[ca] CLI/Docker version check: 6 CLI updates, 3 Docker image bumps (2026-08-15)

[github-actions]

Summary

Routine CLI/MCP/Docker version check. 6 CLI tools updated, 3 Docker images updated (2 with security-relevant CVE remediations), make fmt + make recompile completed successfully (284/284 workflows recompiled). Changes are staged locally in this run's checkout only — not committed; a maintainer needs to review and merge.

CLI / MCP tool updates

Tool	Old	New	Notes
Claude Code	2.1.227	2.1.233	Closed-source CLI, no public changelog
GitHub Copilot CLI	1.0.79	1.0.80	"Update model configurations"
GitHub Copilot SDK	1.0.8	1.0.11	Rewind support, managed permissions, agent factories
Google Gemini CLI	0.39.1	0.55.1	Large jump — several security fixes (see below)
Pi	0.84.1	0.84.2	Patch release
@modelcontextprotocol/sdk	1.24.0	1.30.0	See compare link below

Unchanged (already current): Codex CLI (0.147.0 — only a rust-v0.148.0-alpha.19 pre-release is newer, skipped per stable-only policy), GitHub MCP Server (v1.9.0), MCP Gateway (v0.4.9), Playwright MCP (0.0.79), Playwright CLI (0.1.18), Playwright Browser (v1.62.1), AWF Firewall (v0.28.1 — already the latest release, published 2026-08-14).

Claude Code 2.1.227 → 2.1.233

Daily npm releases, no public repository or changelog:

• 2.1.228 — 2026-08-11
• 2.1.229 — 2026-08-12
• 2.1.231 — 2026-08-13
• 2.1.232 — 2026-08-13
• 2.1.233 — 2026-08-14

Impact: Low. No known breaking changes; monitor for behavior drift in Claude engine workflows.

GitHub Copilot SDK 1.0.8 → 1.0.11

Features:

• Add history.clearContext and Tool.isTerminal across all SDKs (Add history.clearContext and Tool.isTerminal across all SDKs copilot-sdk#2129)
• Add rewind support across all SDKs (Add rewind support across all SDKs copilot-sdk#2321)
• Add managed permission settings to session startup (Add managed permission settings to session startup copilot-sdk#2139)
• Add built-in plugin directory support (Add built-in plugin directory support copilot-sdk#2330)
• Add Agent Factories authoring surface + argsSchema (Add the Agent Factories authoring surface copilot-sdk#2114, [SDK/Factories] Add argsSchema To The Factory Authoring Surface copilot-sdk#2315)
• Support reasoningEffort: max (Support reasoningEffort: max copilot-sdk#2228)

Fixes:

• SDK/Runtime: recover JSON-RPC frames containing unpaired UTF-16 surrogates (SDK, Runtime: Recover JSON-RPC frames containing unpaired UTF-16 surrogates copilot-sdk#2283)
• java: preserve MCP permission extension data (fix(java): preserve MCP permission extension data copilot-sdk#2276)
• Stop sendAndWait from emitting an unhandled rejection (Stop sendAndWait from emitting an unhandled rejection copilot-sdk#2206)
• dotnet: release oversized JSON-RPC receive buffers (dotnet: release oversized JSON-RPC receive buffers copilot-sdk#2047)

Impact: Low/Medium. gh-aw uses the Copilot engine's CLI, not the SDK directly in most workflows, but @github/copilot sub-releases were absorbed into this SDK bump chain. No action required.

Full changelog: github/copilot-sdk@v1.0.8...v1.0.11

Google Gemini CLI 0.39.1 → 0.55.1 (Security-relevant)

This is a large version jump spanning ~16 minor releases. Notable Security fixes surfaced while sampling release notes across the range:

• fix(a2a-server): enforce workspace trust and task isolation to prevent RCE (fix(a2a-server): enforce workspace trust and task isolation to prevent RCE google-gemini/gemini-cli#28470)
• fix(core): mitigate infinite ReAct loops and prompt injection loops (fix(core): mitigate infinite ReAct loops and prompt injection loops google-gemini/gemini-cli#28429)
• fix(security): enforce case-insensitive sensitive path blocklist and VS Code HITL (fix(security): enforce case-insensitive sensitive path blocklist and vscode hitl google-gemini/gemini-cli#27966)
• fix(core): resolve symbolic link directory escape in memory import processor (fix(core): resolve symbolic link directory escape in memory import processor google-gemini/gemini-cli#28233)
• fix(core): enforce HTTPS for GoogleCredentialsAuthProvider to prevent cleartext credential leakage (fix(core): enforce HTTPS for GoogleCredentialsAuthProvider to prevent cleartext leakage google-gemini/gemini-cli#28517)
• fix(core): enforce explicit tag length and validation in file keychain (fix(core): enforce explicit tag length and validation in file keychain google-gemini/gemini-cli#28523)
• refactor(cli): align macOS permissive Seatbelt sandbox profiles with deny-default model (refactor(cli): align macOS permissive Seatbelt profiles with deny-default model google-gemini/gemini-cli#28424)
• fix(sandbox): make ~/.gitconfig read-only in the macOS sandbox (fix(sandbox): make ~/.gitconfig read-only in the macOS sandbox google-gemini/gemini-cli#28221)
• fix(caretaker): sanitize and wrap issue title in untrusted_context (fix(caretaker): sanitize and wrap issue title in untrusted_context google-gemini/gemini-cli#28352)

Impact: Medium — several hardening fixes for prompt-injection and sandbox-escape classes of issues are relevant to gh-aw's threat model when the Gemini engine is used. Recommend prioritizing this bump.

Note: given the range size, this list is a sample of security-tagged commits, not an exhaustive diff. Full compare: google-gemini/gemini-cli@v0.39.1...v0.55.1

`@modelcontextprotocol/sdk` 1.24.0 → 1.30.0

Six minor releases between versions; full changelog: modelcontextprotocol/typescript-sdk@1.24.0...1.30.0

Impact: Low. No gh-aw-specific breakage expected; MCP protocol changes are typically additive/backwards compatible.

Docker image updates

Image	Constant	Old	New	Released	Cooldown
Syft	SyftImage	v1.50.0	v1.51.0	2026-08-10	5 days — passed
Grype	GrypeImage	v0.116.1	v0.117.0	2026-08-10	5 days — passed
Shellcheck	ShellcheckImage	v0.10.0	v0.11.0	2025-08-04	well over a year — passed

Unchanged, digests re-verified against registry (no drift): Actionlint (1.7.12), Grant (v0.6.8), Zizmor (1.29.0), Poutine (1.1.6), RunnerGuard (3.1.5), Yamllint (:latest tag).

Syft v1.50.0 → v1.51.0 (Security)

• Security: remediates 2 vulnerabilities in github.com/go-git/go-git/v5 — GHSA-hc8v-wwc9-vgxm (High) and GHSA-qgq7-7hm3-q39j (Medium)
• Fixes: incorrect PURLs for legacy JARs missing Maven metadata (causing Grype false negatives), wrong SPDX packageVerificationCode when hardlinks are present, phantom <name>@unknown`` npm packages from subpath/export-map stub package.json files
• Features: detect native Go FIPS 140 mode in binaries

New reference: anchore/syft:v1.51.0@sha256:678bfa565b60f747aac0f8e964fe5588a24445b8d0a480e91f6efd70020dfbb0

Release: https://github.com/anchore/syft/releases/tag/v1.51.0

Grype v0.116.1 → v0.117.0 (Security)

• Security: remediates the same 2 go-git vulnerabilities as Syft above (transitive dependency), plus bumps bundled Syft to v1.51.0
• Features: include vulnerable ranges in CycloneDX output format
• Fixes: honor match.rust.using-cpes configuration

New reference: anchore/grype:v0.117.0@sha256:ddf9e9f204049f3a4a0955ef70873cabab6a31432125ad4f20a490b54950a253

Release: https://github.com/anchore/grype/releases/tag/v0.117.0

Shellcheck v0.10.0 → v0.11.0 (Behavior change)

This release was previously untracked by the automated cooldown table (not in the standard source list) despite being over a year old — a stale pin caught by this run's full digest sweep.

• Changed: SC2002 (Useless Use of Cat) is now disabled by default — re-enable with --enable=useless-use-of-cat. This may reduce warning counts in existing gh-aw shellcheck-based lint output.
• Added: SC2327/SC2328 (capturing output of redirected commands), SC2329 (unused functions), SC2330 (BusyBox glob issues), SC2331/SC2332/SC3062 (-o/-a test operator issues), optional avoid-negated-conditions (SC2335) — these may introduce new warnings in previously-clean scripts.
• Fixed: SC2218 function use-before-define accuracy, SC2317 unreachable-command spam reduction, Bash 5.3 support (${| cmd; }, source -p)
• Removed: SC3013 (now POSIX.1-2024 specified)

Impact: Low/Medium — the new default-enabled checks could surface new shellcheck findings the next time shellcheck-backed static analysis runs against workflow scripts. Worth a spot-check after merge.

New reference: koalaman/shellcheck:v0.11.0@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d

Release: https://github.com/koalaman/shellcheck/releases/tag/v0.11.0

Changes made in this run

• Updated pkg/constants/version_constants.go: DefaultClaudeCodeVersion, DefaultCopilotVersion, DefaultCopilotSDKVersion, DefaultGeminiVersion, DefaultPiVersion, DefaultMCPSDKVersion
• Updated pkg/cli/docker_images.go: SyftImage, GrypeImage, ShellcheckImage (version + digest)
• Ran make fmt (success) and make recompile (284/284 workflows recompiled, 0 failures, 209 pre-existing warnings unrelated to this change)
• Not committed — this workflow does not push; a maintainer must review the diff and commit/PR it.

Next actions

• Review and commit the version bumps + regenerated .lock.yml files
• Spot-check shellcheck output after the bump for new/changed warnings in compiled workflows
• Consider prioritizing the Gemini CLI bump given the prompt-injection/RCE-class hardening fixes it includes

Generated by 🔢 CLI Version Checker · agent · 132.4 AIC · ⌖ 9.69 AIC · ⊞ 11.9K · ◷

• expires on Aug 16, 2026, 9:43 PM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.04 AIC · ⌖ 7.91 AIC · ⊞ 13.2K · ◷