Repository navigation
[ca] CLI/MCP version updates: Claude Code, Codex, Pi, GitHub MCP Server (2026-08-25) #55674
Description
This report covers the periodic CLI/MCP/Docker version check. All CLI tool versions and Docker image digests were verified against upstream sources; changes were applied to pkg/constants/version_constants.go and validated with make recompile (292/292 workflows compiled successfully).
Summary of changes
| Tool | Constant | Old | New | Released |
|---|---|---|---|---|
| Claude Code | DefaultClaudeCodeVersion |
2.1.237 | 2.1.245 | 2026-08-25 |
| Codex | DefaultCodexVersion |
0.148.0 | 0.149.1 | 2026-08-24 |
| Pi | DefaultPiVersion |
0.84.2 | 0.84.3 | 2026-08-24 |
| GitHub MCP Server | DefaultGitHubMCPServerVersion |
v1.10.0 | v1.10.1 | 2026-08-20 |
No changes needed for: Copilot CLI (1.0.80), Playwright MCP (0.0.79), Playwright CLI (0.1.18), Playwright Browser (v1.62.1), MCP Gateway (v0.4.10), Threat-detect (already at v0.4.12 — no bump needed).
Docker images in pkg/cli/docker_images.go (Actionlint, Syft, Grype, Grant, Zizmor, Poutine, RunnerGuard, Yamllint): all versions and registry digests verified unchanged — no update required.
Claude Code: 2.1.237 → 2.1.245
No public GitHub repository; only NPM metadata is available. Released across 2026-08-19 through 2026-08-25 (versions 2.1.238–2.1.245 in between). No CHANGELOG published with the package; treat as a routine patch-train update. Risk: Low.
Codex: 0.148.0 → 0.149.1
Changelog (rust-v0.148.0...rust-v0.149.0, plus 0.149.1 patch)
New Features
- Added an interactive
codex agentsdashboard for searching, starting, opening, renaming, and stopping tasks, with configurable shortcuts. (Add an agents overview dashboard to the TUI openai/codex#39094, Make the agents overview an interactive task dashboard openai/codex#39112, Add a dedicatedcodex agentsdashboard command openai/codex#39114, Add configurable shortcuts for the agents dashboard openai/codex#39142) - Added
/cd,/pwd, and/cwdcommands for managing the working directory in TUI sessions. (Add working-directory commands to the TUI openai/codex#38894) - Added
codex queuefor sending messages to existing local or remote sessions. (Add a command to queue messages for existing sessions openai/codex#39092) - Expanded Vim editing with character replacement and more change motions such as
cw,c$, andcc. (Expand Vim change commands and add character replacement openai/codex#39661) codex doctornow diagnoses endpoint protection, network/proxy failures, desktop app state, and update connectivity. (Add endpoint protection checks tocodex doctoropenai/codex#38827, Improvecodex doctornetwork diagnostics openai/codex#38918, Add desktop app diagnostics tocodex doctoropenai/codex#39060, Add desktop update diagnostics tocodex doctoropenai/codex#39074)- SDK users can now pass exact CLI config overrides and select
maxorultrareasoning effort. (Add raw config overrides to the TypeScript SDK openai/codex#38817, Add max and ultra reasoning efforts to the SDKs openai/codex#39662)
Bug Fixes
- Queued messages now wake idle sessions reliably, resolve duplicate session names more usefully, and preserve pasted or deferred command semantics. (Dispatch queued messages written by other processes openai/codex#39034, Prefer the most recent session when queueing by name openai/codex#39385, Preserve queued TUI input semantics openai/codex#39604)
- Resumed and forked threads now restore their active permission profile instead of silently falling back to current defaults. (Restore permission profiles when resuming threads openai/codex#39153)
- Fixed duplicate sub-agent activity and tightened TUI routing for sub-agent notifications and approvals. (Avoid rendering sub-agent activity twice in the TUI openai/codex#39049, Harden TUI subagent navigation openai/codex#39088)
- Realtime WebRTC sideband connections now reconnect after unexpected transport loss without dropping pending output. (Reconnect WebRTC Realtime sideband transports openai/codex#39257)
- Inline TUI history now remains available in Windows Terminal scrollback. (Preserve inline TUI scrollback in Windows Terminal openai/codex#39619)
- Inactive TUI thread replay buffers are now bounded to prevent excessive retained streamed output. (Bound TUI thread replay buffers by delta size openai/codex#39081)
Documentation
- Clarified that external contributions should go through issues and design discussion rather than pull requests. (Clarify the external contribution policy openai/codex#39089)
- Documented DNS exfiltration risks and trust limitations for secure devcontainers. (Document secure devcontainer DNS exfiltration risk openai/codex#39283)
0.149.1
Patch release; changelog only lists the diff (openai/codex@rust-v0.149.0...rust-v0.149.1), no highlighted changes in the release body.
Full changelog: openai/codex@rust-v0.148.0...rust-v0.149.1
Impact assessment: no breaking changes identified. New TUI/dashboard/doctor features are additive and don't affect how gh-aw invokes the Codex CLI headlessly. Risk: Low.
Pi: 0.84.2 → 0.84.3
No public GitHub repository; relying on NPM metadata only (npm view @earendil-works/pi-coding-agent --json). Released 2026-08-24. Treat as a routine patch update. Risk: Low.
GitHub MCP Server: v1.10.0 → v1.10.1
Changelog (v1.10.0...v1.10.1)
- Fix
add_issue_commentschema compatibility regression by@SamMorrowDrumsin Fix add_issue_comment schema compatibility regression github-mcp-server#3127
Full changelog: github/github-mcp-server@v1.10.0...v1.10.1
Impact assessment: this is a regression fix for a tool gh-aw depends on directly (add_issue_comment), so picking it up is worthwhile. Risk: Low, fix-only patch release.
Docker images — no changes
All registry digests were re-resolved and compared against pkg/cli/docker_images.go and matched exactly (version and digest unchanged for all 8 images: Actionlint 1.7.12, Syft v1.51.0, Grype v0.117.0, Grant v0.6.8, Zizmor 1.29.0, Poutine 1.1.6, RunnerGuard 3.1.5, Yamllint latest). No GitHub release for any of these repos is newer than what's already pinned.
Verification
- Edited
pkg/constants/version_constants.gowith the four version bumps above. - Ran
make fmt(Go and JS formatting succeeded;fmt-jsonfailed due to a sandboxEACCESon the.awf-homeGo module cache, unrelated to this change). - Ran
make recompilein the foreground: 292/292 workflows compiled successfully (415 pre-existing warnings, unrelated to this change). - This workflow does not open pull requests — a maintainer will need to apply these constant changes and commit the regenerated
.lock.ymlfiles (or re-runmake recompileafter merging) since lock files and generated JS are intentionally not committed by this workflow.
Generated by 🔢 CLI Version Checker · claude · agent · 114.4 AIC · ⌖ 8.95 AIC · ⊞ 12.8K · ◷
- expires on Aug 26, 2026, 9:44 PM UTC-08:00
Activity
github-actions commentedon Aug 25, 2026
🍪 Issue Monster selected this for Copilot
I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.
If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.
Om nom nom! 🍪