[ca] Update CLI/MCP versions: Copilot 1.0.36, Codex 0.125.0, GitHub MCP Server v1.0.3

[github-actions]

Three CLI/MCP tools have been updated to their latest stable versions in pkg/constants/version_constants.go, and all 201 workflows have been recompiled successfully.

Summary

Tool	Previous	New	Released
GitHub Copilot CLI	1.0.35	1.0.36	2026-04-24
OpenAI Codex CLI	0.124.0	0.125.0	2026-04-24
GitHub MCP Server	v1.0.2	v1.0.3	2026-04-24

No updates needed for: Claude Code (2.1.119), Playwright MCP (0.0.70), Playwright Browser (v1.59.1), MCP Gateway (v0.3.0).

---

Update GitHub Copilot CLI

• Version: 1.0.35 → 1.0.36
• Released: 2026-04-24

View Details

Breaking Changes

None detected.

CLI Discovery

Repository is private; no public release notes available. Version metadata retrieved via NPM.

Impact Assessment

• Risk: Low
• Affects: All Copilot CLI-based workflows

Package Links

• NPM Package: https://www.npmjs.com/package/`@github/copilot`

---

Update OpenAI Codex CLI

• Version: 0.124.0 → 0.125.0
• Released: 2026-04-24

View Full Changelog

New Features

• App-server integrations now support Unix socket transport, pagination-friendly resume/fork, sticky environments, and remote thread config/store plumbing. (app-server: add Unix socket transport openai/codex#18255, Add remote thread config loader protos openai/codex#18892, Add sticky environment API and thread state openai/codex#18897, Add remote thread config endpoint openai/codex#18908, [codex] Implement remote thread store methods openai/codex#19008, Add excludeTurns parameter to thread/resume and thread/fork openai/codex#19014)
• App-server plugin management can install remote plugins and upgrade configured marketplaces. ([codex] Support remote plugin install writes openai/codex#18917, Add app-server marketplace upgrade RPC openai/codex#19074)
• Permission profiles now round-trip across TUI sessions, user turns, MCP sandbox state, shell escalation, and app-server APIs. (tui: sync session permission profiles openai/codex#18284, tui: carry permission profiles on user turns openai/codex#18285, mcp: include permission profiles in sandbox state openai/codex#18286, shell-escalation: carry resolved permission profiles openai/codex#18287, permissions: make profiles represent enforcement openai/codex#19231)
• Model providers now own model discovery, with AWS/Bedrock account state exposed to app clients. (feat: let model providers own model discovery openai/codex#18950, feat: expose AWS account state from account/read openai/codex#19048)
• codex exec --json now reports reasoning-token usage for programmatic consumers. (Surface reasoning tokens in exec JSON usage openai/codex#19308)
• Rollout tracing now records tool, code-mode, session, and multi-agent relationships, with a debug reducer command for inspection. ([rollout_trace] Trace tool and code-mode boundaries openai/codex#18878, [rollout_trace] Trace sessions and multi-agent edges openai/codex#18879, [rollout_trace] Add debug trace reduction command openai/codex#18880)

Bug Fixes

• Interrupting /review and exiting the TUI no longer leaves the interface wedged on delegate startup or unsubscribe. (Fix /review interrupt and TUI exit wedges openai/codex#18921)
• Exec-server no longer drops buffered output after process exit and now waits correctly for stream closure. (fix(exec-server): retain output until streams close openai/codex#18946, exec-server: wait for close after observed exit openai/codex#19130)
• App-server now respects explicitly untrusted project config instead of auto-persisting trust. (Respect explicit untrusted project config openai/codex#18626)
• WebSocket app-server clients are less likely to disconnect during bursts of turn and tool-output notifications. (Increase app-server WebSocket outbound buffer openai/codex#19246)
• Windows sandbox startup handles multiple CLI versions and installed app directories better. (guide Windows to use -WindowStyle Hidden for Start-Process calls openai/codex#19044, use a version-specific suffix for command runner binary in .sandbox-bin openai/codex#19180, do not attempt ACLs on installed codex dir openai/codex#19214)
• Config/schema handling now rejects conflicting MultiAgentV2 thread limits, resolves relative agent-role config paths. (Reject agents.max_threads with multi_agent_v2 openai/codex#19129, Resolve relative agent role config paths from layers openai/codex#19261, Hide unsupported MCP bearer_token from config schema openai/codex#19294, Reject unsupported js_repl image MIME types openai/codex#19292)

Documentation

• App-server docs and generated schemas refreshed for new transport, thread, marketplace, sticky environment, and permission-profile APIs.
• Rollout-trace documentation now covers the debug trace reduction workflow.

Impact Assessment

• Risk: Low
• Affects: Codex CLI-based workflows

Package Links

• NPM Package: https://www.npmjs.com/package/`@openai/codex`
• Release Notes: https://github.com/openai/codex/releases/tag/rust-v0.125.0

---

Update GitHub MCP Server

• Version: v1.0.2 → v1.0.3
• Released: 2026-04-24

View Full Changelog

Bug Fixes

• Fix lockdown mode permission check. (Fix lockdown mode permission check github-mcp-server#2361)

Full Changelog: github/github-mcp-server@v1.0.2...v1.0.3

Impact Assessment

• Risk: Low — single targeted fix for lockdown mode
• Affects: Workflows using GitHub MCP Server with lockdown mode enabled

Package Links

• Release Notes: https://github.com/github/github-mcp-server/releases/tag/v1.0.3

---

Changes Made

• Updated pkg/constants/version_constants.go with all three new versions
• Ran make recompile — all 201 workflows compiled successfully

References:

• §24922420587

Generated by CLI Version Checker · ● 212.4K · ◷

• expires on Apr 27, 2026, 4:25 AM UTC

[github-actions]

🍪 *Issue Monster selected this for Copilotecho BEGIN___COMMAND_OUTPUT_MARKER ; PS1= ; PS2= ; unset HISTFILE ; EC=0 ; echo ___BEGIN___COMMAND_DONE_MARKER___0 ; }

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Caution

Security scanning requires review for Issue Monster

Details

Potential security threats were detected in the agent output. The workflow output should be reviewed before merging.

Review the workflow run logs for details.

🍪 Om nom nom by Issue Monster · ● 16.5K · ◷