[github-actions]

Summary

Keep a release proposal current with changes merged into main.

Changes

Update the package version and draft release notes. The version header and PR title are maintained by automation. Edit the marked note sections in .github/release-notes.md; edited or deleted sections become human-owned. New suggestions appear in subsequent bot comments. The PR description is never regenerated.

Testing

The updater does not run package tests. Before merging, verify required CI in the Checks tab and Codex review on the current commit. Request a final review if Codex last reviewed an older commit. Post later manual test results in a PR comment or review with the tested commit SHA. Editing the description to update status can trigger CI.

Risk and rollout

Merging this PR starts the existing CI and protected release process. Review migration details and complete the public disclosure review before merging.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[github-actions]

Release proposal updated through main commit 4e51fb768b70e568b629dc714ec983dcc5e57345.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 2d322b1.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-11-11T19:20:31.798373Z	0c0cdc6	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Release proposal updated through main commit e0de9ee32395b55ba0dd302a67e2c720db022aa3.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 714f301.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 64bb3607067f0530b06c3be4b687d4d0bfd8dc9a.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head b242a14.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 025fd5be3ed56b1ddb6582662738b7d84029384a.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head c31571a.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit bbc3c7a79168bca9a207ef1f24833da439529977.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 724f444.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 5012030c85b483a7efa6f084607943596e2d40c2.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 60e098d.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 3541d6ba18822c0cee45963de1d14f21495677c9.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head dca0562.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 6df392cf0261945a89244b3725541ed1b947a229.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 250fc0d.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit f706261c6cd2e01d62f38a7adbf20f906383edac.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 904b934.

[github-actions]

Release proposal updated through main commit f85de80d1e9caefdefb4f9becdad8cabbb2dc040.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)
• discover Python for targets when launched from filesystem root (#2569)
• update the Linear SDK to 101.0.0 (#2563)
• read deep sealed artifacts under Linux descriptor limits (#2570)
• update semver to 7.8.6 across SDK and tooling (#2562)
• update install-action to v2.90.0 (#2561)
• isolate Git display settings in content snapshots (#2568)
• preserve native filename bytes in SQLite URIs (#2571)
• inventory policies in list-only POSIX directories (#2572)
• compare ignored policy paths by their Git filename bytes (#2573)
• require thread attachment for legacy scan continuations (#2428)
• report exit status when the scan helper fails (#2406)
• import hosted Semgrep findings locally or in Cloud (#2576)
• reduce setup and tool output in Standard scans (#2046)
• expose identifiers for saved scan follow-up (#2577)
• validate scan inputs and verify hook installation (#2578)
• update the active installation and migrate legacy options (#2579)
• align scan schemas and structured output (#2580)
• inspect integration commands before installation (#2582)
• make command help and discovery reflect runnable workflows (#2584)
• make project setup and authentication easier to inspect (#2581)
• add a guide to security skills (#2586)
• bump node-forge from 1.4.2 to 1.4.3 in /evals/triage-finding (#2588)
• bump fast-xml-parser from 5.11.1 to 5.12.0 in /evals/triage-finding (#2587)
• retain shared history across worktree changes (#456)
• update the Linear SDK to 101.1.0 (#2601)
• update the Codex CLI and SDK to 0.167.1 (#2600)
• honor scan budgets across batch attempts and follow-ups (#2592)
• keep hosted patches uncommitted and report revision changes (#2583)
• validate inputs and make plans and hooks reusable (#2594)
• resolve saved scans in the current worktree (#2590)
• resolve document links against selected sources (#2430)
• resolve command paths and isolate standalone actions (#2596)

Upgrade notes

• preserve physical parent traversal (#1709)
• make MCP targets and launchers explicit (#2591)

@codex review the current head 4f5f119.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 0676faa3ebf77706c45ae523fc2e679cdaa44f80.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)
• discover Python for targets when launched from filesystem root (#2569)
• update the Linear SDK to 101.0.0 (#2563)
• read deep sealed artifacts under Linux descriptor limits (#2570)
• update semver to 7.8.6 across SDK and tooling (#2562)
• update install-action to v2.90.0 (#2561)
• isolate Git display settings in content snapshots (#2568)
• preserve native filename bytes in SQLite URIs (#2571)
• inventory policies in list-only POSIX directories (#2572)
• compare ignored policy paths by their Git filename bytes (#2573)
• require thread attachment for legacy scan continuations (#2428)
• report exit status when the scan helper fails (#2406)
• import hosted Semgrep findings locally or in Cloud (#2576)
• reduce setup and tool output in Standard scans (#2046)
• expose identifiers for saved scan follow-up (#2577)
• validate scan inputs and verify hook installation (#2578)
• update the active installation and migrate legacy options (#2579)
• align scan schemas and structured output (#2580)
• inspect integration commands before installation (#2582)
• make command help and discovery reflect runnable workflows (#2584)
• make project setup and authentication easier to inspect (#2581)
• add a guide to security skills (#2586)
• bump node-forge from 1.4.2 to 1.4.3 in /evals/triage-finding (#2588)
• bump fast-xml-parser from 5.11.1 to 5.12.0 in /evals/triage-finding (#2587)
• retain shared history across worktree changes (#456)
• update the Linear SDK to 101.1.0 (#2601)
• update the Codex CLI and SDK to 0.167.1 (#2600)
• honor scan budgets across batch attempts and follow-ups (#2592)
• keep hosted patches uncommitted and report revision changes (#2583)
• validate inputs and make plans and hooks reusable (#2594)
• resolve saved scans in the current worktree (#2590)
• resolve document links against selected sources (#2430)
• resolve command paths and isolate standalone actions (#2596)
• update install-action to v2.90.1 (#2599)

Upgrade notes

• preserve physical parent traversal (#1709)
• make MCP targets and launchers explicit (#2591)

@codex review the current head cb4d4fa.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 1e3c82abe53ca986d52982e042b675247cd2cc1a.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)
• discover Python for targets when launched from filesystem root (#2569)
• update the Linear SDK to 101.0.0 (#2563)
• read deep sealed artifacts under Linux descriptor limits (#2570)
• update semver to 7.8.6 across SDK and tooling (#2562)
• update install-action to v2.90.0 (#2561)
• isolate Git display settings in content snapshots (#2568)
• preserve native filename bytes in SQLite URIs (#2571)
• inventory policies in list-only POSIX directories (#2572)
• compare ignored policy paths by their Git filename bytes (#2573)
• require thread attachment for legacy scan continuations (#2428)
• report exit status when the scan helper fails (#2406)
• import hosted Semgrep findings locally or in Cloud (#2576)
• reduce setup and tool output in Standard scans (#2046)
• expose identifiers for saved scan follow-up (#2577)
• validate scan inputs and verify hook installation (#2578)
• update the active installation and migrate legacy options (#2579)
• align scan schemas and structured output (#2580)
• inspect integration commands before installation (#2582)
• make command help and discovery reflect runnable workflows (#2584)
• make project setup and authentication easier to inspect (#2581)
• add a guide to security skills (#2586)
• bump node-forge from 1.4.2 to 1.4.3 in /evals/triage-finding (#2588)
• bump fast-xml-parser from 5.11.1 to 5.12.0 in /evals/triage-finding (#2587)
• retain shared history across worktree changes (#456)
• update the Linear SDK to 101.1.0 (#2601)
• update the Codex CLI and SDK to 0.167.1 (#2600)
• honor scan budgets across batch attempts and follow-ups (#2592)
• keep hosted patches uncommitted and report revision changes (#2583)
• validate inputs and make plans and hooks reusable (#2594)
• resolve saved scans in the current worktree (#2590)
• resolve document links against selected sources (#2430)
• resolve command paths and isolate standalone actions (#2596)
• update install-action to v2.90.1 (#2599)

Upgrade notes

• preserve physical parent traversal (#1709)
• make MCP targets and launchers explicit (#2591)
• retire historical reader formats and Cloud checkpoints (#2602)

@codex review the current head 5c78073.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 67ee64c0bce9ee3be3d5337a9590f2eff55dedc3.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)
• discover Python for targets when launched from filesystem root (#2569)
• update the Linear SDK to 101.0.0 (#2563)
• read deep sealed artifacts under Linux descriptor limits (#2570)
• update semver to 7.8.6 across SDK and tooling (#2562)
• update install-action to v2.90.0 (#2561)
• isolate Git display settings in content snapshots (#2568)
• preserve native filename bytes in SQLite URIs (#2571)
• inventory policies in list-only POSIX directories (#2572)
• compare ignored policy paths by their Git filename bytes (#2573)
• require thread attachment for legacy scan continuations (#2428)
• report exit status when the scan helper fails (#2406)
• import hosted Semgrep findings locally or in Cloud (#2576)
• reduce setup and tool output in Standard scans (#2046)
• expose identifiers for saved scan follow-up (#2577)
• validate scan inputs and verify hook installation (#2578)
• update the active installation and migrate legacy options (#2579)
• align scan schemas and structured output (#2580)
• inspect integration commands before installation (#2582)
• make command help and discovery reflect runnable workflows (#2584)
• make project setup and authentication easier to inspect (#2581)
• add a guide to security skills (#2586)
• bump node-forge from 1.4.2 to 1.4.3 in /evals/triage-finding (#2588)
• bump fast-xml-parser from 5.11.1 to 5.12.0 in /evals/triage-finding (#2587)
• retain shared history across worktree changes (#456)
• update the Linear SDK to 101.1.0 (#2601)
• update the Codex CLI and SDK to 0.167.1 (#2600)
• honor scan budgets across batch attempts and follow-ups (#2592)
• keep hosted patches uncommitted and report revision changes (#2583)
• validate inputs and make plans and hooks reusable (#2594)
• resolve saved scans in the current worktree (#2590)
• resolve document links against selected sources (#2430)
• resolve command paths and isolate standalone actions (#2596)
• update install-action to v2.90.1 (#2599)
• simplify finding imports and protect export files (#2595)

Upgrade notes

• preserve physical parent traversal (#1709)
• make MCP targets and launchers explicit (#2591)
• retire historical reader formats and Cloud checkpoints (#2602)

@codex review the current head bd3f10f.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit c1730abab3d44d54452bccb838cf39debeb36557.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)
• discover Python for targets when launched from filesystem root (#2569)
• update the Linear SDK to 101.0.0 (#2563)
• read deep sealed artifacts under Linux descriptor limits (#2570)
• update semver to 7.8.6 across SDK and tooling (#2562)
• update install-action to v2.90.0 (#2561)
• isolate Git display settings in content snapshots (#2568)
• preserve native filename bytes in SQLite URIs (#2571)
• inventory policies in list-only POSIX directories (#2572)
• compare ignored policy paths by their Git filename bytes (#2573)
• require thread attachment for legacy scan continuations (#2428)
• report exit status when the scan helper fails (#2406)
• import hosted Semgrep findings locally or in Cloud (#2576)
• reduce setup and tool output in Standard scans (#2046)
• expose identifiers for saved scan follow-up (#2577)
• validate scan inputs and verify hook installation (#2578)
• update the active installation and migrate legacy options (#2579)
• align scan schemas and structured output (#2580)
• inspect integration commands before installation (#2582)
• make command help and discovery reflect runnable workflows (#2584)
• make project setup and authentication easier to inspect (#2581)
• add a guide to security skills (#2586)
• bump node-forge from 1.4.2 to 1.4.3 in /evals/triage-finding (#2588)
• bump fast-xml-parser from 5.11.1 to 5.12.0 in /evals/triage-finding (#2587)
• retain shared history across worktree changes (#456)
• update the Linear SDK to 101.1.0 (#2601)
• update the Codex CLI and SDK to 0.167.1 (#2600)
• honor scan budgets across batch attempts and follow-ups (#2592)
• keep hosted patches uncommitted and report revision changes (#2583)
• validate inputs and make plans and hooks reusable (#2594)
• resolve saved scans in the current worktree (#2590)
• resolve document links against selected sources (#2430)
• resolve command paths and isolate standalone actions (#2596)
• update install-action to v2.90.1 (#2599)
• simplify finding imports and protect export files (#2595)
• preserve JSON errors and token windows (#2593)

Upgrade notes

• preserve physical parent traversal (#1709)
• make MCP targets and launchers explicit (#2591)
• retire historical reader formats and Cloud checkpoints (#2602)

@codex review the current head 2715a5e.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 7aa2cd1399074fc26b8953f860fab61b10baff12.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)
• discover Python for targets when launched from filesystem root (#2569)
• update the Linear SDK to 101.0.0 (#2563)
• read deep sealed artifacts under Linux descriptor limits (#2570)
• update semver to 7.8.6 across SDK and tooling (#2562)
• update install-action to v2.90.0 (#2561)
• isolate Git display settings in content snapshots (#2568)
• preserve native filename bytes in SQLite URIs (#2571)
• inventory policies in list-only POSIX directories (#2572)
• compare ignored policy paths by their Git filename bytes (#2573)
• require thread attachment for legacy scan continuations (#2428)
• report exit status when the scan helper fails (#2406)
• import hosted Semgrep findings locally or in Cloud (#2576)
• reduce setup and tool output in Standard scans (#2046)
• expose identifiers for saved scan follow-up (#2577)
• validate scan inputs and verify hook installation (#2578)
• update the active installation and migrate legacy options (#2579)
• align scan schemas and structured output (#2580)
• inspect integration commands before installation (#2582)
• make command help and discovery reflect runnable workflows (#2584)
• make project setup and authentication easier to inspect (#2581)
• add a guide to security skills (#2586)
• bump node-forge from 1.4.2 to 1.4.3 in /evals/triage-finding (#2588)
• bump fast-xml-parser from 5.11.1 to 5.12.0 in /evals/triage-finding (#2587)
• retain shared history across worktree changes (#456)
• update the Linear SDK to 101.1.0 (#2601)
• update the Codex CLI and SDK to 0.167.1 (#2600)
• honor scan budgets across batch attempts and follow-ups (#2592)
• keep hosted patches uncommitted and report revision changes (#2583)
• validate inputs and make plans and hooks reusable (#2594)
• resolve saved scans in the current worktree (#2590)
• resolve document links against selected sources (#2430)
• resolve command paths and isolate standalone actions (#2596)
• update install-action to v2.90.1 (#2599)
• simplify finding imports and protect export files (#2595)
• preserve JSON errors and token windows (#2593)
• keep scans running while Codex waits for the network (#2411)

Upgrade notes

• preserve physical parent traversal (#1709)
• make MCP targets and launchers explicit (#2591)
• retire historical reader formats and Cloud checkpoints (#2602)

@codex review the current head 56623dc.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 5811e2df3dc8a94b36c2568d9b5e31450db65fad.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)
• discover Python for targets when launched from filesystem root (#2569)
• update the Linear SDK to 101.0.0 (#2563)
• read deep sealed artifacts under Linux descriptor limits (#2570)
• update semver to 7.8.6 across SDK and tooling (#2562)
• update install-action to v2.90.0 (#2561)
• isolate Git display settings in content snapshots (#2568)
• preserve native filename bytes in SQLite URIs (#2571)
• inventory policies in list-only POSIX directories (#2572)
• compare ignored policy paths by their Git filename bytes (#2573)
• require thread attachment for legacy scan continuations (#2428)
• report exit status when the scan helper fails (#2406)
• import hosted Semgrep findings locally or in Cloud (#2576)
• reduce setup and tool output in Standard scans (#2046)
• expose identifiers for saved scan follow-up (#2577)
• validate scan inputs and verify hook installation (#2578)
• update the active installation and migrate legacy options (#2579)
• align scan schemas and structured output (#2580)
• inspect integration commands before installation (#2582)
• make command help and discovery reflect runnable workflows (#2584)
• make project setup and authentication easier to inspect (#2581)
• add a guide to security skills (#2586)
• bump node-forge from 1.4.2 to 1.4.3 in /evals/triage-finding (#2588)
• bump fast-xml-parser from 5.11.1 to 5.12.0 in /evals/triage-finding (#2587)
• retain shared history across worktree changes (#456)
• update the Linear SDK to 101.1.0 (#2601)
• update the Codex CLI and SDK to 0.167.1 (#2600)
• honor scan budgets across batch attempts and follow-ups (#2592)
• keep hosted patches uncommitted and report revision changes (#2583)
• validate inputs and make plans and hooks reusable (#2594)
• resolve saved scans in the current worktree (#2590)
• resolve document links against selected sources (#2430)
• resolve command paths and isolate standalone actions (#2596)
• update install-action to v2.90.1 (#2599)
• simplify finding imports and protect export files (#2595)
• preserve JSON errors and token windows (#2593)
• keep scans running while Codex waits for the network (#2411)
• publish versioned workbench findings through the shared Cloud transport (#2603)

Upgrade notes

• preserve physical parent traversal (#1709)
• make MCP targets and launchers explicit (#2591)
• retire historical reader formats and Cloud checkpoints (#2602)

@codex review the current head aaea51e.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit ca7a25e9bdb76832094704226c9ef809f4e3b405.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)
• discover Python for targets when launched from filesystem root (#2569)
• update the Linear SDK to 101.0.0 (#2563)
• read deep sealed artifacts under Linux descriptor limits (#2570)
• update semver to 7.8.6 across SDK and tooling (#2562)
• update install-action to v2.90.0 (#2561)
• isolate Git display settings in content snapshots (#2568)
• preserve native filename bytes in SQLite URIs (#2571)
• inventory policies in list-only POSIX directories (#2572)
• compare ignored policy paths by their Git filename bytes (#2573)
• require thread attachment for legacy scan continuations (#2428)
• report exit status when the scan helper fails (#2406)
• import hosted Semgrep findings locally or in Cloud (#2576)
• reduce setup and tool output in Standard scans (#2046)
• expose identifiers for saved scan follow-up (#2577)
• validate scan inputs and verify hook installation (#2578)
• update the active installation and migrate legacy options (#2579)
• align scan schemas and structured output (#2580)
• inspect integration commands before installation (#2582)
• make command help and discovery reflect runnable workflows (#2584)
• make project setup and authentication easier to inspect (#2581)
• add a guide to security skills (#2586)
• bump node-forge from 1.4.2 to 1.4.3 in /evals/triage-finding (#2588)
• bump fast-xml-parser from 5.11.1 to 5.12.0 in /evals/triage-finding (#2587)
• retain shared history across worktree changes (#456)
• update the Linear SDK to 101.1.0 (#2601)
• update the Codex CLI and SDK to 0.167.1 (#2600)
• honor scan budgets across batch attempts and follow-ups (#2592)
• keep hosted patches uncommitted and report revision changes (#2583)
• validate inputs and make plans and hooks reusable (#2594)
• resolve saved scans in the current worktree (#2590)
• resolve document links against selected sources (#2430)
• resolve command paths and isolate standalone actions (#2596)
• update install-action to v2.90.1 (#2599)
• simplify finding imports and protect export files (#2595)
• preserve JSON errors and token windows (#2593)
• keep scans running while Codex waits for the network (#2411)
• publish versioned workbench findings through the shared Cloud transport (#2603)
• clarify blocked patch results (#2609)

Upgrade notes

• preserve physical parent traversal (#1709)
• make MCP targets and launchers explicit (#2591)
• retire historical reader formats and Cloud checkpoints (#2602)

@codex review the current head cc68c44.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit a881fe1a5d9d9ac40e420cb7b4292e9a9c659c90.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)
• discover Python for targets when launched from filesystem root (#2569)
• update the Linear SDK to 101.0.0 (#2563)
• read deep sealed artifacts under Linux descriptor limits (#2570)
• update semver to 7.8.6 across SDK and tooling (#2562)
• update install-action to v2.90.0 (#2561)
• isolate Git display settings in content snapshots (#2568)
• preserve native filename bytes in SQLite URIs (#2571)
• inventory policies in list-only POSIX directories (#2572)
• compare ignored policy paths by their Git filename bytes (#2573)
• require thread attachment for legacy scan continuations (#2428)
• report exit status when the scan helper fails (#2406)
• import hosted Semgrep findings locally or in Cloud (#2576)
• reduce setup and tool output in Standard scans (#2046)
• expose identifiers for saved scan follow-up (#2577)
• validate scan inputs and verify hook installation (#2578)
• update the active installation and migrate legacy options (#2579)
• align scan schemas and structured output (#2580)
• inspect integration commands before installation (#2582)
• make command help and discovery reflect runnable workflows (#2584)
• make project setup and authentication easier to inspect (#2581)
• add a guide to security skills (#2586)
• bump node-forge from 1.4.2 to 1.4.3 in /evals/triage-finding (#2588)
• bump fast-xml-parser from 5.11.1 to 5.12.0 in /evals/triage-finding (#2587)
• retain shared history across worktree changes (#456)
• update the Linear SDK to 101.1.0 (#2601)
• update the Codex CLI and SDK to 0.167.1 (#2600)
• honor scan budgets across batch attempts and follow-ups (#2592)
• keep hosted patches uncommitted and report revision changes (#2583)
• validate inputs and make plans and hooks reusable (#2594)
• resolve saved scans in the current worktree (#2590)
• resolve document links against selected sources (#2430)
• resolve command paths and isolate standalone actions (#2596)
• update install-action to v2.90.1 (#2599)
• simplify finding imports and protect export files (#2595)
• preserve JSON errors and token windows (#2593)
• keep scans running while Codex waits for the network (#2411)
• publish versioned workbench findings through the shared Cloud transport (#2603)
• clarify blocked patch results (#2609)
• guide Codex through scanner imports and workbench publication (#2604)

Upgrade notes

• preserve physical parent traversal (#1709)
• make MCP targets and launchers explicit (#2591)
• retire historical reader formats and Cloud checkpoints (#2602)

@codex review the current head 818f876.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 5aa4d394ea14ecb355e2c25f96f35e5c62e7d76a.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)
• discover Python for targets when launched from filesystem root (#2569)
• update the Linear SDK to 101.0.0 (#2563)
• read deep sealed artifacts under Linux descriptor limits (#2570)
• update semver to 7.8.6 across SDK and tooling (#2562)
• update install-action to v2.90.0 (#2561)
• isolate Git display settings in content snapshots (#2568)
• preserve native filename bytes in SQLite URIs (#2571)
• inventory policies in list-only POSIX directories (#2572)
• compare ignored policy paths by their Git filename bytes (#2573)
• require thread attachment for legacy scan continuations (#2428)
• report exit status when the scan helper fails (#2406)
• import hosted Semgrep findings locally or in Cloud (#2576)
• reduce setup and tool output in Standard scans (#2046)
• expose identifiers for saved scan follow-up (#2577)
• validate scan inputs and verify hook installation (#2578)
• update the active installation and migrate legacy options (#2579)
• align scan schemas and structured output (#2580)
• inspect integration commands before installation (#2582)
• make command help and discovery reflect runnable workflows (#2584)
• make project setup and authentication easier to inspect (#2581)
• add a guide to security skills (#2586)
• bump node-forge from 1.4.2 to 1.4.3 in /evals/triage-finding (#2588)
• bump fast-xml-parser from 5.11.1 to 5.12.0 in /evals/triage-finding (#2587)
• retain shared history across worktree changes (#456)
• update the Linear SDK to 101.1.0 (#2601)
• update the Codex CLI and SDK to 0.167.1 (#2600)
• honor scan budgets across batch attempts and follow-ups (#2592)
• keep hosted patches uncommitted and report revision changes (#2583)
• validate inputs and make plans and hooks reusable (#2594)
• resolve saved scans in the current worktree (#2590)
• resolve document links against selected sources (#2430)
• resolve command paths and isolate standalone actions (#2596)
• update install-action to v2.90.1 (#2599)
• simplify finding imports and protect export files (#2595)
• preserve JSON errors and token windows (#2593)
• keep scans running while Codex waits for the network (#2411)
• publish versioned workbench findings through the shared Cloud transport (#2603)
• clarify blocked patch results (#2609)
• guide Codex through scanner imports and workbench publication (#2604)
• add ArmorCode findings support (#2608)

Upgrade notes

• preserve physical parent traversal (#1709)
• make MCP targets and launchers explicit (#2591)
• retire historical reader formats and Cloud checkpoints (#2602)

@codex review the current head 0c0cdc6.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.