Codex Security 0.8.1

Highlights

Codex Security 0.8.1 improves scan output reliability and adds two ways to move findings between tools.

• Scan output. Scan directories preserve trailing hyphens in repository names. Hosted Linux path scans keep temporary file lists out of captured output when private state storage is available. If a sealed file changes after validation, the hosted SDK returns a failed receipt with no artifacts.
• Dependabot imports. With external imports enabled, import saved GitHub Dependabot alerts with publish findings FILE --provider github. Alerts keep their individual identities across imports, even when they share an advisory. See the Dependabot import guide.
• ServiceNow exports. Export saved findings as a CSV for Manual AVIT Ingestion using --export-format servicenow-avit and --avit-template. See the application template.
• Wolfi containers. A manual release workflow can publish a versioned Linux amd64 scanner image with an SPDX software bill of materials. See the Wolfi image guide.

Upgrade notes

No additional migration steps are documented for this release.

All changes

What's Changed

Features

• feat: add ServiceNow AVIT CSV export by @ianw-oai in #2103
• feat(container): publish a versioned Wolfi amd64 scanner by @andy-tang-oai in #2091
• feat(import): ingest GitHub Dependabot repository alerts by @mldangelo-oai in #2096

Fixes

• fix: preserve hyphens in scan directory names by @mldangelo-oai in #2102
• fix: keep hosted path inventories outside captured scan output by @mldangelo-oai in #2110
• fix(sdk): reject hosted receipts for changed sealed files by @mldangelo-oai in #2105

Documentation

• docs: flag published documentation updates in pull requests by @mldangelo-oai in #2093

Other changes

• refactor(import): share scanner report file decoding by @mldangelo-oai in #2113
• chore(deps): bump the codex group across 3 directories with 2 updates by @dependabot[bot] in #2107

New Contributors

• @moah0911 made their first contribution in #2109

Full Changelog: npm-v0.8.0...npm-v0.8.1