openai/codex-security npm-v0.8.0

Codex Security 0.8.0

Repository: openai/codex-security

Tag: npm-v0.8.0

Published: 2026-10-28T02:51:26Z

Prerelease: no

Release notes:

Highlights

Codex Security 0.8.0 adds OpenGrep report imports and changes how scan results record scope and review details.

• OpenGrep imports. Import a native JSON or gzip-compressed report into the local workbench or publish it to Cloud with publish findings --provider opengrep. Supply --source-repository-url and enable external imports with CODEX_SECURITY_ENABLE_EXTERNAL_IMPORTS=1. Imported findings retain their scanner evidence and start as unassessed. See the OpenGrep guide.
• Scan recovery. Resume an interrupted Deep Scan after clearing its additional instructions. Read a completed Workbench scan’s saved artifacts even after moving or removing the original checkout.

Upgrade notes

• SDK and JSON consumers. Replace reads of ScanResult.coverage or the serialized coverage field with review for comparison exclusions. Read scan mode and scope from manifest.scan. Integrations that write drafts should put reviewed surfaces, unfinished work, and open questions in reviewState.
• Saved files and GitHub Actions. New scans no longer write coverage.json. Replace ScanResult.coveragePath with manifestPath and read scan.review in scan-manifest.json. Workflows that read the Action’s coverage-path output should switch to manifest-path. The legacy output is empty for current scans. Existing saved scans remain readable. See Action outputs.

All changes

What's Changed

Breaking changes

• refactor!: simplify scan completion and recovery by @ianw-oai in https://github.com/openai/codex-security/pull/1762

Features

• feat(container): add a local Wolfi build for Linux amd64 by @andy-tang-oai in https://github.com/openai/codex-security/pull/2053
• feat(imports): support OpenGrep reports locally and in Cloud by @mldangelo-oai in https://github.com/openai/codex-security/pull/1872

Fixes

• fix(knowledge-base): skip Office owner files in knowledge-base folders by @LittleYier in https://github.com/openai/codex-security/pull/1913
• fix(sdk): leave Git-ignored SECURITY.md files out of policy discovery by @ilaigold in https://github.com/openai/codex-security/pull/1535
• fix(scans): retain pre-seal warnings across publication failures by @JayYarlagadda in https://github.com/openai/codex-security/pull/1907
• fix(deps): bump fast-uri from 3.1.8 to 3.1.9 in /github-action/runtime by @dependabot[bot] in https://github.com/openai/codex-security/pull/1914
• fix(patch): stop source excerpts at the end of the file by @LittleYier in https://github.com/openai/codex-security/pull/2015
• fix(plugin): request fields when reading back GitHub issues by @mldangelo-oai in https://github.com/openai/codex-security/pull/2048
• fix(cli): resume deep scans after clearing their instructions by @mldangelo-oai in https://github.com/openai/codex-security/pull/2049
• fix(mcp): read completed scan artifacts after checkout removal by @mldangelo-oai in https://github.com/openai/codex-security/pull/2050
• fix(dedupe): continue hosted reviews after a missing submission by @kmbroai in https://github.com/openai/codex-security/pull/2090

Documentation

• docs(artifacts): clarify recovery for historical scan entries by @mldangelo-oai in https://github.com/openai/codex-security/pull/2027
• docs(imports): map scanner evidence and test cross-provider replay by @mldangelo-oai in https://github.com/openai/codex-security/pull/2080
• docs(imports): distinguish Snyk evidence changes from finding edits by @mldangelo-oai in https://github.com/openai/codex-security/pull/2081

Other changes

• chore(deps): bump fast-uri from 3.1.8 to 3.1.9 in /sdk/typescript by @dependabot[bot] in https://github.com/openai/codex-security/pull/2061
• chore(deps): bump fast-uri from 3.1.8 to 3.1.9 in /plugins/codex-security/mcp-app by @dependabot[bot] in https://github.com/openai/codex-security/pull/2062
• chore(deps): bump fast-uri from 3.1.8 to 3.1.9 in /evals/triage-finding by @dependabot[bot] in https://github.com/openai/codex-security/pull/2063
• chore(deps): update @inquirer/prompts to 8.7.4 in the SDK by @dependabot[bot] in https://github.com/openai/codex-security/pull/2072
• ci: skip container builds for SDK test-only pull requests by @mldangelo-oai in https://github.com/openai/codex-security/pull/2069
• perf(imports): count Cloud request bytes without reserializing batches by @mldangelo-oai in https://github.com/openai/codex-security/pull/2079
• perf(imports): avoid redundant SQLite reads and parsing on replay by @mldangelo-oai in https://github.com/openai/codex-security/pull/2083

New Contributors

• @JayYarlagadda made their first contribution in https://github.com/openai/codex-security/pull/1907
• @andy-tang-oai made their first contribution in https://github.com/openai/codex-security/pull/2053

Full Changelog: https://github.com/openai/codex-security/compare/npm-v0.7.0...npm-v0.8.0