From b69ce17bf992f0f03764233a6720fc2bcde68621 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 15 Oct 2026 13:36:16 +0000 Subject: [PATCH] chore(release): 0.3.1 --- .github/release-notes.md | 200 +------------------------------- .github/release-pr-state.json | 8 +- github-action/package-lock.json | 4 +- github-action/package.json | 2 +- sdk/typescript/package.json | 2 +- 5 files changed, 11 insertions(+), 205 deletions(-) diff --git a/.github/release-notes.md b/.github/release-notes.md index 799de3fa1..b8501676d 100644 --- a/.github/release-notes.md +++ b/.github/release-notes.md @@ -1,99 +1,10 @@ - + ## Highlights -Codex Security Local 0.3.0 reduces unnecessary work in Deep Scan, includes more -source files, and makes scan exit codes easier to use in scripts. It also improves -recovery when scans are interrupted. - -- Deep Scan waits for earlier results to be checked before starting more reviews, - avoiding extra reviews when it already has enough information to stop. Fresh - API-key and Amazon Bedrock scans also skip a model step during startup when - using the bundled plugin and default Node runtime. - ([#1630](https://github.com/openai/codex-security/pull/1630), - [#1555](https://github.com/openai/codex-security/pull/1555)) -- Source selection now includes text files without recognized extensions, build - and test files, and JSP and ASP.NET templates. Fixes also preserve unusual - filenames and the original contents of saved Git-diff and directory scans. - ([#1347](https://github.com/openai/codex-security/pull/1347), - [#1414](https://github.com/openai/codex-security/pull/1414), - [#1345](https://github.com/openai/codex-security/pull/1345), - [#1280](https://github.com/openai/codex-security/pull/1280)) -- Resumed scans preserve their original knowledge context, model/provider - settings, and selected paths. Interrupted scans retain usable results, and - Deep Scan cancellation waits for worker cleanup and state updates before - returning. Exhausted usage stops workers instead of triggering more retries. - ([#1556](https://github.com/openai/codex-security/pull/1556), - [#1501](https://github.com/openai/codex-security/pull/1501), - [#1602](https://github.com/openai/codex-security/pull/1602), - [#1260](https://github.com/openai/codex-security/pull/1260), - [#1638](https://github.com/openai/codex-security/pull/1638)) -- The terminal dashboard batches updates during busy scan replays and avoids - rereading unchanged logs. It shows token usage even when pricing is unavailable - for the selected model. Cost reporting adds Cyber pricing, restores GPT-6 Sol - estimates, and includes Codex context-compaction usage. - ([#1276](https://github.com/openai/codex-security/pull/1276), - [#1336](https://github.com/openai/codex-security/pull/1336), - [#1585](https://github.com/openai/codex-security/pull/1585), - [#1590](https://github.com/openai/codex-security/pull/1590)) - -### Scan exit codes - -Coverage warnings no longer turn a completed scan into a failure. Deep Scans can -also finish when an optional detailed writeup is missing; the findings remain -in the report. - -| Exit code | Meaning | -| --------- | ------------------------------------------------------------------- | -| `0` | The scan completed without a configured severity-threshold failure. | -| `1` | Findings met the configured `--fail-on-severity` threshold. | -| `2` | Execution, result integrity, or required output failed. | - -A successful exit does not mean every file was reviewed. Check coverage details -when your workflow requires that information. -([#1633](https://github.com/openai/codex-security/pull/1633), -[#1624](https://github.com/openai/codex-security/pull/1624)) - -### Other CLI and SDK additions - -- Use `cs` as a shorter alias for `codex-security`. Policy drafting now - works when Codex is installed under your home directory, and app clients can - rename and search saved scans. - ([#1415](https://github.com/openai/codex-security/pull/1415), - [#1416](https://github.com/openai/codex-security/pull/1416), - [#1180](https://github.com/openai/codex-security/pull/1180)) -- Generate and verify fixes from TypeScript with `security.patch()`, using - the SDK client's authentication, model settings, and cancellation support. - Your application controls review, commits, and publication. When you request a - pull request for a supplied issue, CLI results now include its branch and URL. - ([#1635](https://github.com/openai/codex-security/pull/1635), - [#1645](https://github.com/openai/codex-security/pull/1645)) -- Owner suggestions prefer committed CODEOWNERS before falling back to Git - history. In Codex, the new `$cloud-findings` skill reads findings, reports, - and recorded validation from existing Codex Security Cloud scans. - ([#1519](https://github.com/openai/codex-security/pull/1519), - [#1422](https://github.com/openai/codex-security/pull/1422)) - -Other fixes cover GitLab merge-request publication, Windows process launch and -network-share database paths, configuration errors, YAML error messages, and -plugin integrity checks after Python creates cache files. The package includes -Codex CLI/SDK 0.162.1. Display names now say **Codex Security Local**; the package -remains `@openai/codex-security`. - -## GitHub Action - -A new GitHub Action runs repository and pull-request scans in CI. Set the source -scope and time and cost budgets, review job summaries, and download saved results. -You can upload findings to GitHub code scanning as SARIF and fail a job at a -chosen severity. - -The initial Action supports GitHub.com, Linux x64 runners, and API-key -authentication. Action releases follow the verified npm release. See the -[Action guide](https://github.com/openai/codex-security/blob/npm-v0.3.0/github-action/README.md). -([#1015](https://github.com/openai/codex-security/pull/1015), -[#1418](https://github.com/openai/codex-security/pull/1418)) +- update @linear/sdk to 97.1.0 ([#1653](https://github.com/openai/codex-security/pull/1653)) @@ -101,111 +12,6 @@ authentication. Action releases follow the verified npm release. See the ## Upgrade notes -Read the sections that apply to your scripts, saved scans, or integrations before -updating from 0.2.0. - -### Scripts and integrations that read scan results - -If you consume scan JSON or SDK types, replace `coverage.completeness`, -`CoverageCompleteness`, bulk/component `incomplete` counters, comparison -`comparable`, and Action `scan-status: incomplete` handling with -`manifest.scan.status` and exit codes. Action `scan-status` now uses -`completed`, `failed`, or `skipped`. If a later scan does not find a previously -reported finding in the code it scanned, comparison returns `not_observed`. -Excluded paths and uncertain matches remain `unknown`; `resolved` requires -explicit closure as already fixed. - -New drafts, imports, worker output, and custom-validation results must use the -current `codeEvidence`, `rootCause`, `attackPath.dataflow`, and -`evidenceRefs` fields. Migrate unfinished drafts or finish them with their -original version. Completed historical reports remain readable and exportable. -([#1633](https://github.com/openai/codex-security/pull/1633)) - -### Standalone validation - -`validate` now assesses source in a read-only sandbox. It does not build or -execute the target, run tests or proofs of concept, or contact services. -Save the assessment from CLI stdout or SDK `result.report`; the validator -no longer writes report files: - -```bash -codex-security validate findings.json > assessment.md -``` - -Run a separate reproduction when you need runtime proof. Validation within -Standard, Deep, and Diff scans keeps its existing behavior. -([#1423](https://github.com/openai/codex-security/pull/1423)) - -### Resuming existing scans - -Keep the private `.scan-knowledge.json` file with scan artifacts. Resume -uses this captured knowledge-base context even if the original documents change -or disappear. Older individual scans that used knowledge bases but lack this -snapshot require a new scan. Scans without knowledge bases and bulk scans with -captured context remain resumable. Reruns use current inputs. -([#1556](https://github.com/openai/codex-security/pull/1556)) - -Reading compressed `.jsonl.zst` sessions requires Node 22.15+ within 22.x, -or Node 24/26. Node 22.13–22.14 still supports plain logs but cannot resume -compressed sessions. -([#1428](https://github.com/openai/codex-security/pull/1428)) - -### Owner suggestion consumers - -The owner-suggestion JSON report now uses `schemaVersion: 2`. Owners can be GitHub users, teams, or -email-only identities. Check for a non-null owner, then use `"handle" in owner` -before reading `owner.handle` or `owner.email`. Do not assume every owner -has a Git name/email pair. -([#1519](https://github.com/openai/codex-security/pull/1519)) - -### Installation and Windows settings - -Global installs now create the `cs` alias. If npm reports `EEXIST` -because another tool owns that name, use `npx @openai/codex-security`. -Windows defaults to the elevated sandbox backend and honors an explicit backend -selection. -([#1415](https://github.com/openai/codex-security/pull/1415), -[#1281](https://github.com/openai/codex-security/pull/1281)) - -### Custom plugins and direct helper users - -Upgrade custom plugins to the current archive/comparison protocols. New and -resumed Deep scans also require `directDeepScanEngine: 1`, -`workerProviderSnapshot: 4`, and isolated workers. Alternatively, omit -`pluginPath`/`--plugin-path` to use -the bundled plugin. Replace direct `node ./mcp/server.mjs` launches with -the current plugin launcher. - -For retained findings-storage and severity operations, replace direct calls to -retired Python helpers with -`scripts/launch_codex_security_mcp --helper COMMAND` (the `.cmd` launcher -on Windows). Pass JSON on stdin with an absolute `stateDirectory` and the -helper payload. Normal CLI/SDK callers need no helper migration. The selected -state directory must be writable; the temporary-state fallback is removed. -See the [SDK compatibility notes](https://github.com/openai/codex-security/blob/npm-v0.3.0/sdk/typescript/README.md) -and [helper reference](https://github.com/openai/codex-security/blob/npm-v0.3.0/sdk/typescript/docs/findings-service.md#direct-storage-helpers). -([#1548](https://github.com/openai/codex-security/pull/1548), -[#1408](https://github.com/openai/codex-security/pull/1408), -[#1543](https://github.com/openai/codex-security/pull/1543)) - -### Local deduplication and findings service removal - -Saved-scan deduplication now uses local SQLite storage by default, without a -running service. It caches embeddings and review progress so interrupted work -can resume. - -The `serve` command, its `--port` option, `start:server`, -`startFindingsServer`, browser dashboard, and findings-service Compose -deployment are removed. Use `codex-security dedupe --scan SCAN_ID` locally, or supply `--findings-url` for an independently hosted compatible -service. - -Keep existing state directories and volumes. Select the local database through -`CODEX_SECURITY_STATE_DIR`; a separate service volume is not selected -automatically. Generating or refreshing embeddings with the built-in embedder -requires an API key. The `@openai/codex-security/server` entrypoint retains -its storage and embedding exports. See the -[findings guide](https://github.com/openai/codex-security/blob/npm-v0.3.0/sdk/typescript/docs/findings-service.md). -([#1340](https://github.com/openai/codex-security/pull/1340), -[#1338](https://github.com/openai/codex-security/pull/1338)) +No additional migration steps are documented for this release. diff --git a/.github/release-pr-state.json b/.github/release-pr-state.json index 20c06620c..e12e4d279 100644 --- a/.github/release-pr-state.json +++ b/.github/release-pr-state.json @@ -1,13 +1,13 @@ { - "baseVersion": "0.2.0", - "baseCommit": "4949af70fcfadff154f6e8fdf100faa5bf2f8169", + "baseVersion": "0.3.0", + "baseCommit": "5c5239dd8062a7d00916c4bc0d5aeaa3ed0c5477", "sections": { "highlights": { - "generatedHash": "e93f207d9fdc726ae4c467e0c8cd88ca89904316180bc1566903287b12e73570", + "generatedHash": "2c70803cbb36d987d7ef1a71f5b65f798af7e33d7f2741beb208d3637f76f706", "humanOwned": false }, "upgrades": { - "generatedHash": "f5f5a865a61bfbbe4a3844071fcf18bba7a8e21b1bba2abb2960a3e3969c5a7e", + "generatedHash": "f0e089f37da057fc30882ef40dfe50f6b52abdc17018bf2d70c34afb22c66fe2", "humanOwned": false } } diff --git a/github-action/package-lock.json b/github-action/package-lock.json index 98cff9acb..32f3ba635 100644 --- a/github-action/package-lock.json +++ b/github-action/package-lock.json @@ -1,12 +1,12 @@ { "name": "codex-security-action", - "version": "0.3.0", + "version": "0.3.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codex-security-action", - "version": "0.3.0", + "version": "0.3.1", "dependencies": { "@actions/artifact": "6.3.1", "@actions/core": "3.0.1", diff --git a/github-action/package.json b/github-action/package.json index 9b5a9128e..a45c18aee 100644 --- a/github-action/package.json +++ b/github-action/package.json @@ -1,6 +1,6 @@ { "name": "codex-security-action", - "version": "0.3.0", + "version": "0.3.1", "private": true, "type": "module", "description": "Run Codex Security in GitHub Actions with explicit scope, budgets, and scan health reporting", diff --git a/sdk/typescript/package.json b/sdk/typescript/package.json index 93ead67a8..e08cd5f89 100644 --- a/sdk/typescript/package.json +++ b/sdk/typescript/package.json @@ -1,6 +1,6 @@ { "name": "@openai/codex-security", - "version": "0.3.0", + "version": "0.3.1", "description": "TypeScript SDK and CLI for Codex Security", "license": "Apache-2.0", "author": "OpenAI",