Codex Security Files

Highlights

• Classify finding severity with custom rubrics and supporting context through the CLI and SDK. Saved assessments can be reused for Linear publication without changing the original findings or sealed scan artifacts. See severity classification.
• Match repeated findings across scan history, preserving confirmed identities and related-finding relationships. Automatic matching restores batching, and confirmed-finding lookups are faster.
• Open draft GitLab merge requests for verified patches with the existing --create-pr option, including self-hosted GitLab. See patch publication.
• Report component scan progress in headless runs and exclude replayed usage events with identical timestamps from scan budgets.
• Preserve analytics settings in finding workflows and allow 120 seconds for the bundled plugin's MCP server to start.
• Require an explicit request before invoking the security fix verification skill during other work.

Upgrade notes

• GitLab patch publication requires an installed and authenticated glab CLI. For self-hosted GitLab, configure the host as described in the patch publication documentation above.
• Severity classification is opt-in. Without a rubric, it inherits the finding's existing severity without a model call.
• With --max-cost, automatic history matching makes at most one extra model call. If matching needs more context, the completed scan is retained and a warning directs you to run scans match --all explicitly.

The categorized list below contains the individual changes.

What's Changed

Features

• feat: classify finding severity with custom rubrics by @kmbroai in https://github.com/openai/codex-security/pull/791
• feat: match repeated findings across scan history by @mldangelo-oai in https://github.com/openai/codex-security/pull/575
• feat(cli): create GitLab merge requests for verified patches by @kmbroai in https://github.com/openai/codex-security/pull/814
• feat(plugin): add Daybreak access advisory by @soyeon-oai in https://github.com/openai/codex-security/pull/826

Fixes

• fix(plugin): allow 120 seconds for MCP startup by @daneschneider-oai in https://github.com/openai/codex-security/pull/786
• fix: restore batching for automatic finding matching by @ianw-oai in https://github.com/openai/codex-security/pull/782
• fix(release): retry transient GitHub reads by @mldangelo-oai in https://github.com/openai/codex-security/pull/800
• fix(deep-scan): remove coverage from aggregation by @daneschneider-oai in https://github.com/openai/codex-security/pull/767
• fix(cli): preserve analytics settings in finding workflows by @mldangelo-oai in https://github.com/openai/codex-security/pull/801
• fix: exclude same-millisecond replayed usage from scan budgets by @mldangelo-oai in https://github.com/openai/codex-security/pull/631
• fix(cli): report component scan progress headlessly by @Hughhhhcoder in https://github.com/openai/codex-security/pull/807
• fix: reduce deduplication pair review effort to high by @kmbroai in https://github.com/openai/codex-security/pull/813
• fix(release): allow the built-in workflow token by @mldangelo-oai in https://github.com/openai/codex-security/pull/809
• fix: require explicit requests for security fix verification by @kmbroai in https://github.com/openai/codex-security/pull/815

Other changes

• ci: maintain a rolling draft release PR by @mldangelo-oai in https://github.com/openai/codex-security/pull/753
• chore(deps): bump fast-uri from 3.1.5 to 3.1.6 in /sdk/typescript by @dependabot[bot] in https://github.com/openai/codex-security/pull/793
• chore(deps): bump fflate from 0.8.2 to 0.8.3 in /sdk/typescript by @dependabot[bot] in https://github.com/openai/codex-security/pull/804
• build: run the dev container on arm64 hosts by @h1994st in https://github.com/openai/codex-security/pull/787
• perf: speed up confirmed finding matching by @mldangelo-oai in https://github.com/openai/codex-security/pull/808

New Contributors

• @h1994st made their first contribution in https://github.com/openai/codex-security/pull/787

Full Changelog: https://github.com/openai/codex-security/compare/npm-v0.1.25...npm-v0.1.26