[ca] CLI Version Updates: GitHub MCP Server v1.5.0, MCP Gateway v0.3.31

[github-actions]

Overview

Two Docker-image dependency updates detected and applied on 2026-06-28. Both are clean single-version bumps published on 2026-06-27 with no intermediate releases.

Tool	Old	New	Published	Risk
GitHub MCP Server	v1.4.0	v1.5.0	2026-06-27	Low
MCP Gateway (gh-aw-mcpg)	v0.3.30	v0.3.31	2026-06-27	Low

All other monitored tools are already at latest: Claude Code 2.1.195, Copilot CLI 1.0.65, Copilot SDK 1.0.4, Codex 0.142.3, Pi 0.80.2, Playwright MCP 0.0.76, Playwright CLI 0.1.14, Playwright Browser v1.61.1.

GitHub MCP Server v1.4.0 → v1.5.0

Features

• STDIO server now has built-in OAuth 2.1 login — no PAT token required (feat(oauth): add stdio OAuth 2.1 login core library (1/4) github-mcp-server#2704, docs: lead local/stdio install with OAuth login github-mcp-server#2776)
• React to issue and pull request comments — new reaction tools (Add reaction tools for issues and pull requests github-mcp-server#2732)
• Get parent issues via the issue_read tool / new get_parent method (Add get_parent method to issue_read github-mcp-server#2726)
• Issue dependency read/write MCP tools (Add issue dependency read/write MCP tools github-mcp-server#2751)
• MCP App for Issues now shows labels, milestones and more (Show issue_write MCP App form for labels/assignees/milestone/type github-mcp-server#2767)

Breaking / Deprecations

• Promote issue fields and deprecate legacy issue write tool (Promote issue fields and deprecate legacy issue write tool  github-mcp-server#2696) — worth watching: workflows relying on the old issue-write tool name may need to migrate to the promoted issue fields.

Fixes

• Bound ui_get pagination to cap latency (fix(ui_get): bound pagination to cap latency github-mcp-server#2766)
• Validate required params in add_comment_to_pending_review (fix(pull_requests): validate required params in add_comment_to_pending_review github-mcp-server#2770)
• Reconcile MCP-apps show/defer contract; remove show_ui (fix(mcp-apps): reconcile the show/defer contract — render results, remove show_ui github-mcp-server#2774)
• Fix delete:true on issue fields via deleteIssueFieldValue mutation (Fix delete:true on issue fields by calling deleteIssueFieldValue mutation github-mcp-server#2755)

Impact on gh-aw: The GitHub MCP server in gh-aw runs in lockdown/read-only mode and is consumed as a pinned Docker image. New reaction and issue-dependency tools expand capability without breaking existing read paths. The legacy issue-write deprecation is the only item to monitor, but gh-aw uses safe-outputs (not the MCP write tools) for GitHub writes, so impact is minimal.

Full v1.5.0 changelog

Highlights: STDIO OAuth (no PAT), react to issue/PR comments, parent issues via issue_read, MCP App shows labels/milestones.

What's Changed:

• Promote issue fields and deprecate legacy issue write tool — Promote issue fields and deprecate legacy issue write tool  github-mcp-server#2696
• build(deps): bump actions/checkout 6→7 — build(deps): bump actions/checkout from 6 to 7 github-mcp-server#2754
• build(deps): bump golang 8d95af5→523c3ef — build(deps): bump golang from 8d95af5 to 523c3ef github-mcp-server#2753
• build(deps): bump node 3ad34ca→a2dc166 — build(deps): bump node from 3ad34ca to a2dc166 github-mcp-server#2752
• bump hono 4.12.23→4.12.26 in /ui — build(deps): bump hono from 4.12.23 to 4.12.26 in /ui in the npm_and_yarn group across 1 directory github-mcp-server#2735
• Add get_parent method to issue_read — Add get_parent method to issue_read github-mcp-server#2726
• Show issue_write MCP App form for labels/assignees/milestone/type — Show issue_write MCP App form for labels/assignees/milestone/type github-mcp-server#2767
• fix(ui_get): bound pagination to cap latency — fix(ui_get): bound pagination to cap latency github-mcp-server#2766
• feat(oauth): add stdio OAuth 2.1 login core library (1/4) — feat(oauth): add stdio OAuth 2.1 login core library (1/4) github-mcp-server#2704
• docs: lead local/stdio install with OAuth login — docs: lead local/stdio install with OAuth login github-mcp-server#2776
• fix(pull_requests): validate required params in add_comment_to_pending_review — fix(pull_requests): validate required params in add_comment_to_pending_review github-mcp-server#2770
• fix(mcp-apps): reconcile show/defer contract, remove show_ui — fix(mcp-apps): reconcile the show/defer contract — render results, remove show_ui github-mcp-server#2774
• Add issue dependency read/write MCP tools — Add issue dependency read/write MCP tools github-mcp-server#2751
• Fix delete:true on issue fields via deleteIssueFieldValue mutation — Fix delete:true on issue fields by calling deleteIssueFieldValue mutation github-mcp-server#2755
• Add reaction tools for issues and pull requests — Add reaction tools for issues and pull requests github-mcp-server#2732

Full changelog: github/github-mcp-server@v1.4.0...v1.5.0

MCP Gateway (gh-aw-mcpg) v0.3.30 → v0.3.31

~33 merged PRs, predominantly tests and refactoring (mostly authored by lpcox with Copilot).

Fixes

• Fix DIFC proxy GHEC data-residency REST API host derivation
• Close issue dependency guard gaps
• go-sdk: fix context propagation through SDK calls and add prompt passthrough

Refactoring / Maintenance

• Migrate jsonschema v5→v6, eliminate fixSchemaBytes() workaround
• Extract WASM cache helpers; consolidate config/server type helpers; deduplicate backend list handling; centralize validation error helpers
• Added tests for logger, session path-validation, mcp/middleware packages, WASM guard dispatch, DIFC utilities (difc.IsSingularReadTool)
• Schema URL pinned to gh-aw versions v0.81.3 and v0.81.5

Impact on gh-aw: MCP Gateway is the default sandbox.agent container. The DIFC GHEC data-residency host-derivation fix and issue-dependency guard fixes improve correctness for enterprise/data-residency setups. The jsonschema v5→v6 migration is internal; no config-surface changes observed. Low risk.

Full changelog reference

Full changelog: github/gh-aw-mcpg@v0.3.30...v0.3.31

Verification

• pkg/constants/version_constants.go updated: DefaultGitHubMCPServerVersion v1.4.0→v1.5.0, DefaultMCPGatewayVersion v0.3.30→v0.3.31
• Ran make build && make recompile && make recompile (double recompile for MCPG SHA pin refresh) — 257/257 workflows compiled, 0 errors, 202 warnings (all pre-existing)
• 258 files changed (257 .lock.yml + constants). No stale v1.4.0 / v0.3.30 references remain. v1.5.0 present in 252 lock files, v0.3.31 in 257. No pkg/workflow/js/*.js files modified.

References:

• §28314178742
• https://github.com/github/github-mcp-server/releases/tag/v1.5.0
• https://github.com/github/gh-aw-mcpg/releases/tag/v0.3.31

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 🔢 CLI Version Checker · 113.5 AIC · ⌖ 34.6 AIC · ⊞ 8.4K · ◷

• expires on Jun 29, 2026, 10:53 PM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · 4.78 AIC · ⌖ 11 AIC · ⊞ 7.2K · ◷