[ca] CLI/MCP version updates: Claude Code 2.1.246, GitHub MCP Server v1.11.0, MCP Gateway v0.4.11

[github-actions]

Summary

Automated CLI/MCP version check detected updates for 3 tools. Constants were bumped in pkg/constants/version_constants.go, make fmt and make recompile were run (294/294 workflows compiled successfully, twice — no digest pins required refreshing), and all changes verified with git status.

All 8 static-analysis Docker images (Actionlint, Syft, Grype, Grant, Zizmor, Poutine, RunnerGuard, Yamllint) were re-verified directly against their registries: versions and digests are unchanged from pkg/cli/docker_images.go, so no Docker image edits were needed this run.

---

Claude Code CLI: 2.1.245 → 2.1.246

• Constant: DefaultClaudeCodeVersion in pkg/constants/version_constants.go
• Patch release. No public changelog/repository is available for Claude Code; version bump sourced from npm view @anthropic-ai/claude-code version.
• Risk: Low

---

GitHub MCP Server: v1.10.1 → v1.11.0

• Constant: DefaultGitHubMCPServerVersion in pkg/constants/version_constants.go
• Release notes: https://github.com/github/github-mcp-server/releases/tag/v1.11.0
• Full diff: github/github-mcp-server@v1.10.1...v1.11.0

Features

• New --authorization-server flag to override the OAuth AS URL — feat(http): add --authorization-server flag to override OAuth AS URL github-mcp-server#2900
• Root command now named after the installed binary — Name the root command after the installed binary github-mcp-server#2998
• Atomic parent/sub-issue creation workflow — Add atomic parent issue creation github-mcp-server#3134
• ETag conditional requests added to the REST transport (STDIO caching) — Add ETag conditional requests to the REST transport github-mcp-server#3026
• Per-call OAuth scope checks, so each tool invocation requests only the permissions it needs — Add per-call OAuth scope checks github-mcp-server#3128

Fixes

• CORS handling preserved across OAuth discovery routes — fix(http): preserve CORS across OAuth routes github-mcp-server#3147

Security

• No entries explicitly labeled as security fixes; release notes mention routine security/dependency updates tied to the Go 1.27 runtime upgrade.

Performance / Maintenance

• Go runtime upgraded 1.25.13 → 1.27.0 (Alpine base image) — build(deps): bump golang from 1.25.13-alpine to 1.27.0-alpine github-mcp-server#3153
• codeql-action bumped 4 → 4.37.4 — build(deps): bump github/codeql-action from 4 to 4.37.4 github-mcp-server#3004
• docker/setup-buildx-action bumped 4.2.0 → 4.3.0 — build(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 github-mcp-server#3157
• go-chi/chi/v5 bumped 5.3.1 → 5.3.2 — build(deps): bump github.com/go-chi/chi/v5 from 5.3.1 to 5.3.2 github-mcp-server#3156
• distroless/base-debian12 digest updated — build(deps): bump distroless/base-debian12 from 76b3162 to fabbf1c github-mcp-server#3154
• stretchr/testify bumped 1.12.0 → 1.12.1 — build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 github-mcp-server#3155

Breaking Changes

• None explicitly flagged. The root-command rename ([q] Fix invalid network configuration in dictation-prompt workflow #2998) could in theory affect scripts hardcoding the binary/command name, but this is not called out as breaking in the release notes.

• Risk: Low — no breaking changes identified; adds new OAuth flag and tightens per-call scopes (net security improvement).

---

MCP Gateway (gh-aw-mcpg): v0.4.10 → v0.4.11

• Constant: DefaultMCPGatewayVersion in pkg/constants/version_constants.go
• Used as the default sandbox.agent container image (ghcr.io/github/gh-aw-mcpg)
• Release notes: https://github.com/github/gh-aw-mcpg/releases/tag/v0.4.11
• Digest: this constant is tag-only (no @sha256 pin) in generated lock files — make recompile run twice confirmed zero additional diff on the second pass.

Full changelog (mostly maintenance/testing; expand for details)

Breaking Changes

• Deprecated DIFC Resource type/API removed — [Repo Assist] refactor(difc): remove deprecated Resource type and its constructors gh-aw-mcpg#11677, Remove deprecated DIFC resource API and colocate schema cache gh-aw-mcpg#11685 (could affect any external consumer still relying on the deprecated interface; not used by gh-aw itself)

Features

• Capability-bound enclave issue reads added — Add capability-bound enclave issue reads gh-aw-mcpg#11813

Fixes

• OpenTelemetry endpoint validation aligned with MCP Gateway spec 1.16.0 — Align OpenTelemetry endpoint validation with MCP Gateway spec 1.16.0 (HTTP or HTTPS) gh-aw-mcpg#11588
• Rust guard refactor using shared OWNER field-name constant — [Repo Assist] fix(rust-guard): use field_names::OWNER constant in owner_type_from_repo_object gh-aw-mcpg#11627
• Gojq iteration-after-error regression tests — Add gojq iteration-after-error regression tests and include cached type in filter cache error gh-aw-mcpg#11788

Maintenance

• Numerous debug-logging additions and test-coverage PRs across server middleware, launcher, config, and enclave code (github-actions[bot] automated PRs)
• Dependency bumps: stretchr/testify 1.11.1 → 1.12.1 (Bump stretchr/testify from v1.11.1 to v1.12.1 gh-aw-mcpg#11574), golang.org/x/text → 0.41.0 (chore(deps): bump golang.org/x/text to v0.41.0 gh-aw-mcpg#11789)
• Internal workflow upgrades to gh-aw v0.87.1 → v0.87.4

• Risk: Low — the only breaking item (deprecated DIFC resource removal) is not part of the interface gh-aw currently depends on; remaining changes are fixes, tests, and internal maintenance.

---

Unchanged (verified, no action needed)

Tool	Version	Source
Copilot CLI	1.0.80	npm view @github/copilot version
Codex	0.149.1	npm view @openai/codex version
Playwright MCP	0.0.79	npm view @playwright/mcp version
Playwright CLI	0.1.18	npm view @playwright/cli version
Playwright Browser	v1.62.1	https://github.com/microsoft/playwright/releases/latest
Pi	0.84.3	npm view @earendil-works/pi-coding-agent version
Threat-detect	v0.4.12	https://github.com/github/gh-aw-threat-detection/releases/latest

Docker images (all unchanged, version + digest verified against registries)

Image	Version	Digest verified
ActionlintImage	1.7.12	sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
SyftImage	v1.51.0	sha256:678bfa565b60f747aac0f8e964fe5588a24445b8d0a480e91f6efd70020dfbb0
GrypeImage	v0.117.0	sha256:ddf9e9f204049f3a4a0955ef70873cabab6a31432125ad4f20a490b54950a253
GrantImage	v0.6.8	sha256:172463611795f43b77302cdfbd7b3f81295492a7330e0820cfe41c3674920237
ZizmorImage	1.29.0	sha256:863026d54f91271b10b60b67ad8054cb37120167e162482597db102b3026a284
PoutineImage	1.1.6	sha256:722a8e0999b583c1540fe2974e691032b2d9d21b9256a17965132b6bfd0081b0
RunnerGuardImage	3.1.5	sha256:2df426ef96d21f1622e05b21329f26bd263fc46110609cefb6afe43457613ac0
YamllintImage	latest	sha256:5ab5eb7da0ed5e606b07c1723fc8b275e925189f70ac259b26b7329cb5f8f44d

Verification performed

• pkg/constants/version_constants.go: 3 constants edited (DefaultClaudeCodeVersion, DefaultGitHubMCPServerVersion, DefaultMCPGatewayVersion)
• make fmt: Go and JS formatting succeeded (fmt-json failed on an unrelated pre-existing sandbox permissions issue, not caused by this change)
• make recompile (run twice, in foreground): 294/294 workflows compiled successfully both times; second pass produced no additional diff
• git status: only pkg/constants/version_constants.go and the 294 regenerated .lock.yml files changed

Generated by 🔢 CLI Version Checker · claude · agent · 97.7 AIC · ⌖ 8.05 AIC · ⊞ 12.8K · ◷

• expires on Aug 27, 2026, 9:45 PM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.42 AIC · ⌖ 3.47 AIC · ⊞ 18.4K · ◷

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · codex · mai10 · 2.67 AIC · ⌖ 1.34 AIC · ⊞ 18.7K · ◷