[ca] CLI Updates Available: Claude Code 2.1.169, Codex 0.138.0, GitHub MCP Server v1.2.0

[github-actions]

Summary

Three monitored CLI/MCP tools have newer releases available (all published 2026-06-08):

Tool	Current	Latest	Risk
Claude Code	2.1.168	2.1.169	Low
OpenAI Codex	0.137.0	0.138.0	Low
GitHub MCP Server	v1.1.2	v1.2.0	Low

No changes for: Copilot CLI (1.0.60), Copilot SDK (1.0.0), MCP Gateway (v0.3.25), Playwright MCP (0.0.75), Playwright CLI (0.1.13), Playwright Browser (v1.60.0).

All three are constant-only edits in pkg/constants/version_constants.go. CLI --help output is byte-identical between old and new versions for Claude Code and Codex (no command/flag changes).

Note

This workflow can only emit issues (safe-outputs = create_issue). The constant edits and make recompile are documented below as migration steps for a maintainer to apply — lock files must not be committed by this workflow.

Update Claude Code

• Previous: 2.1.168 → New: 2.1.169 (published 2026-06-08)
• No public repository; analysis based on NPM metadata and CLI help output.
• CLI Discovery: claude --help output is identical to 2.1.168 — no new commands or flags. Patch release.
• Risk: Low (single patch increment, no surface change)

Update OpenAI Codex

• Previous: 0.137.0 (2026-06-04) → New: 0.138.0 (2026-06-08)
• CLI Discovery: codex --help output identical to 0.137.0 — no top-level flag changes.

Key Features

• /app command hands off the CLI thread into Codex Desktop on macOS and native Windows; Windows workspace launches can open directly into Desktop (feat(tui): add /app desktop handoff openai/codex#25638, Open Windows app workspaces via deep link openai/codex#26500)
• Local image attachments and standalone image generations expose saved file paths to the model for more reliable follow-up edits (Expose local image paths to models openai/codex#25944, Add saved image path hint to standalone image generation openai/codex#25947)
• More flexible reasoning-effort selection: TUI fallback shortcuts for terminals without Alt bindings; model-defined effort levels flow through in model-advertised order (fix(tui): add reasoning effort fallback shortcuts openai/codex#25623, [codex] Support model-defined reasoning efforts openai/codex#26444, [codex] Use model-advertised reasoning effort order openai/codex#26446)
• App-server can read account token usage; auth supports v2 personal access tokens in CLI and app-server flows (feat(app-server): expose account token usage [1 of 2] openai/codex#25344, [codex-rs] support v2 personal access tokens openai/codex#25731)
• Richer plugin automation: --json for add/remove and marketplace commands; plugin list JSON includes marketplace source; plugin detail exposes default prompts, remote MCP servers, and unavailable app templates (Add JSON output for plugin subcommands openai/codex#26631, Expose configured marketplace source in plugin list JSON openai/codex#26417, Preserve remote plugin default prompts openai/codex#25887, fix(app-server): expose remote MCP servers in plugin read openai/codex#26453, [codex] Expose unavailable app templates in plugin detail openai/codex#26317)

View Full Changelog (Codex 0.138.0)

Bug Fixes

• Goal workflows: multiline paste in /goal edit no longer submits early; idle auto-turns stay out of Plan mode; goals stop auto-continuing after terminal turn failures (Fix multiline paste in /goal edit openai/codex#26047, Gate automatic idle turns in Plan mode openai/codex#26147, Block active goals after terminal turn errors openai/codex#26690)
• Forked threads keep user-renamed titles instead of reverting to the first-prompt name (Fix forked thread name inheritance openai/codex#26075)
• TUI no longer adds extra blank space while streaming; cancelled prompts reopen with the cursor at the end (fix(tui): avoid doubled blank rows while streaming openai/codex#26636, fix(tui): restore cancelled prompt cursor at end openai/codex#26457)
• TUI config write failures now surface the underlying cause (read-only FS, validation) (Surface TUI config write error causes openai/codex#26537)
• Startup resilience: /usr/bin/bash fallback, shorter Linux proxy socket paths, pre-refresh of expired OAuth-backed MCP credentials ([codex] Add /usr/bin/bash shell fallback openai/codex#26538, [codex] Fix long proxy socket paths openai/codex#26553, fix(rmcp): refresh expired OAuth tokens before startup openai/codex#26482)
• More accurate AGENTS.md loading for remote and symlinked workspaces (Route AGENTS.md loading through environment filesystems openai/codex#26205, [codex] Preserve logical paths during AGENTS.md discovery openai/codex#26465)

Performance / Chores

• ThinLTO for release binaries (build: use ThinLTO for release binaries openai/codex#23710)
• Optimized unbounded byte scans with memchr for large MCP/Ollama streams (Optimize unbounded byte scans with memchr openai/codex#26265)
• resume --last uses the state DB first for faster restore on large histories (Use state DB first for resume --last openai/codex#26462)
• TUI startup reuses plugin discovery and loads only hook metadata on the critical path (Speed up TUI startup by reusing plugin discovery openai/codex#26469, Load plugin hooks without other plugin capabilities openai/codex#26272)

Full Changelog: openai/codex@rust-v0.137.0...rust-v0.138.0

Impact Assessment

• Risk: Low. No CLI flag changes; gh-aw invokes Codex non-interactively. Changes are largely TUI/desktop/plugin features irrelevant to headless workflow runs.

Update GitHub MCP Server

• Previous: v1.1.2 → New: v1.2.0 (published 2026-06-08)
• Docker image: ghcr.io/github/github-mcp-server:v1.2.0

Key Features

• New create_project and create_iteration_field methods in projects_write (feat: add create_project and create_iteration_field methods to projects_write github-mcp-server#2232)
• New include_patch parameter for the get_commit tool (feat: add include_patch parameter to get_commit tool github-mcp-server#1924)
• New confidence parameter on issue mutation tools (Add confidence parameter to issue mutation MCP tools github-mcp-server#2605)
• MCP Apps aligned with the 2026-01-26 stable spec (MCP Apps: align with the 2026-01-26 stable spec github-mcp-server#2573); created issue/PR links open via host open-link capability (MCP Apps: Open created issue/PR link via host open-link capability github-mcp-server#2593); MCP App form skipped when issue/PR write carries non-form params (Skip MCP App form when issue/PR write carries non-form params github-mcp-server#2589)

View Full Changelog (GitHub MCP Server v1.2.0)

Bug Fixes

• Restore thread id in get_review_comments response (fix: restore thread id in get_review_comments response github-mcp-server#2245)
• Support team pull-request reviewers (fix: support team pull request reviewers github-mcp-server#2514)
• Empty assignees array now clears assignees (fix: Empty assignees array should clear assignees github-mcp-server#2600)
• Return project item id usable for updates (fix: return project item id usable for updates github-mcp-server#2169)
• Add MCP initialize handshake to mcpcurl (fix: add MCP initialize handshake to mcpcurl github-mcp-server#2009)

Docs

• Installation guides for Zed and OpenCode (docs: add installation guides for Zed and OpenCode github-mcp-server#2535); Windows PowerShell support in Claude guide (docs: improve Claude installation guide with Windows PowerShell support github-mcp-server#2312); remote-server toolset docs fix (Fix remote-server docs inconsistency regarding toolset at base url github-mcp-server#2217)

Full Changelog: github/github-mcp-server@v1.1.2...v1.2.0

Impact Assessment

• Risk: Low. The gh-aw GitHub MCP server is read-only; new tools are additive (project/iteration writes, include_patch, confidence) and do not remove or change existing read tool signatures. The get_review_comments thread-id restoration is a positive fix for review-reading workflows.

Migration Guide

Apply these constant edits in pkg/constants/version_constants.go:

const DefaultClaudeCodeVersion Version = "2.1.169"        // was 2.1.168
const DefaultCodexVersion Version = "0.138.0"             // was 0.137.0
const DefaultGitHubMCPServerVersion Version = "v1.2.0"    // was v1.1.2

Then regenerate lock files (GitHub MCP is a Docker-pinned image, so a double recompile is recommended to refresh container SHA pins):

make build && make recompile && make recompile
git status   # verify *.lock.yml changes; do NOT commit pkg/workflow/js/*.js

Recommendations

• All three updates are Low risk and safe to batch in a single PR.
• Priority: routine. No security advisories surfaced in the release notes.
• Testing: a standard make recompile + existing CI is sufficient; no flag/behavior migration required.

References:

• https://www.npmjs.com/package/`@anthropic-ai/claude-code`
• https://github.com/openai/codex/releases/tag/rust-v0.138.0
• https://github.com/github/github-mcp-server/releases/tag/v1.2.0

Generated by 🔢 CLI Version Checker · 123.1 AIC · ⌖ 16.7 AIC · ⊞ 11.3K · ◷

• expires on Jun 10, 2026, 10:43 PM UTC-08:00