[ca] CLI Version Updates: Claude Code, Copilot, Codex, GitHub MCP Server

[github-actions]

Summary

4 CLI tools have been updated in pkg/constants/version_constants.go. All 197 workflows recompiled successfully.

Tool	Previous	New	Risk
Claude Code	2.1.112	2.1.117	Low
GitHub Copilot CLI	1.0.21	1.0.34	Medium
OpenAI Codex CLI	0.121.0	0.122.0	Low
GitHub MCP Server	v1.0.0	v1.0.1	Low

No changes needed for: Playwright MCP (0.0.70 ✓), Playwright Browser (v1.59.1 ✓), MCP Gateway (v0.2.30 ✓).

---

Update Claude Code (2.1.112 → 2.1.117)

• Intermediate versions: 2.1.113, 2.1.114, 2.1.116, 2.1.117
• Source: No public GitHub repository; NPM-only

View Details

No public changelog available. Patch-level increments suggest bug fixes and stability improvements.

CLI Changes: No structural changes detected in --help output.

Package Links:

• NPM Package: https://www.npmjs.com/package/`@anthropic-ai/claude-code`

View Migration Guide

No breaking changes expected for patch versions. Standard upgrade.

Impact Assessment

• Risk: Low
• Affects: All workflows using Claude Code engine

---

Update GitHub Copilot CLI (1.0.21 → 1.0.34)

• Intermediate versions: 1.0.24, 1.0.25, 1.0.26, 1.0.27, 1.0.28, 1.0.29, 1.0.30, 1.0.31, 1.0.32, 1.0.33, 1.0.34
• Source: Private repository (https://github.com/github/copilot-cli)

View CLI Help Analysis

Key new flags and options discovered via copilot --help on v1.0.34:

New/Notable Options:

• --bash-env[=value] — Enable BASH_ENV support for bash shells (on|off)
• --connect[=sessionId] — Connect directly to a remote session (optionally specify session ID or task ID)
• --disallow-temp-dir — Prevent automatic access to the system temporary directory
• --enable-all-github-mcp-tools — Enable all GitHub MCP server tools instead of the default CLI subset
• --enable-reasoning-summaries — Request reasoning summaries for OpenAI models
• --fork-session — When resuming, create a new session ID instead of reusing the original
• --output-format <format> — Output format: 'text' (default) or 'json' (JSONL)
• --plain-diff — Disable rich diff rendering
• --plugin-dir <directory> — Load a plugin from a local directory
• --screen-reader — Enable screen reader optimizations
• --secret-env-vars[=vars...] — Strip sensitive env vars from shell/MCP environments
• --share[=path] / --share-gist — Share session to markdown file or secret GitHub gist
• --stream <mode> — Enable or disable streaming mode
• --yolo — Alias for --allow-all (allow all permissions)
• --no-custom-instructions — Disable loading from AGENTS.md and related files
• --no-remote / --remote — Control remote control of session from GitHub web and mobile
• --exclude-dynamic-system-prompt-sections (Claude Code equivalent) noted separately

New Commands:

• mcp — Manage MCP servers
• plugin — Manage plugins

New Help Topics:

• monitoring — Monitoring with OpenTelemetry
• providers — Custom Model Providers (BYOK)

Config Changes (from copilot help config):

• compactPaste — Collapse large pasted content; defaults to true
• companyAnnouncements — Team messages shown in banner
• custom_agents.default_local_only — Restrict to local custom agents
• disableAllHooks — Disable all hooks
• hooks — Inline hook definitions
• ide.auto_connect — Auto-connect to IDE workspace
• ide.open_diff_on_edit — Open diffs in IDE for approval
• powershellFlags — Flags passed to PowerShell on startup
• respectGitignore — Exclude gitignored files from @ file picker
• statusLine — Custom status line below input (command-type)
• streamerMode — Hide model names and quota details
• updateTerminalTitle — Update terminal title with current intent

Available Models (v1.0.34):

• Claude: claude-sonnet-4.6, claude-sonnet-4.5, claude-haiku-4.5, claude-opus-4.7, claude-opus-4.6, claude-opus-4.6-fast, claude-opus-4.5, claude-sonnet-4
• GPT: gpt-5.4, gpt-5.3-codex, gpt-5.2-codex, gpt-5.2, gpt-5.1, gpt-5.4-mini, gpt-5-mini, gpt-4.1

Environment Variables (new in copilot help environment):

• COPILOT_OFFLINE — Enable offline mode, skip network access
• COPILOT_PROVIDER_* — BYOK (Bring Your Own Key) provider configuration suite
• COPILOT_CUSTOM_INSTRUCTIONS_DIRS — Additional directories for custom instructions
• PLAIN_DIFF — Disable rich diff rendering
• USE_BUILTIN_RIPGREP — Use PATH ripgrep instead of bundled version
• Full OpenTelemetry suite: COPILOT_OTEL_*, OTEL_* variables

View Migration Guide

1. The --no-ask-user flag (introduced in v1.0.19) is still present and required for autonomous runs.
2. New --yolo flag is an alias for --allow-all — consider using it for shorter command lines.
3. BYOK (custom model providers) now supported via COPILOT_PROVIDER_* env vars.
4. Plugin system (--plugin-dir, plugin command) is new — no migration required but enables new capabilities.
5. Secret env var stripping (--secret-env-vars) improves security for sensitive workflows.

Impact Assessment

• Risk: Medium (13 intermediate versions, significant new features)
• Affects: All workflows using Copilot CLI engine
• Verify: MCPs not blocked, /models works with PAT auth (per existing pinning note)

Package Links

• NPM Package: https://www.npmjs.com/package/`@github/copilot`

---

Update OpenAI Codex CLI (0.121.0 → 0.122.0)

View Full Changelog

Release Highlights (from GitHub: https://github.com/openai/codex/releases/tag/rust-v0.122.0)

New Features:

• Desktop Integration: Standalone installs are more self-contained; codex app now opens or installs Desktop correctly on Windows and Intel Macs (Significantly improve standalone installer openai/codex#17022, Support codex app on macOS (Intel) and Windows openai/codex#18500)
• TUI Enhancements: Side conversations via /side command; queued input supporting slash commands and shell prompts during execution (Add /side conversations openai/codex#18190, Queue slash and shell prompts in the TUI openai/codex#18542)
• Plan Mode: Fresh context implementation with pre-decision context usage display (feat(tui): add clear-context plan implementation openai/codex#17499, feat(tui): show context used in plan implementation prompt openai/codex#18573)
• Plugin Workflows: Tabbed browsing, inline toggles, marketplace removal, cross-repo source support ( /plugins: Add v2 tabbed marketplace menu openai/codex#18222, /plugins: Add inline enablement toggles openai/codex#18395, [codex] Add marketplace remove command and shared logic openai/codex#17752)
• Security Enhancements: Deny-read glob policies, managed requirements, platform sandbox enforcement, isolated codex exec runs (feat(permissions): add glob deny-read policy support openai/codex#15979, feat(sandbox): add glob deny-read platform enforcement openai/codex#18096)
• Tool Discovery & Images: Now enabled by default with higher-detail image handling (Update ToolSearch to be enabled by default openai/codex#17854, Update image outputs to default to high detail openai/codex#18386)

Bug Fixes:

• Stale app-server prompts dismiss when resolved remotely (Dismiss stale app-server requests after remote resolution openai/codex#15134)
• Remote-control tolerates missing ChatGPT auth (fix: auth preflight openai/codex#18117)
• TUI stability improvements across skills, resume hints, and menus (Avoid fatal TUI errors on skills list failure openai/codex#18061, Fix invalid TUI resume hints openai/codex#18059)
• Filesystem sandbox corrections for split policies (fix: fix fs sandbox helper for apply_patch openai/codex#18296)

Infrastructure:

• Security boundaries documentation added to SECURITY.md
• Code reorganization: plugin logic extracted to codex-core-plugins
• Bazel/CI stabilization with native Rust test sharding

View Migration Guide

No breaking changes noted. Security enhancements (deny-read glob policies, sandbox enforcement) may affect workflows running codex exec in restricted environments.

Impact Assessment

• Risk: Low
• Affects: All workflows using Codex engine

Package Links

• NPM Package: https://www.npmjs.com/package/`@openai/codex`
• Release Notes: https://github.com/openai/codex/releases/tag/rust-v0.122.0

---

Update GitHub MCP Server (v1.0.0 → v1.0.1)

View Full Changelog

Release Notes (from https://github.com/github/github-mcp-server/releases/tag/v1.0.1)

Bug Fixes:

• Fix Content-Type rejection for application/json; charset=utf-8 by @IrynaKulakova (Fix Content-Type rejection for application/json; charset=utf-8 github-mcp-server#2362)
• SDK Regression: Re-allow browser-based MCP clients via CORS by @RossTarrant (SDK Regression: Re-allow browser-based MCP clients via CORS github-mcp-server#2359)

Dependencies:

• build(deps): bump docker/build-push-action from 7.0.0 to 7.1.0 (build(deps): bump docker/build-push-action from 7.0.0 to 7.1.0 github-mcp-server#2357)
• build(deps): bump actions/github-script from 8 to 9 (build(deps): bump actions/github-script from 8 to 9 github-mcp-server#2356)
• build(deps): bump golang base image (build(deps): bump golang from 04d017a to 5caaf1c github-mcp-server#2355)

Full Changelog: github/github-mcp-server@v1.0.0...v1.0.1

View Migration Guide

No breaking changes. The Content-Type fix (github/github-mcp-server#2362) may improve compatibility with clients sending charset annotations. CORS fix (github/github-mcp-server#2359) restores browser-based MCP client access.

Impact Assessment

• Risk: Low (bug fixes only)
• Affects: Workflows using GitHub MCP server tools

Package Links

• Release Notes: https://github.com/github/github-mcp-server/releases/tag/v1.0.1

---

No Changes Required

Tool	Version	Status
Playwright MCP	0.0.70	✓ Up to date
Playwright Browser	v1.59.1	✓ Up to date
MCP Gateway	v0.2.30	✓ Up to date

---

References:

• §24760047157

Generated by CLI Version Checker · ● 312.5K · ◷

• expires on Apr 24, 2026, 4:29 AM UTC

[github-actions]

🍪 *Issue Monster selected this for Copilotecho BEGIN___COMMAND_OUTPUT_MARKER ; PS1= ; PS2= ; unset HISTFILE ; EC=0 ; echo ___BEGIN___COMMAND_DONE_MARKER___0 ; }

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Caution

Security scanning requires review for Issue Monster

Details

Potential security threats were detected in the agent output. The workflow output should be reviewed before merging.

Review the workflow run logs for details.

🍪 Om nom nom by Issue Monster · ● 13.6K · ◷

[pelikhan]

@copilot do not upgrade copilot-cli

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #28199

View newer issue

---

This action was performed automatically by the CLI Version Checker workflow.