from the TUI resume picker. (Add session forking tocodex execopenai/codex#37367, Add session archiving to the resume picker openai/codex#37369, Restore archived sessions from the resume picker openai/codex#37371) - Draft prompts while the TUI initializes, with resume and fork progress shown during startup. (Keep the composer editable during TUI startup openai/codex#38642, Show resume and fork status during TUI startup openai/codex#38788)
- View estimated thread credits or cost in
/status, status lines, and terminal titles for eligible workspaces. (Show estimated thread usage in/statusopenai/codex#38281, Add thread usage to TUI status surfaces openai/codex#38282) - Use Amazon Bedrock Runtime as a built-in provider with AWS profile, region, and GPT-5.6 routing support. (Add an Amazon Bedrock Runtime provider openai/codex#38470)
- Hooks can now run commands asynchronously and invoke MCP tools. (Support asynchronous command hooks openai/codex#37533, Add MCP tool handler support to the hooks engine openai/codex#38705)
Bug Fixes
- Model switches and settings updates no longer leave stale instructions behind or change an active turn midstream. (Fix first-turn model switching and rollback openai/codex#37260, Keep active-turn model settings stable across updates openai/codex#38785)
- Resumed sessions now restore their persisted working directory and approval policy, with more accurate transcript previews. (Prefer persisted cwd when reading local threads openai/codex#37198, Restore approval policy when resuming threads openai/codex#37368, Fix resume transcript preview line selection openai/codex#38605)
- Turns reconnect through temporary provider outages, and MCP servers recover after OAuth reauthentication without restarting Codex. (Recover MCP servers after OAuth reauthentication openai/codex#37337, Keep response streams alive through connection failures openai/codex#37485, Clarify MCP OAuth reauthentication errors openai/codex#38418)
- TUI startup no longer lets buffered terminal input activate prompts accidentally, and onboarding appears when authentication is missing. (Harden TUI startup input handling openai/codex#38641, Delay the startup composer until first-login onboarding openai/codex#38643, Show onboarding when Codex home lacks authentication state openai/codex#38644)
- Composer and transcript rendering now handle CRLF pastes, wrapped whitespace, and long URLs correctly. (Keep wrapped composer whitespace with following text openai/codex#37709, Preserve user message styling when wrapping long URLs openai/codex#38380, Normalize CRLF line endings in pasted text openai/codex#38704)
- Sandbox restrictions now fail closed for denied or unreadable paths across Linux and Windows. (Honor the configured Windows sandbox level for managed networking openai/codex#37875, Fail closed on unsafe Linux unreadable globs openai/codex#38026, Honor filesystem permissions for app file uploads openai/codex#38416, Enforce managed deny-read rules in the Windows sandbox openai/codex#38660)
Documentation
- The bundled skill-creator guide is more focused, and validation now rejects unfinished TODO placeholders. (Refine skill creation guidance and validation openai/codex#38384)
Full changelog: openai/codex@rust-v0.147.0...rust-v0.148.0
- Impact assessment: Low risk for gh-aw. No breaking CLI flag changes noted; sandbox hardening (fail-closed for denied/unreadable paths) is a positive-security change relevant to how gh-aw sandboxes Codex runs. No action required beyond the version bump.
- Release notes: https://github.com/openai/codex/releases/tag/rust-v0.148.0
GitHub MCP Server: v1.9.0 → v1.10.0
Substantial security/reliability release. Highlights relevant to gh-aw's usage as the default github MCP server:
Changelog (v1.9.0 → v1.10.0)
Security
- Added confirmed repository deletion with form elicitation and protected multi-round-trip state. (Add confirmed repository deletion tool github-mcp-server#3076)
- Restricted bearer credentials to configured GitHub authorities. (Attach GitHub token only to configured GitHub hosts github-mcp-server#3056)
- Enforced HTTPS for GitHub Enterprise hosts. (fix(security): enforce HTTPS for gh-host/GITHUB_HOST to prevent cleartext credentials github-mcp-server#3069)
- Invalid static
--toolsconfiguration now fails closed (unknown tool names prevent startup). (Fix static --tools validation fallback github-mcp-server#3050) - Hardened lockdown mode, request size limits, per-caller cache isolation, URL traversal protection, and response sanitization. (fix(lockdown): harden pull_request_read get_commits handling github-mcp-server#3109, fix(http): make server lockdown mode an upper bound over requests github-mcp-server#3112, fix(lockdown): isolate repo-access cache per caller identity github-mcp-server#3113, Limit HTTP request bodies before MCP middleware parsing github-mcp-server#3111, fix(raw): reject traversal segments when constructing raw content URLs github-mcp-server#3108, Centralize sanitization of untrusted GitHub response fields github-mcp-server#3114, Filter invisible Unicode after HTML entity normalization github-mcp-server#3110)
- Symbolic-link writes now require explicit
allow_symlink_write: trueopt-in;get_file_contentslabels dereferenced symlink content. (Clarify symlink behavior for repository file reads and writes github-mcp-server#3071) - Fixed binary MCP resources being base64-encoded twice. (Fix binary resource blob encoding github-mcp-server#3098)
GitHub Enterprise Server compatibility
list_issues/search_issuesdegrade safely when issue custom-field GraphQL types are unavailable. (Fix list_issues on GHES schemas without issue fields github-mcp-server#3086, Handle unsupported issueFieldValues enrichment in search_issues github-mcp-server#2897)list_issuesnow returns assignee logins and stable empty arrays for unassigned issues. (Return assignees from list_issues github-mcp-server#3064)
Tool contract fixes
- Corrected
add_issue_commentinput mode validation. (fix(issues): validate add_issue_comment input modes github-mcp-server#3085) issue_write.issue_fields[].delete: falseis now a valid no-op for strict-schema clients. (fix(issues): allow delete:false in issue_write issue_fields github-mcp-server#3077)- Zero-parameter tools accept omitted
argumentswhile rejecting explicitnull/malformed JSON. (Fix omitted tool arguments github-mcp-server#3099) - Copilot review-request denials now return actionable guidance instead of a bare 404. (fix(copilot): explain review request denials instead of forwarding a bare 404 github-mcp-server#3119)
Projects/Actions/perf
- Added Project view lifecycle operations and visible-field configuration. (Add basic project view management github-mcp-server#2961, Add visible fields to project views github-mcp-server#2988)
- Reduced Actions and other successful response payload sizes. (Reduce Actions workflow list response payloads github-mcp-server#3047, Use minimal response types for tool results github-mcp-server#3055)
- Improved sanitization performance. (perf(sanitize): make clean text allocation-free on the hot path github-mcp-server#3120)
Behavior changes to note
- Unknown static
--toolsnames now prevent startup — verify gh-aw'slist_issue_fields/tool-name allowlists (if any hardcoded static--toolsconfig is used) still match server-supported names. - Symbolic-link updates require explicit opt-in.
- Requests cannot relax server-enforced lockdown (gh-aw sets
DefaultGitHubLockdown = false, so this mainly affects deployments with lockdown enabled). - Oversized HTTP request bodies are rejected early.
Full changelog: github/github-mcp-server@v1.9.0...v1.10.0
- Impact assessment: Medium — mostly additive hardening and bug fixes with no gh-aw-breaking changes identified. Worth a spot-check that gh-aw's static
--toolslist (if any) still validates cleanly at startup with strict tool-name checking, since invalid names now fail closed instead of degrading gracefully. - Release notes: https://github.com/github/github-mcp-server/releases/tag/v1.10.0
MCP Gateway: v0.4.9 → v0.4.10
Primarily internal refactors, test coverage improvements, and dependency bumps (OpenTelemetry to v1.45.0, schema URL bump to v0.86.2); no user-facing behavior changes identified in the release notes.
Changelog (v0.4.9 → v0.4.10)
- Config schema validation: support remote custom
$refand expand structured error context. (Config schema validation: support remote custom$refand expand structured error context gh-aw-mcpg#11226) - Refactor duplicated proxy rate-limit tracing into a shared helper. (Refactor duplicated proxy rate-limit tracing into a shared helper gh-aw-mcpg#11225)
- Bump OpenTelemetry to v1.45.0 and codify semconv/SDK lockstep in tracing. (Bump OpenTelemetry to v1.45.0 and codify semconv/SDK lockstep in tracing gh-aw-mcpg#11060)
- Consolidate wazero guard runtime/module config and disable DWARF debug info by default. (Consolidate wazero guard runtime/module config and disable DWARF debug info by default gh-aw-mcpg#11505)
- Close GitHub guard coverage gaps for CLI issue/PR state-transition writes; add regression coverage for GitHub guard write operations. (Close GitHub guard coverage gaps for CLI issue/PR state-transition writes gh-aw-mcpg#11063, Add regression coverage for GitHub guard write operations gh-aw-mcpg#11371)
- Fix readonly-stress test methodology gap (tool names, gateway vs. backend read-only enforcement). (Fix readonly-stress test methodology gap: correct tool names, clarify gateway vs. backend read-only enforcement gh-aw-mcpg#11342)
- Numerous test-improver and debug-logging additions across the guard/proxy/server packages (no behavior change).
Full changelog: github/gh-aw-mcpg@v0.4.9...v0.4.10
- Impact assessment: Low — internal quality/observability work, no config schema breaking changes.
- Release notes: https://github.com/github/gh-aw-mcpg/releases/tag/v0.4.10
Docker images (no changes)
All 8 tracked images in pkg/cli/docker_images.go were checked for both version and registry digest drift; none changed:
| Image | Constant | Pinned version | Digest match |
|---|---|---|---|
| rhysd/actionlint | ActionlintImage |
1.7.12 | ✓ unchanged |
| anchore/syft | SyftImage |
v1.51.0 | ✓ unchanged |
| anchore/grype | GrypeImage |
v0.117.0 | ✓ unchanged |
| anchore/grant | GrantImage |
v0.6.8 | ✓ unchanged |
| ghcr.io/zizmorcore/zizmor | ZizmorImage |
1.29.0 | ✓ unchanged |
| ghcr.io/boostsecurityio/poutine | PoutineImage |
1.1.6 | ✓ unchanged |
| ghcr.io/vigilant-llc/runner-guard | RunnerGuardImage |
3.1.5 | ✓ unchanged |
| pipelinecomponents/yamllint | YamllintImage |
latest | ✓ unchanged (no stable GitHub release available to resolve a pinned tag) |
Unchanged CLIs/MCPs
Copilot CLI (1.0.80), Gemini CLI (0.55.1), Pi (0.84.2), Playwright MCP (0.0.79), Playwright CLI (0.1.18), Playwright Browser (v1.62.1), threat-detect (v0.4.11) — all confirmed at latest via NPM registry / GitHub releases, no update needed.
Changes made
- Updated
pkg/constants/version_constants.go:DefaultClaudeCodeVersion,DefaultCodexVersion,DefaultGitHubMCPServerVersion,DefaultMCPGatewayVersion. - Ran
make fmt(Go formatting succeeded; the JSON-formatting sub-step failed for unrelated environment/network reasons — no JSON files required changes for this update). - Ran
make recompilein the foreground: 286/286 workflow lock files recompiled successfully. - Per instructions,
.lock.ymlfiles andpkg/workflow/js/*.jsare left uncommitted here for the maintainer/CI to handle.
Next actions: review and merge the version bumps; spot-check the GitHub MCP Server static --tools allowlist behavior if gh-aw relies on one, given the new fail-closed validation in v1.10.0.
Generated by 🔢 CLI Version Checker · agent · 122.2 AIC · ⌖ 9.49 AIC · ⊞ 12.3K · ◷
- expires on Aug 21, 2026, 9:44 PM UTC-08:00
Reacted by Copilot
Activity
github-actions commentedon Aug 21, 2026
🍪 Issue Monster selected this for Copilot
I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪