Bump gh-aw-mcpg image to v0.4.9

[Copilot]

The pinned gh-aw-mcpg:v0.4.8 image carries high-severity container findings. This updates workflow-generated gateway usage to the latest released image and immutable digest.

• Gateway image
  • Set the default MCP gateway version to v0.4.9.
  • Refresh the embedded OCI digest pin.

ghcr.io/github/gh-aw-mcpg:v0.4.9@sha256:e5a1569aeaf41820fa7bdee3e94468cae448133cdbf00119ad24f5b74db1ab9f

• Generated workflows

  • Regenerate all workflow lock files so download, gateway, and CLI proxy references use the new pinned image.

• Release metadata

  • Add a patch changeset for the default gateway image update.

• Fixes [container-image-scan] Container findings for ghcr.io/github/gh-aw-mcpg:v0.4.8 #51707

[github-actions]

Triage: Bump gh-aw-mcpg image to v0.4.9

• Category: chore | Risk: low | Score: 55/100 (impact 25, urgency 15, quality 15)
• Recommended action: batch_review (batch: security-container-mitigation)
• Notes: Duplicate of Bump MCP Gateway (gh-aw-mcpg) from v0.4.8 to v0.4.9 #51754 (near-identical diff, same digest bump). Draft, blocked mergeable_state, 289 files changed (regenerated locks). Recommend closing one of Bump gh-aw-mcpg image to v0.4.9 #51770/Bump MCP Gateway (gh-aw-mcpg) from v0.4.8 to v0.4.9 #51754 as duplicate before merge.

Generated by 🔧 PR Triage Agent · auto · 49.6 AIC · ⌖ 2.51 AIC · ⊞ 7.8K · ◷

[Copilot]

Pull request overview

Updates the default MCP gateway image from v0.4.8 to v0.4.9, replacing the vulnerable container pin across generated workflows.

Changes:

• Bumps the default gateway version and embedded OCI digest.
• Regenerates workflow lock files with the new image reference.
• Adds patch release metadata.

Show a summary per file

File	Description
pkg/workflow/data/action_pins.json	Updates the workflow container pin.
pkg/constants/version_constants.go	Sets the default gateway to v0.4.9.
pkg/actionpins/data/action_pins.json	Updates the embedded container pin.
.github/aw/actions-lock.json	Refreshes the repository action lock.
.changeset/patch-bump-mcpg-v0-4-9.md	Adds patch release metadata.
.github/workflows/smoke-copilot-sub-agents.lock.yml	Regenerates gateway references.
.github/workflows/smoke-copilot-small.lock.yml	Regenerates gateway references.
.github/workflows/smoke-copilot-sdk.lock.yml	Regenerates gateway references.
.github/workflows/notion-issue-summary.lock.yml	Regenerates gateway references.
.github/workflows/github-remote-mcp-auth-test.lock.yml	Regenerates gateway references.
.github/workflows/github-mcp-tools-report.lock.yml	Regenerates gateway references.
.github/workflows/example-permissions-warning.lock.yml	Regenerates gateway references.
.github/workflows/example-failure-category-filter.lock.yml	Regenerates gateway references.
.github/workflows/daily-team-status.lock.yml	Regenerates gateway references.
.github/workflows/daily-squid-image-scan.lock.yml	Regenerates gateway references.
.github/workflows/daily-max-ai-credits-test.lock.yml	Regenerates gateway references.
.github/workflows/daily-go-test-parallelizer.lock.yml	Regenerates gateway references.
.github/workflows/daily-github-docs-seo-optimizer.lock.yml	Regenerates gateway references.
.github/workflows/daily-credit-limit-test.lock.yml	Regenerates gateway references.
.github/workflows/daily-byok-ollama-test.lock.yml	Regenerates gateway references.
.github/workflows/copilot-pr-merged-report.lock.yml	Regenerates gateway references.
.github/workflows/copilot-centralization-optimizer.lock.yml	Regenerates gateway references.
.github/workflows/copilot-centralization-drilldown.lock.yml	Regenerates gateway references.
.github/workflows/codex-github-remote-mcp-test.lock.yml	Regenerates gateway references.

Review details

Tip

Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 79/289 changed files
• Comments generated: 0
• Review effort level: Balanced