[github-actions]

Summary

Prepare Codex Security CLI and SDK 0.5.0, with investigation time budgets, host-provided finding reviews, provider improvements, and reliability fixes. The minor version includes removal of the advisory capability-preflight integration.

Changes

• Align package versions at 0.5.0 and update the standalone workflow example's CLI pin.
• Publish reviewed highlights and migration guidance for time budgets, saved evidence, Action release assets, capability preflight, and selected-profile approval policy.
• Preserve the release updater's human-owned note sections.

Testing

• All CI checks passed on e063a0abb0f534746adfba1a5d5bab69eef7fca6, including node-ci, Action CI, installed-package checks, and security review. The pull request is approved.
• The exact CI-built 0.5.0 package passed the full local package smoke test on Linux with Node 24.19.0. Coverage includes CLI startup, public SDK imports and TypeScript types, SDK lifecycle, credential locking, hosted protocols, MCP initialization, nested workers, and Deep Scan retry/restart/finalization.
• Local smoke testing used a clean temporary directory and standard 022 file-creation permissions after identifying temporary-root Git metadata and permissive fixture permissions in the initial environment.
• Release-note validation, formatting, and whitespace checks passed. Verified that the updater preserves both human-owned sections and that versioned documentation paths and fragments resolve in the release source.

Risk and rollout

Merging starts the existing post-merge CI and protected release process. Publication waits for CI on the exact merge commit. Monitor npm publication and provenance, the GitHub release, exact-version installation checks, and the matching Action release with its manifest and SBOM.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[github-actions]

Release proposal updated through main commit bb65abd1150126cefd349abaf67635d40972a56a.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

• support host-provided standalone reviews (#1682)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head c9e85bd.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-19T23:38:25.829130Z	e063a0a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Release proposal updated through main commit 896b0c9a31a002c14e32a853944235e6c59a806e.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

• support host-provided standalone reviews (#1682)
• retire advisory capability preflight (#1609)

Upgrade notes

Review migration steps for these breaking changes:

• retire advisory capability preflight (#1609)

@codex review the current head b197adf.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 83040eeecf0eee8042cbf8ba6167b5df65774050.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

• support host-provided standalone reviews (#1682)
• retire advisory capability preflight (#1609)
• support scan CLI inference providers (#1677)
• do not report a successful envelope for a failed dedupe (#1071)
• separate Git transport from review providers (#1551)

Upgrade notes

Review migration steps for these breaking changes:

• retire advisory capability preflight (#1609)

@codex review the current head eca41b6.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 49eaf6ce1b64fe430fe04355000ccbb9caaab0b9.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

• support host-provided standalone reviews (#1682)
• retire advisory capability preflight (#1609)
• support scan CLI inference providers (#1677)
• do not report a successful envelope for a failed dedupe (#1071)
• separate Git transport from review providers (#1551)
• update Bedrock workflow to CLI 0.3.0 (#1675)
• avoid copying unused dictionary items (#1661)
• normalize hostnames before credential lookup and API routing (#1069)
• clean up imports and expected test exceptions (#1665)
• honor selected profile approval policy (#530)
• remove reasoning effort allowlist (#1712)
• use the SHA-256 empty tree for root commit diffs (#1716)
• read diff blobs with Git before 2.38 (#1715)
• bump the third-party group across 3 directories with 3 updates (#1696)
• separate diff revisions from paths in scan inputs (#1694)
• bump ruff from 0.16.10 to 0.17.0 in /plugins/codex-security (#1695)
• preserve generated-note command failures (#1729)
• drop deleted revisions and field codes from DOCX (#1714)
• URL-encode generated schema references (#981)
• detect Windows Yarn global installs in update notices (#1692)
• add Cheaper Inference inference provider (#1623)
• describe positive numeric input bounds (#1605)
• import schema APIs directly from Zod (#1726)
• normalize CWE identifiers without integer conversion (#1723)
• remove the empty editable Python distribution (#1724)
• delete whole characters when editing patch instructions (#1549)
• adopt the registered target kind when sealing a scan draft (#828)
• reject remote targets the SDK reader refuses to load (#1569)
• validate deferred source paths (#1573)
• validate code evidence paths (#1567)
• bump taiki-e/install-action from 2.87.27 to 2.87.28 (#1742)

Upgrade notes

Review migration steps for these breaking changes:

• retire advisory capability preflight (#1609)

@codex review the current head 97ceeec.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.