[ca] Update CLI/MCP versions: Claude Code, Codex, GitHub MCP Server, MCP Gateway

[github-actions]

Overview

Routine CLI/MCP version check found 4 updates. Constants updated in pkg/constants/version_constants.go, make fmt (Go portion) and make recompile completed successfully (286/286 workflows recompiled). All 8 Docker images tracked in pkg/cli/docker_images.go (Actionlint, Syft, Grype, Grant, Zizmor, Poutine, RunnerGuard, Yamllint) are unchanged — both version tag and registry digest match the current pins, no action needed. Playwright MCP, Playwright CLI, Playwright Browser, Copilot CLI, Gemini CLI, Pi, and threat-detect are also unchanged.

Key updates

Tool	Constant	Old	New	Risk
Claude Code	DefaultClaudeCodeVersion	2.1.233	2.1.237	Low
OpenAI Codex	DefaultCodexVersion	0.147.0	0.148.0	Low
GitHub MCP Server	DefaultGitHubMCPServerVersion	v1.9.0	v1.10.0	Medium (security-hardening release)
MCP Gateway	DefaultMCPGatewayVersion	v0.4.9	v0.4.10	Low

Claude Code CLI: 2.1.233 → 2.1.237

No public GitHub repository exists for Claude Code, so this is based on NPM registry metadata only (published 2026-08-14 → 2026-08-19). The npm package (@anthropic-ai/claude-code) ships only a thin wrapper (cli-wrapper.cjs, install.cjs, platform binary stub) with no bundled CHANGELOG — the actual CLI binary is fetched at install/update time, so no changelog content is available. --help output was captured for reference but the installed binary reports 2.1.233 (self-updating wrapper); no new top-level flags were observable from the static package contents.

• Impact assessment: Low risk, routine point release.
• Source: npm view @anthropic-ai/claude-code version / npm view @anthropic-ai/claude-code --json.

OpenAI Codex CLI: 0.147.0 → 0.148.0

Changelog (rust-v0.147.0 → rust-v0.148.0)

New Features

• Export complete TUI conversations to Markdown with /export, either to the clipboard or a new file. (Add Markdown conversation export to the TUI openai/codex#37358)
• Fork sessions with codex exec fork, and archive or restore sessions from the TUI resume picker. (Add session forking to codex exec openai/codex#37367, Add session archiving to the resume picker openai/codex#37369, Restore archived sessions from the resume picker openai/codex#37371)
• Draft prompts while the TUI initializes, with resume and fork progress shown during startup. (Keep the composer editable during TUI startup openai/codex#38642, Show resume and fork status during TUI startup openai/codex#38788)
• View estimated thread credits or cost in /status, status lines, and terminal titles for eligible workspaces. (Show estimated thread usage in /status openai/codex#38281, Add thread usage to TUI status surfaces openai/codex#38282)
• Use Amazon Bedrock Runtime as a built-in provider with AWS profile, region, and GPT-5.6 routing support. (Add an Amazon Bedrock Runtime provider openai/codex#38470)
• Hooks can now run commands asynchronously and invoke MCP tools. (Support asynchronous command hooks openai/codex#37533, Add MCP tool handler support to the hooks engine openai/codex#38705)

Bug Fixes

• Model switches and settings updates no longer leave stale instructions behind or change an active turn midstream. (Fix first-turn model switching and rollback openai/codex#37260, Keep active-turn model settings stable across updates openai/codex#38785)
• Resumed sessions now restore their persisted working directory and approval policy, with more accurate transcript previews. (Prefer persisted cwd when reading local threads openai/codex#37198, Restore approval policy when resuming threads openai/codex#37368, Fix resume transcript preview line selection openai/codex#38605)
• Turns reconnect through temporary provider outages, and MCP servers recover after OAuth reauthentication without restarting Codex. (Recover MCP servers after OAuth reauthentication openai/codex#37337, Keep response streams alive through connection failures openai/codex#37485, Clarify MCP OAuth reauthentication errors openai/codex#38418)
• TUI startup no longer lets buffered terminal input activate prompts accidentally, and onboarding appears when authentication is missing. (Harden TUI startup input handling openai/codex#38641, Delay the startup composer until first-login onboarding openai/codex#38643, Show onboarding when Codex home lacks authentication state openai/codex#38644)
• Composer and transcript rendering now handle CRLF pastes, wrapped whitespace, and long URLs correctly. (Keep wrapped composer whitespace with following text openai/codex#37709, Preserve user message styling when wrapping long URLs openai/codex#38380, Normalize CRLF line endings in pasted text openai/codex#38704)
• Sandbox restrictions now fail closed for denied or unreadable paths across Linux and Windows. (Honor the configured Windows sandbox level for managed networking openai/codex#37875, Fail closed on unsafe Linux unreadable globs openai/codex#38026, Honor filesystem permissions for app file uploads openai/codex#38416, Enforce managed deny-read rules in the Windows sandbox openai/codex#38660)

Documentation

• The bundled skill-creator guide is more focused, and validation now rejects unfinished TODO placeholders. (Refine skill creation guidance and validation openai/codex#38384)

Full changelog: openai/codex@rust-v0.147.0...rust-v0.148.0

• Impact assessment: Low risk for gh-aw. No breaking CLI flag changes noted; sandbox hardening (fail-closed for denied/unreadable paths) is a positive-security change relevant to how gh-aw sandboxes Codex runs. No action required beyond the version bump.
• Release notes: https://github.com/openai/codex/releases/tag/rust-v0.148.0

GitHub MCP Server: v1.9.0 → v1.10.0

Substantial security/reliability release. Highlights relevant to gh-aw's usage as the default github MCP server:

Changelog (v1.9.0 → v1.10.0)

Security

• Added confirmed repository deletion with form elicitation and protected multi-round-trip state. (Add confirmed repository deletion tool github-mcp-server#3076)
• Restricted bearer credentials to configured GitHub authorities. (Attach GitHub token only to configured GitHub hosts github-mcp-server#3056)
• Enforced HTTPS for GitHub Enterprise hosts. (fix(security): enforce HTTPS for gh-host/GITHUB_HOST to prevent cleartext credentials github-mcp-server#3069)
• Invalid static --tools configuration now fails closed (unknown tool names prevent startup). (Fix static --tools validation fallback github-mcp-server#3050)
• Hardened lockdown mode, request size limits, per-caller cache isolation, URL traversal protection, and response sanitization. (fix(lockdown): harden pull_request_read get_commits handling github-mcp-server#3109, fix(http): make server lockdown mode an upper bound over requests github-mcp-server#3112, fix(lockdown): isolate repo-access cache per caller identity github-mcp-server#3113, Limit HTTP request bodies before MCP middleware parsing github-mcp-server#3111, fix(raw): reject traversal segments when constructing raw content URLs github-mcp-server#3108, Centralize sanitization of untrusted GitHub response fields github-mcp-server#3114, Filter invisible Unicode after HTML entity normalization github-mcp-server#3110)
• Symbolic-link writes now require explicit allow_symlink_write: true opt-in; get_file_contents labels dereferenced symlink content. (Clarify symlink behavior for repository file reads and writes github-mcp-server#3071)
• Fixed binary MCP resources being base64-encoded twice. (Fix binary resource blob encoding github-mcp-server#3098)

GitHub Enterprise Server compatibility

• list_issues/search_issues degrade safely when issue custom-field GraphQL types are unavailable. (Fix list_issues on GHES schemas without issue fields github-mcp-server#3086, Handle unsupported issueFieldValues enrichment in search_issues github-mcp-server#2897)
• list_issues now returns assignee logins and stable empty arrays for unassigned issues. (Return assignees from list_issues github-mcp-server#3064)

Tool contract fixes

• Corrected add_issue_comment input mode validation. (fix(issues): validate add_issue_comment input modes github-mcp-server#3085)
• issue_write.issue_fields[].delete: false is now a valid no-op for strict-schema clients. (fix(issues): allow delete:false in issue_write issue_fields github-mcp-server#3077)
• Zero-parameter tools accept omitted arguments while rejecting explicit null/malformed JSON. (Fix omitted tool arguments github-mcp-server#3099)
• Copilot review-request denials now return actionable guidance instead of a bare 404. (fix(copilot): explain review request denials instead of forwarding a bare 404 github-mcp-server#3119)

Projects/Actions/perf

• Added Project view lifecycle operations and visible-field configuration. (Add basic project view management github-mcp-server#2961, Add visible fields to project views github-mcp-server#2988)
• Reduced Actions and other successful response payload sizes. (Reduce Actions workflow list response payloads github-mcp-server#3047, Use minimal response types for tool results github-mcp-server#3055)
• Improved sanitization performance. (perf(sanitize): make clean text allocation-free on the hot path github-mcp-server#3120)

Behavior changes to note

• Unknown static --tools names now prevent startup — verify gh-aw's list_issue_fields/tool-name allowlists (if any hardcoded static --tools config is used) still match server-supported names.
• Symbolic-link updates require explicit opt-in.
• Requests cannot relax server-enforced lockdown (gh-aw sets DefaultGitHubLockdown = false, so this mainly affects deployments with lockdown enabled).
• Oversized HTTP request bodies are rejected early.

Full changelog: github/github-mcp-server@v1.9.0...v1.10.0

• Impact assessment: Medium — mostly additive hardening and bug fixes with no gh-aw-breaking changes identified. Worth a spot-check that gh-aw's static --tools list (if any) still validates cleanly at startup with strict tool-name checking, since invalid names now fail closed instead of degrading gracefully.
• Release notes: https://github.com/github/github-mcp-server/releases/tag/v1.10.0

MCP Gateway: v0.4.9 → v0.4.10

Primarily internal refactors, test coverage improvements, and dependency bumps (OpenTelemetry to v1.45.0, schema URL bump to v0.86.2); no user-facing behavior changes identified in the release notes.

Changelog (v0.4.9 → v0.4.10)

• Config schema validation: support remote custom $ref and expand structured error context. (Config schema validation: support remote custom $ref and expand structured error context gh-aw-mcpg#11226)
• Refactor duplicated proxy rate-limit tracing into a shared helper. (Refactor duplicated proxy rate-limit tracing into a shared helper gh-aw-mcpg#11225)
• Bump OpenTelemetry to v1.45.0 and codify semconv/SDK lockstep in tracing. (Bump OpenTelemetry to v1.45.0 and codify semconv/SDK lockstep in tracing gh-aw-mcpg#11060)
• Consolidate wazero guard runtime/module config and disable DWARF debug info by default. (Consolidate wazero guard runtime/module config and disable DWARF debug info by default gh-aw-mcpg#11505)
• Close GitHub guard coverage gaps for CLI issue/PR state-transition writes; add regression coverage for GitHub guard write operations. (Close GitHub guard coverage gaps for CLI issue/PR state-transition writes gh-aw-mcpg#11063, Add regression coverage for GitHub guard write operations gh-aw-mcpg#11371)
• Fix readonly-stress test methodology gap (tool names, gateway vs. backend read-only enforcement). (Fix readonly-stress test methodology gap: correct tool names, clarify gateway vs. backend read-only enforcement gh-aw-mcpg#11342)
• Numerous test-improver and debug-logging additions across the guard/proxy/server packages (no behavior change).

Full changelog: github/gh-aw-mcpg@v0.4.9...v0.4.10

• Impact assessment: Low — internal quality/observability work, no config schema breaking changes.
• Release notes: https://github.com/github/gh-aw-mcpg/releases/tag/v0.4.10

Docker images (no changes)

All 8 tracked images in pkg/cli/docker_images.go were checked for both version and registry digest drift; none changed:

Image	Constant	Pinned version	Digest match
rhysd/actionlint	ActionlintImage	1.7.12	✓ unchanged
anchore/syft	SyftImage	v1.51.0	✓ unchanged
anchore/grype	GrypeImage	v0.117.0	✓ unchanged
anchore/grant	GrantImage	v0.6.8	✓ unchanged
ghcr.io/zizmorcore/zizmor	ZizmorImage	1.29.0	✓ unchanged
ghcr.io/boostsecurityio/poutine	PoutineImage	1.1.6	✓ unchanged
ghcr.io/vigilant-llc/runner-guard	RunnerGuardImage	3.1.5	✓ unchanged
pipelinecomponents/yamllint	YamllintImage	latest	✓ unchanged (no stable GitHub release available to resolve a pinned tag)

Unchanged CLIs/MCPs

Copilot CLI (1.0.80), Gemini CLI (0.55.1), Pi (0.84.2), Playwright MCP (0.0.79), Playwright CLI (0.1.18), Playwright Browser (v1.62.1), threat-detect (v0.4.11) — all confirmed at latest via NPM registry / GitHub releases, no update needed.

Changes made

• Updated pkg/constants/version_constants.go: DefaultClaudeCodeVersion, DefaultCodexVersion, DefaultGitHubMCPServerVersion, DefaultMCPGatewayVersion.
• Ran make fmt (Go formatting succeeded; the JSON-formatting sub-step failed for unrelated environment/network reasons — no JSON files required changes for this update).
• Ran make recompile in the foreground: 286/286 workflow lock files recompiled successfully.
• Per instructions, .lock.yml files and pkg/workflow/js/*.js are left uncommitted here for the maintainer/CI to handle.

Next actions: review and merge the version bumps; spot-check the GitHub MCP Server static --tools allowlist behavior if gh-aw relies on one, given the new fail-closed validation in v1.10.0.

Generated by 🔢 CLI Version Checker · agent · 122.2 AIC · ⌖ 9.49 AIC · ⊞ 12.3K · ◷

• expires on Aug 21, 2026, 9:44 PM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 9.44 AIC · ⌖ 10.1 AIC · ⊞ 12.3K · ◷