Summary
Four monitored agentic CLI tools have new stable releases. pkg/constants/version_constants.go was updated and make recompile succeeded (237/237 workflows, 0 errors).
Note: the previous tracking issue #35883 was closed as expired/not_planned on 2026-06-01 before its constant changes were committed, and newer versions have since shipped (Claude 2.1.160, Copilot 1.0.57, plus a new Codex 0.136.0). This issue supersedes it.
| Tool |
Previous |
New |
Risk |
| Claude Code |
2.1.156 |
2.1.160 |
Low |
| Copilot CLI |
1.0.55 |
1.0.57 |
Low |
| Codex |
0.135.0 |
0.136.0 |
Low |
| GitHub MCP Server |
v1.1.0 |
v1.1.2 |
Low |
No changes needed (already current): MCP Gateway v0.3.22, Playwright MCP 0.0.75, Playwright CLI 0.1.13, Playwright Browser v1.60.0.
Critical Information
- All updates are point/patch releases with no breaking changes.
make recompile regenerated 237 lock files (0 errors, 47 pre-existing warnings). Per project guidelines only pkg/constants/version_constants.go is committed — *.lock.yml files are not committed.- Observation:
@github/copilot-sdk (not in the monitored set of 8) has 1.0.0-beta.12 available vs the pinned 1.0.0-beta.9 — left unchanged here.
Update Claude Code
- Previous: 2.1.156 → New: 2.1.160 (intermediates: 2.1.157, 2.1.158, 2.1.159)
Breaking Changes: None
View CLI Discovery & Details
CLI Discovery
No new flags or commands. --help output for 2.1.160 is identical to 2.1.158 (the version analyzed in the prior cycle).
Notes
Claude Code has no public GitHub repository; analysis is based on NPM metadata and --help output comparison.
Impact Assessment
- Risk: Low
- Affects: Claude engine default version pin (
DefaultClaudeCodeVersion)
Package Links
Update Copilot CLI
- Previous: 1.0.55 → New: 1.0.57 (intermediate: 1.0.56)
Breaking Changes: None
Key Features (cumulative since 1.0.55, from --help/subcommand diff)
- New flag
--context — set the context window tier, overriding the persisted setting (choices: default, long_context). (1.0.56)
- New flag
--extension-sdk-path — override the bundled @github/copilot-sdk injected into extension subprocesses with a local copilot-sdk/ folder. (1.0.56)
View Subcommand Changes
config subcommand
- (1.0.56) Added
contextTier (context window tier for tiered-pricing models) and builtInAgents.rubberDuck (adversarial-feedback subagent, defaults true).
- (1.0.57) Added
showTipsOnStartup — whether to show a random command tip when the CLI starts; defaults to true.
- (1.0.57) Removed
gpt-4.1 from a documented model list in the config help.
environment subcommand
No changes vs 1.0.55.
Impact Assessment
- Risk: Low
- Affects: Copilot engine default version pin (
DefaultCopilotVersion). New flags/settings are additive and opt-in.
- Note: Copilot CLI repository is private; analysis based on NPM metadata + installed
--help/subcommand output comparison. Per the standing note in version_constants.go, verify MCPs still load and /models works with PAT auth.
Package Links
Update Codex
- Previous: 0.135.0 → New: 0.136.0
Breaking Changes: None
Key Features (from GitHub release notes)
CLI Discovery
- New top-level subcommands:
archive and unarchive (confirmed via codex --help diff).
View Bug Fixes & Security (from release notes)
Impact Assessment
- Risk: Low
- Affects: Codex engine default version pin (
DefaultCodexVersion). Several command-safety/sandbox hardening fixes are security-positive.
Package Links
Update GitHub MCP Server
- Previous: v1.1.0 → New: v1.1.2 (intermediate: v1.1.1)
Breaking Changes: None
Key Changes
- v1.1.1 (bugfix release for MCP APP Resources):
- v1.1.2:
View Changelog Links
Impact Assessment
- Risk: Low
- Affects: GitHub MCP server Docker image pin (
DefaultGitHubMCPServerVersion). The v1.1.2 lockdown-mode fix (per-request RepoAccessCache scoping) is relevant to gh-aw's lockdown feature (DefaultGitHubLockdown) — a security-positive correctness fix.
Package Links
Recommendations
- Merge priority: Normal. All low-risk patch/point updates; the GitHub MCP v1.1.2 lockdown fix and Codex command-safety hardening are the most valuable (security-positive).
- Testing: CI recompile already validates lock-file regeneration. When upgrading Copilot, verify MCPs still load and
/models works with PAT auth.
- Commit: Only
pkg/constants/version_constants.go. Do not commit *.lock.yml files.
References:
Generated by 🔢 CLI Version Checker · opus48 1.2M · ◷
Summary
Four monitored agentic CLI tools have new stable releases.
pkg/constants/version_constants.gowas updated andmake recompilesucceeded (237/237 workflows, 0 errors).Note: the previous tracking issue #35883 was closed as expired/not_planned on 2026-06-01 before its constant changes were committed, and newer versions have since shipped (Claude 2.1.160, Copilot 1.0.57, plus a new Codex 0.136.0). This issue supersedes it.
No changes needed (already current): MCP Gateway v0.3.22, Playwright MCP 0.0.75, Playwright CLI 0.1.13, Playwright Browser v1.60.0.
Critical Information
make recompileregenerated 237 lock files (0 errors, 47 pre-existing warnings). Per project guidelines onlypkg/constants/version_constants.gois committed —*.lock.ymlfiles are not committed.@github/copilot-sdk(not in the monitored set of 8) has 1.0.0-beta.12 available vs the pinned 1.0.0-beta.9 — left unchanged here.Update Claude Code
Breaking Changes: None
View CLI Discovery & Details
CLI Discovery
No new flags or commands.
--helpoutput for 2.1.160 is identical to 2.1.158 (the version analyzed in the prior cycle).Notes
Claude Code has no public GitHub repository; analysis is based on NPM metadata and
--helpoutput comparison.Impact Assessment
DefaultClaudeCodeVersion)Package Links
Update Copilot CLI
Breaking Changes: None
Key Features (cumulative since 1.0.55, from
--help/subcommand diff)--context— set the context window tier, overriding the persisted setting (choices:default,long_context). (1.0.56)--extension-sdk-path— override the bundled@github/copilot-sdkinjected into extension subprocesses with a localcopilot-sdk/folder. (1.0.56)View Subcommand Changes
configsubcommandcontextTier(context window tier for tiered-pricing models) andbuiltInAgents.rubberDuck(adversarial-feedback subagent, defaultstrue).showTipsOnStartup— whether to show a random command tip when the CLI starts; defaults totrue.gpt-4.1from a documented model list in the config help.environmentsubcommandNo changes vs 1.0.55.
Impact Assessment
DefaultCopilotVersion). New flags/settings are additive and opt-in.--help/subcommand output comparison. Per the standing note inversion_constants.go, verify MCPs still load and/modelsworks with PAT auth.Package Links
Update Codex
Breaking Changes: None
Key Features (from GitHub release notes)
/archiveor from the CLI withcodex archive/codex unarchive; archived sessions are protected from resume/fork until restored — Add/archiveslash command openai/codex#25027 · Add thread archive CLI commands openai/codex#25021codex app-server --stdio— feat(app-server): include turns page on thread resume openai/codex#23534 · Addcodex app-server --stdioalias openai/codex#24940CODEX_API_KEYregistration; remote-control websockets use short-lived server tokens — Allow API-key auth for remote exec-server registration openai/codex#24666 · feat(app-server): migrate remote control to server tokens openai/codex#24141CLI Discovery
archiveandunarchive(confirmed viacodex --helpdiff).View Bug Fixes & Security (from release notes)
/diffno longer runs repo-provided Git helpers/hooks; no PowerShell parser execution on non-Windows hosts; browser-origin exec-server websocket handshakes rejected — fix(tui): prevent repository-configured code execution in /diff openai/codex#24954 · [codex] Avoid PowerShell safety parsing off Windows openai/codex#24946 · fix(exec-server): reject websocket requests with Origin headers openai/codex#24947denyread rules enforced on safe-command and approval-bypass paths — fix(linux-sandbox): preserve shell cleanup on interruption openai/codex#22729 · fix: cancel Windows sandbox on network denial openai/codex#19880 · fix: preserve deny-read sandboxing for safe commands openai/codex#23943AWS_REGION/AWS_DEFAULT_REGION; unsupported Bedrock GPT tiers no longer advertised — fix: Bedrock API key region fallback openai/codex#25171 · fix: Limit Bedrock GPT models to default service tier openai/codex#25318Impact Assessment
DefaultCodexVersion). Several command-safety/sandbox hardening fixes are security-positive.Package Links
Update GitHub MCP Server
Breaking Changes: None
Key Changes
RepoAccessCacheper request — Lockdown mode: scope RepoAccessCache per request github-mcp-server#2571View Changelog Links
Impact Assessment
DefaultGitHubMCPServerVersion). The v1.1.2 lockdown-mode fix (per-requestRepoAccessCachescoping) is relevant to gh-aw's lockdown feature (DefaultGitHubLockdown) — a security-positive correctness fix.Package Links
Recommendations
/modelsworks with PAT auth.pkg/constants/version_constants.go. Do not commit*.lock.ymlfiles.References: