Evidence record / github-copilot-cli
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-09-21-github-copilot-cli-1-0-83-and-1-0-87-enterprise-login-pinning-mcp-policy-race-closed-marketplace-lockdown
1.0.83 and 1.0.87: enterprise login pinning, MCP policy race closed, marketplace lockdown. 1.0.83: forceLoginOrgs managed setting pins sign-in to approved GitHub orgs (L161); enterprise-denied MCP servers could previously start before the managed allow/deny policy resolved, and startup now waits for the fetch (L175). 1.0.87: an empty strictKnownMarketplaces allowlist now hides and blocks built-in plugin marketplaces (L12); secrets exported in the launching shell are no longer written to debug logs on session create or resume (L21); --yolo stays enabled after startup policy checks for authenticated unmanaged sessions (L11); Auto routing tier gains managed startup defaults (L3).
Channel: tagged-release. Half: both. Date: 2026-09-04 and 2026-09-21.
Operator consequence: The MCP race means a denied server could run briefly on versions before 1.0.83; treat that as a gap in the enterprise MCP deny list for older clients. Anyone who collected debug logs (--collect-debug-logs, now available to all users in 1.0.85, L138) before 1.0.87 should treat those bundles as possibly containing shell secrets and rotate or scrub before sharing.
Receipt
Finding metadata
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
Finding ID: 2026-09-21-github-copilot-cli-1-0-83-and-1-0-87-enterprise-login-pinning-mcp-policy-race-closed-marketplace-lockdown
Profile citations
- github-copilot-cli / claim / login-pinning-mcp-race-marketplaces
Source links
Primary links, including exact changelog lines when available.
Versioned source: run artifact