[ca] Update CLI versions: Claude Code 2.1.110, Copilot 1.0.28, Codex 0.121.0, Gemini 0.38.1, GitHub MCP v0.33.1, MCPG v0.2.20

[github-actions]

Summary

Multiple CLI and MCP server versions updated in pkg/constants/version_constants.go and workflows recompiled (191/191). Playwright MCP (0.0.70) and Playwright Browser (v1.59.1) remain up-to-date.

Tool	Previous	Updated
Claude Code	2.1.98	2.1.110
Copilot CLI	1.0.21	1.0.28
Codex	0.118.0	0.121.0
Gemini CLI	0.37.2	0.38.1
GitHub MCP Server	v0.32.0	v0.33.1
MCP Gateway	v0.2.19	v0.2.20

---

Update Claude Code → 2.1.110

• Version: 2.1.98 → 2.1.110 (via 2.1.99–2.1.109)
• Source: https://www.npmjs.com/package/`@anthropic-ai/claude-code`

CLI Changes (2.1.105 → 2.1.110)

• Tool name format example updated: Bash(git:*) → Bash(git *) in --allowedTools and --disallowedTools help text (colon separator removed)

View Full Help Diff

-  --allowedTools, --allowed-tools <tools...>  Comma or space-separated list of tool names to allow (e.g. "Bash(git:*) Edit")
+  --allowedTools, --allowed-tools <tools...>  Comma or space-separated list of tool names to allow (e.g. "Bash(git *) Edit")
-  --disallowedTools, --disallowed-tools <tools...>  Comma or space-separated list of tool names to deny (e.g. "Bash(git:*) Edit")
+  --disallowedTools, --disallowed-tools <tools...>  Comma or space-separated list of tool names to deny (e.g. "Bash(git *) Edit")

Impact Assessment

• Risk: Low
• No public changelog; no breaking changes detected

---

Update Copilot CLI → 1.0.28

• Version: 1.0.21 → 1.0.28 (via 1.0.22–1.0.27)
• Source: https://www.npmjs.com/package/`@github/copilot`

CLI Changes (1.0.27 → 1.0.28)

Subcommand restructure: copilot config --help and copilot environment --help no longer show their documentation pages. Documentation is now only accessible via copilot help config and copilot help environment. The main help (commands list) no longer shows config and environment as subcommands — available commands are now: help, init, login, mcp, plugin.

The underlying config and environment help content appears unchanged; only the access path changed.

View Subcommand Changes

1.0.27 commands: help, init, login, mcp, plugin, config (docs), environment (docs)

1.0.28 commands: help [topic], init, login, mcp, plugin

Access via: copilot help config / copilot help environment (still works)

Impact Assessment

• Risk: Medium (subcommand restructure; verify any automation using copilot config --help or copilot environment --help)

---

Update Codex → 0.121.0

• Version: 0.118.0 → 0.121.0 (via 0.119.0, 0.120.0)
• Release: https://github.com/openai/codex/releases/tag/rust-v0.121.0

View Key Changes (0.121.0)

Features

• codex marketplace add command for installing plugin marketplaces from GitHub, git URLs, local directories, and direct marketplace.json URLs (Add marketplace command openai/codex#17087, [codex] Refactor marketplace add into shared core flow openai/codex#17717, [codex] Support local marketplace sources openai/codex#17756)
• TUI Ctrl+R reverse history search in composer (feat(tui): add reverse history search to composer openai/codex#17550)
• Memory mode controls: reset/deletion and memory-extension cleanup (feat: memories menu openai/codex#17632, feat: disable memory endpoint openai/codex#17626, feat: add endpoint to delete memories openai/codex#17913, feat: reset memories button openai/codex#17937, feat: cleaning of memories extension openai/codex#17844)
• MCP Apps tool calls, namespaced MCP registration, parallel-call opt-in ([mcp] Support MCP Apps part 3 - Add mcp tool call support. openai/codex#17364, register all mcp tools with namespace openai/codex#17404, Add supports_parallel_tool_calls flag to included mcps openai/codex#17667, Send sandbox state through MCP tool metadata openai/codex#17763)
• Secure devcontainer profile with bubblewrap support (feat(devcontainer): add separate secure customer profile openai/codex#10431, [codex] Support bubblewrap in secure Docker devcontainer openai/codex#17547)
• Realtime output modality and transcript completion events (Add realtime output modality and transcript events openai/codex#17701, Add turn item injection API openai/codex#17703, [codex] Add symlink flag to fs metadata openai/codex#17719)

Bug Fixes

• Fixed macOS sandbox/proxy handling for private DNS (fix: unblock private DNS in macOS sandbox openai/codex#17370)
• Fixed Windows resume --last and thread/list with verbatim path prefixes (Fix thread/list cwd filtering for Windows verbatim paths openai/codex#17414)
• Guardian timeouts now distinct from policy denials with timeout-specific guidance (representing guardian review timeouts in protocol types openai/codex#17381, changing decision semantics after guardian timeout openai/codex#17486)
• Fixed broken symlinks in fs/readDirectory (Fix fs/readDirectory to skip broken symlinks openai/codex#17907)

Impact Assessment

• Risk: Low

---

Update Gemini CLI → 0.38.1

• Version: 0.37.2 → 0.38.1 (via 0.38.0)
• Source: https://www.npmjs.com/package/`@google/gemini-cli`

Impact Assessment

• Risk: Low
• No public release notes available

---

Update GitHub MCP Server → v0.33.1

• Version: v0.32.0 → v0.33.1 (via v0.33.0)
• Release: https://github.com/github/github-mcp-server/releases/tag/v0.33.1
• Full Changelog: github/github-mcp-server@v0.32.0...v0.33.1

Impact Assessment

• Risk: Low
• Release notes minimal; see full changelog link above

---

Update MCP Gateway → v0.2.20

• Version: v0.2.19 → v0.2.20
• Release: https://github.com/github/gh-aw-mcpg/releases/tag/v0.2.20
• Docker Image: ghcr.io/github/gh-aw-mcpg:v0.2.20

View Release Highlights

Features

• Rate-Limit Circuit Breaker (Rate-limit circuit breaker for GitHub MCP backend tool calls gh-aw-mcpg#3799) — auto-trips when GitHub MCP backend encounters rate limits, with automatic recovery
• Enhanced OpenTelemetry Tracing (feat(tracing): OTel resource enrichment, semconv HTTP attributes, cached tracers gh-aw-mcpg#3857) — richer resource attributes, standardized HTTP semconv attributes, cached tracer lookups
• Expanded Guard Coverage (Guard coverage: classify 21 granular github-mcp-server mutation tools gh-aw-mcpg#3860) — 21 granular GitHub MCP server mutation tools now classified with precise DIFC labels
• Collaborator Permission Fallback (Add collaborator permission fallback to response-level integrity functions gh-aw-mcpg#3831) — response-level integrity functions fall back to collaborator permissions

Bug Fixes

• HTTP backend connect timeout increased from 5s to 30s and now configurable (fix: increase HTTP backend connect timeout from 5s to 30s and make configurable gh-aw-mcpg#3782)
• ValidatorClient pagination and LRU cache eviction fixed (fix: ValidatorClient pagination, logger, and filteredServerCache LRU eviction gh-aw-mcpg#3789)
• WASM guard shutdown resource leak fixed (wazero: fix guard shutdown leak, logging namespace, and typed trap detection gh-aw-mcpg#3790)
• GITHUB_MCP_SERVER_TOKEN token priority order documented correctly (docs: document GITHUB_MCP_SERVER_TOKEN and fix token priority order gh-aw-mcpg#3761)
• Deprecated tool aliases and enable_toolset DIFC rules now properly enforced (fix(guard): cover deprecated tool aliases, enable_toolset DIFC rule, and pre-emptive CLI entries gh-aw-mcpg#3762)

Impact Assessment

• Risk: Low
• Security/reliability improvements; backwards-compatible changes

---

References:

• §24492016365

Generated by CLI Version Checker · ● 305.5K · ◷

• expires on Apr 18, 2026, 4:32 AM UTC

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot coding agent.

The Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · ● 311.5K · ◷