Codex Security 0.8.2

Highlights

Codex Security 0.8.2 adds threat-model explorers and Amazon Inspector imports, and improves scan progress and finding review.

• Threat-model explorers. Turn an existing threat model into a shareable HTML explorer with interactive architecture, scenarios, controls, and source evidence. Export HTML or SVG from the bundled skill.
• Amazon Inspector imports. With external imports enabled, import a complete Inspector Code Security repository findings export while retaining each finding's identity across imports. See the Inspector import guide.
• Dedupe corrections. Hosted reviewers can correct rejected decisions in the original open review when the host supports pending-call validation.
• Interactive scans. Finding review shows critical findings first, followed by high, medium, and low severity. Component tables show saved review progress, and scan titles resolve relative directory names.
• Output directories. Existing scan output directories keep their permissions across scans, saved-result reads, and resume. Newly created directories remain private by default.
• Container releases. The release workflow builds Debian and Wolfi images from the same verified scanner package and frozen runtime dependency lock. See the container guide.

Upgrade notes

No migration is required for existing CLI workflows. Hosted integrations that opt into pending-call validation must keep the original review session open until they handle the CLI's feedback; existing hosts can continue returning final results.

Inspector imports remain opt-in. Cloud publication requires a connected GitHub repository and a deployment that accepts the Inspector provider. The import guide describes repository matching and complete-export requirements.

All changes

What's Changed

Features

• feat: resolve dependency alerts by @mldangelo-oai in #2084
• feat(import): track Amazon Inspector repository vulnerabilities by @mldangelo-oai in #2097
• feat: add a threat-model explorer by @fwph-oai in #2112
• feat(container): release Debian and Wolfi from the verified scanner package by @mldangelo-oai in #2116

Fixes

• fix: allow existing scan output directory permissions by @suhailpatel-oai in #2120
• fix(dashboard): show saved review progress in the component table by @WenJing95 in #2111
• fix(action): check RUNNER_TEMP before resolving it by @LittleYier in #2125
• fix(auth): keep login URLs when OSC sequences end with ST by @LittleYier in #2124
• fix: ship explorer references as standalone vector images by @mldangelo-oai in #2128
• fix: resolve directory names in scan titles by @suhailpatel-oai in #2121
• fix: sort interactive findings by severity by @suhailpatel-oai in #2135
• fix(dedupe): correct rejected decisions in the open records review by @kmbroai in #2139

Documentation

• docs: explain how to verify a committed diff scan inventory by @mldangelo-oai in #2122
• docs: add published docs to the release checklist by @mldangelo-oai in #2094

Other changes

• ci: bump taiki-e/install-action from 2.87.29 to 2.87.30 by @dependabot[bot] in #2108
• ci: bump actions/setup-python from 7.0.0 to 7.1.0 by @dependabot[bot] in #2106
• chore(deps): bump @hono/node-server from 2.1.1 to 2.1.5 in /plugins/codex-security/mcp-app by @dependabot[bot] in #2123
• chore(native): document exact dependency pins by @mldangelo-oai in #2126
• ci: bump actions/attest from 4.2.1 to 4.2.2 by @dependabot[bot] in #2131
• chore(deps): bump @linear/sdk from 98.0.0 to 99.0.0 in /sdk/typescript by @dependabot[bot] in #2132
• chore(deps): bump napi from 3.14.2 to 3.15.0 in /plugins/codex-security/native by @dependabot[bot] in #2130
• chore(deps): bump napi-derive from 3.6.12 to 3.6.13 in /plugins/codex-security/native by @dependabot[bot] in #2129
• refactor: simplify scanner imports and SDK test setup by @mldangelo-oai in #2136
• refactor: simplify workbench and Deep Scan processing by @mldangelo-oai in #2137

New Contributors

• @suhailpatel-oai made their first contribution in #2120
• @fwph-oai made their first contribution in #2112

Full Changelog: npm-v0.8.1...npm-v0.8.2