From 2d322b184de4b1f5d6c397cacc4af39b72a0834a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 9 Nov 2026 22:34:17 +0000 Subject: [PATCH] chore(release): 0.9.2 --- .github/release-notes.md | 18 ++++++++---------- .github/release-pr-state.json | 10 +++++----- examples/github-actions/codex-security.yml | 2 +- github-action/package-lock.json | 4 ++-- github-action/package.json | 2 +- sdk/typescript/package.json | 2 +- 6 files changed, 18 insertions(+), 20 deletions(-) diff --git a/.github/release-notes.md b/.github/release-notes.md index 728d254929..1cfdb68424 100644 --- a/.github/release-notes.md +++ b/.github/release-notes.md @@ -1,13 +1,15 @@ - + ## Highlights -- The npm package includes Developer ID-signed native addons for Apple Silicon and Intel Macs. This lets Codex Desktop load the addon when preparing review items. -- Deep Scan runs independent Standard reviews in batches. Workers can share leads and verify each other's evidence. The final report groups observations that have the same fix and retains the source locations from each review. [Deep Scan guide](https://github.com/openai/codex-security/blob/main/sdk/typescript/docs/cli.md#configure-deep-scans) -- External scanner imports are enabled by default in the CLI, SDK, and plugin. You can preview supported reports, save findings locally, and publish supported findings to Cloud. The scanner guides list the accepted formats and which inputs are local-only. [Scanner import guides](https://github.com/openai/codex-security/blob/main/docs/scanner-imports/README.md) -- `scans logs` finds sessions faster in large compressed histories. The GitHub Action also includes scan scope limitations in its job summary, including when a scan returns zero findings. +
+Changes to review for highlights + +- resolve home-relative project config paths on POSIX ([#2505](https://github.com/openai/codex-security/pull/2505)) + +
@@ -15,10 +17,6 @@ ## Upgrade notes -- **Deep Scan budgets.** `--stop-after-no-new` now counts consecutive completed Standard reviews that add no findings. If you depend on a particular run length, review this threshold alongside `--max-discovery-runs` and `--max-time`. [Deep Scan settings](https://github.com/openai/codex-security/blob/main/docs/project-configuration.md#deep-settings-and-limits) -- **Scanner imports.** Remove `CODEX_SECURITY_ENABLE_EXTERNAL_IMPORTS` from launch scripts. A legacy value of `0` no longer disables imports. [Scanner import guides](https://github.com/openai/codex-security/blob/main/docs/scanner-imports/README.md) -- **Linux Compose deployments.** The bundled seccomp profile restricts direct socket families and blocks `ptrace`, `process_vm_readv`, and `process_vm_writev`. If a custom tool needs one of these operations, test it against your deployment's profile before upgrading. [Container guide](https://github.com/openai/codex-security/blob/main/docker/README.md) -- **Source builds.** Sparse SDK checkouts must include `plugins/codex-security/mcp-app/src/deep-scan-settings.ts`. Upgrade or roll back the bundled plugin as a unit. [Source build change](https://github.com/openai/codex-security/pull/2452) -- **Package verification.** The source package checker rejects sparse tar entries. If an unsigned candidate was built with a sparse-aware archiver, recreate it with `pnpm pack` from `sdk/typescript`. Use the original published archive for release recovery. [Package verification change](https://github.com/openai/codex-security/pull/2456) +No additional migration steps are documented for this release. diff --git a/.github/release-pr-state.json b/.github/release-pr-state.json index 6dab13cde1..61c3132688 100644 --- a/.github/release-pr-state.json +++ b/.github/release-pr-state.json @@ -1,14 +1,14 @@ { - "baseVersion": "0.9.0", - "baseCommit": "7cc6bae5003503e826aef70cb96fd042ea3d436a", + "baseVersion": "0.9.1", + "baseCommit": "fe1089ab514599931ff0ce77a82dc8c4a99201ea", "sections": { "highlights": { - "generatedHash": "1a95122d50517aa00b5e2dc8becaf9fb60a852238723dce499111c9504a991b2", - "humanOwned": true + "generatedHash": "d9097193fc57486819be7736079929c206b898e9865cd2b4730176d5cf8e55a9", + "humanOwned": false }, "upgrades": { "generatedHash": "f0e089f37da057fc30882ef40dfe50f6b52abdc17018bf2d70c34afb22c66fe2", - "humanOwned": true + "humanOwned": false } } } diff --git a/examples/github-actions/codex-security.yml b/examples/github-actions/codex-security.yml index 2217d47bba..dbb6973634 100644 --- a/examples/github-actions/codex-security.yml +++ b/examples/github-actions/codex-security.yml @@ -32,7 +32,7 @@ jobs: security-events: write actions: read env: - CODEX_SECURITY_VERSION: "0.9.1" + CODEX_SECURITY_VERSION: "0.9.2" BEDROCK_MODEL_ID: ${{ vars.BEDROCK_MODEL_ID }} # Report-only by default. Set to "high" to fail on high/critical findings. FAIL_ON_SEVERITY: "" diff --git a/github-action/package-lock.json b/github-action/package-lock.json index 2f9e926b0d..14db6ae2d2 100644 --- a/github-action/package-lock.json +++ b/github-action/package-lock.json @@ -1,12 +1,12 @@ { "name": "codex-security-action", - "version": "0.9.1", + "version": "0.9.2", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codex-security-action", - "version": "0.9.1", + "version": "0.9.2", "dependencies": { "@actions/artifact": "6.3.1", "@actions/core": "3.0.1", diff --git a/github-action/package.json b/github-action/package.json index 310c1def24..8d1ff99763 100644 --- a/github-action/package.json +++ b/github-action/package.json @@ -1,6 +1,6 @@ { "name": "codex-security-action", - "version": "0.9.1", + "version": "0.9.2", "private": true, "type": "module", "description": "Run Codex Security in GitHub Actions with explicit scope, budgets, and scan health reporting", diff --git a/sdk/typescript/package.json b/sdk/typescript/package.json index 908a5f9e51..3fe47cee29 100644 --- a/sdk/typescript/package.json +++ b/sdk/typescript/package.json @@ -1,6 +1,6 @@ { "name": "@openai/codex-security", - "version": "0.9.1", + "version": "0.9.2", "description": "TypeScript SDK and CLI for Codex Security", "license": "Apache-2.0", "author": "OpenAI",