[ca] Update CLI tool versions: Claude Code, Copilot CLI, Codex, GitHub MCP Server

[github-actions]

Four CLI tools have new versions available. Constants updated in pkg/constants/version_constants.go and all 193 workflows recompiled.

Summary

Tool	Previous	New	Change
Claude Code	2.1.98	2.1.112	+14 patch
Copilot CLI	1.0.21	1.0.31	+10 patch
Codex	0.118.0	0.121.0	+3 minor
GitHub MCP Server	v0.32.0	v1.0.0	Major

No changes: Playwright MCP (0.0.70), Playwright Browser (v1.59.1), MCP Gateway (v0.2.22)

---

Update Claude Code

• Previous: 2.1.98 → New: 2.1.112
• Note: The stable tag is 2.1.97; latest is 2.1.112. Pinned to latest.
• Risk: Low — no public GitHub repository; npm-only distribution

Impact Assessment

• Risk: Low
• No breaking changes reported in npm metadata

Package Links

• NPM Package: https://www.npmjs.com/package/`@anthropic-ai/claude-code`

---

Update Copilot CLI

• Previous: 1.0.21 → New: 1.0.31
• Risk: Medium — verify MCPs still load and /models works with PAT auth (per inline comment in constants)

View Notes

The Copilot CLI repository is private. No detailed changelog available from GitHub. The npm package description is unchanged: "GitHub Copilot CLI brings the power of Copilot coding agent directly to your terminal."

10 patch releases were skipped (1.0.21 → 1.0.31). Manual smoke testing recommended per the existing comment:

• MCPs are not blocked from loading (tools.mcp configuration still works end-to-end)
• /models does not silently fail on PATs

Package Links

• NPM Package: https://www.npmjs.com/package/`@github/copilot`

---

Update Codex

• Previous: 0.118.0 → New: 0.121.0
• Intermediate versions: 0.119.0 (2026-04-xx), 0.120.0 (2026-04-xx), 0.121.0 (2026-04-15)
• Risk: Low

View Codex 0.119.0 Highlights

Features

• Realtime voice sessions default to v2 WebRTC path with configurable transport, voice selection, native TUI media support
• MCP Apps and custom MCP servers: resource reads, tool-call metadata, custom-server tool search, server-driven elicitations, file-parameter uploads
• Remote/app-server workflows: egress websocket transport, remote --cd forwarding, runtime remote-control enablement, sandbox-aware filesystem APIs, experimental codex exec-server subcommand
• TUI: copy latest agent response with Ctrl+O; /resume can jump directly to a session by ID or name
• TUI notifications: Warp OSC 9 support, opt-in mode for notifications while terminal focused

Bug Fixes

• TUI starts faster (rate limits fetched asynchronously); /status refreshes stale limits
• Resume flows more stable (picker no longer flashes empty states, stabilized timestamps)
• MCP status and startup less noisy
• Sandbox/network/platform edge cases tightened

Full Changelog: openai/codex@rust-v0.118.0...rust-v0.119.0

View Codex 0.120.0 Highlights

Features

• Realtime V2 can stream background agent progress while work is running, queue follow-up responses
• Hook activity in TUI: live running hooks shown separately, completed hook output kept only when useful
• Custom TUI status lines can include renamed thread title
• Code-mode tool declarations include MCP outputSchema for typed structured results
• SessionStart hooks can distinguish /clear sessions from fresh startup or resume sessions

Bug Fixes

• Fixed Windows elevated sandbox handling for split filesystem policies
• Fixed sandbox permission handling for symlinked writable roots
• Fixed codex --remote wss://... panics (Rustls crypto provider)
• Preserved tool search result ordering (no more alphabetical reorder)
• Fixed live Stop-hook prompts appearing immediately

Full Changelog: openai/codex@rust-v0.119.0...rust-v0.120.0

View Codex 0.121.0 Highlights

Features

• codex marketplace add — install plugin marketplaces from GitHub, git URLs, local directories, or direct marketplace.json URLs (Add marketplace command openai/codex#17087, [codex] Refactor marketplace add into shared core flow openai/codex#17717, [codex] Support local marketplace sources openai/codex#17756)
• TUI prompt history: Ctrl+R reverse search and local recall for accepted slash commands (feat(tui): add reverse history search to composer openai/codex#17550, fix(tui): recall accepted slash commands locally openai/codex#17336)
• TUI and app-server controls for memory mode, memory reset/deletion, memory-extension cleanup (feat: memories menu openai/codex#17632, feat: disable memory endpoint openai/codex#17626, feat: add endpoint to delete memories openai/codex#17913)
• MCP/plugin: MCP Apps tool calls, namespaced MCP registration, parallel-call opt-in, sandbox-state metadata ([mcp] Support MCP Apps part 3 - Add mcp tool call support. openai/codex#17364, register all mcp tools with namespace openai/codex#17404, Add supports_parallel_tool_calls flag to included mcps openai/codex#17667)
• Secure devcontainer profile with bubblewrap support; macOS sandbox allowlists for Unix sockets (feat(devcontainer): add separate secure customer profile openai/codex#10431, Support Unix socket allowlists in macOS sandbox openai/codex#17654)

Bug Fixes

• Fixed macOS sandbox private DNS handling; removed danger-full-access denylist-only mode (fix: unblock private DNS in macOS sandbox openai/codex#17370, fix: Revert danger-full-access denylist-only mode openai/codex#17732)
• Fixed Windows cwd/session matching for verbatim paths (Fix thread/list cwd filtering for Windows verbatim paths openai/codex#17414)
• Guardian timeouts now distinct from policy denials with timeout-specific guidance (representing guardian review timeouts in protocol types openai/codex#17381, changing decision semantics after guardian timeout openai/codex#17486)
• Fixed MCP flattened deferred tool names, elicitation timeout accounting, empty namespace descriptions ([codex] Support flattened deferred MCP tool calls openai/codex#17556, fix(mcp) pause timer for elicitations openai/codex#17566, Fix empty tool descriptions openai/codex#17946)

Full Changelog: openai/codex@rust-v0.120.0...rust-v0.121.0

Package Links

• NPM Package: https://www.npmjs.com/package/`@openai/codex`
• Repository: https://github.com/openai/codex
• Release Notes (0.121.0): https://github.com/openai/codex/releases/tag/rust-v0.121.0

---

Update GitHub MCP Server

• Previous: v0.32.0 → New: v1.0.0 (MAJOR VERSION)
• Intermediate versions: v0.33.0 (2026-04-14), v0.33.1 (2026-04-14), v1.0.0 (2026-04-16)
• Risk: Medium — major version bump; review breaking changes

View v0.33.0 Changes

Features

• Resolve review threads (Feat/resolve review threads github-mcp-server#1919)
• Configurable server name and title via translation strings (Add configurable server name and title via translation strings github-mcp-server#2159)
• list_commits gains path, since, and until parameters (Add path, since and until to list_commits github-mcp-server#2260)
• Initial OSS logging adapter for HTTP (Initial OSS logging adapter for http github-mcp-server#2008)
• Granular PRs and issues toolsets (OSS granular PRs and issues toolsets github-mcp-server#2306)
• --exclude-tools flag to shut off specific tools (Add --exclude-tools (and X-MCP-Exclude-Tools) flag to enable shutting off tools as part of server configuration github-mcp-server#2036)
• HTTP: enforce static CLI flags as upper bound for per-request filtering (feat(http): enforce static CLI flags as upper bound for per-request filtering github-mcp-server#2208)
• ProjectV2 status update tools: list, get, create (Add ProjectV2 status update tools (list, get, create) github-mcp-server#1987)

Bug Fixes

• Fixed SHA validation in create_or_update_file (Fix SHA validation in create_or_update_file github-mcp-server#2134)
• Handle empty files in get_file_contents (fix: Handle empty files in get_file_contents github-mcp-server#2042)
• Fixed panic when fetching resources fails due to network error (Fix panic when fetching resources fails due to network error github-mcp-server#1506)

Full Changelog: github/github-mcp-server@v0.32.0...v0.33.0

View v1.0.0 Highlights (most recent)

New Features

• set_issue_fields tool — set, update, or delete organization-level custom field values on issues (feature-flagged under issues_granular) (Add granular tool to set issue field values github-mcp-server#2338)
• MCP Apps feature flag — remote_mcp_ui_apps feature flag replaces insiders-only mode; rolling out to more users (Migrate MCP Apps support from insiders mode to feature flag with insiders opt-in github-mcp-server#2335)
• X-MCP-Features header validation — HeaderAllowedFeatureFlags for HTTP feature flag control (feat(http): implement HeaderAllowedFeatureFlags for X-MCP-Features header validation github-mcp-server#2332)
• MCP Go SDK upgraded to v1.5.0 (deps: upgrade modelcontextprotocol/go-sdk to v1.5.0 github-mcp-server#2336)

Full Changelog: github/github-mcp-server@v0.33.1...v1.0.0

Breaking Changes

No explicit breaking changes documented in the v1.0.0 release notes. The major version bump reflects a stability milestone rather than a breaking API change. No migration steps required.

Impact Assessment

• Risk: Medium (major version bump warrants smoke test)
• The Docker image tag changes from v0.32.0 to v1.0.0 — verify image pulls correctly
• No schema changes to the tool interface documented

Package Links

• Repository: https://github.com/github/github-mcp-server
• Release Notes (v1.0.0): https://github.com/github/github-mcp-server/releases/tag/v1.0.0

---

Recommendations

1. Smoke-test Copilot CLI (MCP loading + PAT auth model listing) — most sensitive upgrade
2. Verify GitHub MCP Server Docker image pull with new v1.0.0 tag
3. No action needed for Codex or Claude Code beyond monitoring

References:

• §24547560881

Generated by CLI Version Checker · ● 255.1K · ◷

• expires on Apr 19, 2026, 4:30 AM UTC