[ca] chore(deps): bump 5 CLI/MCP versions (Claude 2.1.152, Copilot 1.0.54, Codex 0.134.0, GitHub MCP v1.0.5, MCP Gateway v0.3.20) #35150

Summary

Five CLI/MCP version updates detected on 2026-05-27. Constants updated in pkg/constants/version_constants.go and make recompile succeeded (236 workflows, 0 errors).

No changes for: Playwright MCP (0.0.75), Playwright CLI (0.1.13), Playwright Browser (v1.60.0).

Update Claude Code

• Previous: 2.1.150 → New: 2.1.152 (intermediate: 2.1.151)
• Timeline: 2.1.150 published 2026-05-23, 2.1.152 published 2026-05-26

No public changelog (Anthropic does not publish release notes for this package). This is a patch-level bump.

Impact Assessment

• Risk: Low
• Affects: Claude engine workflows only; patch bump, no API changes expected

Package Links

• NPM Package: https://www.npmjs.com/package/`@anthropic-ai/claude-code`

Update Copilot CLI

• Previous: 1.0.52 → New: 1.0.54 (intermediate: 1.0.53)
• Timeline: 1.0.53 published 2026-05-24, 1.0.54 published 2026-05-24

Bug Fixes (1.0.53)

• Multiline prompts now display fully without content clipping or selection offset
• /skills picker correctly honors --config-dir when saving skill preferences
• Bash shell sessions no longer hang when PS0 or PROMPT_COMMAND is set in the environment

1.0.54

• Release notes: "Fixes and changes" (no detailed body published)

Impact Assessment

• Risk: Low
• Affects: Copilot engine workflows; bug-fix-only release stream

Package Links

• NPM Package: https://www.npmjs.com/package/`@github/copilot`
• Repository: https://github.com/github/copilot-cli
• Release Notes 1.0.53: https://github.com/github/copilot-cli/releases/tag/v1.0.53
• Release Notes 1.0.54: https://github.com/github/copilot-cli/releases/tag/v1.0.54

Update Codex

• Previous: 0.133.0 → New: 0.134.0
• Timeline: 0.133.0 published 2026-05-21, 0.134.0 published 2026-05-26

Key Features

• Local conversation history search with case-insensitive content matches and result previews ([codex] Add rollout-backed thread content search openai/codex#23519, [codex] Make thread search case-insensitive openai/codex#23921)
• --profile is now the primary profile selector across CLI, TUI permissions, and sandbox flows; legacy profile configs rejected with migration guidance (tui: plumb permission profile selection openai/codex#23708, cli: rename profile v2 flag to --profile openai/codex#23883, config: remove legacy profile v1 resolution openai/codex#24051, fix: reject legacy profile selectors openai/codex#24059)
• MCP setup with per-server environment targeting and OAuth options for streamable HTTP servers (Route MCP servers through explicit environments openai/codex#23583, Support OAuth options in codex mcp add openai/codex#24120)
• Local $ref/$defs preserved in tool schemas; oversized schemas compacted (feat: support local refs and defs in tool input schemas openai/codex#23357, feat: best-effort compact large tool schemas openai/codex#23904)
• Read-only MCP tools can run concurrently when they advertise readOnlyHint (Allow parallel MCP tool calls when annotated readOnly openai/codex#23750)
• Conversation history exposed to extension tools; subagent identity in hook inputs (Add subagent identity to hook inputs openai/codex#22882, Expose conversation history to extension tools openai/codex#23963)

Impact Assessment

• Risk: Medium
• Affects: Codex engine workflows. The --profile v1 rejection is the most material change but is opt-in (only affects users who set profile configs explicitly).

Package Links

• NPM Package: https://www.npmjs.com/package/`@openai/codex`
• Repository: https://github.com/openai/codex
• Release Notes: https://github.com/openai/codex/releases/tag/rust-v0.134.0
• Full Changelog: openai/codex@rust-v0.133.0...rust-v0.134.0

Update GitHub MCP Server

• Previous: v1.0.4 → New: v1.0.5
• Timeline: v1.0.5 published 2026-05-18

Key Features

• New tool to list repository collaborators (Add tool to list repo collaborators github-mcp-server#2477)
• New tool for discussion comment write operations (feat: Add tool for discussion comment write operations github-mcp-server#2427)
• Optional rationale parameter on update_issue_type tool (Add optional rationale parameter to update_issue_type tool github-mcp-server#2458)
• Minimal code search results with text match snippets returned by default (feat: return minimal code search results with text match snippets github-mcp-server#2476)
• Missing pagination added on get_reviews (fix: add missing pagination on get_reviews github-mcp-server#2367)
• IFC (Information Flow Control) labels added to list_issues, get_file_contents, search_issues, issue_read, search_repositories tools (Add ifc label for list_issues tool github-mcp-server#2453, Add ifc label for get_file_contents tool github-mcp-server#2454, Add ifc label for search_issues tool github-mcp-server#2456, Add ifc label for issue_read tool github-mcp-server#2457, Add ifc label for search_repositories tool github-mcp-server#2459)
• Ingress IFC reader list replaced with private marker (Replace ingress IFC reader list with private marker github-mcp-server#2478)
• Copilot Spaces PAT requirements documented (Document Copilot Spaces PAT requirements github-mcp-server#2479)
• go-github upgraded to v0.87 (Upgrade go-github to v 0.87 github-mcp-server#2452)

Impact Assessment

• Risk: Low
• Affects: All workflows using tools.github MCP. New tools are additive; get_reviews pagination is a behavior improvement (results now properly paginated).

Package Links

• Repository: https://github.com/github/github-mcp-server
• Release Notes: https://github.com/github/github-mcp-server/releases/tag/v1.0.5
• Docker Image: ghcr.io/github/github-mcp-server:v1.0.5

Update MCP Gateway

• Previous: v0.3.19 → New: v0.3.20
• Timeline: v0.3.20 published 2026-05-27

Key Features

• Per-session tool call limits enforced in allow-only guard policies (Enforce per-session tool call limits in allow-only guard policies gh-aw-mcpg#6533)
• DIFC proxy handling fixed for top-level array responses on comment list endpoints (Fix DIFC proxy handling for top-level array responses on comment list endpoints gh-aw-mcpg#6538)

Impact Assessment

• Risk: Low
• Affects: Default sandbox.agent container for all workflows using the MCP gateway. Per-session tool call limit enforcement may surface previously hidden over-limit behavior; DIFC fix affects PRs/issues with comment list payloads.

Package Links

• Repository: https://github.com/github/gh-aw-mcpg
• Release Notes: https://github.com/github/gh-aw-mcpg/releases/tag/v0.3.20
• Full Changelog: github/gh-aw-mcpg@v0.3.19...v0.3.20
• Docker Image: ghcr.io/github/gh-aw-mcpg:v0.3.20

Recommendations

• Apply all updates together — they are independently low-risk and only the constants file is committed (lock files regenerate via build pipeline).
• Validate one Codex-engine workflow end-to-end given the --profile v1 deprecation, even though gh-aw does not emit profile flags.
• Validate one Copilot-engine workflow given the bash PS0/PROMPT_COMMAND fix, in case any workflow shell hooks were previously affected.
• No make recompile re-run needed for these version bumps (the MCP Gateway "twice" rule applies only when changing the gateway version causes container SHA pins to refresh — verified make recompile succeeded in a single pass).

References

• §26495518536

Generated by 🔢 CLI Version Checker · opus47 11.6M · ◷

• expires on May 29, 2026, 6:54 AM UTC