openai/codex-security npm-v0.8.1

Codex Security 0.8.1

Repository: openai/codex-security

Tag: npm-v0.8.1

Published: 2026-10-29T21:09:54Z

Prerelease: no

Release notes:

Highlights

Codex Security 0.8.1 improves scan output reliability and adds two ways to move findings between tools.

• Scan output. Scan directories preserve trailing hyphens in repository names. Hosted Linux path scans keep temporary file lists out of captured output when private state storage is available. If a sealed file changes after validation, the hosted SDK returns a failed receipt with no artifacts.
• Dependabot imports. With external imports enabled, import saved GitHub Dependabot alerts with publish findings FILE --provider github. Alerts keep their individual identities across imports, even when they share an advisory. See the Dependabot import guide.
• ServiceNow exports. Export saved findings as a CSV for Manual AVIT Ingestion using --export-format servicenow-avit and --avit-template. See the application template.
• Wolfi containers. A manual release workflow can publish a versioned Linux amd64 scanner image with an SPDX software bill of materials. See the Wolfi image guide.

Upgrade notes

No additional migration steps are documented for this release.

All changes

What's Changed

Features

• feat: add ServiceNow AVIT CSV export by @ianw-oai in https://github.com/openai/codex-security/pull/2103
• feat(container): publish a versioned Wolfi amd64 scanner by @andy-tang-oai in https://github.com/openai/codex-security/pull/2091
• feat(import): ingest GitHub Dependabot repository alerts by @mldangelo-oai in https://github.com/openai/codex-security/pull/2096

Fixes

• fix: preserve hyphens in scan directory names by @mldangelo-oai in https://github.com/openai/codex-security/pull/2102
• fix: keep hosted path inventories outside captured scan output by @mldangelo-oai in https://github.com/openai/codex-security/pull/2110
• fix(sdk): reject hosted receipts for changed sealed files by @mldangelo-oai in https://github.com/openai/codex-security/pull/2105

Documentation

• docs: flag published documentation updates in pull requests by @mldangelo-oai in https://github.com/openai/codex-security/pull/2093

Other changes

• refactor(import): share scanner report file decoding by @mldangelo-oai in https://github.com/openai/codex-security/pull/2113
• chore(deps): bump the codex group across 3 directories with 2 updates by @dependabot[bot] in https://github.com/openai/codex-security/pull/2107

New Contributors

• @moah0911 made their first contribution in https://github.com/openai/codex-security/pull/2109

Full Changelog: https://github.com/openai/codex-security/compare/npm-v0.8.0...npm-v0.8.1