Codex Security 0.8.3

Highlights

• update SDK and MCP parser dependencies (#2141)
• do not split surrogate pairs in truncated report text (#2133)
• update vulnerable triage dependencies (#2142)
• defer CLI and plugin validators until first use (#2140)
• explain package provenance (#361)
• speed up plugin setup and defer CLI prompts (#2146)
• track Black Duck SCA project-version vulnerabilities (#2098)
• avoid claiming output was kept after scan failures (#359)
• track Veracode static application policy flaws (#2099)
• accept UTF-8 BOM in JSON project files (#980)
• avoid duplicate plugin setup inspection and defer CLI YAML (#2149)
• accept UTF-8 BOMs in scan inputs and calibration datasets (#2151)
• preserve IPv6 verification URL brackets (#232)
• bump the third-party group across 2 directories with 2 updates (#2157)
• bump ruff from 0.17.1 to 0.17.2 in /plugins/codex-security (#2153)
• bump docker/login-action from 4.6.0 to 4.7.0 (#2155)
• bump the codex group across 3 directories with 2 updates (#2154)
• keep whole characters when shortening publish progress (#2158)
• preserve local scan startup diagnostics (#2115)
• name the outermost rejected Windows ancestor (#2065)
• count only CR and LF as assessment line breaks (#2147)
• retain the reviewed surface count for completed Deep scans (#2161)
• show highest-severity findings first (#2160)
• bump taiki-e/install-action from 2.87.30 to 2.87.31 (#2156)
• align Unicode repository columns (#2148)
• link Markdown evidence to plain source lines (#2032)
• update MCP SDK to 1.32.2 and Stryker to 10.1.1 (#2170)
• import SonarQube Cloud security findings (#2162)
• share saved coverage logic and checkpoint fixtures (#2185)
• organize external scanner integration guides (#2189)
• index SARIF artifact URIs once per run (#2191)
• normalize GitHub scanner evidence for its destination (#2192)
• reuse Wiz replay projections for package reports (#2193)
• share local Git metadata discovery (#2194)
• require exhaustive scanner reader dispatch (#2195)
• normalize selected Semgrep Code findings for local import (#2164)
• share optional field parsing across GitHub and Wiz (#2198)
• share scanner Cloud publication and recovery guidance (#2199)
• share SARIF rule indexing and reference checks (#2200)
• isolate rejected publication progress callbacks (#2203)
• share connection and error handling for finding imports (#2204)
• avoid duplicate Git metadata discovery (#2205)
• skip Cloud number formatting for local evidence (#2202)
• give each scanner import a focused guide (#2201)
• reuse native record checks for Black Duck components (#2207)
• reduce Sonar issue collection requests (#2208)
• show the SDK fallback for finding imports (#2209)
• show how to retrieve selected scanner evidence (#2210)
• share SARIF result context for Semgrep and Endor (#2219)
• share the repository scope for external finding reads (#2221)
• choose configured tools for scanner and Cloud findings (#2213)
• parse fenced triage results in one pass (#2214)
• simplify publication progress and scan selection (#2218)
• share the latest remediation attempt query (#2215)
• share patch and verify-fix input selection (#2217)
• share smoke inputs and native artifact upload settings (#2220)
• share artifact path validation during finalization (#2222)
• remove private Wiz finding type re-exports (#2229)
• remove unreachable component dashboard status cases (#2230)
• reuse validated patch risk summaries in draft reviews (#2228)
• remove unused permissive Git-tree lookup (#2227)
• remove retired GitHub publication commands (#2226)
• share SARIF rule reference validation (#2235)
• simplify provider import examples (#2234)
• skip Cloud replay projections for local Wiz findings (#2236)
• accept imported evidence in records deduplication (#2241)
• use the singular for one finding or reviewed file (#2239)
• preserve PDF line breaks during text extraction (#2196)
• skip index paths under directories replaced by files (#2182)
• use the singular for one repository in bulk scan prompts (#2174)
• spell numeric ranges with en dashes, not tildes (#2095)
• keep every scroll step in the finding details pane (#2016)
• align the component cost column with its header (#2004)
• bump taiki-e/install-action from 2.87.31 to 2.87.32 (#2244)
• distinguish library defaults from caller obligations (#2245)
• preserve boxed numeric evidence across retries (#2224)
• restore concrete discovery guidance for Standard and Deep scans (#2246)
• reuse repository membership checks across scans (#2249)
• preserve permission errors from plugin installation (#2247)
• share terminal grapheme handling (#2232)
• prepare Veracode selection filters once per report (#2248)
• index saved sessions by parent when reading scan logs (#2237)
• share SARIF evidence projection for Semgrep and Endor (#2233)
• share projection and validation logic (#2183)
• reconcile unacknowledged findings uploads (#2211)
• reuse scoped GitHub connections for finding intake (#2223)
• clarify the post-scan findings review prompt (#2255)
• remove Daybreak latest alias pricing (#2165)
• opt in to the remote rubric for standalone reclassification (#2257)
• accept a host-supplied severity rubric for Standard scans (#2253)
• submit selected scanner findings to the private inbox (#2177)
• apply native profiles across scan workflows (#1018)
• share sealed scan reads with tracking (#1846)
• skip the old position of moved DOCX text (#2256)
• honor signed-in tracker connections for finding reads (#2212)
• inherit the launching turn's Deep Scan speed (#2231)
• reconcile live and saved parent updates (#1596)
• review agent skills before installation (#2088)
• show Git errors for unreadable tracked files (#2058)
• prepare hosted runners and require completed PR checks (#1580)
• share the host adapter for records commands (#2259)
• preserve the severity rubric across standalone scan attempts (#2258)
• share bundled severity grading with the SDK (#2260)
• report the exact rubric used for severity classification (#2262)
• support AWS Continuum code findings (#2264)
• recognize Windows drive and UNC host casing (#545)
• verify large saved scans in bounded requests (#2251)
• save generated patches for completed scans (#2033)
• prepare local deduplication in Node (#1840)
• bump ruff from 0.17.2 to 0.17.3 in /plugins/codex-security (#2267)
• preserve caller tool settings across scan turns (#2012)
• count changed files when registering diff scans (#1916)
• run local scans without connecting an app (#2100)

Upgrade notes

Review migration steps for these breaking changes:

• remove Daybreak latest alias pricing (#2165)
• share sealed scan reads with tracking (#1846)
• prepare hosted runners and require completed PR checks (#1580)
• prepare local deduplication in Node (#1840)

All changes

What's Changed

Breaking changes

• fix(pricing)!: remove Daybreak latest alias pricing by @mldangelo-oai in #2165
• refactor!: share sealed scan reads with tracking by @mldangelo-oai in #1846
• feat(action)!: prepare hosted runners and require completed PR checks by @mldangelo-oai in #1580
• refactor!: prepare local deduplication in Node by @mldangelo-oai in #1840

Features

• feat(import): track Black Duck SCA project-version vulnerabilities by @mldangelo-oai in #2098
• feat(import): track Veracode static application policy flaws by @mldangelo-oai in #2099
• feat: import SonarQube Cloud security findings by @mldangelo-oai in #2162
• feat(imports): normalize selected Semgrep Code findings for local import by @mldangelo-oai in #2164
• feat(sdk): opt in to the remote rubric for standalone reclassification by @Aismit in #2257
• feat(sdk): accept a host-supplied severity rubric for Standard scans by @Aismit in #2253
• feat(imports): submit selected scanner findings to the private inbox by @mldangelo-oai in #2177
• feat(config): apply native profiles across scan workflows by @mldangelo-oai in #1018
• feat(plugin): review agent skills before installation by @mldangelo-oai in #2088
• feat(sdk): preserve the severity rubric across standalone scan attempts by @Aismit in #2258
• feat(import): support AWS Continuum code findings by @mldangelo-oai in #2264

Fixes

• fix(deps): update SDK and MCP parser dependencies by @mldangelo-oai in #2141
• fix(action): do not split surrogate pairs in truncated report text by @WenJing95 in #2133
• fix(evals): update vulnerable triage dependencies by @mldangelo-oai in #2142
• fix(cli): avoid claiming output was kept after scan failures by @Mr-Neutr0n in #359
• fix(config): accept UTF-8 BOM in JSON project files by @dipeshbabu in #980
• fix: accept UTF-8 BOMs in scan inputs and calibration datasets by @mldangelo-oai in #2151
• fix(auth): preserve IPv6 verification URL brackets by @dipeshbabu in #232
• fix(cli): keep whole characters when shortening publish progress by @WenJing95 in #2158
• fix: preserve local scan startup diagnostics by @andy-tang-oai in #2115
• fix(runtime): name the outermost rejected Windows ancestor by @lumatic2 in #2065
• fix(threat-model): count only CR and LF as assessment line breaks by @LittleYier in #2147
• fix(plugin): retain the reviewed surface count for completed Deep scans by @mldangelo-oai in #2161
• fix(action): show highest-severity findings first by @andy-tang-oai in #2160
• fix(history): align Unicode repository columns by @JunkaiWang-TheoPhy in #2148
• fix(publication): link Markdown evidence to plain source lines by @WenJing95 in #2032
• fix(sdk): isolate rejected publication progress callbacks by @mldangelo-oai in #2203
• fix(plugin): choose configured tools for scanner and Cloud findings by @mldangelo-oai in #2213
• fix(imports): skip Cloud replay projections for local Wiz findings by @mldangelo-oai in #2236
• fix(sdk): accept imported evidence in records deduplication by @alandelong-oai in #2241
• fix(history): use the singular for one finding or reviewed file by @LittleYier in #2239
• fix(knowledge-base): preserve PDF line breaks during text extraction by @Shizoqua in #2196
• fix(targets): skip index paths under directories replaced by files by @LittleYier in #2182
• fix(cli): use the singular for one repository in bulk scan prompts by @WenJing95 in #2174
• fix(reports): spell numeric ranges with en dashes, not tildes by @LittleYier in #2095
• fix(patch): keep every scroll step in the finding details pane by @LittleYier in #2016
• fix(dashboard): align the component cost column with its header by @WenJing95 in #2004
• fix(threat-model): distinguish library defaults from caller obligations by @mldangelo-oai in #2245
• fix(imports): preserve boxed numeric evidence across retries by @mldangelo-oai in #2224
• fix(scan): restore concrete discovery guidance for Standard and Deep scans by @mldangelo-oai in #2246
• fix(cli): preserve permission errors from plugin installation by @mldangelo-oai in #2247
• fix(plugin): reuse scoped GitHub connections for finding intake by @mldangelo-oai in #2223
• fix(cli): clarify the post-scan findings review prompt by @mldangelo-oai in #2255
• fix(knowledge-base): skip the old position of moved DOCX text by @Shizoqua in #2256
• fix(plugin): honor signed-in tracker connections for finding reads by @mldangelo-oai in #2212
• fix(plugin): inherit the launching turn's Deep Scan speed by @mldangelo-oai in #2231
• fix(progress): reconcile live and saved parent updates by @mldangelo-oai in #1596
• fix(workbench): show Git errors for unreadable tracked files by @mldangelo-oai in #2058
• fix(sdk): report the exact rubric used for severity classification by @Aismit in #2262
• fix(activity): recognize Windows drive and UNC host casing by @sylvesterkaczmarek in #545
• fix(cli): verify large saved scans in bounded requests by @mldangelo-oai in #2251
• fix(plugin): save generated patches for completed scans by @mldangelo-oai in #2033
• fix(deep-scan): preserve caller tool settings across scan turns by @mldangelo-oai in #2012
• fix(scans): count changed files when registering diff scans by @mldangelo-oai in #1916
• fix(plugin): declare app connections optional by @ianw-oai in #2100
• fix: stop Deep Scan retries from assuming the review finished by @ianw-oai in #2068
• fix(bulk-scan): identify invalid committed receipt lines by @dipeshbabu in #2180

Documentation

• docs(release): explain package provenance by @Mr-Neutr0n in #361
• docs: organize external scanner integration guides by @mldangelo-oai in #2189
• docs: normalize GitHub scanner evidence for its destination by @mldangelo-oai in #2192
• docs: share scanner Cloud publication and recovery guidance by @mldangelo-oai in #2199
• docs: give each scanner import a focused guide by @mldangelo-oai in #2201
• docs(github): show the SDK fallback for finding imports by @mldangelo-oai in #2209
• docs(imports): show how to retrieve selected scanner evidence by @mldangelo-oai in #2210
• docs(plugin): simplify provider import examples by @mldangelo-oai in #2234
• docs(publish): reconcile unacknowledged findings uploads by @mldangelo-oai in #2211

Other changes

• perf: defer CLI and plugin validators until first use by @mldangelo-oai in #2140
• perf: speed up plugin setup and defer CLI prompts by @mldangelo-oai in #2146
• perf: avoid duplicate plugin setup inspection and defer CLI YAML by @mldangelo-oai in #2149
• chore(deps): bump the third-party group across 2 directories with 2 updates by @dependabot[bot] in #2157
• chore(deps): bump ruff from 0.17.1 to 0.17.2 in /plugins/codex-security by @dependabot[bot] in #2153
• ci: bump docker/login-action from 4.6.0 to 4.7.0 by @dependabot[bot] in #2155
• chore(deps): bump the codex group across 3 directories with 2 updates by @dependabot[bot] in #2154
• ci: bump taiki-e/install-action from 2.87.30 to 2.87.31 by @dependabot[bot] in #2156
• chore(deps): update MCP SDK to 1.32.2 and Stryker to 10.1.1 by @dependabot[bot] in #2170
• refactor(workbench): share saved coverage logic and checkpoint fixtures by @mldangelo-oai in #2185
• perf(sdk): index SARIF artifact URIs once per run by @mldangelo-oai in #2191
• perf(imports): reuse Wiz replay projections for package reports by @mldangelo-oai in #2193
• refactor(imports): share local Git metadata discovery by @mldangelo-oai in #2194
• refactor(imports): require exhaustive scanner reader dispatch by @mldangelo-oai in #2195
• refactor(imports): share optional field parsing across GitHub and Wiz by @mldangelo-oai in #2198
• refactor(imports): share SARIF rule indexing and reference checks by @mldangelo-oai in #2200
• refactor(github): share connection and error handling for finding imports by @mldangelo-oai in #2204
• perf(imports): avoid duplicate Git metadata discovery by @mldangelo-oai in #2205
• perf(imports): skip Cloud number formatting for local evidence by @mldangelo-oai in #2202
• refactor(imports): reuse native record checks for Black Duck components by @mldangelo-oai in #2207
• perf(imports): reduce Sonar issue collection requests by @mldangelo-oai in #2208
• refactor(imports): share SARIF result context for Semgrep and Endor by @mldangelo-oai in #2219
• refactor(workbench): share the repository scope for external finding reads by @mldangelo-oai in #2221
• refactor(evals): parse fenced triage results in one pass by @mldangelo-oai in #2214
• refactor(cli): simplify publication progress and scan selection by @mldangelo-oai in #2218
• refactor(workbench): share the latest remediation attempt query by @mldangelo-oai in #2215
• refactor(cli): share patch and verify-fix input selection by @mldangelo-oai in #2217
• ci: share smoke inputs and native artifact upload settings by @mldangelo-oai in #2220
• refactor(plugin): share artifact path validation during finalization by @mldangelo-oai in #2222
• refactor(imports): remove private Wiz finding type re-exports by @mldangelo-oai in #2229
• refactor(cli): remove unreachable component dashboard status cases by @mldangelo-oai in #2230
• refactor(cli): reuse validated patch risk summaries in draft reviews by @mldangelo-oai in #2228
• refactor(workbench): remove unused permissive Git-tree lookup by @mldangelo-oai in #2227
• refactor(release): remove retired GitHub publication commands by @mldangelo-oai in #2226
• refactor(imports): share SARIF rule reference validation by @mldangelo-oai in #2235
• ci: bump taiki-e/install-action from 2.87.31 to 2.87.32 by @dependabot[bot] in #2244
• perf(history): reuse repository membership checks across scans by @mldangelo-oai in #2249
• refactor(cli): share terminal grapheme handling by @mldangelo-oai in #2232
• refactor(imports): prepare Veracode selection filters once per report by @mldangelo-oai in #2248
• perf(cli): index saved sessions by parent when reading scan logs by @mldangelo-oai in #2237
• refactor(imports): share SARIF evidence projection for Semgrep and Endor by @mldangelo-oai in #2233
• refactor(reports): share projection and validation logic by @mldangelo-oai in #2183
• refactor(cli): share the host adapter for records commands by @Aismit in #2259
• refactor(plugin): share bundled severity grading with the SDK by @Aismit in #2260
• chore(deps): bump ruff from 0.17.2 to 0.17.3 in /plugins/codex-security by @dependabot[bot] in #2267

New Contributors

• @Mr-Neutr0n made their first contribution in #361
• @lumatic2 made their first contribution in #2065
• @JunkaiWang-TheoPhy made their first contribution in #2148
• @Aismit made their first contribution in #2257

Full Changelog: npm-v0.8.2...npm-v0.8.3