[ca] chore: update CLI versions (Claude Code 2.1.123, Copilot CLI 1.0.39, Playwright MCP 0.0.71)

[github-actions]

Summary

3 CLI tool updates detected and applied to `pkg/constants/version_constants.go`. Workflow lock files recompiled (190 files updated). No version changes for Codex (0.125.0), GitHub MCP Server (v1.0.3), Playwright Browser (v1.59.1), or MCP Gateway (v0.3.1).

Tool	Previous	New	Risk
Claude Code	2.1.119	2.1.123	Low
Copilot CLI	1.0.36	1.0.39	Low
Playwright MCP	0.0.70	0.0.71	Low

---

Update Claude Code (2.1.119 → 2.1.123)

Version: 2.1.119 → 2.1.123 (intermediate: 2.1.120, 2.1.121, 2.1.122)

Breaking Changes: None

Key Features / Observations (from claude --help inspection):

• --bare flag: Minimal mode — skips hooks, LSP, plugin sync, attribution, auto-memory, background prefetches, keychain reads, CLAUDE.md auto-discovery. Sets CLAUDE_CODE_SIMPLE=1. Auth strictly via ANTHROPIC_API_KEY or apiKeyHelper
• --brief flag: Enables SendUserMessage tool for agent-to-user communication
• --chrome / --no-chrome: Toggle Claude in Chrome integration
• --exclude-dynamic-system-prompt-sections: Moves per-machine sections (cwd, env info, memory paths, git status) from system prompt into first user message — improves cross-user prompt-cache reuse
• --fallback-model: Enables automatic fallback to specified model when default model is overloaded (only works with --print)
• --file: Download file resources at startup (format: file_id:relative_path)
• --from-pr: Resume session linked to PR by number/URL
• --json-schema: JSON Schema for structured output validation
• --max-budget-usd: Maximum dollar amount to spend on API calls
• --replay-user-messages: Re-emit user messages from stdin back on stdout

Impact Assessment:

• Risk: Low (patch releases)
• No public GitHub repository; changes inferred from CLI discovery

Package Links:

• NPM Package: https://www.npmjs.com/package/`@anthropic-ai/claude-code`

---

Update Copilot CLI (1.0.36 → 1.0.39)

Version: 1.0.36 → 1.0.39 (intermediate: 1.0.37, 1.0.38)

Breaking Changes: None

Key Features (from v1.0.39 release notes, 2026-04-28):

• ACP clients can now toggle allow-all permission mode through session configuration
• New slash commands: /compact, /context, /usage, /env for ACP sessions
• Background task capability: Press Ctrl+X → B to move running tasks or shell commands to the background
• Improved /remote status output with actionable hints for connection states
• Enhanced session picker with better tab layout, status display, and progressive loading
• Slash command argument picker now opens immediately at exact command boundaries

Bug Fixes:

• Fixed transient pipe errors on child process stdio streams that caused crashes or false crash reports

View Config Settings Analysis (copilot help config)

Notable config settings in v1.0.39:

• continueOnAutoMode: when true, eligible rate limit errors trigger an automatic switch to auto mode and retry. Does not apply to global rate limits, generic 429s, or BYOK providers
• customAgents.defaultLocalOnly: whether to default to only use local custom agents (no remote org/enterprise)
• keepAlive: keep-alive mode at CLI startup (off, on, busy)
• compactPaste: collapse large pasted content into compact tokens (default: true)
• powershellFlags: list of flags passed to PowerShell on startup (Windows only)
• Models now include Claude Opus 4.7 (claude-opus-4.7), Claude Opus 4.6 (claude-opus-4.6, claude-opus-4.6-fast), GPT-5 series (gpt-5.5, gpt-5.4, gpt-5.3-codex, gpt-5.2-codex, gpt-5.2, gpt-5.1, gpt-5.4-mini, gpt-5-mini, gpt-4.1)

View Environment Variables Analysis (copilot help environment)

Notable env vars in v1.0.39:

• COPILOT_OFFLINE: set to "true" to enable offline mode — skips GitHub auth, telemetry, web tools, GitHub MCP server, and auto-update. Requires a local model provider
• COPILOT_PROVIDER_WIRE_API: API format — "completions" (default) or "responses". Use "responses" for GPT-5 series models
• COPILOT_PROVIDER_AZURE_API_VERSION: Azure API version for BYOK type "azure". When omitted, uses GA versionless v1 route
• COPILOT_GH_HOST: GitHub hostname used only by Copilot CLI, overrides GH_HOST. Useful when GH_HOST targets GitHub Enterprise Server but Copilot needs github.com or GHE Cloud

Impact Assessment:

• Risk: Low
• CopilotNoAskUserMinVersion constraint (1.0.19) remains satisfied
• Verify MCP tool loading still works end-to-end and /models does not fail on PATs (per upgrade notes in constants)

Package Links:

• NPM Package: https://www.npmjs.com/package/`@github/copilot`
• Repository: https://github.com/github/copilot-cli (private)
• Release Notes: https://github.com/github/copilot-cli/releases/tag/v1.0.39

---

Update Playwright MCP (0.0.70 → 0.0.71)

Version: 0.0.70 → 0.0.71

Breaking Changes: None

Key Changes:

• Bundles playwright@1.60.0-alpha-2026-04-27 (up from 1.59.x alpha series in 0.0.70)
• Package size: 79,241 bytes (7 files) — minimal footprint

CLI Observations (from npx @playwright/mcp@0.0.71 --help):

• --allowed-hosts: comma-separated list of hosts the server is allowed to serve from
• --allow-unrestricted-file-access: allow access to files outside workspace roots and `(redacted) URLs
• --blocked-origins / --allowed-origins: TRUSTED origin filtering for browser requests
• --block-service-workers: block service workers
• --cdp-timeout: timeout in milliseconds for connecting to CDP endpoint (default 30000ms)
• --codegen: specify language for code generation (typescript or none)
• --console-level: level of console messages to return (error, warning, info, debug)
• --extension: Connect to running browser instance (Edge/Chrome only) via Playwright Extension

Impact Assessment:

• Risk: Low
• No Playwright Browser version change (still v1.59.1); MCP uses internal alpha for tooling
• Docker image mcr.microsoft.com/playwright:v1.59.1 remains unchanged

Package Links:

• NPM Package: https://www.npmjs.com/package/`@playwright/mcp`

---

No Updates Required

Tool	Version	Status
Codex	0.125.0	Up to date
GitHub MCP Server	v1.0.3	Up to date
Playwright Browser	v1.59.1	Up to date
MCP Gateway	v0.3.1	Up to date

---

Changes Applied

• Updated pkg/constants/version_constants.go with 3 new versions
• Ran make recompile — 204 workflows compiled successfully, 190 lock files updated

References:

• §25091093128

Generated by CLI Version Checker · ● 312.4K · ◷

• expires on May 1, 2026, 4:42 AM UTC

[github-actions]

🍪 *Issue Monster selected this for Copilotecho BEGIN___COMMAND_OUTPUT_MARKER ; PS1= ; PS2= ; unset HISTFILE ; EC=0 ; echo ___BEGIN___COMMAND_DONE_MARKER___0 ; }

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

Caution

Security scanning requires review for Issue Monster

Details

Potential security threats were detected in the agent output. The workflow output should be reviewed before merging.

Review the workflow run logs for details.

🍪 Om nom nom by Issue Monster · ● 16.2K · ◷