Skip to content

[ca] CLI/MCP version updates: Claude Code, Codex, Pi, GitHub MCP Server (2026-08-25) #55674

Description

@github-actions

This report covers the periodic CLI/MCP/Docker version check. All CLI tool versions and Docker image digests were verified against upstream sources; changes were applied to pkg/constants/version_constants.go and validated with make recompile (292/292 workflows compiled successfully).

Summary of changes

Tool Constant Old New Released
Claude Code DefaultClaudeCodeVersion 2.1.237 2.1.245 2026-08-25
Codex DefaultCodexVersion 0.148.0 0.149.1 2026-08-24
Pi DefaultPiVersion 0.84.2 0.84.3 2026-08-24
GitHub MCP Server DefaultGitHubMCPServerVersion v1.10.0 v1.10.1 2026-08-20

No changes needed for: Copilot CLI (1.0.80), Playwright MCP (0.0.79), Playwright CLI (0.1.18), Playwright Browser (v1.62.1), MCP Gateway (v0.4.10), Threat-detect (already at v0.4.12 — no bump needed).

Docker images in pkg/cli/docker_images.go (Actionlint, Syft, Grype, Grant, Zizmor, Poutine, RunnerGuard, Yamllint): all versions and registry digests verified unchanged — no update required.

Claude Code: 2.1.237 → 2.1.245

No public GitHub repository; only NPM metadata is available. Released across 2026-08-19 through 2026-08-25 (versions 2.1.238–2.1.245 in between). No CHANGELOG published with the package; treat as a routine patch-train update. Risk: Low.

Codex: 0.148.0 → 0.149.1

Changelog (rust-v0.148.0...rust-v0.149.0, plus 0.149.1 patch)

New Features

Bug Fixes

Documentation

0.149.1

Patch release; changelog only lists the diff (openai/codex@rust-v0.149.0...rust-v0.149.1), no highlighted changes in the release body.

Full changelog: openai/codex@rust-v0.148.0...rust-v0.149.1

Impact assessment: no breaking changes identified. New TUI/dashboard/doctor features are additive and don't affect how gh-aw invokes the Codex CLI headlessly. Risk: Low.

Pi: 0.84.2 → 0.84.3

No public GitHub repository; relying on NPM metadata only (npm view @earendil-works/pi-coding-agent --json). Released 2026-08-24. Treat as a routine patch update. Risk: Low.

GitHub MCP Server: v1.10.0 → v1.10.1

Changelog (v1.10.0...v1.10.1)

Full changelog: github/github-mcp-server@v1.10.0...v1.10.1

Impact assessment: this is a regression fix for a tool gh-aw depends on directly (add_issue_comment), so picking it up is worthwhile. Risk: Low, fix-only patch release.

Docker images — no changes

All registry digests were re-resolved and compared against pkg/cli/docker_images.go and matched exactly (version and digest unchanged for all 8 images: Actionlint 1.7.12, Syft v1.51.0, Grype v0.117.0, Grant v0.6.8, Zizmor 1.29.0, Poutine 1.1.6, RunnerGuard 3.1.5, Yamllint latest). No GitHub release for any of these repos is newer than what's already pinned.

Verification

  • Edited pkg/constants/version_constants.go with the four version bumps above.
  • Ran make fmt (Go and JS formatting succeeded; fmt-json failed due to a sandbox EACCES on the .awf-home Go module cache, unrelated to this change).
  • Ran make recompile in the foreground: 292/292 workflows compiled successfully (415 pre-existing warnings, unrelated to this change).
  • This workflow does not open pull requests — a maintainer will need to apply these constant changes and commit the regenerated .lock.yml files (or re-run make recompile after merging) since lock files and generated JS are intentionally not committed by this workflow.

Generated by 🔢 CLI Version Checker · claude · agent · 114.4 AIC · ⌖ 8.95 AIC · ⊞ 12.8K ·

  • expires on Aug 26, 2026, 9:44 PM UTC-08:00

Metadata

Metadata

Labels

automationcookieIssue Monster Loves Cookies!dependenciesPull requests that update a dependency file

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions