[github-actions]

Summary

Keep a release proposal current with changes merged into main.

Changes

Update the package version and draft release notes. The version header and PR title are maintained by automation. Edit the marked note sections in .github/release-notes.md; edited or deleted sections become human-owned. New suggestions appear in subsequent bot comments. The PR description is never regenerated.

Testing

The updater does not run package tests. Before merging, verify required CI in the Checks tab and Codex review on the current commit. Request a final review if Codex last reviewed an older commit. Post later manual test results in a PR comment or review with the tested commit SHA. Editing the description to update status can trigger CI.

Risk and rollout

Merging this PR starts the existing CI and protected release process. Review migration details and complete the public disclosure review before merging.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[github-actions]

Release proposal updated through main commit 4e51fb768b70e568b629dc714ec983dcc5e57345.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 2d322b1.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-11-10T15:19:32.739458Z	2e6e875	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Release proposal updated through main commit e0de9ee32395b55ba0dd302a67e2c720db022aa3.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 714f301.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 64bb3607067f0530b06c3be4b687d4d0bfd8dc9a.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head b242a14.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 025fd5be3ed56b1ddb6582662738b7d84029384a.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head c31571a.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit bbc3c7a79168bca9a207ef1f24833da439529977.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 724f444.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 5012030c85b483a7efa6f084607943596e2d40c2.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 60e098d.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 3541d6ba18822c0cee45963de1d14f21495677c9.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head dca0562.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 6df392cf0261945a89244b3725541ed1b947a229.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 250fc0d.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit f706261c6cd2e01d62f38a7adbf20f906383edac.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 904b934.

[github-actions]

Release proposal updated through main commit fbfba97201ba051e7e06749a16d04b76bf1b381e.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 5e3f63a.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 34d0e634ea0d5a2e2d2b740b3634e74e55ba2fab.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head f9ce016.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 770d369c127e2426f454ea01941e52c48793ac25.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 4989fc3.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit fce296540c5e337b8f8e9446de067428794a5c6a.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 48157e6.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit bf9853020059a51e704808543b88d0da05697074.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)
• discover Python for targets when launched from filesystem root (#2569)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 0924c77.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit d2bbdbac95ac5a06de9f66dd68009803fe183042.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)
• discover Python for targets when launched from filesystem root (#2569)
• update the Linear SDK to 101.0.0 (#2563)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 61b9065.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit d4175bc3b5356ffc29d7de4d549a043604eea35e.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)
• discover Python for targets when launched from filesystem root (#2569)
• update the Linear SDK to 101.0.0 (#2563)
• read deep sealed artifacts under Linux descriptor limits (#2570)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head fc4e122.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit 1579aeb514be943df6c1d08e2611b0994f5ca127.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)
• discover Python for targets when launched from filesystem root (#2569)
• update the Linear SDK to 101.0.0 (#2563)
• read deep sealed artifacts under Linux descriptor limits (#2570)
• update semver to 7.8.6 across SDK and tooling (#2562)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head c95e7ba.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit ea9114512ebe9744ec7e991271fc3347f38f68bf.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)
• discover Python for targets when launched from filesystem root (#2569)
• update the Linear SDK to 101.0.0 (#2563)
• read deep sealed artifacts under Linux descriptor limits (#2570)
• update semver to 7.8.6 across SDK and tooling (#2562)
• update install-action to v2.90.0 (#2561)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 0f6b0d4.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.

[github-actions]

Release proposal updated through main commit ba6702440e7c1e3e819c8d552376b36ded56d564.

The note sections still match the generated draft and were refreshed.

These suggestions use merged titles, not a review of migration requirements. The committed notes remain authoritative.

Highlights

Changes to review for highlights

• resolve home-relative project config paths on POSIX (#2505)
• preserve literal paths when loading scan policy (#2510)
• select a SQLite-capable Node runtime on Linux (#2499)
• prevent stale SDK archives on long Windows paths (#2511)
• follow directory links in selected project config paths (#2514)
• report filesystem module failures during output validation (#2516)
• build the bundled plugin in long Windows checkouts (#2508)
• preserve Linux install path case in update notices (#2521)
• resume Deep Scans interrupted before their first artifact (#2515)
• create scan output for long POSIX repository names (#2527)
• retry rolled-back plugin cache activation (#2528)
• correct compressed session prerequisites (#2546)
• save artifacts with long POSIX filenames (#2533)
• explain the Alpine tar prerequisite in release checks (#2536)
• archive long POSIX output directory names (#2529)
• identify replaced checkout parent directories (#2537)
• register nested Windows scans with long Git metadata paths (#2534)
• preserve closed helper stdin under BusyBox ash (#2540)
• preserve Continuum import retries and active sign-in credentials (#2531)
• shorten the npm package README (#2542)
• find system Python for Linux accounts without a home (#2509)
• allow more time for npm package availability (#2532)
• use the singular for one review round in Deep Scan stop reasons (#2443)
• skip DOCX content control placeholder text (#2490)
• publish new patch files on musl without hard links (#2530)
• preserve Windows checkout identity across Python versions (#2541)
• register local marketplaces in Codex homes containing a hash (#2547)
• preserve whitespace in POSIX state directory overrides (#2548)
• record the Wolfi Canvas 1.1.0 source and Skia notice (#2549)
• preserve trailing whitespace in POSIX scan roots (#2552)
• honor literal POSIX executable override paths (#2551)
• preserve explicit usage database paths (#2556)
• grant scan workers explicit source read access (#2545)
• verify assumed-unchanged files for committed diffs (#2554)
• resolve temporary paths before patching a saved checkout (#2558)
• stage knowledge in the selected temporary directory (#2559)
• isolate Git pathspec modes for file inventories (#2565)
• read sealed artifacts in searchable Linux directories (#2564)
• pin Git metadata on another Windows fixed drive (#2539)
• preserve long Git metadata in reviewed patch replay (#2543)
• reuse verified generated plugin cache content (#2538)
• use UTF-8 for workbench responses and diagnostics (#2566)
• report local failures from mock scans (#2567)
• stage validated plugin ZIPs for scan workers (#2507)
• tolerate executable metadata changes on first launch (#2555)
• discover Python for targets when launched from filesystem root (#2569)
• update the Linear SDK to 101.0.0 (#2563)
• read deep sealed artifacts under Linux descriptor limits (#2570)
• update semver to 7.8.6 across SDK and tooling (#2562)
• update install-action to v2.90.0 (#2561)
• isolate Git display settings in content snapshots (#2568)

Upgrade notes

No additional migration steps are documented for this release.

@codex review the current head 2e6e875.

[chatgpt-codex-connector]

Note

To use Codex here, create a Codex account and connect to github.