You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
5 CLI tools have updates available; all Docker images (zizmor, poutine, actionlint, runner-guard, syft, grype, grant, yamllint) are unchanged (version and registry digest both match the pinned constants — no action needed there).
pkg/constants/version_constants.go has been updated and make recompile was run successfully (276/276 workflows compiled). @playwright/cli was intentionally not bumped — see below.
Summary
Tool
Old
New
Risk
Claude Code
2.1.222
2.1.224
Low
OpenAI Codex
0.146.0
0.147.0
Medium
Playwright MCP
0.0.78
0.0.79
Low
Pi
0.83.0
0.84.0
Low
Playwright CLI
0.1.17
0.1.18 (held, cooldown)
Medium
GitHub Copilot CLI
1.0.78
unchanged
—
GitHub MCP Server
v1.8.0
unchanged
—
Playwright Browser
v1.62.1
unchanged
—
MCP Gateway
v0.4.8
unchanged
—
Claude Code: 2.1.222 → 2.1.224
Two patch releases (2.1.223, 2.1.224). Claude Code has no public repository/changelog; npm metadata shows only version bumps published 2026-08-04 through 2026-08-07. No known breaking changes. Risk: Low.
OpenAI Codex: 0.146.0 → 0.147.0
Release notes (rust-v0.147.0, published 2026-08-07)
Impact assessment: The removed codex exec --full-auto flag is a breaking CLI change — worth grepping gh-aw's Codex engine integration (pkg/workflow/codex_engine.go) and workflow templates for any use of --full-auto before release, since it would now error instead of falling back to --sandbox workspace-write. No such usage was found in a quick pass, but a dedicated review before merge is recommended. Risk: Medium (one breaking flag removal, otherwise additive).
Playwright MCP: 0.0.78 → 0.0.79
Tracks the microsoft/playwright monorepo release that also produced Playwright CLI v0.1.18 (see below) — the two packages share a release train, so the underlying MCP server changes are documented there: structured JSON snapshots, configurable snapshot.boxes, extension-relay reconnect/CDP profile fixes, and a Host/Origin validation hardening fix for the extension relay WebSocket upgrade. Risk: Low (bug fixes and additive config, no breaking API change for the gh-aw integration).
Pi: 0.83.0 → 0.84.0
No public repository; npm metadata shows only a version bump with no changelog detail available. Risk: Low.
Playwright CLI: 0.1.17 → 0.1.18 — HELD (cooldown)
v0.1.18 was published 2026-08-06T00:15:21Z (~30 hours before this check). pkg/constants/version_constants_test.go (TestDefaultPlaywrightCLIVersionOutsideCooldownWindow) enforces a 72-hour cooldown before a new Playwright CLI version can be pinned, so this update was not applied. It should become eligible around 2026-08-09T00:15:21Z.
Release notes (v0.1.18) for when the cooldown clears
All 8 images were checked for both version and registry digest drift. Every digest matched the value already pinned in pkg/cli/docker_images.go exactly:
Ran make fmt and make recompile (foreground) — 276/276 workflow lock files recompiled successfully with no new errors.
pkg/constants/version_constants_test.go was left unchanged since Playwright CLI was not bumped.
Not committed — this issue documents the change so it can be reviewed and merged via PR.
Next actions
Review and merge the version bump for Claude Code, Codex, Playwright MCP, and Pi.
Grep pkg/workflow/codex_engine.go and workflow prompt templates for --full-auto before merging the Codex bump (flag was removed in 0.147.0).
Re-run this check after 2026-08-09 to pick up Playwright CLI v0.1.18 once its cooldown clears.
Regenerate wasm golden test fixtures referencing the old Claude Code version (pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden) via make update-wasm-golden as part of the follow-up PR.
CLI & Docker image version check — 2026-08-07
5 CLI tools have updates available; all Docker images (zizmor, poutine, actionlint, runner-guard, syft, grype, grant, yamllint) are unchanged (version and registry digest both match the pinned constants — no action needed there).
pkg/constants/version_constants.gohas been updated andmake recompilewas run successfully (276/276 workflows compiled).@playwright/cliwas intentionally not bumped — see below.Summary
Claude Code: 2.1.222 → 2.1.224
Two patch releases (2.1.223, 2.1.224). Claude Code has no public repository/changelog; npm metadata shows only version bumps published 2026-08-04 through 2026-08-07. No known breaking changes. Risk: Low.
OpenAI Codex: 0.146.0 → 0.147.0
Release notes (rust-v0.147.0, published 2026-08-07)
New Features
--approve-for-meCLI flag for automatically reviewed approvals. (Add an--approve-for-meCLI flag openai/codex#36373)Bug Fixes (Security-relevant)
Other Bug Fixes
Chores
codex exec --full-autoflag; use--sandbox workspace-writeinstead. (Remove legacy--full-autohandling fromcodex execopenai/codex#36054)codex-package-<target>archives. (Stop publishing legacy Linux bundle archives openai/codex#36342)Full changelog: openai/codex@rust-v0.146.0...rust-v0.147.0
Impact assessment: The removed
codex exec --full-autoflag is a breaking CLI change — worth grepping gh-aw's Codex engine integration (pkg/workflow/codex_engine.go) and workflow templates for any use of--full-autobefore release, since it would now error instead of falling back to--sandbox workspace-write. No such usage was found in a quick pass, but a dedicated review before merge is recommended. Risk: Medium (one breaking flag removal, otherwise additive).Playwright MCP: 0.0.78 → 0.0.79
Tracks the microsoft/playwright monorepo release that also produced Playwright CLI v0.1.18 (see below) — the two packages share a release train, so the underlying MCP server changes are documented there: structured JSON snapshots, configurable
snapshot.boxes, extension-relay reconnect/CDP profile fixes, and a Host/Origin validation hardening fix for the extension relay WebSocket upgrade. Risk: Low (bug fixes and additive config, no breaking API change for the gh-aw integration).Pi: 0.83.0 → 0.84.0
No public repository; npm metadata shows only a version bump with no changelog detail available. Risk: Low.
Playwright CLI: 0.1.17 → 0.1.18 — HELD (cooldown)
v0.1.18was published 2026-08-06T00:15:21Z (~30 hours before this check).pkg/constants/version_constants_test.go(TestDefaultPlaywrightCLIVersionOutsideCooldownWindow) enforces a 72-hour cooldown before a new Playwright CLI version can be pinned, so this update was not applied. It should become eligible around 2026-08-09T00:15:21Z.Release notes (v0.1.18) for when the cooldown clears
Highlights
install --skillssupports-gto install into the home directory instead of the workspace. (feat(cli): add -g flag to install skills globally microsoft/playwright#42099, issue [Feature]:playwright-cli install --skillsshould support the-gflag microsoft/playwright#42087)Fixes (security-relevant)
Other fixes
--jsonnow emits a structured page snapshot instead of a string-wrapped blob. (feat(mcp): emit structured snapshot in --json responses microsoft/playwright#42098, issue [CLI]: --json emits formatted text wrapped in a string, not structured data microsoft/playwright#42076)snapshot.boxesconfig to enable bounding boxes globally. (feat(mcp): add snapshot.boxes config to include bounding boxes in snapshots microsoft/playwright#42102, issue feat: add snapshot.boxes config to include bounding boxes in auto-snapshots microsoft/playwright-mcp#1695)uploadcommand now accepts multiple files. (fix(cli): accept multiple files in upload command microsoft/playwright#42057, issue [CLI]:uploadrejects a second file although it advertises "one or multiple files" microsoft/playwright#42047)attachtargets the correct Chrome profile. (fix(mcp): reconnect to the browser after disconnect microsoft/playwright#41966, fix(mcp): launch the Chrome profile that has the extension installed microsoft/playwright#41939)gotocrashing on privileged pages (`(redacted) was reverted upstream — the crash originates in the browser process itself and the fix only masked it. (Revert "fix(cli): don't crash the response when navigating closes the last tab" microsoft/playwright#41931)Full release: https://github.com/microsoft/playwright-cli/releases/tag/v0.1.18
Docker images — no changes
All 8 images were checked for both version and registry digest drift. Every digest matched the value already pinned in
pkg/cli/docker_images.goexactly:ZizmorImagePoutineImageActionlintImageRunnerGuardImageSyftImageGrypeImageGrantImageYamllintImageNo edits needed to
pkg/cli/docker_images.go.Changes made
pkg/constants/version_constants.go: bumpedDefaultClaudeCodeVersion,DefaultCodexVersion,DefaultPiVersion,DefaultPlaywrightMCPVersion.make fmtandmake recompile(foreground) — 276/276 workflow lock files recompiled successfully with no new errors.pkg/constants/version_constants_test.gowas left unchanged since Playwright CLI was not bumped.Next actions
pkg/workflow/codex_engine.goand workflow prompt templates for--full-autobefore merging the Codex bump (flag was removed in 0.147.0).pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden) viamake update-wasm-goldenas part of the follow-up PR.References: