From 495cde85c1a10852417618bbd814aabde8f76e1b Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
<41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 9 Nov 2026 19:33:17 +0000
Subject: [PATCH 1/2] chore(release): 0.9.1
---
.github/release-notes.md | 17 ++++++++---------
.github/release-pr-state.json | 8 ++++----
examples/github-actions/codex-security.yml | 2 +-
github-action/package-lock.json | 4 ++--
github-action/package.json | 2 +-
sdk/typescript/package.json | 2 +-
6 files changed, 17 insertions(+), 18 deletions(-)
diff --git a/.github/release-notes.md b/.github/release-notes.md
index f03962b3e5..822f46e460 100644
--- a/.github/release-notes.md
+++ b/.github/release-notes.md
@@ -1,12 +1,15 @@
-
+
## Highlights
-- Deep Scan runs independent Standard reviews in batches. Workers can share leads and verify each other's evidence. The final report groups observations that have the same fix and retains the source locations from each review. [Deep Scan guide](https://github.com/openai/codex-security/blob/main/sdk/typescript/docs/cli.md#configure-deep-scans)
-- External scanner imports are enabled by default in the CLI, SDK, and plugin. You can preview supported reports, save findings locally, and publish supported findings to Cloud. The scanner guides list the accepted formats and which inputs are local-only. [Scanner import guides](https://github.com/openai/codex-security/blob/main/docs/scanner-imports/README.md)
-- `scans logs` finds sessions faster in large compressed histories. The GitHub Action also includes scan scope limitations in its job summary, including when a scan returns zero findings.
+
+Changes to review for highlights
+
+- bind Darwin signing to builds from protected main ([#2495](https://github.com/openai/codex-security/pull/2495))
+
+
@@ -14,10 +17,6 @@
## Upgrade notes
-- **Deep Scan budgets.** `--stop-after-no-new` now counts consecutive completed Standard reviews that add no findings. If you depend on a particular run length, review this threshold alongside `--max-discovery-runs` and `--max-time`. [Deep Scan settings](https://github.com/openai/codex-security/blob/main/docs/project-configuration.md#deep-settings-and-limits)
-- **Scanner imports.** Remove `CODEX_SECURITY_ENABLE_EXTERNAL_IMPORTS` from launch scripts. A legacy value of `0` no longer disables imports. [Scanner import guides](https://github.com/openai/codex-security/blob/main/docs/scanner-imports/README.md)
-- **Linux Compose deployments.** The bundled seccomp profile restricts direct socket families and blocks `ptrace`, `process_vm_readv`, and `process_vm_writev`. If a custom tool needs one of these operations, test it against your deployment's profile before upgrading. [Container guide](https://github.com/openai/codex-security/blob/main/docker/README.md)
-- **Source builds.** Sparse SDK checkouts must include `plugins/codex-security/mcp-app/src/deep-scan-settings.ts`. Upgrade or roll back the bundled plugin as a unit. [Source build change](https://github.com/openai/codex-security/pull/2452)
-- **Package verification.** The source package checker rejects sparse tar entries. If an unsigned candidate was built with a sparse-aware archiver, recreate it with `pnpm pack` from `sdk/typescript`. Use the original published archive for release recovery. [Package verification change](https://github.com/openai/codex-security/pull/2456)
+No additional migration steps are documented for this release.
diff --git a/.github/release-pr-state.json b/.github/release-pr-state.json
index 57f720552c..c65b3f0dce 100644
--- a/.github/release-pr-state.json
+++ b/.github/release-pr-state.json
@@ -1,13 +1,13 @@
{
- "baseVersion": "0.8.3",
- "baseCommit": "f22b8b991ebfe0a348ec9b5c29341a5b48dee649",
+ "baseVersion": "0.9.0",
+ "baseCommit": "7cc6bae5003503e826aef70cb96fd042ea3d436a",
"sections": {
"highlights": {
- "generatedHash": "9e7e57cc51cdb7c8747b7cdc33470b7c3b4af7ea289265c06280412b5ab7728a",
+ "generatedHash": "1a95122d50517aa00b5e2dc8becaf9fb60a852238723dce499111c9504a991b2",
"humanOwned": false
},
"upgrades": {
- "generatedHash": "2948040a17c453f501741772fae72fe5f8c6c893d96262a2a45ea017662c9286",
+ "generatedHash": "f0e089f37da057fc30882ef40dfe50f6b52abdc17018bf2d70c34afb22c66fe2",
"humanOwned": false
}
}
diff --git a/examples/github-actions/codex-security.yml b/examples/github-actions/codex-security.yml
index 30f95a4572..2217d47bba 100644
--- a/examples/github-actions/codex-security.yml
+++ b/examples/github-actions/codex-security.yml
@@ -32,7 +32,7 @@ jobs:
security-events: write
actions: read
env:
- CODEX_SECURITY_VERSION: "0.9.0"
+ CODEX_SECURITY_VERSION: "0.9.1"
BEDROCK_MODEL_ID: ${{ vars.BEDROCK_MODEL_ID }}
# Report-only by default. Set to "high" to fail on high/critical findings.
FAIL_ON_SEVERITY: ""
diff --git a/github-action/package-lock.json b/github-action/package-lock.json
index 1b8a820c77..2f9e926b0d 100644
--- a/github-action/package-lock.json
+++ b/github-action/package-lock.json
@@ -1,12 +1,12 @@
{
"name": "codex-security-action",
- "version": "0.9.0",
+ "version": "0.9.1",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "codex-security-action",
- "version": "0.9.0",
+ "version": "0.9.1",
"dependencies": {
"@actions/artifact": "6.3.1",
"@actions/core": "3.0.1",
diff --git a/github-action/package.json b/github-action/package.json
index 2b89021a37..310c1def24 100644
--- a/github-action/package.json
+++ b/github-action/package.json
@@ -1,6 +1,6 @@
{
"name": "codex-security-action",
- "version": "0.9.0",
+ "version": "0.9.1",
"private": true,
"type": "module",
"description": "Run Codex Security in GitHub Actions with explicit scope, budgets, and scan health reporting",
diff --git a/sdk/typescript/package.json b/sdk/typescript/package.json
index 9e952332d3..908a5f9e51 100644
--- a/sdk/typescript/package.json
+++ b/sdk/typescript/package.json
@@ -1,6 +1,6 @@
{
"name": "@openai/codex-security",
- "version": "0.9.0",
+ "version": "0.9.1",
"description": "TypeScript SDK and CLI for Codex Security",
"license": "Apache-2.0",
"author": "OpenAI",
From 345379fe136fe69332ed6d55ebdbd97758e5873c Mon Sep 17 00:00:00 2001
From: ianw-oai
Date: Mon, 9 Nov 2026 11:33:54 -0800
Subject: [PATCH 2/2] docs(release): carry forward upgrade notes for 0.9.1
---
.github/release-notes.md | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/.github/release-notes.md b/.github/release-notes.md
index 822f46e460..728d254929 100644
--- a/.github/release-notes.md
+++ b/.github/release-notes.md
@@ -4,12 +4,10 @@
## Highlights
-
-Changes to review for highlights
-
-- bind Darwin signing to builds from protected main ([#2495](https://github.com/openai/codex-security/pull/2495))
-
-
+- The npm package includes Developer ID-signed native addons for Apple Silicon and Intel Macs. This lets Codex Desktop load the addon when preparing review items.
+- Deep Scan runs independent Standard reviews in batches. Workers can share leads and verify each other's evidence. The final report groups observations that have the same fix and retains the source locations from each review. [Deep Scan guide](https://github.com/openai/codex-security/blob/main/sdk/typescript/docs/cli.md#configure-deep-scans)
+- External scanner imports are enabled by default in the CLI, SDK, and plugin. You can preview supported reports, save findings locally, and publish supported findings to Cloud. The scanner guides list the accepted formats and which inputs are local-only. [Scanner import guides](https://github.com/openai/codex-security/blob/main/docs/scanner-imports/README.md)
+- `scans logs` finds sessions faster in large compressed histories. The GitHub Action also includes scan scope limitations in its job summary, including when a scan returns zero findings.
@@ -17,6 +15,10 @@
## Upgrade notes
-No additional migration steps are documented for this release.
+- **Deep Scan budgets.** `--stop-after-no-new` now counts consecutive completed Standard reviews that add no findings. If you depend on a particular run length, review this threshold alongside `--max-discovery-runs` and `--max-time`. [Deep Scan settings](https://github.com/openai/codex-security/blob/main/docs/project-configuration.md#deep-settings-and-limits)
+- **Scanner imports.** Remove `CODEX_SECURITY_ENABLE_EXTERNAL_IMPORTS` from launch scripts. A legacy value of `0` no longer disables imports. [Scanner import guides](https://github.com/openai/codex-security/blob/main/docs/scanner-imports/README.md)
+- **Linux Compose deployments.** The bundled seccomp profile restricts direct socket families and blocks `ptrace`, `process_vm_readv`, and `process_vm_writev`. If a custom tool needs one of these operations, test it against your deployment's profile before upgrading. [Container guide](https://github.com/openai/codex-security/blob/main/docker/README.md)
+- **Source builds.** Sparse SDK checkouts must include `plugins/codex-security/mcp-app/src/deep-scan-settings.ts`. Upgrade or roll back the bundled plugin as a unit. [Source build change](https://github.com/openai/codex-security/pull/2452)
+- **Package verification.** The source package checker rejects sparse tar entries. If an unsigned candidate was built with a sparse-aware archiver, recreate it with `pnpm pack` from `sdk/typescript`. Use the original published archive for release recovery. [Package verification change](https://github.com/openai/codex-security/pull/2456)