Codex Security 0.1.26

Highlights

• Classify finding severity with custom rubrics and supporting context through
  the CLI and SDK. Saved assessments can be reused for Linear publication
  without changing the original findings or sealed scan artifacts. See
  severity classification.
• Match repeated findings across scan history, preserving confirmed identities
  and related-finding relationships. Automatic matching restores batching, and
  confirmed-finding lookups are faster.
• Open draft GitLab merge requests for verified patches with the existing
  --create-pr option, including self-hosted GitLab. See
  patch publication.
• Report component scan progress in headless runs and exclude replayed usage
  events with identical timestamps from scan budgets.
• Preserve analytics settings in finding workflows and allow 120 seconds for
  the bundled plugin's MCP server to start.
• Require an explicit request before invoking the security fix verification
  skill during other work.

Upgrade notes

• GitLab patch publication requires an installed and authenticated glab CLI.
  For self-hosted GitLab, configure the host as described in the patch
  publication documentation above.
• Severity classification is opt-in. Without a rubric, it inherits the
  finding's existing severity without a model call.
• With --max-cost, automatic history matching makes at most one extra model
  call. If matching needs more context, the completed scan is retained and a
  warning directs you to run scans match --all explicitly.

The categorized list below contains the individual changes.

What's Changed

Features

• feat: classify finding severity with custom rubrics by @kmbroai in #791
• feat: match repeated findings across scan history by @mldangelo-oai in #575
• feat(cli): create GitLab merge requests for verified patches by @kmbroai in #814
• feat(plugin): add Daybreak access advisory by @soyeon-oai in #826

Fixes

• fix(plugin): allow 120 seconds for MCP startup by @daneschneider-oai in #786
• fix: restore batching for automatic finding matching by @ianw-oai in #782
• fix(release): retry transient GitHub reads by @mldangelo-oai in #800
• fix(deep-scan): remove coverage from aggregation by @daneschneider-oai in #767
• fix(cli): preserve analytics settings in finding workflows by @mldangelo-oai in #801
• fix: exclude same-millisecond replayed usage from scan budgets by @mldangelo-oai in #631
• fix(cli): report component scan progress headlessly by @Hughhhhcoder in #807
• fix: reduce deduplication pair review effort to high by @kmbroai in #813
• fix(release): allow the built-in workflow token by @mldangelo-oai in #809
• fix: require explicit requests for security fix verification by @kmbroai in #815

Other changes

• ci: maintain a rolling draft release PR by @mldangelo-oai in #753
• chore(deps): bump fast-uri from 3.1.5 to 3.1.6 in /sdk/typescript by @dependabot[bot] in #793
• chore(deps): bump fflate from 0.8.2 to 0.8.3 in /sdk/typescript by @dependabot[bot] in #804
• build: run the dev container on arm64 hosts by @h1994st in #787
• perf: speed up confirmed finding matching by @mldangelo-oai in #808

New Contributors

• @h1994st made their first contribution in #787

Full Changelog: npm-v0.1.25...npm-v0.1.26