### Summary Three CLI/MCP tools have new stable releases. Constants in `pkg/constants/version_constants.go` updated and `make recompile` ran twice — 235 lock files regenerated. | Tool | Previous | New | Risk | |---|---|---|---| | Copilot CLI | 1.0.51 | 1.0.52 | Low | | OpenAI Codex | 0.130.0 | 0.133.0 (3 intermediate) | Low–Medium | | GitHub MCP Server | v1.0.4 | v1.0.5 | Low | No changes needed for: Claude Code (2.1.150), MCP Gateway (v0.3.18), Playwright MCP (0.0.75), Playwright CLI (0.1.13), Playwright Browser (v1.60.0). --- ### Update Copilot CLI - Previous: 1.0.51 → New: 1.0.52 - Release date: 2026-05-23 - Release notes: https://github.com/github/copilot-cli/releases/tag/v1.0.52 - NPM Package: https://www.npmjs.com/package/`@github/copilot` - Repository: https://github.com/github/copilot-cli #### Key Features - Scrollbar with mouse drag support in the main conversation view. - `/compact` accepts optional focus instructions to shape the compaction summary. - `/usage` shows quota progress bars for session and weekly limits. - New `deferred-tool-loading` agent frontmatter for tool-search discovery on large toolsets. - Status line command accepts plain shell commands alongside executable script paths. - Old process log files in `~/.copilot/logs/` are auto-pruned at startup. - General-purpose subagents use GPT-5.4 or GPT-5.5 when available. - Reasoning tokens shown alongside output token count in usage summary. <details> <summary>View Full Changelog (Copilot CLI 1.0.52)</summary> #### Bug Fixes - Non-interactive subcommands (`plugin list`, `mcp list`, `help`, `version`) no longer read from stdin. - Switching to Autopilot mode no longer raises unexpected permission prompts for tools, paths, or URLs. - `copilot --continue` from a saved session refreshes the saved branch and git context. - Kill command safety filter no longer rejects valid commands with shell redirection (e.g., `kill -0 <PID> 2>/dev/null`). - Sessions resume in their saved working directory; pass `-C` to override. Relative-path flag values resolve from saved cwd. - Context window tier selection (~200K vs 1M tokens) enforced across compaction, truncation, and token display. - AI Credits usage now correctly displays after Responses API sessions. - Rendering stutter fixed on tmux + Cygwin/mintty. - Slash command picker keeps `(experimental)` and `(staff)` labels orange when row is selected. - Sessions with non-URL strings in URL/URI fields resume without 'Session file is corrupted' error. - HTTP/2 upload stall timeouts auto-retry over HTTP/1.1. - Windows: sessions no longer fail to load when a process exits with a high-bit exit code. - Timeline entry connector color matches surrounding elements when expanded. - Gray background bar removed from user messages on non-truecolor terminals. - Exit summary `AI Credits` label has correct spacing. - `/restart` and `/update` preserve current session ID. - PowerShell's division operator no longer falsely triggers 'Allow directory access' prompt on Windows. #### MCP / OAuth - Legacy nested `oauth.clientId` and `oauth.callbackPort` keys in MCP server configs are migrated to `oauthClientId` and `auth.redirectPort` (previously dropped silently). - MCP OAuth re-authentication honors configured `redirectPort`. #### Polish & UI - `/statusline` picker has cleaner item descriptions and improved spacing. - Picker checkboxes use a single-cell ▣/▢ glyph. - AI credits error messages reworded for clarity; include Manage budget link. </details> #### Impact Assessment - Risk: Low — patch release, mostly bug fixes and UI polish. - Affects: Copilot engine workflows. The MCP OAuth key migration is helpful for any nested-config users. No breaking changes detected. - Verify after update: MCPs load (tools.mcp configuration), `/models` works with PAT auth (per existing checklist in version_constants.go comment). --- ### Update OpenAI Codex - Previous: 0.130.0 → New: 0.133.0 - Intermediate versions: 0.131.0, 0.132.0 - Release notes: - https://github.com/openai/codex/releases/tag/rust-v0.131.0 - https://github.com/openai/codex/releases/tag/rust-v0.132.0 - https://github.com/openai/codex/releases/tag/rust-v0.133.0 - NPM Package: https://www.npmjs.com/package/`@openai/codex` - Repository: https://github.com/openai/codex #### Key Features (across 0.131–0.133) - **Goals** are now enabled by default with dedicated storage and progress tracking across turns (0.133). - **`codex remote-control`** runs like a foreground command with readiness waits, machine status, and explicit `start`/`stop` daemon commands (0.133). - **Permission profiles** expanded: list APIs, inheritance, managed `requirements.toml` support, runtime refresh, stronger Windows sandbox integration (0.133). - **Plugin discovery** improved: marketplace-aware list output, installed versions, visible marketplace roots, remote collection support (0.133). - **Extension lifecycle events** for subagent start/stop, tool execution, turn metadata, async approval/turn processing (0.133). - **Python SDK auth**: API key login, ChatGPT browser/device-code flows, account inspection, logout APIs (0.132). - **Python turn APIs**: pass plain string as input; handle-based runs return richer `TurnResult` with collected items, timing, and usage (0.132). - **`codex exec resume`** accepts `--output-schema` (0.132). - **Faster TUI startup** via batched terminal capability probes (0.132). - **TUI session controls**: data-driven service-tier commands, blended token usage, permissions/approval mode, effective workspace roots, responsive Markdown tables (0.131). - **Unified `@` picker** for files, directories, plugins, skills via app-server plugin metadata (0.131). - **Plugin marketplace** CLI commands, version-aware sharing, shared-workspace buckets (0.131). - **Remote workflows** with daemon-managed `codex remote-control`, runtime enable/disable APIs (0.131). - **Python SDK** moved to `openai-codex` / `openai_codex` package name (0.131). - **`codex doctor`** for support-ready diagnostics across runtime, auth, terminal, network, config, local state (0.131). <details> <summary>View Full Changelog (Codex 0.131 – 0.133)</summary> #### Codex 0.133.0 — Bug Fixes - TUI startup choosing wrong working directory when reusing a local app-server socket (https://github.com/openai/codex/pull/23538). - Plan-mode free-form answers so modified Enter keys (e.g. Shift+Enter) no longer submit unexpectedly (https://github.com/openai/codex/pull/23536). - Stale background terminal poll events removed after process exits (https://github.com/openai/codex/pull/23231). - Preserved raw code-mode exec output unless an explicit output token limit is requested (https://github.com/openai/codex/pull/23564). - AGENTS instruction loading more reliable, local global reads, warnings for invalid UTF-8 (https://github.com/openai/codex/pull/23343, https://github.com/openai/codex/pull/23232). - Fixed app-server startup/shutdown races, empty resume/fork paths, plugin upgrade failures, realtime v1 websocket compatibility (https://github.com/openai/codex/pull/23516, https://github.com/openai/codex/pull/23578, https://github.com/openai/codex/pull/23400, https://github.com/openai/codex/pull/23356, https://github.com/openai/codex/pull/23771). #### Codex 0.133.0 — Documentation - Plugin-creator guidance for updating and reinstalling local personal plugins (https://github.com/openai/codex/pull/23542). - Expanded app-server/API docs and schema coverage around managed permission profile requirements (https://github.com/openai/codex/pull/23433, https://github.com/openai/codex/pull/23555). #### Codex 0.133.0 — Chores - Canonical Codex package archive pipeline; installers, npm packages, DotSlash, SDK runtimes moved toward shared layout (https://github.com/openai/codex/pull/23513, https://github.com/openai/codex/pull/23582, https://github.com/openai/codex/pull/23586, https://github.com/openai/codex/pull/23596, https://github.com/openai/codex/pull/23635, https://github.com/openai/codex/pull/23636, https://github.com/openai/codex/pull/23637, https://github.com/openai/codex/pull/23638, https://github.com/openai/codex/pull/23786). - Linux Python runtime wheel tags fixed so glibc-based systems can install runtime artifacts (https://github.com/openai/codex/pull/21812). - Release/CI reliability: package-builder tests, prebuilt resource packaging, DotSlash zstd handling, platform-sharded Rust tests, Codex Linux release runners (https://github.com/openai/codex/pull/23760, https://github.com/openai/codex/pull/23759, https://github.com/openai/codex/pull/23752, https://github.com/openai/codex/pull/23358, https://github.com/openai/codex/pull/23761). #### Codex 0.132.0 — Bug Fixes - Goal continuations stop on usage limits or repeated blockers; completion responses phrase usage more naturally (https://github.com/openai/codex/pull/23094, https://github.com/openai/codex/pull/22907). - Session picker: renamed threads show `name (thread-id)` in resume hints; pasted text works in picker search box (https://github.com/openai/codex/pull/23234, https://github.com/openai/codex/pull/23338). - Multi-session TUI: in-progress MCP calls stay marked as active during replay; elicitation replies sent back to requesting thread (https://github.com/openai/codex/pull/23236, https://github.com/openai/codex/pull/23241). - Remote sessions keep websocket connections alive; repo-relative diff paths restored (https://github.com/openai/codex/pull/23226, https://github.com/openai/codex/pull/23261). - Windows: `codex doctor` detects npm-managed installs correctly; MSVC release binaries no longer depend on separately installed VC++ runtime DLLs (https://github.com/openai/codex/pull/22967, https://github.com/openai/codex/pull/22905). - TUI polish: immediate shutdown feedback on exit; hide ChatGPT usage link for non-OpenAI providers; cleared Fast tier stays cleared after side-thread resume (https://github.com/openai/codex/pull/23323, https://github.com/openai/codex/pull/23127, https://github.com/openai/codex/pull/23121). #### Codex 0.132.0 — Chores - Memory summaries versioned and rebuilt when stored format is stale (https://github.com/openai/codex/pull/23148). #### Codex 0.131.0 — Bug Fixes - TUI rendering/interaction: URL wrapping, light-mode selection contrast, Shift+Enter in tmux, `/review` MCP startup status, `/side` Esc handling, network approval history text (https://github.com/openai/codex/pull/21760, https://github.com/openai/codex/pull/21950, https://github.com/openai/codex/pull/21943, https://github.com/openai/codex/pull/21624, https://github.com/openai/codex/pull/22710, https://github.com/openai/codex/pull/22229). - Windows sandbox hardening: deny-read rules, scoped write roots, ineffective firewall policy, PowerShell edge cases (https://github.com/openai/codex/pull/18202, https://github.com/openai/codex/pull/21479, https://github.com/openai/codex/pull/22353, https://github.com/openai/codex/pull/21400, https://github.com/openai/codex/pull/22643). - Preserved managed read restrictions during permission escalation; cleaned up workspace-root permission profile resolution (https://github.com/openai/codex/pull/15977, https://github.com/openai/codex/pull/22624, https://github.com/openai/codex/pull/22683). - App-server/local state startup: preserve SQLite data, fail closed when state cannot open, add recovery paths, soften optional metadata sync failures (https://github.com/openai/codex/pull/21831, https://github.com/openai/codex/pull/21847, https://github.com/openai/codex/pull/22580, https://github.com/openai/codex/pull/22734, https://github.com/openai/codex/pull/22899). - Git/auth: root worktree hooks used consistently; helper commands ignore repo hook/fsmonitor config; local MCP OAuth callbacks bind; superseded login tokens revoked (https://github.com/openai/codex/pull/21969, https://github.com/openai/codex/pull/22843, https://github.com/openai/codex/pull/22652, https://github.com/openai/codex/pull/20237, https://github.com/openai/codex/pull/21747). - Remote/Windows cleanup: longer exec-server transport timeouts; quieter `taskkill` cleanup; non-queued plugin reads (https://github.com/openai/codex/pull/21825, https://github.com/openai/codex/pull/21759, https://github.com/openai/codex/pull/22058, https://github.com/openai/codex/pull/22703). #### Codex 0.131.0 — Documentation - Clarified general Codex product docs don't belong in this repo; app-server API docs remain in scope (https://github.com/openai/codex/pull/21772). - Plugin-creator guidance updated for simplified local plugin handoff links (https://github.com/openai/codex/pull/22240). - Documented new app-server/API contracts for remote environments and the desktop-owned config namespace (https://github.com/openai/codex/pull/21323, https://github.com/openai/codex/pull/22584). </details> #### Impact Assessment - Risk: Low–Medium — three sequential releases with broad changes, but no breaking changes identified for gh-aw workflow usage (Codex is invoked non-interactively via CLI). - Affects: Codex engine workflows. The auto-enabled Goals feature and richer permission profiles may shift behavior, but defaults remain compatible. - Migration: None required. Codex CLI invocation surface used by gh-aw is unchanged. --- ### Update GitHub MCP Server - Previous: v1.0.4 → New: v1.0.5 - Release date: 2026-05-18 - Release notes: https://github.com/github/github-mcp-server/releases/tag/v1.0.5 - Repository: https://github.com/github/github-mcp-server - Docker image: `ghcr.io/github/github-mcp-server:v1.0.5` - Full Changelog: https://github.com/github/github-mcp-server/compare/v1.0.4...v1.0.5 #### Key Features - New tool: **list repo collaborators** (https://github.com/github/github-mcp-server/pull/2477). - New tool: **discussion comment write operations** (https://github.com/github/github-mcp-server/pull/2427). - Optional `rationale` parameter on `update_issue_type` (https://github.com/github/github-mcp-server/pull/2458). - Code search returns minimal results with text match snippets (https://github.com/github/github-mcp-server/pull/2476). - Added missing pagination on `get_reviews` (https://github.com/github/github-mcp-server/pull/2367). <details> <summary>View Full Changelog (GitHub MCP Server v1.0.5)</summary> #### IFC Labeling (Information Flow Control) - Added `ifc` label for `list_issues` tool (https://github.com/github/github-mcp-server/pull/2453). - Added `ifc` label for `get_file_contents` tool (https://github.com/github/github-mcp-server/pull/2454). - Added `ifc` label for `search_issues` tool (https://github.com/github/github-mcp-server/pull/2456). - Added `ifc` label for `issue_read` tool (https://github.com/github/github-mcp-server/pull/2457). - Added `ifc` label for `search_repositories` tool (https://github.com/github/github-mcp-server/pull/2459). - Replaced ingress IFC reader list with private marker (https://github.com/github/github-mcp-server/pull/2478). #### Documentation - Document Copilot Spaces PAT requirements (https://github.com/github/github-mcp-server/pull/2479). #### Chores - Upgrade go-github to v0.87 (https://github.com/github/github-mcp-server/pull/2452). </details> #### Impact Assessment - Risk: Low — additive changes (new tools, new optional params, new pagination). No breaking changes. - Affects: Workflows using the GitHub MCP server. New tools become available; `get_reviews` pagination may require updates in scripts that assumed all reviews returned in one call (existing behavior preserved for default page size). - Migration: None required. --- ### Update Process Applied: - Edited `pkg/constants/version_constants.go` (3 lines changed) - Ran `make recompile` twice — 235 lock files modified, 0 errors - Saved version-check cache to `/tmp/gh-aw/cache-memory/version-check-2026-05-24.txt` ### Recommendations - **Update priority**: Routine. None of these are security releases. - **Testing**: Existing workflow tests should cover all three CLIs. For Copilot, verify the existing checklist from `version_constants.go` (MCP loading, `/models` with PAT). - **Rollout**: Standard PR review and merge. ### References - [§26354138907](https://github.com/github/gh-aw/actions/runs/26354138907) > Generated by [🔢 CLI Version Checker](https://github.com/github/gh-aw/actions/runs/26354138907) · ● opu47 9.5M · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fcli-version-checker%22&type=issues) > - [x] expires <!-- gh-aw-expires: 2026-05-26T06:42:41.106Z --> on May 26, 2026, 6:42 AM UTC <!-- gh-aw-agentic-workflow: CLI Version Checker, engine: claude, model: agent, id: 26354138907, workflow_id: cli-version-checker, run: https://github.com/github/gh-aw/actions/runs/26354138907 --> <!-- gh-aw-workflow-id: cli-version-checker --> <!-- gh-aw-workflow-call-id: github/gh-aw/cli-version-checker -->