Skip to content

Refresh CLI defaults and scanner image pins #61432

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 7 commits into from
Sep 17, 2026
Merged

Refresh CLI defaults and scanner image pins #61432

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
ab95d4d
Initial plan
Copilot Sep 16, 2026
a18bf6b
chore: update CLI and scanner pins
Copilot Sep 16, 2026
ab0caf1
chore: update CLI and scanner pins
Copilot Sep 16, 2026
2792f4b
Add changeset and update scanner inventory docs for CLI/scanner pin r…
Copilot Sep 17, 2026
454b356
Merge branch 'main' into copilot/update-cli-version-checker
github-actions[bot] Sep 17, 2026
c96f7c1
Merge branch 'main' into copilot/update-cli-version-checker
pelikhan Sep 17, 2026
add2a04
Merge branch 'main' into copilot/update-cli-version-checker
pelikhan Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/aw/compat.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@
"min-gh-aw": "0.72.0",
"max-gh-aw": "*",
"min-agent": "1.0.21",
"max-agent": "1.0.83",
"max-agent": "1.0.85",
"open": true
},
{
Expand Down
2 changes: 1 addition & 1 deletion actions/setup/sh/install_copilot_cli.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ COPILOT_TOOLCACHE_MAX_DEPTH=4
# argument nor a GH_AW_COMPILED_VERSION-backed compat.json lookup is available.
# It is the last resort (priority 3) after engine.version (priority 1) and
# compat.json toolcache lookup (priority 2).
DEFAULT_COPILOT_VERSION="1.0.83"
DEFAULT_COPILOT_VERSION="1.0.85"
COMPAT_URL="${COPILOT_COMPAT_URL:-https://raw.githubusercontent.com/github/gh-aw-actions/main/.github/aw/compat.json}"
COMPILED_GH_AW_VERSION="${GH_AW_COMPILED_VERSION:-}"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
Expand Down
6 changes: 3 additions & 3 deletions pkg/cli/docker_images.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,12 @@ func (e *DockerUnavailableError) Error() string {

// DockerImages defines the Docker images used by the compile tool's static analysis scanners
const (
ZizmorImage = "ghcr.io/zizmorcore/zizmor:1.29.0@sha256:863026d54f91271b10b60b67ad8054cb37120167e162482597db102b3026a284"
ZizmorImage = "ghcr.io/zizmorcore/zizmor:1.30.1@sha256:a2eb396d886c053073405c7a980f2139ba2248ec172243cfa3841e57196e8101"
PoutineImage = "ghcr.io/boostsecurityio/poutine:1.1.6@sha256:722a8e0999b583c1540fe2974e691032b2d9d21b9256a17965132b6bfd0081b0"
ActionlintImage = "rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667"
RunnerGuardImage = "ghcr.io/vigilant-llc/runner-guard:3.1.5@sha256:2df426ef96d21f1622e05b21329f26bd263fc46110609cefb6afe43457613ac0"
SyftImage = "anchore/syft:v1.51.0@sha256:678bfa565b60f747aac0f8e964fe5588a24445b8d0a480e91f6efd70020dfbb0"
GrypeImage = "anchore/grype:v0.117.0@sha256:ddf9e9f204049f3a4a0955ef70873cabab6a31432125ad4f20a490b54950a253"
SyftImage = "anchore/syft:v1.51.1@sha256:95fe0835e5bebc6f8b1f8acef68d47d63d594ef4c0f25c097ff853b23cbac74c"
GrypeImage = "anchore/grype:v0.118.0@sha256:8a93fc48da96bd6ec5981279d099b69de11541dc68fdf222fb9161f8ff284af7"
Comment on lines +37 to +38

Copilot AI Sep 17, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in 2792f4b by updating pkg/cli/README.md so the scanner inventory documents Grype v0.118.0 and Syft v1.51.1.

GrantImage = "anchore/grant:v0.6.8@sha256:172463611795f43b77302cdfbd7b3f81295492a7330e0820cfe41c3674920237"
YamllintImage = "pipelinecomponents/yamllint:latest@sha256:5ab5eb7da0ed5e606b07c1723fc8b275e925189f70ac259b26b7329cb5f8f44d"
// ShellcheckImage is the Docker fallback for shellcheck when the binary is not installed.
Expand Down
6 changes: 3 additions & 3 deletions pkg/constants/version_constants.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,20 +32,20 @@ func (v Version) IsValid() bool {
type ModelName string

// DefaultClaudeCodeVersion is the default version of the Claude Code CLI.
const DefaultClaudeCodeVersion Version = "2.1.266"
const DefaultClaudeCodeVersion Version = "2.1.273"

Copilot AI Sep 17, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in 2792f4b by adding .changeset/patch-refresh-cli-defaults-scanner-pins.md covering the CLI default and scanner pin refresh.


// DefaultCopilotVersion is the default version of the GitHub Copilot CLI.
//
// When unpinning or upgrading this version, verify:
// - MCPs are not blocked from loading (tools.mcp configuration still works end-to-end)
// - /models does not silently fail on PATs (check that model listing works with PAT auth)
const DefaultCopilotVersion Version = "1.0.83"
const DefaultCopilotVersion Version = "1.0.85"

// DefaultCopilotSDKVersion is the default version of the @github/copilot-sdk package.
const DefaultCopilotSDKVersion Version = "1.0.13"

// DefaultCodexVersion is the default version of the OpenAI Codex CLI
const DefaultCodexVersion Version = "0.153.4"
const DefaultCodexVersion Version = "0.154.0"

// DefaultGeminiVersion is the default version of the Google Gemini CLI
const DefaultGeminiVersion Version = "0.59.0"
Expand Down
5 changes: 3 additions & 2 deletions pkg/constants/version_constants_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,9 @@ func TestDefaultCLIMCPVersions(t *testing.T) {
got Version
want Version
}{
{"Claude Code", DefaultClaudeCodeVersion, "2.1.266"},
{"Codex", DefaultCodexVersion, "0.153.4"},
{"Claude Code", DefaultClaudeCodeVersion, "2.1.273"},
{"Copilot CLI", DefaultCopilotVersion, "1.0.85"},
{"Codex", DefaultCodexVersion, "0.154.0"},
{"GitHub MCP Server", DefaultGitHubMCPServerVersion, "v1.12.1"},
{"MCP Gateway", DefaultMCPGatewayVersion, "v0.4.23"},
}
Expand Down
Loading