Skip to content

Codex Security 0.9.0 (source only)

Choose a tag to compare

View all tags
@mldangelo-oai mldangelo-oai released this 10 Nov 07:26
Immutable release. Only release title and notes can be modified.
npm-v0.9.0
7cc6bae
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Source-only release. The source archives below contain the original 0.9.0 release commit. The 0.9.0 build stopped during macOS signing, before npm publication. For the signed CLI and SDK package, use Codex Security 0.9.1.

Highlights

  • Deep Scan runs independent Standard reviews in batches. Workers can share leads and verify each other's evidence. The final report groups observations that have the same fix and retains the source locations from each review. Deep Scan guide
  • External scanner imports are enabled by default in the CLI, SDK, and plugin. You can preview supported reports, save findings locally, and publish supported findings to Cloud. The scanner guides list the accepted formats and which inputs are local-only. Scanner import guides
  • scans logs finds sessions faster in large compressed histories. The GitHub Action also includes scan scope limitations in its job summary, including when a scan returns zero findings.

Upgrade notes

  • Deep Scan budgets. --stop-after-no-new now counts consecutive completed Standard reviews that add no findings. If you depend on a particular run length, review this threshold alongside --max-discovery-runs and --max-time. Deep Scan settings
  • Scanner imports. Remove CODEX_SECURITY_ENABLE_EXTERNAL_IMPORTS from launch scripts. A legacy value of 0 no longer disables imports. Scanner import guides
  • Linux Compose deployments. The bundled seccomp profile restricts direct socket families and blocks ptrace, process_vm_readv, and process_vm_writev. If a custom tool needs one of these operations, test it against your deployment's profile before upgrading. Container guide
  • Source builds. Sparse SDK checkouts must include plugins/codex-security/mcp-app/src/deep-scan-settings.ts. Upgrade or roll back the bundled plugin as a unit. Source build change
  • Package verification. The source package checker rejects sparse tar entries. If an unsigned candidate was built with a sparse-aware archiver, recreate it with pnpm pack from sdk/typescript. Use the original published archive for release recovery. Package verification change

Full changelog from 0.8.3 to 0.9.0

Assets 3
Loading