[ca] CLI and scanner image updates: Claude 2.1.306, Copilot 1.0.101, Zizmor 1.31.1 #70799

Summary

Version monitoring on 2026-10-21 found three stable updates and updated the repository pins.

CLI updates

Claude Code: 2.1.296 → 2.1.306

• Release timeline: 2.1.305 was published 2026-10-20 and 2.1.306 on 2026-10-21.
• Breaking: none identified in the reviewed release notes.
• Features: 2.1.305 adds auto-mode setup, managed-agent security comparison, improved usage guidance, and broader cloud/VS Code support.
• Fixes: 2.1.306 fixes cloud-session authentication, prompt-length/API-error handling with many MCP tools, and compaction behavior.
• Security: 2.1.305 adds the managed-agents-secure comparison command; no security regression identified.
• Performance: improved MCP/tool-search fallback and reduced unnecessary compaction/retries.
• Risk: Medium, because the release includes sandbox, MCP, cloud-session, and provider behavior changes.
• Links: https://www.npmjs.com/package/@anthropic-ai/claude-code and https://github.com/anthropics/claude-code/releases/tag/v2.1.306

GitHub Copilot CLI: 1.0.98 → 1.0.101

• Release timeline: 1.0.101 was published 2026-10-20. The newer 1.0.102-0 and 1.0.102-1 builds published 2026-10-21 are prereleases and were skipped.
• Breaking: none identified in the reviewed stable changelog.
• Features: native structured output for dynamic workflow subagents, assisted approval instructions, team-assigned plugins, improved model selection, and configurable reasoning display.
• Fixes: MCP inventory/auth recovery, provider/model switching, image-limit handling, restored sessions, Windows process cleanup, and permission diagnostics.
• Security: sandbox proxy inheritance now honors NO_PROXY and ALL_PROXY in the 1.0.102 prerelease notes; this was not included because it is not stable.
• Performance: faster MCP startup and session resume, plus reduced unnecessary compaction and request rewrites.
• Risk: Medium, because MCP authentication, sandbox behavior, and dynamic subagent output changed.
• Links: https://www.npmjs.com/package/@github/copilot and https://github.com/github/copilot-cli/releases/tag/v1.0.101
• CLI help was captured for the main command plus config and environment subcommands and stored in cache-memory.

Docker image update

ZizmorImage: 1.30.1 → 1.31.1

• Released 2026-10-15 — 6 days ago; the three-day cooldown passed.
• Digest: sha256:a2eb396d886c053073405c7a980f2139ba2248ec172243cfa3841e57196e8101 → sha256:42d409dbb851d4c5d35a058cf042b828bea1e3f2884378c526eb0974780e18d9
• Full image reference: ghcr.io/zizmorcore/zizmor:1.31.1@sha256:42d409dbb851d4c5d35a058cf042b828bea1e3f2884378c526eb0974780e18d9
• Changes: 1.31.1 fixes ignore comments/configuration for dangerous-triggers. The 1.31.0 release added pre-commit typosquat inputs, more precise self-hosted-runner and dangerous-trigger audits, cache-mode awareness, and PowerShell parsing improvements.
• Risk: Low to Medium; scanner findings may change because audit precision improved.
• Release: https://github.com/zizmorcore/zizmor/releases/tag/v1.31.1

Checked without updates

• Codex 0.163.0, Playwright CLI 0.1.22, Pi 1.3.0, GitHub MCP Server v2.0.2, MCP Gateway v0.4.36, and threat-detect v0.5.2 remain current.
• Actionlint 1.7.12, Grant 0.6.8, Poutine 1.1.6, Runner Guard 3.1.5, and Yamllint latest digests matched their pins.
• Syft v1.55.0 and Grype v0.121.0 were skipped because their 2026-10-19 releases had not passed the three-day cooldown at check time.

Validation

• make recompile completed successfully in the foreground.
• go test ./pkg/constants passed.
• make fmt formatted Go successfully but the JavaScript phase could not run because actions/setup/js/node_modules/.bin/prettier is missing.

Files updated

• pkg/constants/version_constants.go
• pkg/constants/spec_test.go
• pkg/constants/version_constants_test.go
• pkg/cli/docker_images.go
• actions/setup/sh/install_copilot_cli.sh
• .github/aw/compat.json

Generated lock files were not retained, per repository guidance.

Generated by 🔢 CLI Version Checker · pi · gpt50 · 6.33 AIC · ⌖ 0.688 AIC · ⊞ 17.9K · ◷

• expires on Oct 22, 2026, 9:40 PM UTC-08:00