Bump default CLI/MCP toolchain versions and regenerate workflow locks by Copilot · Pull Request #33246 · github/gh-aw

Copilot · 2026-05-19T09:03:16Z

This updates the tracked default toolchain versions from the 2026-05-19 inventory: Claude Code, Copilot CLI, Codex, GitHub MCP Server, and MCP Gateway. It also aligns generated lock files with the new MCP/GitHub MCP pairing so workflow outputs consume the updated defaults consistently.

Version constant updates
- pkg/constants/version_constants.go
- DefaultClaudeCodeVersion: 2.1.142 → 2.1.144
- DefaultCopilotVersion: 1.0.48 → 1.0.50
- DefaultCodexVersion: 0.130.0 → 0.131.0
- DefaultGitHubMCPServerVersion: v1.0.4 → v1.0.5
- DefaultMCPGatewayVersion: v0.3.9 → v0.3.12
Generated workflow lock refresh
- Recompiled lock files across .github/workflows/*.lock.yml to propagate:
  - new CLI install defaults (Claude/Copilot/Codex)
  - new container tags/digests for github-mcp-server and gh-aw-mcpg
- Ensures compiled workflows and pinned artifacts are synchronized with the updated defaults.
Release metadata
- Added .changeset/patch-update-cli-tool-versions-2026-05-19.md documenting the coordinated version bump.

// pkg/constants/version_constants.go
const DefaultClaudeCodeVersion Version = "2.1.144"
const DefaultCopilotVersion Version = "1.0.50"
const DefaultCodexVersion Version = "0.131.0"
const DefaultGitHubMCPServerVersion Version = "v1.0.5"
const DefaultMCPGatewayVersion Version = "v0.3.12"

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-05-19T09:20:22Z

❌ Smoke OTEL failed. Please review the logs for details.

github-actions · 2026-05-19T09:20:25Z

⚠️ Smoke Gemini failed. Gemini encountered unexpected challenges...

github-actions · 2026-05-19T09:20:25Z

⚠️ Smoke Pi failed. Pi encountered unexpected challenges...

Copilot

Pull request overview

Updates the repository’s default CLI/MCP toolchain versions to the latest inventory and refreshes generated workflow lock files so compiled workflows consume the new defaults consistently.

Changes:

Bumped default versions for Claude Code, GitHub Copilot CLI, Codex, GitHub MCP Server image, and MCP Gateway image.
Regenerated .github/workflows/*.lock.yml files to reflect the new tool versions and container tags.
Updated action pin datasets / cache and added a Changeset entry documenting the coordinated patch bump.

Show a summary per file

File	Description
pkg/constants/version_constants.go	Updates default toolchain version constants (CLIs + MCP containers).
pkg/workflow/data/action_pins.json	Adds additional action refs to the embedded pin dataset.
pkg/actionpins/data/action_pins.json	Mirrors the embedded action pin dataset update for the actionpins package.
.github/aw/actions-lock.json	Updates the repo’s cached action lock entries used during compilation.
.github/workflows/video-analyzer.lock.yml	Regenerated lock workflow to use updated Copilot/MCP versions.
.github/workflows/test-workflow.lock.yml	Regenerated lock workflow to use updated Copilot/MCP versions.
.github/workflows/test-dispatcher.lock.yml	Regenerated lock workflow to use updated Copilot/MCP versions.
.github/workflows/smoke-pi.lock.yml	Regenerated lock workflow to use updated MCP Gateway / MCP Server versions.
.github/workflows/smoke-opencode.lock.yml	Regenerated lock workflow to use updated MCP Gateway / MCP Server versions.
.github/workflows/smoke-gemini.lock.yml	Regenerated lock workflow to use updated MCP Gateway / MCP Server versions.
.github/workflows/smoke-crush.lock.yml	Regenerated lock workflow to use updated MCP Gateway / MCP Server versions.
.github/workflows/smoke-ci.lock.yml	Regenerated lock workflow to use updated Copilot/MCP versions.
.github/workflows/research.lock.yml	Regenerated lock workflow to use updated Copilot/MCP versions.
.github/workflows/repo-tree-map.lock.yml	Regenerated lock workflow to use updated Copilot/MCP versions.
.github/workflows/hippo-embed.lock.yml	Regenerated lock workflow to use updated Copilot/MCP versions.
.github/workflows/github-remote-mcp-auth-test.lock.yml	Regenerated lock workflow to use updated Copilot + MCP Gateway version.
.github/workflows/firewall.lock.yml	Regenerated lock workflow to use updated Copilot/MCP versions.
.github/workflows/example-permissions-warning.lock.yml	Regenerated lock workflow to use updated Copilot/MCP versions.
.github/workflows/dev.lock.yml	Regenerated lock workflow to use updated MCP Gateway / MCP Server versions.
.github/workflows/daily-team-evolution-insights.lock.yml	Regenerated lock workflow to use updated Claude Code + MCP versions.
.github/workflows/daily-malicious-code-scan.lock.yml	Regenerated lock workflow to use updated Copilot/MCP versions.
.github/workflows/copilot-token-optimizer.lock.yml	Regenerated lock workflow to use updated Copilot/MCP versions.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Regenerated lock workflow to use updated Codex + MCP Gateway version.
.github/workflows/cli-consistency-checker.lock.yml	Regenerated lock workflow to use updated Copilot/MCP versions.
.github/workflows/changeset.lock.yml	Regenerated lock workflow to use updated Codex + MCP versions.
.github/workflows/bot-detection.lock.yml	Regenerated lock workflow to use updated Copilot/MCP versions.
.github/workflows/ace-editor.lock.yml	Regenerated lock workflow to use updated Copilot/MCP versions.
.changeset/patch-update-cli-tool-versions-2026-05-19.md	Adds release metadata describing the coordinated version bump.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 77/236 changed files
Comments generated: 2

@@ -105,7 +105,7 @@ const CopilotNoAskUserMinVersion Version = "1.0.19"
 //
 // The first recompile regenerates all lock files using the new version; the second recompile
 // refreshes the container SHA pins that were resolved during the first pass.
-const DefaultMCPGatewayVersion Version = "v0.3.9"
+const DefaultMCPGatewayVersion Version = "v0.3.12"


 # gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"8a82e5f819d781dddbf557ff7b33866a5fdcde1c43b2a0a187ba046cc840e6f4","strict":true,"agent_id":"copilot"}
-# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.49"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.49"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.49"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.9","digest":"sha256:64828b42a4482f58fab16509d7f8f495a6d97c972a98a68aff20543531ac0388","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.3.9@sha256:64828b42a4482f58fab16509d7f8f495a6d97c972a98a68aff20543531ac0388"},{"image":"ghcr.io/github/github-mcp-server:v1.0.4"},{"image":"node:lts-alpine","digest":"sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f","pinned_image":"node:lts-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f"}]}
+# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.49"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.49"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.49"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.12"},{"image":"ghcr.io/github/github-mcp-server:v1.0.5"},{"image":"node:lts-alpine","digest":"sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f","pinned_image":"node:lts-alpine@sha256:d1b3b4da11eefd5941e7f0b9cf17783fc99d9c6fc34884a665f40a06dbdfc94f"}]}


github-actions · 2026-05-19T10:16:16Z

Hey @Copilot 👋 — thanks for keeping the toolchain versions up to date! This looks like a systematic version bump and lock file regeneration. Here are a few observations to help this PR land smoothly:

Add tests — While this PR updates version constants and regenerates lock files, there are no test changes included. Consider adding or updating tests that verify the new version constants are correctly applied (e.g., integration tests that check the installed CLI versions match the new defaults, or unit tests confirming the constants are read correctly).
Clarify project alignment — The CONTRIBUTING.md doesn't explicitly list version bumps as a priority area. It might help to reference an issue or discussion that establishes why these specific version updates are needed now (e.g., security patch, feature requirement, deprecation timeline).

If you'd like to add test coverage, here's a prompt you can use:

Add integration tests to verify that the updated default toolchain versions in pkg/constants/version_constants.go are correctly applied when workflows are compiled. The tests should:
1. Confirm that DefaultClaudeCodeVersion, DefaultCopilotVersion, DefaultCodexVersion, DefaultGitHubMCPServerVersion, and DefaultMCPGatewayVersion constants match the expected values (2.1.144, 1.0.50, 0.131.0, v1.0.5, v0.3.12 respectively).
2. Validate that at least one generated workflow lock file references the new version numbers (e.g., check .github/workflows/ab-testing-advisor.lock.yml for updated container tags or CLI install versions).
3. Ensure the changeset file .changeset/patch-update-cli-tool-versions-2026-05-19.md is present and documents the version changes.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

patchdiff.githubusercontent.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "patchdiff.githubusercontent.com"

See Network Configuration for more information.

Generated by ✅ Contribution Check · ● 12.4M · ◷

Initial plan

05e1038

Copilot AI assigned Copilot and pelikhan May 19, 2026

Copilot started work on behalf of pelikhan May 19, 2026 09:03 View session

Copilot AI linked an issue May 19, 2026 that may be closed by this pull request

[ca] CLI Updates: Claude Code 2.1.144, Copilot 1.0.50, Codex 0.131.0, GitHub MCP Server v1.0.5, MCP Gateway v0.3.12 #33234

Open

Copilot AI and others added 2 commits May 19, 2026 09:13

Plan minimal CLI version update changes

f7f4ffc

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Bump default CLI and MCP versions and recompile lock files

8b65e36

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update CLI components to latest versions~~ Bump default CLI/MCP toolchain versions and regenerate workflow locks May 19, 2026

Copilot finished work on behalf of pelikhan May 19, 2026 09:18

Copilot AI requested a review from pelikhan May 19, 2026 09:18

pelikhan marked this pull request as ready for review May 19, 2026 09:19

Copilot AI review requested due to automatic review settings May 19, 2026 09:19

pelikhan added the smoke label May 19, 2026

github-actions Bot removed the smoke label May 19, 2026

Copilot started reviewing on behalf of pelikhan May 19, 2026 09:20 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

github-actions Bot mentioned this pull request May 19, 2026

[Contribution Check Report] Contribution Check — 2026-05-19 #33189

Open

pelikhan closed this May 19, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump default CLI/MCP toolchain versions and regenerate workflow locks#33246

Bump default CLI/MCP toolchain versions and regenerate workflow locks#33246
Copilot wants to merge 3 commits into
mainfrom
copilot/update-cli-versions-another-one

Copilot AI commented May 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 19, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

github-actions Bot commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 19, 2026 •

edited

Loading

github-actions Bot commented May 19, 2026 •

edited

Loading

github-actions Bot commented May 19, 2026 •

edited

Loading

github-actions Bot commented May 19, 2026 •

edited

Loading