[ca] CLI/MCP version updates: Claude Code 2.1.246, GitHub MCP Server v1.11.0, MCP Gateway v0.4.11 #55951

Summary

Automated CLI/MCP version check detected updates for 3 tools. Constants were bumped in pkg/constants/version_constants.go, make fmt and make recompile were run (294/294 workflows compiled successfully, twice — no digest pins required refreshing), and all changes verified with git status.

All 8 static-analysis Docker images (Actionlint, Syft, Grype, Grant, Zizmor, Poutine, RunnerGuard, Yamllint) were re-verified directly against their registries: versions and digests are unchanged from pkg/cli/docker_images.go, so no Docker image edits were needed this run.

Claude Code CLI: 2.1.245 → 2.1.246

• Constant: DefaultClaudeCodeVersion in pkg/constants/version_constants.go
• Patch release. No public changelog/repository is available for Claude Code; version bump sourced from npm view @anthropic-ai/claude-code version.
• Risk: Low

GitHub MCP Server: v1.10.1 → v1.11.0

• Constant: DefaultGitHubMCPServerVersion in pkg/constants/version_constants.go
• Release notes: https://github.com/github/github-mcp-server/releases/tag/v1.11.0
• Full diff: github/github-mcp-server@v1.10.1...v1.11.0

Features

• New --authorization-server flag to override the OAuth AS URL — feat(http): add --authorization-server flag to override OAuth AS URL github-mcp-server#2900
• Root command now named after the installed binary — Name the root command after the installed binary github-mcp-server#2998
• Atomic parent/sub-issue creation workflow — Add atomic parent issue creation github-mcp-server#3134
• ETag conditional requests added to the REST transport (STDIO caching) — Add ETag conditional requests to the REST transport github-mcp-server#3026
• Per-call OAuth scope checks, so each tool invocation requests only the permissions it needs — Add per-call OAuth scope checks github-mcp-server#3128

Fixes

• CORS handling preserved across OAuth discovery routes — fix(http): preserve CORS across OAuth routes github-mcp-server#3147

Security

• No entries explicitly labeled as security fixes; release notes mention routine security/dependency updates tied to the Go 1.27 runtime upgrade.

Performance / Maintenance

• Go runtime upgraded 1.25.13 → 1.27.0 (Alpine base image) — build(deps): bump golang from 1.25.13-alpine to 1.27.0-alpine github-mcp-server#3153
• codeql-action bumped 4 → 4.37.4 — build(deps): bump github/codeql-action from 4 to 4.37.4 github-mcp-server#3004
• docker/setup-buildx-action bumped 4.2.0 → 4.3.0 — build(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 github-mcp-server#3157
• go-chi/chi/v5 bumped 5.3.1 → 5.3.2 — build(deps): bump github.com/go-chi/chi/v5 from 5.3.1 to 5.3.2 github-mcp-server#3156
• distroless/base-debian12 digest updated — build(deps): bump distroless/base-debian12 from 76b3162 to fabbf1c github-mcp-server#3154
• stretchr/testify bumped 1.12.0 → 1.12.1 — build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 github-mcp-server#3155

Breaking Changes

• None explicitly flagged. The root-command rename ([q] Fix invalid network configuration in dictation-prompt workflow #2998) could in theory affect scripts hardcoding the binary/command name, but this is not called out as breaking in the release notes.

• Risk: Low — no breaking changes identified; adds new OAuth flag and tightens per-call scopes (net security improvement).

MCP Gateway (gh-aw-mcpg): v0.4.10 → v0.4.11

• Constant: DefaultMCPGatewayVersion in pkg/constants/version_constants.go
• Used as the default sandbox.agent container image (ghcr.io/github/gh-aw-mcpg)
• Release notes: https://github.com/github/gh-aw-mcpg/releases/tag/v0.4.11
• Digest: this constant is tag-only (no @sha256 pin) in generated lock files — make recompile run twice confirmed zero additional diff on the second pass.

• Risk: Low — the only breaking item (deprecated DIFC resource removal) is not part of the interface gh-aw currently depends on; remaining changes are fixes, tests, and internal maintenance.

Unchanged (verified, no action needed)

Docker images (all unchanged, version + digest verified against registries)

Verification performed

• pkg/constants/version_constants.go: 3 constants edited (DefaultClaudeCodeVersion, DefaultGitHubMCPServerVersion, DefaultMCPGatewayVersion)
• make fmt: Go and JS formatting succeeded (fmt-json failed on an unrelated pre-existing sandbox permissions issue, not caused by this change)
• make recompile (run twice, in foreground): 294/294 workflows compiled successfully both times; second pass produced no additional diff
• git status: only pkg/constants/version_constants.go and the 294 regenerated .lock.yml files changed

Generated by 🔢 CLI Version Checker · claude · agent · 97.7 AIC · ⌖ 8.05 AIC · ⊞ 12.8K · ◷

• expires on Aug 27, 2026, 9:45 PM UTC-08:00