[ca] CLI/Docker version check: 6 CLI updates, 3 Docker image bumps (2026-08-15) #52853

Daily npm releases, no public repository or changelog:

• 2.1.228 — 2026-08-11
• 2.1.229 — 2026-08-12
• 2.1.231 — 2026-08-13
• 2.1.232 — 2026-08-13
• 2.1.233 — 2026-08-14

Impact: Low. No known breaking changes; monitor for behavior drift in Claude engine workflows.

Features:

• Add history.clearContext and Tool.isTerminal across all SDKs (Add history.clearContext and Tool.isTerminal across all SDKs copilot-sdk#2129)
• Add rewind support across all SDKs (Add rewind support across all SDKs copilot-sdk#2321)
• Add managed permission settings to session startup (Add managed permission settings to session startup copilot-sdk#2139)
• Add built-in plugin directory support (Add built-in plugin directory support copilot-sdk#2330)
• Add Agent Factories authoring surface + argsSchema (Add the Agent Factories authoring surface copilot-sdk#2114, [SDK/Factories] Add argsSchema To The Factory Authoring Surface copilot-sdk#2315)
• Support reasoningEffort: max (Support reasoningEffort: max copilot-sdk#2228)

Fixes:

• SDK/Runtime: recover JSON-RPC frames containing unpaired UTF-16 surrogates (SDK, Runtime: Recover JSON-RPC frames containing unpaired UTF-16 surrogates copilot-sdk#2283)
• java: preserve MCP permission extension data (fix(java): preserve MCP permission extension data copilot-sdk#2276)
• Stop sendAndWait from emitting an unhandled rejection (Stop sendAndWait from emitting an unhandled rejection copilot-sdk#2206)
• dotnet: release oversized JSON-RPC receive buffers (dotnet: release oversized JSON-RPC receive buffers copilot-sdk#2047)

Impact: Low/Medium. gh-aw uses the Copilot engine's CLI, not the SDK directly in most workflows, but @github/copilot sub-releases were absorbed into this SDK bump chain. No action required.

Full changelog: github/copilot-sdk@v1.0.8...v1.0.11

This is a large version jump spanning ~16 minor releases. Notable Security fixes surfaced while sampling release notes across the range:

• fix(a2a-server): enforce workspace trust and task isolation to prevent RCE (fix(a2a-server): enforce workspace trust and task isolation to prevent RCE google-gemini/gemini-cli#28470)
• fix(core): mitigate infinite ReAct loops and prompt injection loops (fix(core): mitigate infinite ReAct loops and prompt injection loops google-gemini/gemini-cli#28429)
• fix(security): enforce case-insensitive sensitive path blocklist and VS Code HITL (fix(security): enforce case-insensitive sensitive path blocklist and vscode hitl google-gemini/gemini-cli#27966)
• fix(core): resolve symbolic link directory escape in memory import processor (fix(core): resolve symbolic link directory escape in memory import processor google-gemini/gemini-cli#28233)
• fix(core): enforce HTTPS for GoogleCredentialsAuthProvider to prevent cleartext credential leakage (fix(core): enforce HTTPS for GoogleCredentialsAuthProvider to prevent cleartext leakage google-gemini/gemini-cli#28517)
• fix(core): enforce explicit tag length and validation in file keychain (fix(core): enforce explicit tag length and validation in file keychain google-gemini/gemini-cli#28523)
• refactor(cli): align macOS permissive Seatbelt sandbox profiles with deny-default model (refactor(cli): align macOS permissive Seatbelt profiles with deny-default model google-gemini/gemini-cli#28424)
• fix(sandbox): make ~/.gitconfig read-only in the macOS sandbox (fix(sandbox): make ~/.gitconfig read-only in the macOS sandbox google-gemini/gemini-cli#28221)
• fix(caretaker): sanitize and wrap issue title in untrusted_context (fix(caretaker): sanitize and wrap issue title in untrusted_context google-gemini/gemini-cli#28352)

Impact: Medium — several hardening fixes for prompt-injection and sandbox-escape classes of issues are relevant to gh-aw's threat model when the Gemini engine is used. Recommend prioritizing this bump.

Note: given the range size, this list is a sample of security-tagged commits, not an exhaustive diff. Full compare: google-gemini/gemini-cli@v0.39.1...v0.55.1

Six minor releases between versions; full changelog: modelcontextprotocol/typescript-sdk@1.24.0...1.30.0

Impact: Low. No gh-aw-specific breakage expected; MCP protocol changes are typically additive/backwards compatible.

• Security: remediates 2 vulnerabilities in github.com/go-git/go-git/v5 — GHSA-hc8v-wwc9-vgxm (High) and GHSA-qgq7-7hm3-q39j (Medium)
• Fixes: incorrect PURLs for legacy JARs missing Maven metadata (causing Grype false negatives), wrong SPDX packageVerificationCode when hardlinks are present, phantom <name>@unknown`` npm packages from subpath/export-map stub package.json files
• Features: detect native Go FIPS 140 mode in binaries

New reference: anchore/syft:v1.51.0@sha256:678bfa565b60f747aac0f8e964fe5588a24445b8d0a480e91f6efd70020dfbb0

Release: https://github.com/anchore/syft/releases/tag/v1.51.0

• Security: remediates the same 2 go-git vulnerabilities as Syft above (transitive dependency), plus bumps bundled Syft to v1.51.0
• Features: include vulnerable ranges in CycloneDX output format
• Fixes: honor match.rust.using-cpes configuration

New reference: anchore/grype:v0.117.0@sha256:ddf9e9f204049f3a4a0955ef70873cabab6a31432125ad4f20a490b54950a253

Release: https://github.com/anchore/grype/releases/tag/v0.117.0

This release was previously untracked by the automated cooldown table (not in the standard source list) despite being over a year old — a stale pin caught by this run's full digest sweep.

• Changed: SC2002 (Useless Use of Cat) is now disabled by default — re-enable with --enable=useless-use-of-cat. This may reduce warning counts in existing gh-aw shellcheck-based lint output.
• Added: SC2327/SC2328 (capturing output of redirected commands), SC2329 (unused functions), SC2330 (BusyBox glob issues), SC2331/SC2332/SC3062 (-o/-a test operator issues), optional avoid-negated-conditions (SC2335) — these may introduce new warnings in previously-clean scripts.
• Fixed: SC2218 function use-before-define accuracy, SC2317 unreachable-command spam reduction, Bash 5.3 support (${| cmd; }, source -p)
• Removed: SC3013 (now POSIX.1-2024 specified)

Impact: Low/Medium — the new default-enabled checks could surface new shellcheck findings the next time shellcheck-backed static analysis runs against workflow scripts. Worth a spot-check after merge.

New reference: koalaman/shellcheck:v0.11.0@sha256:61862eba1fcf09a484ebcc6feea46f1782532571a34ed51fedf90dd25f925a8d

Release: https://github.com/koalaman/shellcheck/releases/tag/v0.11.0