chore(release): 0.7.0 by github-actions[bot] · Pull Request #1864 · openai/codex-security

github-actions · 2026-10-22T13:54:18Z

Summary

Release Codex Security 0.7.0 with optional post-scan validation, improved Deep Scan recovery and finalization, clearer usage reporting, and more reliable saved results.

Changes

Align the CLI, SDK, Action package, Action lockfile roots, and standalone workflow example at 0.7.0. Keep the Action runtime on its published baseline until release packaging.
Replace generated title lists with reviewed highlights and upgrade instructions for external-import opt-in, hosted verification, direct inventory helpers, and committed-diff checkout requirements.
Preserve the release-note section markers so automation retains the reviewed prose.

Testing

Release automation and tag-cut tests: 307 cases passed across the full run and an isolated rerun after installing missing worktree dependencies.
Release-guide test, versioned release-note validation, formatting for all six release files, and git diff --check: passed.
Independent Codex content review and GitHub Codex code and security reviews passed with no findings. The GitHub reviews cover the exact head c6725635bd4ebb991ef1557fcfd5e6e83869816c.
Hosted validation: node-ci. Required checks must finish successfully before merging.

Risk and rollout

This pre-1.0 minor release contains compatibility changes; follow the committed upgrade notes. Squash-merge with the subject chore(release): 0.7.0. Publication then requires CI on the merged commit, protected npm publication, provenance verification, exact-version installation checks, and coordinated Action and container publication. Marketplace publication remains a separate maintainer step.

Public disclosure review

No customer, partner, prospect, or user identities, data, or identifying details are included.
No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

github-actions · 2026-10-22T13:54:20Z

Release proposal updated through main commit 64f0d8b6a7700682d56cdbb9bbf77c1eebcb719c.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

simplify user guides and correct setup instructions (#1857)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head cf46b52.

chatgpt-codex-connector · 2026-10-22T13:54:41Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T11:04:14.144067Z	`c672563`	Manual request
🔒 Security Review	✅ Completed 2026-10-26T10:57:58.473547Z	`c672563`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-10-22T13:55:06Z

Note

To use Codex here, create a Codex account and connect to github.

github-actions · 2026-10-23T17:30:45Z

Release proposal updated through main commit 57f698ebc11560722a2122d3ceba80439d73d64e.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

simplify user guides and correct setup instructions (#1857)
verify Codex before caching installation (#1855)
update incur to 0.7.1 and react to 19.3.1 (#1862)
build owner reports without extra model calls (#1845)
isolate audits and retain exact file identities (#1859)
update Node to security release 26.12.1 (#1870)
preserve large Git configuration environments (#1882)
accept large security policy files (#1883)
preserve complete scan failure diagnostics (#1884)
preserve all reviewed scan feedback (#1885)
update OpenCode SDK to 1.19.2 (#1880)
preserve complete local vendor evidence (#1886)
preserve MCP connections for large scan checkpoints (#1873)
persist large scan usage at completion and failure (#1874)
skip work cancelled before it starts (#1733)
preserve scan directory identities and isolate Git fixtures (#1833)
isolate artifact upload failures (#1719)
report usage and extend integration attribution (#1703)
recover publication after a lost reply (#938)
render MCP threat models in TypeScript (#1839)
recover checkpoints at discovery deadlines (#1594)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 883ff98.

chatgpt-codex-connector · 2026-10-23T17:30:56Z

Note

To use Codex here, create a Codex account and connect to github.

github-actions · 2026-10-23T17:44:30Z

Release proposal updated through main commit cba35d1196071b6c5adcd5aba0879812ba55d6ba.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

simplify user guides and correct setup instructions (#1857)
verify Codex before caching installation (#1855)
update incur to 0.7.1 and react to 19.3.1 (#1862)
build owner reports without extra model calls (#1845)
isolate audits and retain exact file identities (#1859)
update Node to security release 26.12.1 (#1870)
preserve large Git configuration environments (#1882)
accept large security policy files (#1883)
preserve complete scan failure diagnostics (#1884)
preserve all reviewed scan feedback (#1885)
update OpenCode SDK to 1.19.2 (#1880)
preserve complete local vendor evidence (#1886)
preserve MCP connections for large scan checkpoints (#1873)
persist large scan usage at completion and failure (#1874)
skip work cancelled before it starts (#1733)
preserve scan directory identities and isolate Git fixtures (#1833)
isolate artifact upload failures (#1719)
report usage and extend integration attribution (#1703)
recover publication after a lost reply (#938)
render MCP threat models in TypeScript (#1839)
recover checkpoints at discovery deadlines (#1594)
validate findings after a scan (#1007)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head fadb8e0.

chatgpt-codex-connector · 2026-10-23T17:44:38Z

Note

To use Codex here, create a Codex account and connect to github.

github-actions · 2026-10-25T20:30:17Z

Release proposal updated through main commit d0543c7adf64947c5456e03ab5bf70f4ca55b234.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

simplify user guides and correct setup instructions (#1857)
verify Codex before caching installation (#1855)
update incur to 0.7.1 and react to 19.3.1 (#1862)
build owner reports without extra model calls (#1845)
isolate audits and retain exact file identities (#1859)
update Node to security release 26.12.1 (#1870)
preserve large Git configuration environments (#1882)
accept large security policy files (#1883)
preserve complete scan failure diagnostics (#1884)
preserve all reviewed scan feedback (#1885)
update OpenCode SDK to 1.19.2 (#1880)
preserve complete local vendor evidence (#1886)
preserve MCP connections for large scan checkpoints (#1873)
persist large scan usage at completion and failure (#1874)
skip work cancelled before it starts (#1733)
preserve scan directory identities and isolate Git fixtures (#1833)
isolate artifact upload failures (#1719)
report usage and extend integration attribution (#1703)
recover publication after a lost reply (#938)
render MCP threat models in TypeScript (#1839)
recover checkpoints at discovery deadlines (#1594)
validate findings after a scan (#1007)
bump ruff from 0.17.0 to 0.17.1 in /plugins/codex-security (#1878)
bump @linear/sdk from 97.2.0 to 98.0.0 in /sdk/typescript (#1881)
bump ip-address from 10.7.2 to 10.7.4 in /plugins/codex-security/mcp-app (#1876)
bump taiki-e/install-action from 2.87.28 to 2.87.29 (#1877)
keep saved-results source within import limit (#1891)
allow readable interactive verification results (#1836)
upgrade Codex and preserve oversized MCP recovery (#1879)
normalize location paths before deduplicating (#1867)
report verification failures in structured output (#1835)
retain unfinished deadline checkpoints (#1710)
clarify requested scope and deferred work (#586)
preserve literal scope paths across renderers (#1850)
preserve Unicode colon source paths (#542)
simplify security skill instructions (#1676)
update the GitHub Action runtime to 0.6.0 (#1906)
separate report readers from source providers (#1871)
persist run warnings in SARIF exports (#1893)
keep HTML entities literal in report text (#1851)
keep saved findings consistent through recovery (#1310)
preserve unrated vulnerability severity on import (#1898)
match scan owner hints across email case variants (#1900)
preserve worker coverage during recovery (#1064)
update bundled undici to 6.29.1 (#1915)
bump @opencode-ai/sdk from 1.19.2 to 1.19.3 in /evals/triage-finding in the third-party group across 1 directory (#1919)
bump libc from 0.2.190 to 0.2.191 in /plugins/codex-security/native (#1918)
verify merge parents after a pull request retarget (#1948)
wait for static checks before validating container images (#1949)
trace failures to the original job attempt (#1922)
document the deterministic triage CI checks (#1932)
validate generated files before rebuilding them (#1934)
consolidate required check forwarding into one matrix (#1938)
refresh triage eval transport dependencies (#1935)
preserve required checks after pull request edits (#1944)
let reducers page inputs without code mode (#1910)
show scan usage timestamps and account allowance (#1911)
keep local action dependencies up to date (#1961)
distinguish file inventory from review progress (#1960)
omit excerpts for unknown diff target kinds (#515)
finalize runs, preserve findings, and honor project budgets (#1912)
select the mutation test runtime in one setup step (#1985)
keep selected results stable during retries (#915)
request review when the updated PR head becomes visible (#1989)
use the CLI verdict contract for hosted verification (#1951)
run inventory and ranking helpers in Node (#1432)
remove redundant required check jobs (#2001)
skip independent jobs for edits to existing Python tests (#2002)
skip SDK shards when PR static checks fail (#2006)
share the exact npm setup for release workflows (#1998)
include unscanned repository targets (#547)
constrain deferred coverage paths (#558)
compile evals with separate Ajv installations (#2009)

Upgrade notes

Review migration steps for these breaking changes:

use the CLI verdict contract for hosted verification (#1951)
run inventory and ranking helpers in Node (#1432)

@codex review the current head db5405e.

chatgpt-codex-connector · 2026-10-25T20:30:26Z

Note

To use Codex here, create a Codex account and connect to github.

github-actions · 2026-10-25T20:49:51Z

Release proposal updated through main commit b2c818907a410b664cb29f928f0b17f4c7c7d127.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

simplify user guides and correct setup instructions (#1857)
verify Codex before caching installation (#1855)
update incur to 0.7.1 and react to 19.3.1 (#1862)
build owner reports without extra model calls (#1845)
isolate audits and retain exact file identities (#1859)
update Node to security release 26.12.1 (#1870)
preserve large Git configuration environments (#1882)
accept large security policy files (#1883)
preserve complete scan failure diagnostics (#1884)
preserve all reviewed scan feedback (#1885)
update OpenCode SDK to 1.19.2 (#1880)
preserve complete local vendor evidence (#1886)
preserve MCP connections for large scan checkpoints (#1873)
persist large scan usage at completion and failure (#1874)
skip work cancelled before it starts (#1733)
preserve scan directory identities and isolate Git fixtures (#1833)
isolate artifact upload failures (#1719)
report usage and extend integration attribution (#1703)
recover publication after a lost reply (#938)
render MCP threat models in TypeScript (#1839)
recover checkpoints at discovery deadlines (#1594)
validate findings after a scan (#1007)
bump ruff from 0.17.0 to 0.17.1 in /plugins/codex-security (#1878)
bump @linear/sdk from 97.2.0 to 98.0.0 in /sdk/typescript (#1881)
bump ip-address from 10.7.2 to 10.7.4 in /plugins/codex-security/mcp-app (#1876)
bump taiki-e/install-action from 2.87.28 to 2.87.29 (#1877)
keep saved-results source within import limit (#1891)
allow readable interactive verification results (#1836)
upgrade Codex and preserve oversized MCP recovery (#1879)
normalize location paths before deduplicating (#1867)
report verification failures in structured output (#1835)
retain unfinished deadline checkpoints (#1710)
clarify requested scope and deferred work (#586)
preserve literal scope paths across renderers (#1850)
preserve Unicode colon source paths (#542)
simplify security skill instructions (#1676)
update the GitHub Action runtime to 0.6.0 (#1906)
separate report readers from source providers (#1871)
persist run warnings in SARIF exports (#1893)
keep HTML entities literal in report text (#1851)
keep saved findings consistent through recovery (#1310)
preserve unrated vulnerability severity on import (#1898)
match scan owner hints across email case variants (#1900)
preserve worker coverage during recovery (#1064)
update bundled undici to 6.29.1 (#1915)
bump @opencode-ai/sdk from 1.19.2 to 1.19.3 in /evals/triage-finding in the third-party group across 1 directory (#1919)
bump libc from 0.2.190 to 0.2.191 in /plugins/codex-security/native (#1918)
verify merge parents after a pull request retarget (#1948)
wait for static checks before validating container images (#1949)
trace failures to the original job attempt (#1922)
document the deterministic triage CI checks (#1932)
validate generated files before rebuilding them (#1934)
consolidate required check forwarding into one matrix (#1938)
refresh triage eval transport dependencies (#1935)
preserve required checks after pull request edits (#1944)
let reducers page inputs without code mode (#1910)
show scan usage timestamps and account allowance (#1911)
keep local action dependencies up to date (#1961)
distinguish file inventory from review progress (#1960)
omit excerpts for unknown diff target kinds (#515)
finalize runs, preserve findings, and honor project budgets (#1912)
select the mutation test runtime in one setup step (#1985)
keep selected results stable during retries (#915)
request review when the updated PR head becomes visible (#1989)
use the CLI verdict contract for hosted verification (#1951)
run inventory and ranking helpers in Node (#1432)
remove redundant required check jobs (#2001)
skip independent jobs for edits to existing Python tests (#2002)
skip SDK shards when PR static checks fail (#2006)
share the exact npm setup for release workflows (#1998)
include unscanned repository targets (#547)
constrain deferred coverage paths (#558)
compile evals with separate Ajv installations (#2009)
require opt-in for external import workflows (#1863)

Upgrade notes

Review migration steps for these breaking changes:

use the CLI verdict contract for hosted verification (#1951)
run inventory and ranking helpers in Node (#1432)
require opt-in for external import workflows (#1863)

@codex review the current head 7e38bb1.

chatgpt-codex-connector · 2026-10-25T20:50:00Z

Note

To use Codex here, create a Codex account and connect to github.

github-actions · 2026-10-25T20:53:40Z

Release proposal updated through main commit 28a18608984edbc5b849dc60fb3da20af948c5ae.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

simplify user guides and correct setup instructions (#1857)
verify Codex before caching installation (#1855)
update incur to 0.7.1 and react to 19.3.1 (#1862)
build owner reports without extra model calls (#1845)
isolate audits and retain exact file identities (#1859)
update Node to security release 26.12.1 (#1870)
preserve large Git configuration environments (#1882)
accept large security policy files (#1883)
preserve complete scan failure diagnostics (#1884)
preserve all reviewed scan feedback (#1885)
update OpenCode SDK to 1.19.2 (#1880)
preserve complete local vendor evidence (#1886)
preserve MCP connections for large scan checkpoints (#1873)
persist large scan usage at completion and failure (#1874)
skip work cancelled before it starts (#1733)
preserve scan directory identities and isolate Git fixtures (#1833)
isolate artifact upload failures (#1719)
report usage and extend integration attribution (#1703)
recover publication after a lost reply (#938)
render MCP threat models in TypeScript (#1839)
recover checkpoints at discovery deadlines (#1594)
validate findings after a scan (#1007)
bump ruff from 0.17.0 to 0.17.1 in /plugins/codex-security (#1878)
bump @linear/sdk from 97.2.0 to 98.0.0 in /sdk/typescript (#1881)
bump ip-address from 10.7.2 to 10.7.4 in /plugins/codex-security/mcp-app (#1876)
bump taiki-e/install-action from 2.87.28 to 2.87.29 (#1877)
keep saved-results source within import limit (#1891)
allow readable interactive verification results (#1836)
upgrade Codex and preserve oversized MCP recovery (#1879)
normalize location paths before deduplicating (#1867)
report verification failures in structured output (#1835)
retain unfinished deadline checkpoints (#1710)
clarify requested scope and deferred work (#586)
preserve literal scope paths across renderers (#1850)
preserve Unicode colon source paths (#542)
simplify security skill instructions (#1676)
update the GitHub Action runtime to 0.6.0 (#1906)
separate report readers from source providers (#1871)
persist run warnings in SARIF exports (#1893)
keep HTML entities literal in report text (#1851)
keep saved findings consistent through recovery (#1310)
preserve unrated vulnerability severity on import (#1898)
match scan owner hints across email case variants (#1900)
preserve worker coverage during recovery (#1064)
update bundled undici to 6.29.1 (#1915)
bump @opencode-ai/sdk from 1.19.2 to 1.19.3 in /evals/triage-finding in the third-party group across 1 directory (#1919)
bump libc from 0.2.190 to 0.2.191 in /plugins/codex-security/native (#1918)
verify merge parents after a pull request retarget (#1948)
wait for static checks before validating container images (#1949)
trace failures to the original job attempt (#1922)
document the deterministic triage CI checks (#1932)
validate generated files before rebuilding them (#1934)
consolidate required check forwarding into one matrix (#1938)
refresh triage eval transport dependencies (#1935)
preserve required checks after pull request edits (#1944)
let reducers page inputs without code mode (#1910)
show scan usage timestamps and account allowance (#1911)
keep local action dependencies up to date (#1961)
distinguish file inventory from review progress (#1960)
omit excerpts for unknown diff target kinds (#515)
finalize runs, preserve findings, and honor project budgets (#1912)
select the mutation test runtime in one setup step (#1985)
keep selected results stable during retries (#915)
request review when the updated PR head becomes visible (#1989)
use the CLI verdict contract for hosted verification (#1951)
run inventory and ranking helpers in Node (#1432)
remove redundant required check jobs (#2001)
skip independent jobs for edits to existing Python tests (#2002)
skip SDK shards when PR static checks fail (#2006)
share the exact npm setup for release workflows (#1998)
include unscanned repository targets (#547)
constrain deferred coverage paths (#558)
compile evals with separate Ajv installations (#2009)
require opt-in for external import workflows (#1863)
require Marketplace publication for Action releases (#2008)
wait for the coordinator before ending CLI scans (#2007)

Upgrade notes

Review migration steps for these breaking changes:

use the CLI verdict contract for hosted verification (#1951)
run inventory and ranking helpers in Node (#1432)
require opt-in for external import workflows (#1863)

@codex review the current head fb76da0.

chatgpt-codex-connector · 2026-10-25T20:53:48Z

Note

To use Codex here, create a Codex account and connect to github.

github-actions · 2026-10-26T01:07:06Z

Release proposal updated through main commit 8ed8d9dffc766343c8534601286dc5980afcb1c8.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

simplify user guides and correct setup instructions (#1857)
verify Codex before caching installation (#1855)
update incur to 0.7.1 and react to 19.3.1 (#1862)
build owner reports without extra model calls (#1845)
isolate audits and retain exact file identities (#1859)
update Node to security release 26.12.1 (#1870)
preserve large Git configuration environments (#1882)
accept large security policy files (#1883)
preserve complete scan failure diagnostics (#1884)
preserve all reviewed scan feedback (#1885)
update OpenCode SDK to 1.19.2 (#1880)
preserve complete local vendor evidence (#1886)
preserve MCP connections for large scan checkpoints (#1873)
persist large scan usage at completion and failure (#1874)
skip work cancelled before it starts (#1733)
preserve scan directory identities and isolate Git fixtures (#1833)
isolate artifact upload failures (#1719)
report usage and extend integration attribution (#1703)
recover publication after a lost reply (#938)
render MCP threat models in TypeScript (#1839)
recover checkpoints at discovery deadlines (#1594)
validate findings after a scan (#1007)
bump ruff from 0.17.0 to 0.17.1 in /plugins/codex-security (#1878)
bump @linear/sdk from 97.2.0 to 98.0.0 in /sdk/typescript (#1881)
bump ip-address from 10.7.2 to 10.7.4 in /plugins/codex-security/mcp-app (#1876)
bump taiki-e/install-action from 2.87.28 to 2.87.29 (#1877)
keep saved-results source within import limit (#1891)
allow readable interactive verification results (#1836)
upgrade Codex and preserve oversized MCP recovery (#1879)
normalize location paths before deduplicating (#1867)
report verification failures in structured output (#1835)
retain unfinished deadline checkpoints (#1710)
clarify requested scope and deferred work (#586)
preserve literal scope paths across renderers (#1850)
preserve Unicode colon source paths (#542)
simplify security skill instructions (#1676)
update the GitHub Action runtime to 0.6.0 (#1906)
separate report readers from source providers (#1871)
persist run warnings in SARIF exports (#1893)
keep HTML entities literal in report text (#1851)
keep saved findings consistent through recovery (#1310)
preserve unrated vulnerability severity on import (#1898)
match scan owner hints across email case variants (#1900)
preserve worker coverage during recovery (#1064)
update bundled undici to 6.29.1 (#1915)
bump @opencode-ai/sdk from 1.19.2 to 1.19.3 in /evals/triage-finding in the third-party group across 1 directory (#1919)
bump libc from 0.2.190 to 0.2.191 in /plugins/codex-security/native (#1918)
verify merge parents after a pull request retarget (#1948)
wait for static checks before validating container images (#1949)
trace failures to the original job attempt (#1922)
document the deterministic triage CI checks (#1932)
validate generated files before rebuilding them (#1934)
consolidate required check forwarding into one matrix (#1938)
refresh triage eval transport dependencies (#1935)
preserve required checks after pull request edits (#1944)
let reducers page inputs without code mode (#1910)
show scan usage timestamps and account allowance (#1911)
keep local action dependencies up to date (#1961)
distinguish file inventory from review progress (#1960)
omit excerpts for unknown diff target kinds (#515)
finalize runs, preserve findings, and honor project budgets (#1912)
select the mutation test runtime in one setup step (#1985)
keep selected results stable during retries (#915)
request review when the updated PR head becomes visible (#1989)
use the CLI verdict contract for hosted verification (#1951)
run inventory and ranking helpers in Node (#1432)
remove redundant required check jobs (#2001)
skip independent jobs for edits to existing Python tests (#2002)
skip SDK shards when PR static checks fail (#2006)
share the exact npm setup for release workflows (#1998)
include unscanned repository targets (#547)
constrain deferred coverage paths (#558)
compile evals with separate Ajv installations (#2009)
require opt-in for external import workflows (#1863)
require Marketplace publication for Action releases (#2008)
wait for the coordinator before ending CLI scans (#2007)
omit GitHub event data from container validation provenance (#2010)

Upgrade notes

Review migration steps for these breaking changes:

use the CLI verdict contract for hosted verification (#1951)
run inventory and ranking helpers in Node (#1432)
require opt-in for external import workflows (#1863)

@codex review the current head c1f4208.

chatgpt-codex-connector · 2026-10-26T01:07:16Z

Note

To use Codex here, create a Codex account and connect to github.

github-actions · 2026-10-26T10:34:45Z

Release proposal updated through main commit 6bee35400f489f300a88d2cb3f7619cd7eecb94c.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

simplify user guides and correct setup instructions (#1857)
verify Codex before caching installation (#1855)
update incur to 0.7.1 and react to 19.3.1 (#1862)
build owner reports without extra model calls (#1845)
isolate audits and retain exact file identities (#1859)
update Node to security release 26.12.1 (#1870)
preserve large Git configuration environments (#1882)
accept large security policy files (#1883)
preserve complete scan failure diagnostics (#1884)
preserve all reviewed scan feedback (#1885)
update OpenCode SDK to 1.19.2 (#1880)
preserve complete local vendor evidence (#1886)
preserve MCP connections for large scan checkpoints (#1873)
persist large scan usage at completion and failure (#1874)
skip work cancelled before it starts (#1733)
preserve scan directory identities and isolate Git fixtures (#1833)
isolate artifact upload failures (#1719)
report usage and extend integration attribution (#1703)
recover publication after a lost reply (#938)
render MCP threat models in TypeScript (#1839)
recover checkpoints at discovery deadlines (#1594)
validate findings after a scan (#1007)
bump ruff from 0.17.0 to 0.17.1 in /plugins/codex-security (#1878)
bump @linear/sdk from 97.2.0 to 98.0.0 in /sdk/typescript (#1881)
bump ip-address from 10.7.2 to 10.7.4 in /plugins/codex-security/mcp-app (#1876)
bump taiki-e/install-action from 2.87.28 to 2.87.29 (#1877)
keep saved-results source within import limit (#1891)
allow readable interactive verification results (#1836)
upgrade Codex and preserve oversized MCP recovery (#1879)
normalize location paths before deduplicating (#1867)
report verification failures in structured output (#1835)
retain unfinished deadline checkpoints (#1710)
clarify requested scope and deferred work (#586)
preserve literal scope paths across renderers (#1850)
preserve Unicode colon source paths (#542)
simplify security skill instructions (#1676)
update the GitHub Action runtime to 0.6.0 (#1906)
separate report readers from source providers (#1871)
persist run warnings in SARIF exports (#1893)
keep HTML entities literal in report text (#1851)
keep saved findings consistent through recovery (#1310)
preserve unrated vulnerability severity on import (#1898)
match scan owner hints across email case variants (#1900)
preserve worker coverage during recovery (#1064)
update bundled undici to 6.29.1 (#1915)
bump @opencode-ai/sdk from 1.19.2 to 1.19.3 in /evals/triage-finding in the third-party group across 1 directory (#1919)
bump libc from 0.2.190 to 0.2.191 in /plugins/codex-security/native (#1918)
verify merge parents after a pull request retarget (#1948)
wait for static checks before validating container images (#1949)
trace failures to the original job attempt (#1922)
document the deterministic triage CI checks (#1932)
validate generated files before rebuilding them (#1934)
consolidate required check forwarding into one matrix (#1938)
refresh triage eval transport dependencies (#1935)
preserve required checks after pull request edits (#1944)
let reducers page inputs without code mode (#1910)
show scan usage timestamps and account allowance (#1911)
keep local action dependencies up to date (#1961)
distinguish file inventory from review progress (#1960)
omit excerpts for unknown diff target kinds (#515)
finalize runs, preserve findings, and honor project budgets (#1912)
select the mutation test runtime in one setup step (#1985)
keep selected results stable during retries (#915)
request review when the updated PR head becomes visible (#1989)
use the CLI verdict contract for hosted verification (#1951)
run inventory and ranking helpers in Node (#1432)
remove redundant required check jobs (#2001)
skip independent jobs for edits to existing Python tests (#2002)
skip SDK shards when PR static checks fail (#2006)
share the exact npm setup for release workflows (#1998)
include unscanned repository targets (#547)
constrain deferred coverage paths (#558)
compile evals with separate Ajv installations (#2009)
require opt-in for external import workflows (#1863)
require Marketplace publication for Action releases (#2008)
wait for the coordinator before ending CLI scans (#2007)
omit GitHub event data from container validation provenance (#2010)
honor cancellation during PDF extraction (#532)

Upgrade notes

Review migration steps for these breaking changes:

use the CLI verdict contract for hosted verification (#1951)
run inventory and ranking helpers in Node (#1432)
require opt-in for external import workflows (#1863)

@codex review the current head de58228.

chatgpt-codex-connector · 2026-10-26T10:34:55Z

Note

To use Codex here, create a Codex account and connect to github.

mluck-openai · 2026-10-26T10:37:53Z

@codex review the current head 9f8f8d7.

chatgpt-codex-connector · 2026-10-26T10:39:30Z

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 9f8f8d74cf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

mluck-openai · 2026-10-26T10:39:33Z

@codex security review the current head 9f8f8d7.

chatgpt-codex-connector · 2026-10-26T10:41:11Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 9f8f8d74cf

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

github-actions · 2026-10-26T10:56:21Z

Release proposal updated through main commit 83111fb03ef15c3730c7c9d5bdbc5b55b0e64be8.

Preserved human-owned sections: highlights, upgrades. The suggestions below have not replaced them.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

simplify user guides and correct setup instructions (#1857)
verify Codex before caching installation (#1855)
update incur to 0.7.1 and react to 19.3.1 (#1862)
build owner reports without extra model calls (#1845)
isolate audits and retain exact file identities (#1859)
update Node to security release 26.12.1 (#1870)
preserve large Git configuration environments (#1882)
accept large security policy files (#1883)
preserve complete scan failure diagnostics (#1884)
preserve all reviewed scan feedback (#1885)
update OpenCode SDK to 1.19.2 (#1880)
preserve complete local vendor evidence (#1886)
preserve MCP connections for large scan checkpoints (#1873)
persist large scan usage at completion and failure (#1874)
skip work cancelled before it starts (#1733)
preserve scan directory identities and isolate Git fixtures (#1833)
isolate artifact upload failures (#1719)
report usage and extend integration attribution (#1703)
recover publication after a lost reply (#938)
render MCP threat models in TypeScript (#1839)
recover checkpoints at discovery deadlines (#1594)
validate findings after a scan (#1007)
bump ruff from 0.17.0 to 0.17.1 in /plugins/codex-security (#1878)
bump @linear/sdk from 97.2.0 to 98.0.0 in /sdk/typescript (#1881)
bump ip-address from 10.7.2 to 10.7.4 in /plugins/codex-security/mcp-app (#1876)
bump taiki-e/install-action from 2.87.28 to 2.87.29 (#1877)
keep saved-results source within import limit (#1891)
allow readable interactive verification results (#1836)
upgrade Codex and preserve oversized MCP recovery (#1879)
normalize location paths before deduplicating (#1867)
report verification failures in structured output (#1835)
retain unfinished deadline checkpoints (#1710)
clarify requested scope and deferred work (#586)
preserve literal scope paths across renderers (#1850)
preserve Unicode colon source paths (#542)
simplify security skill instructions (#1676)
update the GitHub Action runtime to 0.6.0 (#1906)
separate report readers from source providers (#1871)
persist run warnings in SARIF exports (#1893)
keep HTML entities literal in report text (#1851)
keep saved findings consistent through recovery (#1310)
preserve unrated vulnerability severity on import (#1898)
match scan owner hints across email case variants (#1900)
preserve worker coverage during recovery (#1064)
update bundled undici to 6.29.1 (#1915)
bump @opencode-ai/sdk from 1.19.2 to 1.19.3 in /evals/triage-finding in the third-party group across 1 directory (#1919)
bump libc from 0.2.190 to 0.2.191 in /plugins/codex-security/native (#1918)
verify merge parents after a pull request retarget (#1948)
wait for static checks before validating container images (#1949)
trace failures to the original job attempt (#1922)
document the deterministic triage CI checks (#1932)
validate generated files before rebuilding them (#1934)
consolidate required check forwarding into one matrix (#1938)
refresh triage eval transport dependencies (#1935)
preserve required checks after pull request edits (#1944)
let reducers page inputs without code mode (#1910)
show scan usage timestamps and account allowance (#1911)
keep local action dependencies up to date (#1961)
distinguish file inventory from review progress (#1960)
omit excerpts for unknown diff target kinds (#515)
finalize runs, preserve findings, and honor project budgets (#1912)
select the mutation test runtime in one setup step (#1985)
keep selected results stable during retries (#915)
request review when the updated PR head becomes visible (#1989)
use the CLI verdict contract for hosted verification (#1951)
run inventory and ranking helpers in Node (#1432)
remove redundant required check jobs (#2001)
skip independent jobs for edits to existing Python tests (#2002)
skip SDK shards when PR static checks fail (#2006)
share the exact npm setup for release workflows (#1998)
include unscanned repository targets (#547)
constrain deferred coverage paths (#558)
compile evals with separate Ajv installations (#2009)
require opt-in for external import workflows (#1863)
require Marketplace publication for Action releases (#2008)
wait for the coordinator before ending CLI scans (#2007)
omit GitHub event data from container validation provenance (#2010)
honor cancellation during PDF extraction (#532)

Upgrade notes

Review migration steps for these breaking changes:

use the CLI verdict contract for hosted verification (#1951)
run inventory and ranking helpers in Node (#1432)
require opt-in for external import workflows (#1863)

@codex review the current head c672563.

chatgpt-codex-connector · 2026-10-26T10:56:29Z

Note

To use Codex here, create a Codex account and connect to github.

mluck-openai · 2026-10-26T11:02:25Z

@codex review the current head c672563.

chatgpt-codex-connector · 2026-10-26T11:04:13Z

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: c6725635bd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

github-actions · 2026-10-26T11:47:08Z

Automated release complete

Stage	Status	Details
Post-merge CI	Passed	View run
npm release status	Passed	View run
Release verification	Passed	View run
Protected npm publication	Passed	View run
Start GitHub publication	Passed	View run
Public npm package and provenance	Passed	View run
Published installation checks	Passed	View run
GitHub Action	Passed	View run
Container image	Passed	View run
Final release status	Passed	View run

Progress updates do not change publication approvals or verification requirements.
GitHub Marketplace publication is a separate manual step.

chore(release): 0.6.1

cf46b52

github-actions Bot added 3 commits October 22, 2026 14:28

chore(release): 0.6.1

9190b7d

chore(release): 0.6.1

e5e3785

chore(release): 0.6.1

39a98a9

jameshiester-oai approved these changes Oct 22, 2026

View reviewed changes

github-actions Bot added the skip-release-notes Omit internal changes from generated release notes label Oct 22, 2026

mldangelo-oai closed this Oct 23, 2026

mldangelo-oai reopened this Oct 23, 2026

github-actions Bot added 13 commits October 23, 2026 02:37

chore(release): 0.6.1

a7111d3

chore(release): 0.6.1

a1b8d0d

chore(release): 0.6.1

71ff34f

chore(release): 0.6.1

e89f2fe

chore(release): 0.6.1

931af0d

chore(release): 0.6.1

b030aa4

chore(release): 0.6.1

ea99f85

chore(release): 0.6.1

bf8a2ed

chore(release): 0.6.1

2c334dc

chore(release): 0.6.1

99a20de

chore(release): 0.6.1

9f11d25

chore(release): 0.6.1

0274781

chore(release): 0.6.1

883ff98

chore(release): 0.6.1

fadb8e0

chore(release): 0.6.1

4c64dbe

github-actions Bot added 2 commits October 25, 2026 20:03

chore(release): 0.7.0

29ee0c3

chore(release): 0.7.0

db5405e

chore(release): 0.7.0

7e38bb1

chore(release): 0.7.0

fb76da0

github-actions Bot added 2 commits October 25, 2026 21:26

chore(release): 0.7.0

21970a0

chore(release): 0.7.0

c1f4208

chore(release): 0.7.0

de58228

docs(release): review 0.7.0 highlights and migration guidance

9f8f8d7

chore(release): 0.7.0

c672563

mluck-openai merged commit f05a0b0 into main Oct 26, 2026
170 of 208 checks passed

mluck-openai deleted the release/next-0.6.0 branch October 26, 2026 11:30

Conversation

github-actions Bot commented Oct 22, 2026 • edited by mluck-openai Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

Risk and rollout

Public disclosure review

Uh oh!

github-actions Bot commented Oct 22, 2026

Highlights

Upgrade notes

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

Highlights

Upgrade notes

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

Highlights

Upgrade notes

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 25, 2026

Highlights

Upgrade notes

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026

Uh oh!

github-actions Bot commented Oct 25, 2026

Highlights

Upgrade notes

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026

Uh oh!

github-actions Bot commented Oct 25, 2026

Highlights

Upgrade notes

Uh oh!

chatgpt-codex-connector Bot commented Oct 25, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Highlights

Upgrade notes

Uh oh!

chatgpt-codex-connector Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Highlights

Upgrade notes

Uh oh!

chatgpt-codex-connector Bot commented Oct 26, 2026

Uh oh!

mluck-openai commented Oct 26, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 26, 2026

Uh oh!

mluck-openai commented Oct 26, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 26, 2026

🛡️ Codex Security Review

Uh oh!

github-actions Bot commented Oct 26, 2026

Highlights

Upgrade notes

Uh oh!

chatgpt-codex-connector Bot commented Oct 26, 2026

Uh oh!

mluck-openai commented Oct 26, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026 •

edited by mluck-openai

Loading

chatgpt-codex-connector Bot commented Oct 22, 2026 •

edited

Loading

github-actions Bot commented Oct 26, 2026 •

edited

Loading