[ca] CLI/runtime version updates detected (Claude, Copilot, Codex, GitHub MCP Server) #61733

Summary

Detected upstream version updates for four CLI/runtime dependencies that gh-aw pins in pkg/constants/version_constants.go. No repository files were changed in this run because the task instructions require issue creation for any detected update, while several candidates are still inside the 3-day cooldown window or need broader follow-up before a code bump.

Recommended updates

• Claude Code: 2.1.273 → 2.1.276
• Copilot CLI: 1.0.85 → 1.0.86
• Codex CLI: 0.154.0 → 0.155.0
• GitHub MCP Server: v1.12.1 → v1.12.2

No-change findings

• Pi CLI remains current at 0.85.1.
• Threat-detect remains current at v0.5.1.
• MCP Gateway latest is v0.4.25, which matches the current pin, but its release is newer than 3 days so no action is needed anyway.
• Playwright CLI latest is 0.1.20, but the release was published 2026-09-14T21:26:38Z and is still inside the repository's enforced 3-day cooldown window as of this run.
• Docker image pins in pkg/cli/docker_images.go already match the currently selected tags/digests for Zizmor, Poutine, Actionlint, Runner Guard, Syft, Grype, Grant, and Yamllint. Newer Syft/Grype upstream releases exist, but both were published on 2026-09-17 and are still inside the 3-day cooldown window, so they should not be adopted yet.
• GitHub MCP Server and MCP Gateway latest releases are also newer than 3 days, but they are listed here because the task specifically requires issue creation when any version change is detected.

Version details

Claude Code 2.1.273 → 2.1.276

• Release timeline:
  • Current pinned version observed in repo: 2.1.273
  • Latest npm version: 2.1.276
  • npm publish time for 2.1.276: 2026-09-18T01:39:31.986Z
• Breaking: none identified from npm metadata.
• Features: not available from a public release feed during this run.
• Fixes: not available from a public release feed during this run.
• Security: not available from a public release feed during this run.
• Performance: not available from a public release feed during this run.
• Impact on gh-aw: likely low-to-medium; Claude Code is used as a runtime option, so behavior changes could alter agent UX or flags even without repository code changes.
• Risk: Medium, because there is no public changelog available in this run and the package advanced by three patch versions.
• Research links:
  • https://www.npmjs.com/package/``@anthropic-ai/claude-code``

Copilot CLI 1.0.85 → 1.0.86

• Release timeline:
  • Current pinned version observed in repo: 1.0.85
  • Latest npm version: 1.0.86
  • npm publish time for 1.0.86: 2026-09-17T22:57:31.082Z
  • GitHub release time: 2026-09-17T22:57:47Z
• Breaking: none called out in the release notes.
• Features:
  • Custom agents can opt into repository instruction files by setting include-custom-instructions: true in frontmatter.
  • /sandbox policy reports local-network access using the configured setting.
• Fixes:
  • Resume sessions preserve plugins/skills better when reloading an active session.
  • Recover from transcript corruption during resume.
  • Timeline reasoning text readability improved.
  • Status row now distinguishes waiting on background shells.
• Security:
  • Indirectly relevant behavior visibility improvement in /sandbox policy reporting; no explicit security advisory noted.
• Performance: none explicitly called out.
• Impact on gh-aw: medium. Repository instruction file handling is especially relevant because gh-aw workflows rely heavily on instruction files and autonomous resume behavior.
• Risk: Medium.
• Release notes:
  • https://github.com/github/copilot-cli/releases/tag/v1.0.86
• Full changelog compare:
  • github/copilot-cli@v1.0.85...v1.0.86
• README reference:
  • https://github.com/github/copilot-cli/blob/main/README.md
• CLI help diff findings:
  • copilot --help: no text diff detected between 1.0.85 and 1.0.86
  • copilot config --help: no text diff detected
  • copilot environment --help: no text diff detected

Codex CLI 0.154.0 → 0.155.0

• Release timeline:
  • Current pinned version observed in repo: 0.154.0
  • Latest npm version: 0.155.0
  • npm publish time for 0.155.0: 2026-09-17T23:19:02.781Z
  • GitHub release time: 2026-09-17T23:14:43Z
• Breaking: none explicitly called out in release notes.
• Features:
  • Experimental /voice conversations with live transcripts and microphone controls.
  • Live reasoning summaries and completion timestamps in the TUI.
  • Task hiding, archiving, deletion, and worktree ownership details in agent overview.
  • Touch ID verification for MCP requests on supported Macs.
  • Configurable daemon update schedules and explicit codex app-server daemon update command.
  • Amazon Bedrock credential command support with caching and refresh.
• Fixes:
  • Prompt preservation when compaction fails.
  • TUI resize/history/transcript restoration fixes.
  • Better expired OAuth credential reporting for MCP servers.
  • More reliable automatic approval reviews and clearer unsafe-action distinctions.
  • Account switching now invalidates stale sessions and model catalogs.
• Security:
  • Blocked Windows-process escapes from restricted WSL sandboxes: Block WSL interop escapes from restricted filesystem sandboxes openai/codex#44286
  • Hardened brokered shell snapshots against credential exposure: Protect shell snapshots when credential brokerage is enabled openai/codex#43909 and Harden credential handling in shell snapshots and replay openai/codex#44040
• Performance:
  • Multiple TUI/session robustness and telemetry improvements; no singular headline perf feature.
• Impact on gh-aw: medium-to-high. Codex is used as an agent runtime; sandbox, credential, MCP, and daemon changes can affect workflow execution semantics.
• Risk: Medium.
• Release notes:
  • https://github.com/openai/codex/releases/tag/rust-v0.155.0
• Full changelog compare:
  • openai/codex@rust-v0.154.0...rust-v0.155.0
• Example external PR URLs referenced by the release:
  • Add live WebRTC voice conversations to the TUI openai/codex#43581
  • Show streaming reasoning summaries in the TUI status row openai/codex#43921
  • Block WSL interop escapes from restricted filesystem sandboxes openai/codex#44286
  • Preserve complete actions in Guardian approval reviews openai/codex#44569
• CLI help diff findings:
  • codex --help: no text diff detected between 0.154.0 and 0.155.0

GitHub MCP Server v1.12.1 → v1.12.2

• Release timeline:
  • Current pinned version observed in repo: v1.12.1
  • Latest GitHub release: v1.12.2
  • Release time: 2026-09-16T10:58:24Z
• Breaking: none called out.
• Features:
  • Added update_issue_comment: feat: add update_issue_comment tool github-mcp-server#3284
  • Added granular reaction-removal tools for issues and pull-request review comments: feat: add remove_issue_reaction, remove_issue_comment_reaction and remove_pull_request_review_comment_reaction tools to the granular issues and pull requests toolsets github-mcp-server#3285
• Fixes: none explicitly called out.
• Security: none explicitly called out.
• Performance: none explicitly called out.
• Impact on gh-aw: low-to-medium. New MCP tools may expand capabilities but should not be required for existing workflows.
• Risk: Low.
• Release notes:
  • https://github.com/github/github-mcp-server/releases/tag/v1.12.2
• Full changelog compare:
  • github/github-mcp-server@v1.12.1...v1.12.2

Cooldown-gated items to revisit later

Playwright CLI 0.1.19 → 0.1.20

• Released 2026-09-14T21:26:38Z; still within the 3-day cooldown window during this run.
• Notable changes once eligible:
  • New webmcp-list and webmcp-call commands: feat(mcp): expose page-registered WebMCP tools microsoft/playwright#42613
  • Idle timeout behavior for headless sessions: feat(cli): shut idle headless sessions down after an hour microsoft/playwright#42676
  • Several daemon, screenshot, extension-attach, and Linux sandbox fixes.
• Release notes:
  • https://github.com/microsoft/playwright-cli/releases/tag/v0.1.20
• CLI help diff findings:
  • playwright --help: no text diff detected between 0.1.19 and 0.1.20

Docker images

• SyftImage: upstream v1.52.0 exists, published 2026-09-17T14:38:17Z; cooldown not yet satisfied.
• GrypeImage: upstream v0.119.0 exists, published 2026-09-17T16:45:23Z; cooldown not yet satisfied.
• Current pinned image digests match the registry digests for the currently selected tags, so there is no digest-only update to make right now.

Validation notes

• Examined current pinned versions in:
  • pkg/constants/version_constants.go
  • pkg/cli/docker_images.go
• Queried latest npm versions for Claude Code, Copilot CLI, Codex, Pi, and Playwright CLI.
• Queried latest GitHub releases for GitHub MCP Server, MCP Gateway, threat-detect, and Docker-backed scanners.
• Installed old/new versions locally under /tmp/gh-aw/agent/cli-check/ and compared --help output for Copilot, Playwright, Claude, and Codex. No help text diffs were detected in the commands checked.
• No repository files were modified, so make fmt, make recompile, and report_progress were not run.

Suggested next step

• Re-run this checker after the cooldown window expires, then update the pinned versions in pkg/constants/version_constants.go for any still-desired upgrades and create the matching code change with make fmt and make recompile.

network:
  allowed:
    - defaults
    - "raw.githubusercontent.com"

Generated by 🔢 CLI Version Checker · pi · gpt54 · 25.7 AIC · ⊞ 10.1K · ◷

• expires on Sep 19, 2026, 9:35 PM UTC-08:00