[ca] chore: CLI version updates — Claude 2.1.178, Codex 0.140.0, Playwright Browser v1.61.0, MCP Gateway v0.3.26, Pi 0.79.4, Copilot [Content truncated due to length]

[github-actions]

Summary

The 2026-06-16 CLI version check finds 10 tools newer than the versions pinned in pkg/constants/version_constants.go. Supersedes #39194 (the 2026-06-14 check, now expired). Two tools that were up-to-date in #39194 have new releases this cycle — MCP Gateway v0.3.26 and Playwright Browser v1.61.0 — alongside patch/minor bumps to Claude, Copilot CLI, Codex, and Pi.

Tool	Pinned	Latest	Status
Claude Code	2.1.168	2.1.178	⬆️ patch (+10)
GitHub Copilot CLI	1.0.60	1.0.63	⬆️ patch (+3)
Copilot SDK	1.0.0	1.0.1	⬆️ patch
OpenAI Codex	0.137.0	0.140.0	⬆️ minor (+3)
Pi	0.75.4	0.79.4	⬆️ minor (+4)
GitHub MCP Server	v1.1.2	v1.3.0	⬆️ minor (+2)
MCP Gateway	v0.3.25	v0.3.26	⬆️ patch ⭐ new
Playwright MCP	0.0.75	0.0.76	⬆️ patch
Playwright CLI	0.1.13	0.1.14	⬆️ patch
Playwright Browser	v1.60.0	v1.61.0	⬆️ minor ⭐ new
MCP SDK (@modelcontextprotocol/sdk)	1.24.0	1.29.0	⬆️ note

Impact Assessment

All changes are Low risk: additive features or internal/protocol-level changes. gh-aw invokes Codex/Claude/Copilot/Pi via CLI and uses GitHub MCP read-only, so new MCP write tools and CLI-internal changes do not affect it. Playwright Browser v1.61.0 rolls Chromium to 149, Firefox to 151, WebKit to 26.5 (pinned via mcr.microsoft.com/playwright:v1.61.0). No security advisories identified.

New since #39194

• Claude 2.1.177 → 2.1.178 (2026-06-15). No public repo; --help unchanged (cached). https://www.npmjs.com/package/`@anthropic-ai/claude-code`
• Copilot CLI 1.0.62 → 1.0.63 (stable 2026-06-16). Repo private; verify MCPs load and /models works on PATs per the constant doc comment. https://www.npmjs.com/package/`@github/copilot`
• Codex 0.139.0 → 0.140.0 (2026-06-15) — see below.
• Pi 0.79.3 → 0.79.4 (2026-06-15). Patch fixes in the 0.79 series. https://www.npmjs.com/package/`@earendil-works/pi-coding-agent`
• MCP Gateway v0.3.25 → v0.3.26 ⭐ (2026-06-15; release API now publicly visible) — see below.
• Playwright Browser v1.60.0 → v1.61.0 ⭐ — see below.

OpenAI Codex — v0.140.0 release notes

Features: /usage token-activity views — openai/codex#27925 · /goal oversized text/paste/image handling — openai/codex#27508 · session deletion via codex delete / /delete — openai/codex#25018 · /import config + chats from Claude Code — openai/codex#27070 · unified @ mentions menu — openai/codex#27499 · Amazon Bedrock API-key auth + encrypted credential storage — openai/codex#27443.

Fixes: corrupted-SQLite auto-recovery — openai/codex#26859 · /review crash on Esc with queued guidance — openai/codex#22879 · MCP reliability — openai/codex#27414 · Ctrl-C for non-TTY background commands — openai/codex#26734. Removed: experimental /realtime voice — openai/codex#27801.

Full changelog (incl. v0.138/v0.139: web search in code mode, -P sandbox alias, v2 PAT auth): https://github.com/openai/codex/releases/tag/rust-v0.140.0

Playwright Browser — v1.61.0 ⭐

Browsers: Chromium 149.0.7827.55, Firefox 151.0, WebKit 26.5 (tested vs Chrome 149 / Edge 149). New APIs: WebAuthn virtual authenticator / passkeys (browserContext.credentials); WebStorage via page.localStorage / page.sessionStorage; apiResponse.securityDetails() + serverAddr(); artifactsDir in connectOverCDP(); cursor in screencast.showActions(). Test runner: video gains trace-style modes, expect.soft.poll(...), -G for --grep-invert. Other: Ubuntu 26.04 support; HAR/trace capture WebSocket requests. Release: https://github.com/microsoft/playwright/releases/tag/v1.61.0

MCP Gateway — v0.3.26 ⭐

Features: OTLP multi-endpoint fan-out via GH_AW_OTLP_ENDPOINTS — github/gh-aw-mcpg#7446 · JSON-form support for it — github/gh-aw-mcpg#7482. Fixes: run.sh uses MCP_GATEWAY_AGENT_ID (fallback MCP_GATEWAY_API_KEY) — github/gh-aw-mcpg#7342 · tracing semconv aligned to v1.41.0 — github/gh-aw-mcpg#7531 · OTel span error recording in proxy handler — github/gh-aw-mcpg#7576. Perf/refactor: generic syncutil.TTLCache — github/gh-aw-mcpg#7277 · json.Compact in SanitizeJSON — github/gh-aw-mcpg#7528. Default sandbox.agent container (ghcr.io/github/gh-aw-mcpg:v0.3.26); mostly internal/observability — Low risk. Release: https://github.com/github/gh-aw-mcpg/releases/tag/v0.3.26

Carried-forward from #39194 (unchanged)

GitHub MCP Server v1.1.2 → v1.3.0: get_commits on pull_request_read — github/github-mcp-server#2608 · get_file_blame (insiders) — github/github-mcp-server#1538 · create_project + include_patch on get_commit — github/github-mcp-server#2232 / github/github-mcp-server#1924. Used read-only; write/insiders tools not enabled. https://github.com/github/github-mcp-server/releases/tag/v1.3.0

Pi 0.75.4 → 0.79.x: Claude Fable 5 support; prompt-template default positional args; defaultProjectTrust + ctx.isProjectTrusted(). Fixes: Bedrock ARN region resolution, GPT-5 context-window metadata, IME/CJK input.

Copilot CLI (carried): /settings, /worktree; auto-load MCP from .github/mcp.json; mTLS OTLP; /every + /after. Copilot SDK 1.0.1: patch, no public repo. Playwright MCP 0.0.76 / CLI 0.1.14: browser_video_show_actions/hide_actions; --output-max-size; moz-firefox BiDi; path-traversal protections.

Migration Guide

Edits for pkg/constants/version_constants.go:

const DefaultClaudeCodeVersion        Version = "2.1.178"  // was 2.1.168
const DefaultCopilotVersion           Version = "1.0.63"   // was 1.0.60
const DefaultCopilotSDKVersion        Version = "1.0.1"    // was 1.0.0
const DefaultCodexVersion             Version = "0.140.0"  // was 0.137.0
const DefaultPiVersion                Version = "0.79.4"   // was 0.75.4
const DefaultGitHubMCPServerVersion   Version = "v1.3.0"   // was v1.1.2
const DefaultMCPGatewayVersion        Version = "v0.3.26"  // was v0.3.25
const DefaultPlaywrightMCPVersion     Version = "0.0.76"   // was 0.0.75
const DefaultPlaywrightCLIVersion     Version = "0.1.14"   // was 0.1.13
const DefaultPlaywrightBrowserVersion Version = "v1.61.0"  // was v1.60.0
// Optional, separate review: const DefaultMCPSDKVersion Version = "1.29.0" // was 1.24.0

Per the DefaultMCPGatewayVersion doc comment, rebuild + recompile twice so the second pass refreshes container SHA pins: make build && make recompile && make recompile. Verify with git status. Do not commit *.lock.yml or pkg/workflow/js/*.js.

Recommendations

Priority Low. Playwright Browser v1.61.0 and Codex 0.140.0 carry the most net-new functionality; MCP Gateway v0.3.26 is mostly internal. After bumping, run make build && make recompile && make recompile and a per-engine smoke test; for Copilot, re-confirm MCP loading + /models on PAT. The MCP SDK 1.24.0 → 1.29.0 jump should be reviewed separately.

References: §27600530955 · supersedes #39194

Generated by 🔢 CLI Version Checker · 174.3 AIC · ⌖ 16.4 AIC · ⊞ 10.8K · ◷

• expires on Jun 17, 2026, 11:16 PM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · 26.7 AIC · ⌖ 9.52 AIC · ⊞ 24.3K · ◷

[copilot-swe-agent]

The agent encountered an error and was unable to start working on this issue: Please try again later, or contact support if the problem persists. (Request id: 12C3:39BC34:193674F:5F8E725:6A310B5C)

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #39746

View newer issue

---

This action was performed automatically by the CLI Version Checker workflow.