[ca] chore(deps): bump 5 CLI/MCP versions (Claude 2.1.152, Copilot 1.0.54, Codex 0.134.0, GitHub MCP v1.0.5, MCP Gateway v0.3.20)

[github-actions]

Summary

Five CLI/MCP version updates detected on 2026-05-27. Constants updated in pkg/constants/version_constants.go and make recompile succeeded (236 workflows, 0 errors).

Tool	Previous	New	Risk
Claude Code	2.1.150	2.1.152	Low
Copilot CLI	1.0.52	1.0.54	Low
Codex	0.133.0	0.134.0	Medium
GitHub MCP Server	v1.0.4	v1.0.5	Low
MCP Gateway	v0.3.19	v0.3.20	Low

No changes for: Playwright MCP (0.0.75), Playwright CLI (0.1.13), Playwright Browser (v1.60.0).

---

Update Claude Code

• Previous: 2.1.150 → New: 2.1.152 (intermediate: 2.1.151)
• Timeline: 2.1.150 published 2026-05-23, 2.1.152 published 2026-05-26

No public changelog (Anthropic does not publish release notes for this package). This is a patch-level bump.

Impact Assessment

• Risk: Low
• Affects: Claude engine workflows only; patch bump, no API changes expected

Package Links

• NPM Package: https://www.npmjs.com/package/`@anthropic-ai/claude-code`

---

Update Copilot CLI

• Previous: 1.0.52 → New: 1.0.54 (intermediate: 1.0.53)
• Timeline: 1.0.53 published 2026-05-24, 1.0.54 published 2026-05-24

Bug Fixes (1.0.53)

• Multiline prompts now display fully without content clipping or selection offset
• /skills picker correctly honors --config-dir when saving skill preferences
• Bash shell sessions no longer hang when PS0 or PROMPT_COMMAND is set in the environment

1.0.54

• Release notes: "Fixes and changes" (no detailed body published)

View CLI/Subcommand Discovery

Cached help outputs for 1.0.54 are already in /tmp/gh-aw/cache-memory/copilot-1.0.54-help.txt, copilot-1.0.54-config-help.txt, and copilot-1.0.54-environment-help.txt from yesterday's run; no new commands or flags detected versus 1.0.52 baseline beyond the documented fixes.

Impact Assessment

• Risk: Low
• Affects: Copilot engine workflows; bug-fix-only release stream

Package Links

• NPM Package: https://www.npmjs.com/package/`@github/copilot`
• Repository: https://github.com/github/copilot-cli
• Release Notes 1.0.53: https://github.com/github/copilot-cli/releases/tag/v1.0.53
• Release Notes 1.0.54: https://github.com/github/copilot-cli/releases/tag/v1.0.54

---

Update Codex

• Previous: 0.133.0 → New: 0.134.0
• Timeline: 0.133.0 published 2026-05-21, 0.134.0 published 2026-05-26

Key Features

• Local conversation history search with case-insensitive content matches and result previews ([codex] Add rollout-backed thread content search openai/codex#23519, [codex] Make thread search case-insensitive openai/codex#23921)
• --profile is now the primary profile selector across CLI, TUI permissions, and sandbox flows; legacy profile configs rejected with migration guidance (tui: plumb permission profile selection openai/codex#23708, cli: rename profile v2 flag to --profile openai/codex#23883, config: remove legacy profile v1 resolution openai/codex#24051, fix: reject legacy profile selectors openai/codex#24059)
• MCP setup with per-server environment targeting and OAuth options for streamable HTTP servers (Route MCP servers through explicit environments openai/codex#23583, Support OAuth options in codex mcp add openai/codex#24120)
• Local $ref/$defs preserved in tool schemas; oversized schemas compacted (feat: support local refs and defs in tool input schemas openai/codex#23357, feat: best-effort compact large tool schemas openai/codex#23904)
• Read-only MCP tools can run concurrently when they advertise readOnlyHint (Allow parallel MCP tool calls when annotated readOnly openai/codex#23750)
• Conversation history exposed to extension tools; subagent identity in hook inputs (Add subagent identity to hook inputs openai/codex#22882, Expose conversation history to extension tools openai/codex#23963)

View Full Changelog

Bug Fixes

• Reconnect stale exec-server websocket clients; retry remote control after auth recovery; retry remote compaction v2 streams (Reconnect disconnected exec-server websocket clients with fresh sessions openai/codex#23867, fix(remote-control): retry after auth recovery openai/codex#23775, retry remote compaction v2 requests openai/codex#23951)
• Windows TUI rendering corruption fixed by restoring virtual terminal mode before drawing (fix(tui): restore Windows VT before TUI renders openai/codex#24082)
• Workspace-specific usage-limit messages for credit and spend-cap failures (Display workspace usage limit error copy from response header openai/codex#24114)
• Plugin skills can reuse shared plugin-level icon assets (fix: Allow plugin skills to share plugin-level icon assets openai/codex#23776)
• Active permission profile metadata preserved when syncing auto-review runtime settings (Fix auto-review permission profile override openai/codex#23956)
• Node-based tools honor Codex's managed network proxy environment ([codex] Enable Node env proxy for managed network proxy openai/codex#23905)

Documentation

• README documents curl and PowerShell installer paths (docs: update README.md to mention curl-based installer openai/codex#24106)
• Developer docs prefer just test over direct cargo test (Prefer just test over cargo test in docs openai/codex#23910)
• Profile migration documentation links added to relevant config errors (chore: link doc in profile error messages openai/codex#23879)

Chores

• Release packaging simplified around canonical native artifacts, reusable DotSlash fetching, new macOS x64 zsh artifact (packaging: move rg manifest out of npm bin openai/codex#23833, npm: remove legacy package artifact synthesis openai/codex#23836, package: factor DotSlash executable fetching openai/codex#24129, release: build macOS x64 zsh artifact openai/codex#24165)
• Release-build support for Codex-produced V8 artifacts (ci: Use codex produced v8 artifacts for release builds openai/codex#23934)
• Improved tracing/analytics for websocket requests, turn starts, remote compaction v2 (Trace logical websocket request after untraced warmup openai/codex#23581, Add trace_id to TurnStartedEvent openai/codex#23980, [codex-analytics] split compaction v2 analytics implementation openai/codex#24146)

View Migration Guide

• Workflows using legacy profile v1 configs will be rejected — migrate to the --profile flag and the new profile config format. Codex provides migration guidance at runtime.
• No frontmatter changes are required in gh-aw workflows; the Codex engine adapter does not currently emit profile flags.
• No changes to pkg/workflow adapter required.

Impact Assessment

• Risk: Medium
• Affects: Codex engine workflows. The --profile v1 rejection is the most material change but is opt-in (only affects users who set profile configs explicitly).

Package Links

• NPM Package: https://www.npmjs.com/package/`@openai/codex`
• Repository: https://github.com/openai/codex
• Release Notes: https://github.com/openai/codex/releases/tag/rust-v0.134.0
• Full Changelog: openai/codex@rust-v0.133.0...rust-v0.134.0

---

Update GitHub MCP Server

• Previous: v1.0.4 → New: v1.0.5
• Timeline: v1.0.5 published 2026-05-18

Key Features

• New tool to list repository collaborators (Add tool to list repo collaborators github-mcp-server#2477)
• New tool for discussion comment write operations (feat: Add tool for discussion comment write operations github-mcp-server#2427)
• Optional rationale parameter on update_issue_type tool (Add optional rationale parameter to update_issue_type tool github-mcp-server#2458)
• Minimal code search results with text match snippets returned by default (feat: return minimal code search results with text match snippets github-mcp-server#2476)
• Missing pagination added on get_reviews (fix: add missing pagination on get_reviews github-mcp-server#2367)
• IFC (Information Flow Control) labels added to list_issues, get_file_contents, search_issues, issue_read, search_repositories tools (Add ifc label for list_issues tool github-mcp-server#2453, Add ifc label for get_file_contents tool github-mcp-server#2454, Add ifc label for search_issues tool github-mcp-server#2456, Add ifc label for issue_read tool github-mcp-server#2457, Add ifc label for search_repositories tool github-mcp-server#2459)
• Ingress IFC reader list replaced with private marker (Replace ingress IFC reader list with private marker github-mcp-server#2478)
• Copilot Spaces PAT requirements documented (Document Copilot Spaces PAT requirements github-mcp-server#2479)
• go-github upgraded to v0.87 (Upgrade go-github to v 0.87 github-mcp-server#2452)

Impact Assessment

• Risk: Low
• Affects: All workflows using tools.github MCP. New tools are additive; get_reviews pagination is a behavior improvement (results now properly paginated).

Package Links

• Repository: https://github.com/github/github-mcp-server
• Release Notes: https://github.com/github/github-mcp-server/releases/tag/v1.0.5
• Docker Image: ghcr.io/github/github-mcp-server:v1.0.5

---

Update MCP Gateway

• Previous: v0.3.19 → New: v0.3.20
• Timeline: v0.3.20 published 2026-05-27

Key Features

• Per-session tool call limits enforced in allow-only guard policies (Enforce per-session tool call limits in allow-only guard policies gh-aw-mcpg#6533)
• DIFC proxy handling fixed for top-level array responses on comment list endpoints (Fix DIFC proxy handling for top-level array responses on comment list endpoints gh-aw-mcpg#6538)

View Full Changelog

• Refactor semantic outliers into config/guard/tracing ownership files (Refactor semantic outliers into config/guard/tracing ownership files gh-aw-mcpg#6543)
• Debug logging added to gateway startup flow in cmd/root.go ([log] Add debug logging to gateway startup flow in cmd/root.go gh-aw-mcpg#6547)
• Documentation: corrected MCP_GATEWAY_WASM_CACHE_DIR default to log-dir sibling path (docs: correct MCP_GATEWAY_WASM_CACHE_DIR default to log-dir sibling path gh-aw-mcpg#6549)
• Tests added for logger.RPCMessageType.JSONLEvent ([test] Add tests for logger.RPCMessageType.JSONLEvent gh-aw-mcpg#6541)
• Improved tests for mcp http_transport ([test-improver] Improve tests for mcp http_transport gh-aw-mcpg#6550)

Impact Assessment

• Risk: Low
• Affects: Default sandbox.agent container for all workflows using the MCP gateway. Per-session tool call limit enforcement may surface previously hidden over-limit behavior; DIFC fix affects PRs/issues with comment list payloads.

Package Links

• Repository: https://github.com/github/gh-aw-mcpg
• Release Notes: https://github.com/github/gh-aw-mcpg/releases/tag/v0.3.20
• Full Changelog: github/gh-aw-mcpg@v0.3.19...v0.3.20
• Docker Image: ghcr.io/github/gh-aw-mcpg:v0.3.20

---

Recommendations

• Apply all updates together — they are independently low-risk and only the constants file is committed (lock files regenerate via build pipeline).
• Validate one Codex-engine workflow end-to-end given the --profile v1 deprecation, even though gh-aw does not emit profile flags.
• Validate one Copilot-engine workflow given the bash PS0/PROMPT_COMMAND fix, in case any workflow shell hooks were previously affected.
• No make recompile re-run needed for these version bumps (the MCP Gateway "twice" rule applies only when changing the gateway version causes container SHA pins to refresh — verified make recompile succeeded in a single pass).

References

• §26495518536

Generated by 🔢 CLI Version Checker · opus47 11.6M · ◷

• expires on May 29, 2026, 6:54 AM UTC