Bump default CLI/MCP versions: Claude Code 2.1.237, Codex 0.148.0, GitHub MCP Server v1.10.0

[Copilot]

Routine CLI/MCP version check flagged updates to Claude Code, OpenAI Codex, and the GitHub MCP Server. DefaultMCPGatewayVersion was already at v0.4.10 on main, and all 8 Docker images tracked in pkg/cli/docker_images.go are unchanged (both tag and registry digest).

Version constants (pkg/constants/version_constants.go)

Constant	Old	New
DefaultClaudeCodeVersion	2.1.233	2.1.237
DefaultCodexVersion	0.147.0	0.148.0
DefaultGitHubMCPServerVersion	v1.9.0	v1.10.0

Container digest pin

• Replaced the ghcr.io/github/github-mcp-server:v1.9.0 entry in .github/aw/actions-lock.json with the v1.10.0 pin, resolved from GHCR. The existing v1.9.0 digest was re-resolved first to validate the lookup path before trusting the new value.
• make build syncs the pin into pkg/actionpins/data/action_pins.json and pkg/workflow/data/action_pins.json.

ghcr.io/github/github-mcp-server:v1.10.0@sha256:097512ddf58af80a620c177ae9cad93448f9a2a55c70ee8fde5cec6714522a8c

Regenerated artifacts

• make recompile regenerated all 286 workflow .lock.yml files so install steps, container pins, and gh-aw-metadata engine versions pick up the new values.
• Added a patch changeset.

Review notes

• v1.10.0 of the GitHub MCP Server is a security-hardening release that fails closed on invalid tool names rather than degrading gracefully. gh-aw emits GITHUB_TOOLSETS/GITHUB_READ_ONLY env config rather than a static --tools allowlist, so no allowlist changes were needed — worth a second pair of eyes.
• The two remaining unpinned github-mcp-server:v1.10.0 references per lock file (Codex mcp_servers.github.container and the MCP gateway JSON config) match the pre-existing v1.9.0 shape and are not a regression from this change.

• Fixes[ca] Update CLI/MCP versions: Claude Code, Codex, GitHub MCP Server, MCP Gateway #54168

[github-actions]

PR Triage

• Category: chore | Risk: low | CI: pending
• Priority score: 21/100 (impact 12, urgency 2, quality 7)
• Recommended action: defer
• WIP version bump, routine.

Generated by 🔧 PR Triage Agent · auto · 80.4 AIC · ⌖ 4.81 AIC · ⊞ 8.3K · ◷

[gh-aw-bot]

@copilot Quick triage nudge for PR #54521.

• Please refresh the branch if GitHub offers it and it is still applicable.
• After addressing feedback/checks, run the pr-finisher skill and leave a concise maintainer handoff with validation status and merge readiness.

Run: https://github.com/github/gh-aw/actions/runs/32496817614

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 6.47 AIC · ⌖ 8.13 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

[Copilot]

Pull request overview

Updates the default Claude Code, Codex, and GitHub MCP Server versions and propagates them through generated workflow artifacts.

Changes:

• Bumps Claude Code to 2.1.237, Codex to 0.148.0, and GitHub MCP Server to v1.10.0.
• Refreshes the GitHub MCP Server digest pin.
• Regenerates 283 affected workflow lockfiles and adds a patch changeset.

Show a summary per file

File	Description
pkg/constants/version_constants.go	Updates default versions.
.github/aw/actions-lock.json	Updates the canonical MCP image pin.
pkg/actionpins/data/action_pins.json	Synchronizes the embedded pin.
pkg/workflow/data/action_pins.json	Synchronizes workflow pin data.
.changeset/bump-cli-mcp-versions-claude-codex-github-mcp-server.md	Adds release notes.
.github/workflows/*.lock.yml (283 files)	Regenerates affected workflow metadata, installations, configurations, and container pins.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 95/288 changed files
• Comments generated: 0
• Review effort level: Balanced

[pelikhan]

@copilot resolve the merge conflicts in this pull request

[gh-aw-bot]

@copilot This PR has merge conflicts with main.

• Please run make merge-main to resolve the conflicts cleanly on the PR branch.
• After resolving conflicts, rerun the relevant validation and use the pr-finisher skill for a concise maintainer handoff.
• Run: https://github.com/github/gh-aw/actions/runs/32500946594

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.86 AIC · ⌖ 8.17 AIC · ⊞ 9.3K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot resolve the merge conflicts in this pull request

Conflicts resolved in d350d30. Merged origin/main and regenerated the conflicting .github/workflows/*.lock.yml files from the merged sources (never ours/theirs). Version constants and the github-mcp-server:v1.10.0 digest pin survived the merge, and a follow-up make build && make recompile produced no drift. make agent-report-progress passes.

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.87.4