Bump gh-aw-mcpg to v0.4.9 and github-mcp-server to v1.9.0 - #51828
Conversation
…ntainer pins Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
@copilot merge main and recmpile |
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Merged All 278 conflicts were in generated Main had already landed the mcpg
|
There was a problem hiding this comment.
Pull request overview
Updates the compiler’s default GitHub MCP server to v1.9.0 to consume the patched container image. The MCP gateway v0.4.9 had already landed on the base branch.
Changes:
- Updates the GitHub MCP server version and SHA256 digest.
- Synchronizes canonical and embedded container-pin data.
- Regenerates 278 affected workflow lock files and adds a patch changeset.
Show a summary per file
| File | Description |
|---|---|
.changeset/patch-bump-github-mcp-server-v1-9-0.md |
Records the patch release. |
.github/aw/actions-lock.json |
Updates the canonical container pin. |
pkg/actionpins/data/action_pins.json |
Updates the embedded action pin. |
pkg/constants/version_constants.go |
Sets the default to v1.9.0. |
pkg/workflow/data/action_pins.json |
Updates the embedded workflow pin. |
.github/workflows/*.lock.yml (278 files) |
Regenerates manifests, download references, MCP configuration, and derived heredoc identifiers with the v1.9.0 pin. |
Review details
Tip
Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 112/283 changed files
- Comments generated: 0
- Review effort level: Balanced
|
🎉 This pull request is included in a new release. Release: |
Container-image scans flagged unpatched CVEs in the MCP gateway and GitHub MCP server images pinned by the compiler. This applies the version bumps and refreshes the corresponding digest pins.
Version constants (
pkg/constants/version_constants.go)DefaultMCPGatewayVersion:v0.4.8→v0.4.9DefaultGitHubMCPServerVersion:v1.8.0→v1.9.0Digest pins
Refreshed only the two bumped images across
.github/aw/actions-lock.jsonand its two embedded copies (pkg/actionpins/data/action_pins.json,pkg/workflow/data/action_pins.json):--force-refresh-container-pinsalso re-resolved the floatinggh-aw-nodetag and prunedmcp/context7/python:alpine; those were reverted to keep the diff scoped to the CVE remediation.Lock files
All 284 workflow lock files recompiled to emit the new SHA-pinned references. Changeset added.
Firewall images — no change available
The issue points at tracking issue #41554 targeting firewall
v0.27.11, butDefaultFirewallVersionis already atv0.27.44, which is the current latestgithub/gh-aw-firewallrelease. The four firewall findings (agent,api-proxy,cli-proxy,squidat0.27.44) cannot be remediated from this repo — they need a new upstream release first, after which the pin here can be bumped.