[ca] CLI Version Updates: Copilot 0.0.407, Codex 0.99.0, MCP Gateway v0.1.2

[github-actions]

Three CLI tools have new versions available with various improvements, bug fixes, and new features.

Summary

• GitHub Copilot CLI: 0.0.406 → 0.0.407 (Minor update)
• OpenAI Codex: 0.98.0 → 0.99.0 (Major feature release)
• MCP Gateway: v0.1.0 → v0.1.2 (Maintenance release)

Status: Constants updated in pkg/constants/constants.go:312, pkg/constants/constants.go:337, pkg/constants/constants.go:346. Full recompile pending due to Go 1.25.0 toolchain availability.

---

GitHub Copilot CLI: 0.0.406 → 0.0.407

Update Timeline

• 0.0.406: Released 2026-02-07
• 0.0.407: Released 2026-02-11 (4 day interval)

Package Information

• NPM Package: https://www.npmjs.com/package/`@github/copilot`
• Repository: https://github.com/github/copilot-cli (may be private)

Impact Assessment

• Risk: Low
• Update Priority: Medium
• Breaking Changes: None expected

Recommendations

Since the Copilot CLI repository may be private, detailed changelog analysis was not possible. The version increment suggests a patch release with likely bug fixes or minor improvements. NPM metadata shows publication on 2026-02-11.

Next Steps:

1. Install and test 0.0.407 in a development environment
2. Compare CLI help output between versions
3. Run integration tests before production deployment
4. Complete the recompile process once Go 1.25.0 toolchain is available

---

OpenAI Codex: 0.98.0 → 0.99.0

Update Timeline

• 0.98.0: Released 2026-02-05
• 0.99.0: Released 2026-02-11 (6 day interval)

Package Information

• NPM Package: https://www.npmjs.com/package/`@openai/codex`
• Repository: https://github.com/openai/codex
• Release Notes: https://github.com/openai/codex/releases/tag/rust-v0.99.0

Release Highlights (from GitHub)

View Key Features

New Features

• Concurrent Shell Commands: Running direct shell commands no longer interrupts an in-flight turn; commands can execute concurrently when a turn is active. (Allow user shell commands to run alongside active turns openai/codex#10513)
• Interactive Status Line Configuration: Added /statusline command to configure which metadata appears in the TUI footer interactively. (feat(tui): add /statusline command for interactive status line configuration openai/codex#10546)
• Resume Picker Enhancements: The TUI resume picker can now toggle sort order between creation time and last-updated time with an in-picker mode indicator. (feat(tui): add sortable resume picker with created/updated timestamp toggle openai/codex#10752)
• App-Server API Improvements: App-server clients now get dedicated APIs for steering active turns, listing experimental features, resuming agents, and opting out of specific notifications. ([app-server] Add a method to list experimental features. openai/codex#10721, feat(app-server): turn/steer API openai/codex#10821, Add resume_agent collab tool openai/codex#10903, feat: opt-out of events in the app-server openai/codex#11319)
• Enterprise Network Controls: Enterprise/admin requirements can now restrict web search modes and define network constraints through requirements.toml. (feat: add support for allowed_web_search_modes in requirements.toml openai/codex#10964, feat(core): add network constraints schema to requirements.toml openai/codex#10958)
• Expanded Image Format Support: Image attachments now accept GIF and WebP inputs in addition to existing formats. (adding image support for gif and webp openai/codex#11237)
• Shell Environment Snapshotting: Enable snapshotting of the shell environment and rc files. (chore: enable shell snapshot openai/codex#11172)

View Bug Fixes

Bug Fixes

• Fixed a Windows startup issue where buffered keypresses could cause the TUI sign-in flow to exit immediately. (fix(tui): flush input buffer on init to prevent early exit on Windows openai/codex#10729)
• Required MCP servers now fail fast during start/resume flows instead of continuing in a broken state. (Handle required MCP startup failures across components openai/codex#10902)
• Fixed a file-watcher bug that emitted spurious skills reload events and could generate very large log files. (Fixed bug in file watcher that results in spurious skills update events and large log files openai/codex#11217)
• Improved TUI input reliability: long option labels wrap correctly, Tab submits in steer mode when idle, history recall keeps cursor placement consistent, and stashed drafts restore image placeholders correctly. (TUI: fix request_user_input wrapping for long option labels openai/codex#11123, fix(tui): tab submits when no task running in steer mode openai/codex#10035, tui: keep history recall cursor at line end openai/codex#11295, fix(tui): rehydrate drafts and restore image placeholders openai/codex#9040)
• Fixed model-modality edge cases by surfacing clearer view_image errors on text-only models and stripping unsupported image history during model switches. (Always expose view_image and return unsupported image-input error openai/codex#11336, Strip unsupported images from prompt history to guard against model switch openai/codex#11349)
• Reduced false approval mismatches for wrapped/heredoc shell commands and guarded against empty command lists in exec policy evaluation. (fix(core): canonicalize wrapper approvals and support heredoc prefix … openai/codex#10941, fix(exec-policy) No empty command lists openai/codex#11397)

View Full Changelog

Documentation

• Expanded app-server docs and protocol references for turn/steer, experimental-feature discovery, resume_agent, notification opt-outs, and null developer_instructions normalization. ([app-server] Add a method to list experimental features. openai/codex#10721, feat(app-server): turn/steer API openai/codex#10821, Add resume_agent collab tool openai/codex#10903, app-server: treat null mode developer instructions as built-in defaults openai/codex#10983, feat: opt-out of events in the app-server openai/codex#11319)
• Updated TUI composer docs to reflect draft/image restoration, steer-mode Tab submit behavior, and history-navigation cursor semantics. (fix(tui): rehydrate drafts and restore image placeholders openai/codex#9040, fix(tui): tab submits when no task running in steer mode openai/codex#10035, tui: keep history recall cursor at line end openai/codex#11295)

Chores

• Reworked npm release packaging so platform-specific binaries are distributed via @openai/codex dist-tags, reducing package-size pressure while preserving platform-specific installs (including @alpha). (chore: split NPM packages openai/codex#11318, # Use @openai/codex dist-tags for platform binaries instead of separate package names openai/codex#11339)
• Pulled in a security-driven dependency update for time (RUSTSEC-2026-0009). (sec: fix version of time to prevent vulnerability openai/codex#10876)

Full Changelog: openai/codex@rust-v0.98.0...rust-v0.99.0

Impact Assessment

• Risk: Medium
• Affects: Core TUI functionality, MCP server lifecycle, shell command execution, image handling, network policy
• Breaking Changes: None explicitly mentioned
• Security Updates: RUSTSEC-2026-0009 (time dependency vulnerability)

Recommendations

Update Priority: High (due to security fix and MCP server improvements)

Testing Strategy:

1. Test concurrent shell command execution in active turns
2. Verify MCP server fail-fast behavior on startup
3. Test image attachment with GIF/WebP formats
4. Validate network constraint enforcement with requirements.toml
5. Test TUI improvements (statusline, resume picker, input handling)

Migration Notes:

• No breaking changes identified
• Enterprise configurations should review new network constraint options in requirements.toml
• App-server integrations can leverage new steering and notification APIs

---

MCP Gateway: v0.1.0 → v0.1.2

Update Timeline

• v0.1.0: Initial release
• v0.1.1: Released 2026-02-12 01:08 UTC
• v0.1.2: Released 2026-02-12 01:14 UTC (6 minute interval - likely hotfix)

Package Information

• Repository: https://github.com/github/gh-aw-mcpg
• Release Notes: https://github.com/github/gh-aw-mcpg/releases/tag/v0.1.2
• Docker Image: ghcr.io/github/gh-aw-mcpg:v0.1.2

Release Highlights (from GitHub)

This maintenance release brings improved documentation accuracy, automated compliance monitoring, and enhanced tool discovery capabilities to MCP Gateway.

What's New

• Tool Discovery Catalog - MCP Gateway now automatically generates a tools.json file in the log directory, providing an up-to-date catalog of all available tools across your backend MCP servers. This makes it easy to discover capabilities without making RPC calls, perfect for monitoring, documentation, and client configuration. Each tool entry includes its name and description, organized by server ID. (Add tools.json logging for MCP server tool discovery gh-aw-mcpg#903)

• Automated GPL Dependency Detection - New daily agentic workflow automatically scans Go dependencies for GPL-licensed packages (GPL, AGPL, LGPL) that may conflict with licensing requirements. The workflow queries multiple sources, traces transitive dependencies, and creates actionable issues with remediation guidance when GPL packages are detected. (Add agentic workflow for daily GPL dependency detection gh-aw-mcpg#902)

Documentation

• Corrected Default Values - Fixed critical documentation discrepancies where the default payload size threshold was incorrectly documented as 1KB instead of the actual 10KB implementation. Also completed the internal directory structure listings in both CONTRIBUTING.md and AGENTS.md. (Fix documentation discrepancies: payload threshold and internal directories gh-aw-mcpg#889)

• Environment Variable Clarifications - Updated documentation to accurately reflect which environment variables are used by the gateway versus test scripts, preventing potential confusion during configuration. (Fix environment variable documentation discrepancies gh-aw-mcpg#901)

View Full Changelog

What's Changed

• Fix documentation discrepancies: payload threshold and internal directories by @Claude in Fix documentation discrepancies: payload threshold and internal directories gh-aw-mcpg#889
• Fix environment variable documentation discrepancies by @Claude in Fix environment variable documentation discrepancies gh-aw-mcpg#901
• Add agentic workflow for daily GPL dependency detection by @Copilot in Add agentic workflow for daily GPL dependency detection gh-aw-mcpg#902
• Add tools.json logging for MCP server tool discovery by @Copilot in Add tools.json logging for MCP server tool discovery gh-aw-mcpg#903

Full Changelog: github/gh-aw-mcpg@v0.1.0...v0.1.2

Docker Image

The Docker image for this release is available at:

docker pull ghcr.io/github/gh-aw-mcpg:v0.1.2
# or
docker pull ghcr.io/github/gh-aw-mcpg:latest

Supported platforms: linux/amd64, linux/arm64

Impact Assessment

• Risk: Low
• Affects: Tool discovery, dependency scanning, documentation accuracy
• Breaking Changes: None

Recommendations

Update Priority: Medium

Key Benefits:

1. Improved observability with automatic tools.json catalog generation
2. Proactive GPL license detection to prevent licensing conflicts
3. Corrected documentation reduces configuration errors

Migration Notes:

• No configuration changes required
• The new tools.json file will appear automatically in the log directory
• GPL dependency workflow runs daily and creates issues when GPL packages are detected

---

References

• Workflow Run: §21930621704
• Constants Updated: pkg/constants/constants.go:312, pkg/constants/constants.go:337, pkg/constants/constants.go:346

Next Steps

1. Complete make recompile once Go 1.25.0 toolchain is available
2. Run integration tests for all three updated tools
3. Deploy to development environment for validation
4. Update production deployments after successful testing

AI generated by CLI Version Checker

• expires on Feb 14, 2026, 2:04 AM UTC