[github-actions]

Summary

Update DefaultClaudeCodeVersion from 2.1.317 to 2.1.318, including the focused version expectation. This is the only cooldown-eligible, safely actionable CLI update identified in this run.

Evidence and release policy

• Check time: 2026-11-07T05:26:49Z
• Global 72-hour cutoff: 2026-11-04T05:26:49Z
• Selected release: Claude Code 2.1.318, published 2026-11-03T21:55:17.247Z; eligible because it predates the cutoff.
• Previous release 2.1.317 was published 2026-11-02T23:57:53.069Z.
• NPM metadata: https://www.npmjs.com/package/``@anthropic-ai/claude-code``

Research

• Breaking changes: none identified from the available NPM metadata.
• Features/fixes/security/performance: the package has no public changelog or repository release notes; no additional categorized changes could be independently verified.
• CLI help comparison: the cached 2.1.317 help was compared with the 2.1.318 package metadata; no verified interface change was identified.

Other candidates were not included: Copilot 1.0.105 lacks an independently reviewed checksum pin; Zizmor v1.32.0 was eligible but its public GHCR manifest lookup returned 404; MCP Gateway v0.5.5, Syft v1.57.0, and Grype v0.121.2 were still inside the cooldown window. No active repository PR covering this pin update was found in the preflight search.

Implementation

• pkg/constants/version_constants.go: set DefaultClaudeCodeVersion to 2.1.318.
• pkg/constants/version_constants_test.go: update the expected default version.
• Generated .lock.yml files were not committed; they were restored after foreground compilation per delivery policy.

Validation

• make recompile: passed in the foreground; all 359 workflows compiled successfully. Generated lock changes were intentionally restored and are excluded from delivery.
• Focused Go tests in pkg/constants and pkg/workflow for default versions, release pins, dependency metadata, Copilot, and Claude: passed.
• git diff --check: passed.
• make fmt: Go formatting passed, but the overall target exited non-zero because the repository JavaScript Prettier executable is missing at actions/setup/js/node_modules/.bin/prettier; no JavaScript files were changed.

Risk

Low: this changes only the default Claude Code CLI version constant and its unit-test expectation; no workflow source or generated lock file is delivered.

Generated by 🔢 CLI Version Checker · pi · gpt50 · ~10 AIC · ⌖ ~2 AIC · ⊞ 20K · ◷

• expires on Nov 8, 2026, 9:36 PM UTC-08:00