Skip to content

Releases: openai/codex-security

Release list

Codex Security 0.1.30

Codex Security 0.1.30 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Sep 05:06
Immutable release. Only release title and notes can be modified.
npm-v0.1.30
6eecd8c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • bump the third-party group across 2 directories with 2 updates (#969)
  • bump ruff from 0.16.6 to 0.16.7 in /plugins/codex-security (#967)
  • bump the codex group across 3 directories with 2 updates (#968)
  • build the native runtime without the SDK (#965)
  • set up Python for Windows package verification (#966)
  • report full-output scan failures as errors (#971)
  • add GitHub Actions workflow for Bedrock scans (#901)
  • add Azure Pipelines Bedrock scan example (#906)
  • run Windows proofs without symlink privileges (#988)
  • pin the MCP formatter (#990)
  • check formatting across the MCP app (#991)
  • review original observation records through a host (#946)

Upgrade notes

Review compatibility and document any required migration steps before releasing.

What's Changed

Features

  • feat(dedupe): review original observation records through a host by @kmbroai in #946

Fixes

Documentation

Other changes

  • chore(deps): bump the third-party group across 2 directories with 2 updates by @dependabot[bot] in #969
  • chore(deps-dev): bump ruff from 0.16.6 to 0.16.7 in /plugins/codex-security by @dependabot[bot] in #967
  • chore(deps): bump the codex group across 3 directories with 2 updates by @dependabot[bot] in #968

New Contributors

Full Changelog: npm-v0.1.29...npm-v0.1.30

Contributors

dependabot, thegoodengineer, and 2 other contributors
Assets 4
Loading

Codex Security 0.1.29

Codex Security 0.1.29

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Sep 16:52
Immutable release. Only release title and notes can be modified.
npm-v0.1.29
6620a38
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • stream large saved scan JSON output (#932)
  • prefer complete saved rollout copies (#933)
  • support custom patch validation prompts (#940)
  • bump @opencode-ai/sdk from 1.18.29 to 1.18.30 in /plugins/codex-security/skills/triage-finding/evals in the third-party group across 1 directory (#936)
  • bump @linear/sdk from 93.0.1 to 94.0.0 in /sdk/typescript (#937)
  • seal drafts with empty artifact lists (#941)
  • include Terraform files in scan inventories (#944)
  • run README CLI commands with npx (#945)
  • resolve Git metadata outside its config (#935)
  • redirect findings service root to dashboard (#948)
  • bound source preview reads (#947)
  • align filter controls and dropdown carets (#949)
  • match filter control borders (#957)
  • make dashboard tables sortable (#958)
  • bump @linear/sdk from 94.0.0 to 95.0.0 in /sdk/typescript (#955)
  • tolerate transient setup failures and slow Windows runners (#953)
  • reject line breaks in inventory paths. (#961)
  • bump the third-party group across 3 directories with 7 updates (#954)
  • keep model-authored runtime status out of finalized reports (#703)
  • show progress while patching findings (#931)
  • deduplicate string-form openQuestions in merge_saved_results (#951)
  • emit structured JSON errors for failed scans (#709)
  • preserve undecided findings after model refusals (#960)

Upgrade notes

Review compatibility and document any required migration steps before releasing.

What's Changed

Features

Fixes

Documentation

Other changes

  • chore(deps): bump @opencode-ai/sdk from 1.18.29 to 1.18.30 in /plugins/codex-security/skills/triage-finding/evals in the third-party group across 1 directory by @dependabot[bot] in #936
  • chore(deps): bump @linear/sdk from 93.0.1 to 94.0.0 in /sdk/typescript by @dependabot[bot] in #937
  • chore(deps): bump @linear/sdk from 94.0.0 to 95.0.0 in /sdk/typescript by @dependabot[bot] in #955
  • chore(deps): bump the third-party group across 3 directories with 7 updates by @dependabot[bot] in #954

New Contributors

Full Changelog: npm-v0.1.28...npm-v0.1.29

Contributors

russlan23, dependabot, and 7 other contributors
Loading

Codex Security 0.1.28

Codex Security 0.1.28

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Sep 06:01
Immutable release. Only release title and notes can be modified.
npm-v0.1.28
f5adb33
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • use versioned conventional commit titles (#879)
  • share scan settings across the CLI and SDK (#742)
  • keep parameterized JUnit names unique (#877)
  • accept large saved post-scan prompts (#876)
  • make cost display optional (#881)
  • collect Desktop and worker session logs (#872)
  • skip unavailable Daybreak access advisories (#878)
  • align Codex 0.154.0 and dependency cooldowns (#755)
  • bump docker/setup-buildx-action from 4.2.0 to 4.3.0 (#891)
  • bump actions/attest-build-provenance from 4.1.1 to 4.2.2 (#886)
  • update setuptools requirement from >=64.0 to >=84.0.0 in /plugins/codex-security (#889)
  • bump SocketDev/action from 1.3.0 to 1.3.2 (#884)
  • bump ruff from 0.16.1 to 0.16.6 in /plugins/codex-security (#887)
  • bump typescript from 6.0.3 to 7.0.2 in /plugins/codex-security/mcp-app (#894)
  • bump pytest from 9.0.3 to 9.1.1 in /plugins/codex-security (#885)
  • bump typescript from 5.7.3 to 7.0.2 in /sdk/typescript (#898)
  • simplify fast-uri dependency and update Ajv resolver (#895)
  • bump @linear/sdk from 89.0.0 to 93.0.1 in /sdk/typescript (#896)
  • bump actions/checkout from 6.0.2 to 7.0.1 (#890)
  • bump actions/setup-node from 6.3.0 to 7.0.0 (#888)
  • bump @types/node from 22.19.17 to 26.4.1 in /sdk/typescript (#897)
  • bump @types/node from 25.9.1 to 26.4.1 in /plugins/codex-security/mcp-app (#893)
  • bump the third-party group across 3 directories with 19 updates (#892)
  • report patch failures and changed files (#874)
  • persist scan artifacts through MCP (#862)
  • advance scan progress when saving drafts (#882)
  • simplify scan runtime bookkeeping (#903)
  • upgrade json-schema-to-typescript to 16.0.0 (#914)
  • upgrade eval OpenCode SDK to 1.18.29 (#911)
  • upgrade Ink and use complete Escape input in TUI tests (#913)
  • upgrade pnpm setup and align the package-manager pin (#910)
  • upgrade actions/setup-python to 7.0.0 (#909)
  • upgrade Stryker with compatible mutation tooling (#912)
  • limit fix-finding to security vulnerabilities (#923)
  • accept text knowledge-base files with any extension (#924)
  • declare native release workflow permissions (#925)
  • report context-aware estimate ranges (#926)
  • update vulnerable image and archive dependencies (#927)
  • update Inquirer prompts and Node/Bun types (#929)

Upgrade notes

Review compatibility and document any required migration steps before releasing.

What's Changed

Features

  • feat: share scan settings across the CLI and SDK by @mldangelo-oai in #742
  • feat(cli): make cost display optional by @ianw-oai in #881
  • feat(plugin): persist scan artifacts through MCP by @soyeon-oai in #862
  • feat(cli): accept text knowledge-base files with any extension by @kmbroai in #924

Fixes

Other changes

  • chore(deps): align Codex 0.154.0 and dependency cooldowns by @mldangelo-oai in #755
  • ci: bump docker/setup-buildx-action from 4.2.0 to 4.3.0 by @dependabot[bot] in #891
  • ci: bump actions/attest-build-provenance from 4.1.1 to 4.2.2 by @dependabot[bot] in #886
  • chore(deps-dev): update setuptools requirement from >=64.0 to >=84.0.0 in /plugins/codex-security by @dependabot[bot] in #889
  • ci: bump SocketDev/action from 1.3.0 to 1.3.2 by @dependabot[bot] in #884
  • chore(deps-dev): bump ruff from 0.16.1 to 0.16.6 in /plugins/codex-security by @dependabot[bot] in #887
  • chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 in /plugins/codex-security/mcp-app by @dependabot[bot] in #894
  • chore(deps-dev): bump pytest from 9.0.3 to 9.1.1 in /plugins/codex-security by @dependabot[bot] in #885
  • chore(deps-dev): bump typescript from 5.7.3 to 7.0.2 in /sdk/typescript by @dependabot[bot] in #898
  • chore(deps): simplify fast-uri dependency and update Ajv resolver by @dependabot[bot] in #895
  • chore(deps): bump @linear/sdk from 89.0.0 to 93.0.1 in /sdk/typescript by @dependabot[bot] in #896
  • ci: bump actions/checkout from 6.0.2 to 7.0.1 by @dependabot[bot] in #890
  • ci: bump actions/setup-node from 6.3.0 to 7.0.0 by @dependabot[bot] in #888
  • chore(deps-dev): bump @types/node from 22.19.17 to 26.4.1 in /sdk/typescript by @dependabot[bot] in #897
  • chore(deps-dev): bump @types/node from 25.9.1 to 26.4.1 in /plugins/codex-security/mcp-app by @dependabot[bot] in #893
  • chore(deps): bump the third-party group across 3 directories with 19 updates by @dependabot[bot] in #892
  • refactor: simplify scan runtime bookkeeping by @mldangelo-oai in #903
  • chore(deps-dev): upgrade json-schema-to-typescript to 16.0.0 by @dependabot[bot] in #914
  • chore(deps): upgrade eval OpenCode SDK to 1.18.29 by @dependabot[bot] in #911
  • chore(deps): upgrade Ink and use complete Escape input in TUI tests by @dependabot[bot] in #913
  • ci: upgrade pnpm setup and align the package-manager pin by @dependabot[bot] in #910
  • ci: upgrade actions/setup-python to 7.0.0 by @dependabot[bot] in #909
  • chore(deps-dev): upgrade Stryker with compatible mutation tooling by @dependabot[bot] in #912
  • ci: declare native release workflow permissions by @mldangelo-oai in #925
  • chore(deps): update Inquirer prompts and Node/Bun types by @dependabot[bot] in https://github.com/openai/codex-s...
Read more

Contributors

tiffanycitra, dependabot, and 6 other contributors
Loading

Codex Security 0.1.26

Codex Security 0.1.26

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Sep 19:46
Immutable release. Only release title and notes can be modified.
npm-v0.1.26
2536d10
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Classify finding severity with custom rubrics and supporting context through
    the CLI and SDK. Saved assessments can be reused for Linear publication
    without changing the original findings or sealed scan artifacts. See
    severity classification.
  • Match repeated findings across scan history, preserving confirmed identities
    and related-finding relationships. Automatic matching restores batching, and
    confirmed-finding lookups are faster.
  • Open draft GitLab merge requests for verified patches with the existing
    --create-pr option, including self-hosted GitLab. See
    patch publication.
  • Report component scan progress in headless runs and exclude replayed usage
    events with identical timestamps from scan budgets.
  • Preserve analytics settings in finding workflows and allow 120 seconds for
    the bundled plugin's MCP server to start.
  • Require an explicit request before invoking the security fix verification
    skill during other work.

Upgrade notes

  • GitLab patch publication requires an installed and authenticated glab CLI.
    For self-hosted GitLab, configure the host as described in the patch
    publication documentation above.
  • Severity classification is opt-in. Without a rubric, it inherits the
    finding's existing severity without a model call.
  • With --max-cost, automatic history matching makes at most one extra model
    call. If matching needs more context, the completed scan is retained and a
    warning directs you to run scans match --all explicitly.

The categorized list below contains the individual changes.

What's Changed

Features

  • feat: classify finding severity with custom rubrics by @kmbroai in #791
  • feat: match repeated findings across scan history by @mldangelo-oai in #575
  • feat(cli): create GitLab merge requests for verified patches by @kmbroai in #814
  • feat(plugin): add Daybreak access advisory by @soyeon-oai in #826

Fixes

Other changes

New Contributors

Full Changelog: npm-v0.1.25...npm-v0.1.26

Contributors

h1994st, dependabot, and 6 other contributors
Loading

Codex Security 0.1.25

Codex Security 0.1.25

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Sep 00:14
Immutable release. Only release title and notes can be modified.
npm-v0.1.25
7d042cd
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Preserve confirmed finding identities across scans and comparisons, and show
    related findings with their reasons while keeping distinct findings separate.
    Large comparisons now use bounded batches without truncating finding text;
    inputs that cannot fit leave matching explicitly incomplete.
  • Improve deduplication with separate screening and pair reviews, validated
    pair assignments, and groups that respect explicit DISTINCT decisions.
    Invalid submissions receive one corrective turn; blocked reviews fail without
    recording a verdict. DeduplicationReviewError exposes structured, sanitized
    failure details. The SDK also adds deduplicateScanDirectory for complete,
    sealed scans outside local history.
  • Generate synthetic Standard scan results with scan --mock or the SDK's
    mock: true, without authentication or model calls. Mock results support
    normal reports, exports, history, and reruns. See
    mock scans.
  • Increase a running scan's total budget from the interactive dashboard when
    usage reaches 80% of its limit, or use the SDK's onBudgetApproaching
    callback. The existing limit remains enforced until an increase is saved.
    See scan cost limits.
  • Recognize existing Codex authentication in CLI and SDK login status. SDK
    scans, comparisons, and deduplication reviews now honor native command-auth
    providers, including renewable tokens.
  • Configure the findings service's full embeddings endpoint with
    CODEX_SECURITY_EMBEDDINGS_URL. The new @openai/codex-security/server
    exports support embedding credentials supplied by a callback before each
    HTTP batch. See
    embeddings and storage.
  • Include PowerShell module (.psm1) and data (.psd1) files in scan
    inventories, and recognize BOM-marked UTF-16 source files as text.
  • Preserve scoped scan and component-plan inventories after directory renames
    that change only letter casing on case-insensitive filesystems.
  • Support long Codex executable paths on Windows, including nested Deep Scan
    workers, and retry credential snapshots for another Get-Acl path-not-found
    race when a descendant disappears during inspection.
  • Honor case-insensitive Windows environment variable names during finding
    deduplication, so configured API credentials and private configuration paths
    are used consistently.
  • Stream tracked binary diffs when hashing repository snapshots, reducing
    memory use while preserving the existing digest format.
  • Include complete OCI metadata in container image labels and multiarchitecture
    annotations, with documentation pinned to the source commit and image
    verification commands in the release workflow summary. See
    container metadata and verification.

Upgrade notes

  • Mock mode is opt-in and saves clearly marked synthetic findings in local
    history; use a separate CODEX_SECURITY_STATE_DIR for disposable test data.
    It supports Standard scans only and does not audit the repository.
  • Interactive budget increases are unavailable in CI, JSON/JSONL, headless,
    and verbose modes. Existing cost limits continue to apply in those modes.
  • The embeddings URL defaults to the existing OpenAI endpoint. A configured
    endpoint receives finding inputs and the bearer credential and must support
    the OpenAI embeddings format. Embeddings credentials remain separate from
    Codex ChatGPT sign-in.
  • Local history applies an automatic database index migration. Completed scan
    artifacts remain unchanged.
  • Source builds now use repository-pinned pnpm 11.19.0, including MCP app
    dependencies, whose configuration requires a seven-day minimum release age.
    From the repository root, run
    pnpm --dir plugins/codex-security/mcp-app install --frozen-lockfile.
    See
    running without Docker.
  • Container publication remains separate from npm publication. Existing stable
    container tags are not updated in place.

Build and CI updates also improve package verification, portable Python checks,
Windows fixtures, and test scheduling. Documentation clarifies portable
environment-variable guidance and safe examples.

The categorized list below contains the individual changes.

What's Changed

Features

  • feat: allow configuring the findings embeddings URL by @kmbroai in #765
  • feat(cli): allow interactive scan budget increases by @mldangelo-oai in #724
  • feat(sdk): honor command auth and renewable embeddings credentials by @kmbroai in #769
  • feat: preserve cross-scan finding relationships by @mldangelo-oai in #574
  • feat(sdk): deduplicate sealed scan directories by @kmbroai in #779
  • feat(cli): add mock scans with synthetic findings by @kmbroai in #783
  • feat(typescript): align deduplication review stages by @kmbroai in #780

Fixes

  • fix(sdk): retry Windows Get-Acl path-not-found races by @faizan-oai in #731
  • fix(ci): preserve LF Python source checkouts by @faizan-oai in #726
  • fix(container): publish metadata on multi-architecture images by @mldangelo-oai in #714
  • fix(plugin): include PowerShell module and data files by @faizan-oai in #715
  • fix(windows): preserve scoped inventories after case-only renames by @faizan-oai in #633
  • fix(windows): honor dedupe environment settings by @faizan-oai in #696
  • fix(windows): support long Codex executable paths by @faizan-oai in #704
  • fix(plugin): recognize BOM-marked UTF-16 source files by @faizan-oai in #716
  • fix(cli): use shell-neutral env-var removal guidance by @mangeshraut712 in #754
  • fix(auth): make login status recognize existing Codex authentication by @Ultron09 in #738
  • fix: limit finding comparison input size by @ianw-oai in #638
  • fix: surface deduplication review failure reasons by @kmbroai in #766
  • fix(plugin): stream tracked diffs while hashing by @Hughhhhcoder in #773
  • fix(typescript): harden deduplication review validation by @kmbroai in #781

Documentation

Other changes

New Contributors

Full Changelog: npm-v0.1.24...npm-v0.1.25

Contributors

mangeshraut712, Ultron09, and 7 other contributors
Loading

Codex Security 0.1.24

Codex Security 0.1.24

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Aug 16:43
Immutable release. Only release title and notes can be modified.
npm-v0.1.24
d4b7d29
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Start the preview findings service directly with
    codex-security serve [--port PORT], without Docker or an internal package
    path. The command reuses the existing service, state, and shutdown behavior;
    --port overrides PORT, and port 0 selects a free port. See
    running without Docker.
  • Observe durable Deep Scan progress from the SDK with the optional
    onDeepProgress({ completed, active, maximum }) callback. Updates report
    changed completed and active independent-review counts without blocking the
    scan. See
    SDK scan options.
  • Make stopped-result handling explicit and stable. Read, list, and export
    operations no longer publish late retained results as a side effect; the app
    reports when recovery is needed and can recover validated results on request.
    See
    stopped result recovery.
  • Include changed PowerShell .ps1 files in diff-scan inventories and remove a
    conflicting reporting rule so valid internal attack paths remain eligible for
    review. Nested Deep Scan workers now also receive an explicitly configured
    OpenAI provider credential through the plugin's existing environment boundary.
  • Improve Windows reliability by preserving case-insensitive CODEX_HOME
    entries and repository paths from ordinary PowerShell activity, and by
    retrying credential snapshots when a descendant file disappears during ACL
    inspection. Existing path-safety and permission failures remain fatal.

Upgrade notes

  • The findings API and dashboard still have no built-in authentication.
    codex-security serve binds to loopback by default; keep it local or place it
    behind an authenticated TLS proxy before sharing access. Python is still
    required, and nonempty imports still require an embeddings API credential.
  • Stopped-scan recovery is now explicit. App clients should check
    resultsRecoveryNeeded and request recovery when they want validated late
    results republished. Canceled scans remain immutable and cannot use this
    recovery path.
  • onDeepProgress.maximum is the configured independent-review cap, not a
    percentage denominator. The SDK polls the durable projection only when the
    callback is supplied.

The categorized list below contains the individual changes.

What's Changed

Features

Fixes

  • fix(plugin): remove conflicting reporting rule by @ianw-oai in #705
  • fix: include PowerShell files in diff inventory by @Hughhhhcoder in #707
  • fix(plugin): forward OpenAI provider credentials by @soyeon-oai in #712
  • fix(plugin): make stopped result recovery explicit by @soyeon-oai in #713
  • fix(windows): preserve PowerShell environment and activity paths by @faizan-oai in #634
  • fix(windows): retry credential snapshots when files disappear by @faizan-oai in #708

Other changes

  • chore(deps-dev): bump postcss from 8.5.6 to 8.5.23 in /sdk/typescript by @dependabot[bot] in #695
  • refactor(plugin): split workbench publication helpers by @soyeon-oai in #721
  • ci(plugin): enforce source import compatibility by @soyeon-oai in #722

New Contributors

Full Changelog: npm-v0.1.23...npm-v0.1.24

Contributors

dependabot, Hughhhhcoder, and 5 other contributors
Loading

Codex Security 0.1.23

Codex Security 0.1.23

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Aug 13:51
Immutable release. Only release title and notes can be modified.
npm-v0.1.23
3bccb23
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Store complete findings and embeddings in the preview findings service, with
    paginated listing, repository-scoped candidate retrieval, and durable duplicate
    groups. Publish a completed scan with
    publish scan --to custom --scan SCAN_ID --findings-url URL, or preview the
    payload with --dry-run. See the
    findings service
    and custom publication.
  • Review potential duplicates from the CLI or SDK with
    dedupe --scan SCAN_ID --findings-url URL. Reviews run on the calling host and save accepted groups
    without replacing original findings. Searches default to the scan's repository;
    --all-repositories explicitly broadens the scope. Add --workflow-id to scan,
    custom publication, and deduplication to reuse completed stages and checkpointed
    reviews after interruption. See
    deduplication
    and workflow recovery.
  • Browse stored findings and duplicate groups in the service's read-only
    /dashboard, with search, repository filters, sorting, and record details.
    The dashboard shows service-owned data, not local scan or workflow history.
    See the dashboard guide.
  • Run the scanner and findings service from the same container image in separate
    containers, with a Compose runner for the scanner CLI and separate persistent
    state. The image supports Linux amd64 and arm64. See
    container releases and the workflow runner.
  • Preserve sealed scan artifacts when optional follow-up instructions fail,
    propagate caller cancellation during cloud publication, respect the exact
    POSIX PATH when resolving trusted executables, and retain nested attack-path
    evidence strings in saved finding previews.

Upgrade notes

  • Version 0.1.22 was not published to npm or GitHub Releases. This release includes
    its changes and the release-runner fix.
  • The findings API and dashboard have no built-in authentication. Keep the
    service on a trusted local endpoint or behind an authenticated TLS proxy;
    Compose publishes only to host loopback. Nonempty imports send complete finding
    JSON to the OpenAI embeddings API and require an API key. A ChatGPT login is not
    an embedding credential. Duplicate review uses the calling host's Codex
    credentials separately, and embedding and review calls can incur usage charges.
  • Stop the findings service and back up its entire state directory before
    upgrading. Startup applies SQLite migrations automatically; rollback requires
    the pre-upgrade backup and previous image. Existing findings are not
    automatically embedded: import them with their repository ID before using
    repository-scoped deduplication. Keep runner state separate from service state.
    See backups and upgrades.
  • Container publication is separate from npm publication. Use a version or digest
    only after the selected image release is available; source builds remain
    supported. Follow the container setup
    before the first registry release.
  • Source checkouts now generate the SDK's bundled plugin from
    plugins/codex-security. Contributors should edit the canonical plugin source
    and run pnpm run build:plugin; the published npm package still includes the
    runtime payload. See plugin source ownership.

The categorized list below contains the individual changes.

What's Changed

Features

  • feat(typescript): add findings service plumbing by @kmbroai in #653
  • feat(typescript): persist findings and embeddings through the API by @kmbroai in #660

Fixes

  • fix(sdk): prefer exact POSIX PATH for trusted executables by @Hughhhhcoder in #676
  • fix(sdk): preserve caller cancellation in cloud publication by @Hughhhhcoder in #677
  • fix(ci): guard generated plugin Markdown changes by @soyeon-oai in #683
  • fix(sdk): preserve sealed artifacts after post-scan failure by @mldangelo-oai in #626
  • fix(plugin): preserve nested attack-path evidence in previews by @soyeon-oai in #691
  • fix(publish): explain findings before scan details by @ianw-oai in #689
  • fix(ci): install ripgrep for npm release verification by @kmbroai in #698

Documentation

Other changes

  • refactor(plugin): generate the bundled runtime from canonical source by @soyeon-oai in #675
  • refactor(plugin): colocate runtime payload contract by @soyeon-oai in #686
  • chore: configure development environment by @kylos101 in #697
  • refactor(container): share one image for scanner and findings service by @kmbroai in #701

New Contributors

Full Changelog: npm-v0.1.21...npm-v0.1.23

Contributors

kylos101, Hughhhhcoder, and 4 other contributors
Loading

Codex Security 0.1.21

Codex Security 0.1.21

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Aug 07:53
Immutable release. Only release title and notes can be modified.
npm-v0.1.21
fd98a90
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Request an advisory assessment of a completed patch with
    patch --assess-patch-risk. Add --create-pr to include its concise summary
    in the draft pull request. The assessment is opt-in and does not approve or
    merge changes. See
    patching and risk assessment.
  • Import GitHub code scanning alerts through the CLI or SDK for validation
    against a local checkout. Imports are read-only and preserve the upstream
    alert context. See
    GitHub alert imports.
  • Publish findings from CSV with publish scan --to cloud --csv PATH, or
    preview the upload without signing in or sending data with --dry-run.
    See
    Cloud publication.
  • Improve repeated-scan credential handling on Windows, sign-in recovery
    messages, cleanup after interrupted publication, and refreshes of changed
    bundled plugins.

Upgrade notes

  • Finish operations using older versions before upgrading; credential-home
    locks now follow the owning process's lifetime. See
    authentication.
  • The bundled Codex runtime and SDK are now 0.149.1. Custom executables
    selected with CODEX_CLI_PATH need thread-source attribution support for
    both exec and app-server (Codex 0.149.1+). See
    runtime configuration.
  • Existing Windows state with invalid ancestor permissions is not repaired
    automatically. Keep the old reports and select a new private state
    directory as described in
    scan history and recovery.

The categorized list below contains the individual changes.

What's Changed

Features

Fixes

Documentation

Other changes

Full Changelog: npm-v0.1.20...npm-v0.1.21

Contributors

mldangelo-oai, faizan-oai, and 2 other contributors
Loading

Codex Security 0.1.20

Codex Security 0.1.20

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Aug 06:25
Immutable release. Only release title and notes can be modified.
npm-v0.1.20
59d026a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Bug fixes and reliability improvements for cloud publication, including
    access checks, recovery handling, and skipping findings that were already
    recorded.

The categorized list below contains the individual changes.

What's Changed

Features

Fixes

  • fix: reconcile Linear publication recovery identities by @mldangelo-oai in #624
  • fix(publish): select scans and reuse credentials by @kmbroai in #640

Documentation

Full Changelog: npm-v0.1.19...npm-v0.1.20

Contributors

mldangelo-oai, ianw-oai, and kmbroai
Loading

Codex Security 0.1.19

Codex Security 0.1.19

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Aug 00:45
Immutable release. Only release title and notes can be modified.
npm-v0.1.19
df61ece
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Publish one or more completed scans to Codex Security Cloud with
    publish scan --to cloud. Choose saved scans interactively or with
    repeatable --scan options, or use repeatable --scan-dir options for
    external artifacts. --dry-run validates and previews findings without
    uploading. Live uploads require a file-backed ChatGPT sign-in and an account
    authorized for Cloud publication. See
    Cloud publication setup and behavior.
  • Select a saved scan for Linear publication by scan ID, unique ID prefix, or
    latest; omitting the selector opens the interactive picker. See
    Linear publication.

The categorized list below contains the individual changes.

What's Changed

Features

Other changes

  • chore: include Linear comments in patch context by @ianw-oai in #637

New Contributors

Full Changelog: npm-v0.1.18...npm-v0.1.19

Contributors

wholley-oai and ianw-oai
Loading