[ca] CLI/Docker version check: Claude Code, Codex, and Playwright MCP updates (2026-08-06)

[github-actions]

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Overview

Routine CLI/Docker version sweep found 3 updates applied and 1 update detected-but-held (npm cooldown policy). All Docker image versions and digests are unchanged and verified. Constants updated, make fmt + make recompile run, 276/276 workflows recompiled successfully, go test ./pkg/constants/... passes.

Applied updates

Tool	Old	New	Risk
Claude Code	2.1.222	2.1.223	Low
OpenAI Codex	0.146.0	0.146.1	Low (security-adjacent bug fix)
@playwright/mcp	0.0.78	0.0.79	Medium (2 breaking changes, see below)

Claude Code 2.1.222 → 2.1.223

No public repository/changelog for Claude Code. NPM registry shows 2.1.223 published 2026-08-05T22:51:13Z. No CLI help-output diff performed this run (low-risk patch bump, consistent with this repo's established practice of same-day patch bumps, e.g. #50696 merged only hours earlier).

OpenAI Codex 0.146.0 → 0.146.1

Bug Fixes:

• Apply safer automatic-review defaults for cyber-capable models and explain permission changes in the terminal interface. [0.146] Backport safer cyber-model auto-review defaults openai/codex#37057

Full changelog: openai/codex@rust-v0.146.0...rust-v0.146.1

Impact: security-adjacent default-safety improvement, low risk for gh-aw workflows.

`@playwright/mcp` 0.0.78 → 0.0.79 (release notes: https://github.com/microsoft/playwright-mcp/releases/tag/v0.0.79)

Tool Improvements:

• browser_take_screenshot gains a type option (PNG/JPEG/WebP).
• --codegen now supports Python, Java, and C# in addition to TypeScript.
• New --timeout-settle flag configures the post-action settle wait (default 500ms).

Fixes:

• Skips aria snapshot capture when the response discards it.
• --snapshot-boxes flag enables bounding boxes globally.
• Improved reconnection handling after browser disconnects.
• Malformed JSON configs now produce clear errors instead of silently falling back to INI parsing.
• Dialog modal state clears properly when dialogs close unexpectedly.
• Downloads detected via the download event instead of inferred from navigation errors.
• Clearer error messaging when a browser executable path is missing.
• User input escaped in codegen output.

Browser Extension:

• Host/Origin header validation added on CDP relay WebSocket connections (security hardening).
• Fixed launch to use the Chrome profile with the extension installed.
• noDefaults passed for extension CDP connections.
• Error messages reference PLAYWRIGHT_MCP_EXECUTABLE_PATH when a browser isn't found.

Breaking changes:

• Removed the deprecated --output-mode CLI option.
• Removed support for extension protocol v1 (older browser extension versions).

Impact assessment: DefaultPlaywrightMCPVersion in pkg/constants/version_constants.go is currently a tracked/documentation-only constant — it is not wired into any install-step or Docker-image generation code in pkg/workflow (verified via grep; only DefaultPlaywrightCLIVersion and the Playwright browser Docker image constant are used in generated workflows). No generated .lock.yml changes result from this bump beyond the version-checker's own lock file. Low risk.

Detected but held (npm release-age cooldown)

Tool	Current	Latest detected	Published	Status
@playwright/cli	0.1.17	0.1.18	2026-08-06T00:15:41Z (~6h old)	Held — below 3-day cooldown

pkg/constants/version_constants.go pins DefaultPlaywrightCLIVersion with an explicit comment and a regression test (TestDefaultPlaywrightCLIVersionOutsideCooldownWindow) requiring the pinned version to be at least 72 hours old, because generated Playwright CLI install steps enforce NPM_CONFIG_MIN_RELEASE_AGE=3 (3-day cooldown). Pinning a release that hasn't cleared this window makes the install step unsatisfiable and hard-fails all CLI-mode workflows before agent startup — this happened before and was reverted in #42877 ("Roll back default Playwright CLI pin to satisfy npm release-age cooldown").

0.1.18 was published only ~6 hours before this check, so it was not applied this run. Release notes for reference (https://github.com/microsoft/playwright-cli/releases/tag/v0.1.18) — same author/day as the @playwright/mcp release above, similar changes (breaking: --json responses now carry a structured page snapshot instead of a text-wrapped string; CLI now exits non-zero when a tool result is an error).

Next action: once 0.1.18 is ≥ 72 hours old (i.e. after 2026-08-09T00:16 UTC), a future run of this check should bump DefaultPlaywrightCLIVersion to 0.1.18 and update TestDefaultPlaywrightCLIVersionOutsideCooldownWindow's expectedVersion/publishedAtRFC3339 accordingly.

Unchanged (verified this run)

• GitHub Copilot CLI: 1.0.78 (no change)
• Pi: 0.83.0 (no change)
• GitHub MCP Server: v1.8.0 (no change)
• Playwright Browser (Docker): v1.62.1 (no change)
• MCP Gateway (Docker): v0.4.8 (no change)

Docker image versions and digests — all verified unchanged

Image	Constant	Version	Digest match
rhysd/actionlint	ActionlintImage	1.7.12	✓ unchanged
anchore/syft	SyftImage	v1.50.0	✓ unchanged
anchore/grype	GrypeImage	v0.116.1	✓ unchanged
anchore/grant	GrantImage	v0.6.8	✓ unchanged
pipelinecomponents/yamllint	YamllintImage	latest	✓ unchanged
ghcr.io/zizmorcore/zizmor	ZizmorImage	1.29.0	✓ unchanged
ghcr.io/boostsecurityio/poutine	PoutineImage	1.1.6	✓ unchanged
ghcr.io/vigilant-llc/runner-guard	RunnerGuardImage	3.1.5	✓ unchanged

Digests were re-resolved live against Docker Hub / GHCR registries and compared byte-for-byte against pkg/cli/docker_images.go; all matched exactly, so no digest-only update was needed.

Note: pipelinecomponents/yamllint has no reachable GitHub Releases API (repo/releases endpoint returns 404), so only the Docker digest for the latest tag was checked, per the pinned constant's existing tag scheme.

Changes made

• pkg/constants/version_constants.go: bumped DefaultClaudeCodeVersion, DefaultCodexVersion, DefaultPlaywrightMCPVersion.
• Ran make fmt and make recompile (foreground) — 276/276 workflow files recompiled successfully (207 pre-existing warnings, unrelated to this change).
• go test ./pkg/constants/... passes, confirming the Playwright CLI cooldown guard is intact (untouched).

Next actions

• Review and merge the version bump changes (Claude Code, Codex, Playwright MCP + regenerated lock files).
• Re-run this check after 2026-08-09 to pick up @playwright/cli 0.1.18 once it clears the 3-day cooldown.

Generated by 🔢 CLI Version Checker · agent · 173.1 AIC · ⊞ 11.8K · ◷

• expires on Aug 7, 2026, 10:26 PM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 2.33 AIC · ⊞ 8.9K · ◷

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #51014

View newer issue

---

This action was performed automatically by the CLI Version Checker workflow.