[ca] CLI Updates: Claude Code 2.1.144, Copilot 1.0.50, Codex 0.131.0, GitHub MCP Server v1.0.5, MCP Gateway v0.3.12 #33234

Summary

Version check on 2026-05-19 detected updates across five tracked components. Playwright tooling (MCP, CLI, Browser) is unchanged.

No-Change Inventory

• Playwright MCP: 0.0.75
• Playwright CLI: 0.1.13
• Playwright Browser: v1.60.0

Related Open Issues (Dedup Note)

• Bump firewall to v0.25.47 and mcpg to v0.3.10 #32502 — open since 2026-05-16, targets mcpg v0.3.10. Stale: MCPG is now v0.3.12. Reviewers should close Bump firewall to v0.25.47 and mcpg to v0.3.10 #32502 in favor of this issue (or rebase its checklist onto v0.3.12).
• [ca] CLI Updates: Claude Code 2.1.143 and MCP Gateway v0.3.10 #32581 — closed (superseded by this issue).

Update Claude Code

• Previous: 2.1.142 → New: 2.1.144 (intermediate: 2.1.143)
• Risk: Low (patch-level; no public repository)

Claude Code has no public GitHub repository, so detailed release notes are not available. The bump spans two patches (2.1.143 published earlier this week, 2.1.144 today). Patch releases at this semver level are typically bug fixes, stability tweaks, and minor refinements.

Package Links

• NPM Package: https://www.npmjs.com/package/`@anthropic-ai/claude-code`

Update GitHub Copilot CLI

• Previous: 1.0.48 → New: 1.0.50 (intermediate: 1.0.49)
• Risk: Low (patch-level; repository is private — limited public changelog)

The github/copilot-cli repository is not publicly accessible from this workflow's authentication context, so detailed release notes cannot be fetched. The bump spans two patches.

Validation reminder (from DefaultCopilotVersion constant doc): when upgrading, verify:

• MCPs are not blocked from loading (tools.mcp configuration still works end-to-end)
• /models does not silently fail on PATs (model listing works with PAT auth)

Package Links

• NPM Package: https://www.npmjs.com/package/`@github/copilot`
• Repository: https://github.com/github/copilot-cli (private)

Update OpenAI Codex

• Previous: 0.130.0 → New: 0.131.0
• Released: 2026-05-18
• Risk: Medium (minor version; contains TUI / sandbox / app-server behavior changes worth a smoke run)

Release Highlights (from GitHub release notes)

• TUI: richer session controls — data-driven service-tier commands, blended token usage, permissions/approval mode in status line, effective workspace roots, responsive Markdown tables ([codex] Generalize service tier slash commands openai/codex#21745, [codex] Lowercase TUI service tier commands openai/codex#21906, Display blended token count in status line openai/codex#21669, Show permissions and approval mode in the TUI status line openai/codex#21677, feat(tui): render responsive Markdown tables in TUI openai/codex#22052)
• @ mentions: unified picker that searches files, directories, plugins, and skills via app-server plugin metadata (Unified mentions in TUI openai/codex#19068, Use plugin/list to get list of plugins for mentions openai/codex#22375)
• Plugin workflows: marketplace CLI commands, version-aware sharing, share checkout, default-enabled plugin hooks ([codex] add plugin marketplace CLI commands openai/codex#21396, feat: Expose plugin versions and gate plugin sharing openai/codex#22397, feat: Split shared workspace plugins by discoverability openai/codex#22425, feat: Add plugin share checkout openai/codex#22435, Enable plugin hooks by default openai/codex#22549)
• Remote workflows: daemon-managed codex remote-control, runtime enable/disable APIs, status reads, registry-backed remote environments ([daemon] Add app-server daemon lifecycle management openai/codex#20718, Update codex remote-control to start the daemon openai/codex#22218, Improve remote-control daemon UX openai/codex#22562, enable/disable remote control at runtime, not via features openai/codex#22578, feat(app-server): update remote control APIs for better UX openai/codex#22877)
• Python SDK: moved to openai-codex / openai_codex, pinned runtime-generated types, concurrent turn routing, approval modes (Route Python SDK turn notifications by ID openai/codex#21778, [1/8] Pin Python SDK runtime dependency openai/codex#21891, [2/8] Generate Python SDK types from pinned runtime openai/codex#21893, [4/8] Define Python SDK public API surface openai/codex#21896, [5/8] Rename Python SDK package to openai-codex openai/codex#21905, [6/8] Add high-level Python SDK approval mode openai/codex#21910, [7/8] Add Python SDK app-server integration harness openai/codex#22014)
• New codex doctor: support-ready diagnostics for runtime, auth, terminal, network, config, and local state (feat(cli): add codex doctor diagnostics openai/codex#22336)

Impact Assessment

• Risk: Medium — minor bump, large surface; no breaking changes called out, but TUI status-line additions and @ mention unification touch interactive flows used by gh-aw Codex workflows.
• Affects: any workflow using engine: codex; the new codex doctor command may be useful for debugging future sandbox-bound runs.
• Migration: none required at the constants level; existing Codex configs remain compatible.

Package Links

• NPM Package: https://www.npmjs.com/package/`@openai/codex`
• Repository: https://github.com/openai/codex
• Release Notes: https://github.com/openai/codex/releases/tag/rust-v0.131.0
• Compare: openai/codex@rust-v0.130.0...rust-v0.131.0

Update GitHub MCP Server

• Previous: v1.0.4 → New: v1.0.5
• Released: 2026-05-18
• Risk: Low (additive tools and ifc labels; one new tool, no breaking changes)

Key Changes

• New tool: list_repository_collaborators (Add tool to list repo collaborators github-mcp-server#2477)
• New tool: discussion comment write operations (feat: Add tool for discussion comment write operations github-mcp-server#2427)
• New optional parameter: rationale on update_issue_type tool (Add optional rationale parameter to update_issue_type tool github-mcp-server#2458)
• Fix: Added missing pagination on get_reviews (fix: add missing pagination on get_reviews github-mcp-server#2367)
• Optimization: Return minimal code search results with text match snippets (feat: return minimal code search results with text match snippets github-mcp-server#2476)
• ifc labels added to: list_issues, get_file_contents, search_issues, issue_read, search_repositories (Add ifc label for list_issues tool github-mcp-server#2453, Add ifc label for get_file_contents tool github-mcp-server#2454, Add ifc label for search_issues tool github-mcp-server#2456, Add ifc label for issue_read tool github-mcp-server#2457, Add ifc label for search_repositories tool github-mcp-server#2459)
• Infrastructure: Replace ingress IFC reader list with private marker (Replace ingress IFC reader list with private marker github-mcp-server#2478); upgrade go-github to v0.87 (Upgrade go-github to v 0.87 github-mcp-server#2452)
• Docs: Document Copilot Spaces PAT requirements (Document Copilot Spaces PAT requirements github-mcp-server#2479)

Impact Assessment

• Risk: Low — additive surface; existing tool contracts unchanged.
• Affects: workflows declaring tools.github will pick up the new list_repository_collaborators and discussion-comment-write tools. MCP Gateway's DIFC policy already classifies these (see MCPG v0.3.11 below).
• Migration: none required.

Package Links

• Repository: https://github.com/github/github-mcp-server
• Release Notes: https://github.com/github/github-mcp-server/releases/tag/v1.0.5
• Compare: github/github-mcp-server@v1.0.4...v1.0.5

Update MCP Gateway (gh-aw-mcpg)

• Previous: v0.3.9 → New: v0.3.12 (intermediates: v0.3.10, v0.3.11)
• Released: v0.3.10 on 2026-05-15, v0.3.11 on 2026-05-17, v0.3.12 on 2026-05-18
• Risk: Low–Medium (three patches; guard-policy classification changes for new GitHub MCP tools are observable for workflow authors)

This bump touches the default sandbox.agent container image (ghcr.io/github/gh-aw-mcpg). Per the constant's doc, make build && make recompile && make recompile must be run to refresh container SHA pins across all generated lock files.

Key Changes (v0.3.10 → v0.3.12)

• Guard policy: classify discussion_comment_write and add list_repository_collaborators DIFC rules — required to pair with GitHub MCP Server v1.0.5's new tools (fix(guard): classify discussion_comment_write; add list_repository_collaborators DIFC rules gh-aw-mcpg#5818, Align list_repository_collaborators DIFC integrity to reader-level gh-aw-mcpg#5843)
• DIFC proxy: Support gh CLI /meta probe (Support gh CLI /meta probe in DIFC proxy gh-aw-mcpg#5924)
• OTEL: Read OTEL_EXPORTER_OTLP_HEADERS env var as fallback for OTLP export headers (feat: read OTEL_EXPORTER_OTLP_HEADERS env var as fallback for OTLP export headers gh-aw-mcpg#5849)
• Fix: Fall back to stderr (not stdout) when --log-dir is unwritable (fix: fall back to stderr (not stdout) when log-dir is unwritable gh-aw-mcpg#5773)
• Proxy: Replace http.Error with httputil.WriteErrorResponse for consistent JSON error shape (proxy: replace http.Error with httputil.WriteErrorResponse for consistent JSON error shape gh-aw-mcpg#5819)
• Performance: rust-guard removes hot-path scope/integrity allocations via Cow<str> and zero-alloc rank matching (rust-guard: remove hot-path scope/integrity allocations via Cow<str> and zero-alloc rank matching gh-aw-mcpg#5754)

Impact Assessment

• Risk: Low–Medium — guard policy now classifies new tools that GitHub MCP Server v1.0.5 introduces; without this bump, those new tools would be unclassified by DIFC.
• Affects: every generated workflow whose sandbox.agent resolves to the default ghcr.io/github/gh-aw-mcpg image.
• Migration: constant + lock file regeneration; no consumer-facing API changes.

Package Links

• Repository: https://github.com/github/gh-aw-mcpg
• Release Notes: https://github.com/github/gh-aw-mcpg/releases/tag/v0.3.12
• Compare: github/gh-aw-mcpg@v0.3.9...v0.3.12
• Docker Image: ghcr.io/github/gh-aw-mcpg:v0.3.12

Recommendations

• Order matters: bump DefaultGitHubMCPServerVersion (v1.0.5) and DefaultMCPGatewayVersion (v0.3.12) together — the MCPG v0.3.11 guard-policy update is the prerequisite for safely exposing the new GitHub MCP tools (list_repository_collaborators, discussion-comment-write).
• Bundle Claude Code, Copilot, Codex in a separate PR from the MCPG/GitHub-MCP pair so the container-SHA recompile churn does not mix with NPM-only constant updates.
• After bumping MCPG, run make build && make recompile && make recompile twice as documented; verify lock files reference the new digest.
• Validate next CI run on a workflow that exercises both engines (Claude + Copilot + Codex) and at least one workflow using the new github MCP tools.
• Close or rebase Bump firewall to v0.25.47 and mcpg to v0.3.10 #32502 — its MCPG target (v0.3.10) is now stale.

References:

• §26080697468

Generated by 🔢 CLI Version Checker · ● 11M · ◷

• expires on May 21, 2026, 6:43 AM UTC