[ca] Update CLI/MCP and scanner image defaults #67905

Overview

CLI/MCP and Docker image updates were detected for gh-aw default pins in workflow run §38209047437. I updated the local working tree constants and regenerated workflow locks with make recompile.

Updates detected

Already-current pins checked with no update needed: Claude Code 2.1.296, GitHub Copilot CLI 1.0.95, OpenAI Codex 0.162.1, Pi 1.1.0, MCP Gateway v0.4.30, Threat-detect v0.5.2, Actionlint 1.7.12, Grant v0.6.8, Zizmor 1.30.1, Poutine 1.1.6, and Runner Guard 3.1.5.

Local files updated

• pkg/constants/version_constants.go
• pkg/constants/version_constants_test.go
• pkg/cli/docker_images.go
• .github/workflows/*.lock.yml via foreground make recompile

GitHub MCP Server v1.12.2 → v2.0.2

• Release timeline: latest stable v2.0.2 published 2026-10-08.
• Breaking / migration: medium risk because this crosses a major version boundary from v1.x to v2.x. Validate GitHub MCP tool schemas, typed-tool HTTP header behavior, and workflow MCP startup paths before rollout.
• Fixes: v2.0.2 restores typed tool HTTP header validation.
• Security: no explicit security advisory in the release body, but header validation restoration is protocol-hardening relevant.
• Performance: no performance-specific changes identified in latest release notes.
• Impact on gh-aw: medium. GitHub MCP is a core read/tooling path; schema or transport changes may affect generated workflows and sandboxed MCP server behavior.
• Release: https://github.com/github/github-mcp-server/releases/tag/v2.0.2
• External PR reference: fix(inventory): restore typed tool HTTP header validation github-mcp-server#3454

Playwright CLI 0.1.21 → 0.1.22

• Release timeline: npm published 2026-09-28T23:24:31.286Z; outside the 72-hour release-age cooldown.
• Breaking / migration: none identified.
• Features / fixes: run-code supports timers, fetch, URL, Buffer, crypto, AbortController, TextEncoder, and TextDecoder while keeping require and process unavailable; find --filename=results.md saves large result sets; goto/reload report dialogs opened during page load; browser-close during downloads no longer crashes; install-browser --no-shell is accepted; webmcp-call avoids stale tabs/frames and works with Chromium 155+; snapshots quote regex-like accessible names.
• Security: bundled skill now only preapproves Playwright commands instead of any npm or npx command, which narrows command preapproval.
• Performance: no performance-specific changes identified.
• CLI help output: cached 0.1.22 top-level help is available at /tmp/gh-aw/cache-memory/cli-version-checker/playwright-0.1.22.txt; no cached 0.1.21 help was available for direct diff in this run.
• Impact on gh-aw: low and security-positive for Playwright-enabled workflows.
• Release: https://github.com/microsoft/playwright-cli/releases/tag/v0.1.22
• External references: request-mocking.md "Delayed Response" example uses setTimeout, which run-code doesn't provide microsoft/playwright-cli#471, fix(cli): expose benign globals in run-code vm context microsoft/playwright#42975, [CLI]: find returns the full ancestor chain, and neither find nor snapshot can bound their output microsoft/playwright#42077, feat(mcp): allow saving browser_find results to a file microsoft/playwright#42968, [Bug]: MCP browser_navigate blocks for the whole navigation timeout when the page opens a dialog during load microsoft/playwright#42817, fix(mcp): report a dialog opened during navigation instead of timing out microsoft/playwright#42908, MCP server crashes when downloading files with persistent profile on Windows microsoft/playwright#42831, fix(mcp): do not crash when download fails after browser close microsoft/playwright#42922, [CLI]: install-browser --no-shell is rejected with "Unknown option: --shell" microsoft/playwright#42804, fix(cli): accept install-browser --no-shell microsoft/playwright#42871, [Bug]: MCP page-registered WebMCP tools stay bound to a stale frame or tab when the tool list looks unchanged microsoft/playwright#42816, fix(mcp): rebind page-registered WebMCP tools when the tab or frame changes microsoft/playwright#42821, feat(chromium): roll to r1247 microsoft/playwright#42915, [Bug]: toMatchAriaSnapshot cannot parse the snapshot that ariaSnapshot() produces for names starting and ending with "/" microsoft/playwright#42807, fix(aria-snapshot): quote names that only look like regexes microsoft/playwright#42811, [BUG] bundled skills grant Bash(npx:*) / Bash(npm:*), far wider than anything they invoke microsoft/playwright#42745, fix(skills): narrow npm and npx grants microsoft/playwright#42789

Docker image audit

Docker image digests were resolved for every configured scanner image. Syft and Grype version updates passed the 3-day cooldown and were applied. Yamllint's latest tag digest changed and was applied as a digest-only update; digest-only updates are not subject to the release cooldown. All other scanner digests were unchanged.

Other resolved scanner digests:

Syft v1.54.1 notes

• Breaking / migration: none identified in the release body.
• Fixes: deterministic packages.lock dependency resolution; local Podman image attestation output fix.
• Dependencies: 9 updated packages, including go-rpmdb, stereoscope, Docker CLI, SQLite, compression, sigstore, and SIF dependencies.
• Security: dependency refresh includes supply-chain relevant libraries; no explicit vulnerability advisory listed for this release.
• Release: https://github.com/anchore/syft/releases/tag/v1.54.1
• External PR references: fix(dotnet): resolve packages.lock dependencies deterministically  anchore/syft#5210, Add container-storage support for Podman and Buildah anchore/syft#5368

Grype v0.120.1 notes

• Breaking / migration: none identified in the release body.
• Fixes: Windows unit-test handle leaks; table presenter no longer appends a spurious ", ..." to the FIX column when all fix versions are already shown.
• Dependencies: 9 updated packages, including Syft v1.54.1, Docker CLI, sigstore, and SIF dependencies.
• Security: dependency refresh; no explicit vulnerability advisory listed for this release.
• Release: https://github.com/anchore/grype/releases/tag/v0.120.1
• External PR references: ci: run unit tests on windows and fix the handle leaks it surfaced anchore/grype#3766, fix(table): only hint at more fix versions when one was omitted anchore/grype#3770

Next actions

1. Review and land the constants, scanner image pins, Yamllint digest update, and generated lock changes.
2. Validate GitHub MCP Server v2 tool schema compatibility in a workflow run before broad rollout.
3. Re-run full make fmt in an environment where actions/setup/js dependencies are installed, then run the repository's final report_progress path.

References:

• §38209047437

Generated by 🔢 CLI Version Checker · pi · gpt55 · 187.4 AIC · ⌖ 20.4 AIC · ⊞ 11.2K · ◷

• expires on Oct 13, 2026, 9:50 PM UTC-08:00