chore(deps): align Codex 0.151.0 and dependency cooldowns

[mldangelo-oai]

Summary

Update the Codex CLI and SDK to 0.151.0 across the shipping TypeScript SDK, MCP app, and triage evaluation harness. This PR also includes the dependency-update policy from #757, which was merged into this branch.

Reconcile the branch with current main and fix the duplicate minimumReleaseAge key that prevented pnpm from installing MCP app dependencies in CI and container builds.

Changes

• Pin Codex to 0.151.0 in all three projects and keep Promptfoo's transitive Codex SDK aligned with the eval harness's direct dependency.
• Preserve unrelated dependency resolutions, including Promptfoo and the OpenCode SDK, and retain the existing cross-project Codex version regression check.
• Include daily Dependabot checks for npm, Python, and GitHub Actions, with grouped Codex updates, no release cooldown for OpenAI packages, and a seven-day cooldown for other version updates.
• Apply the matching pnpm release-age policy without changing committed-lockfile installability or build-script permissions.
• Merge main without rewriting branch history, retain the centralized pnpm 11.19.0 toolchain, and remove the duplicate MCP workspace setting from the merged configuration.

Testing

• Reproduced the original duplicated mapping key (9:1) failure with the merged branch before the fix.
• All 11 deterministic triage and SastBench harness scripts: passed.
• Required plugin Ruff lint, Ruff formatting, and portable source compatibility checks: passed with Ruff 0.16.1.
• Plugin source boundary check and git diff --check: passed.
• Compared all three lockfiles with main: exactly one Codex 0.151.0 package set in each; unrelated dependency graphs are unchanged.
• Frozen installs for the SDK, MCP app, and eval harness: passed with pnpm 11.19.0.
• SDK and MCP typechecks, SDK formatting, and all 14 SDK skeleton tests: passed.
• All nine portable-source checker regression tests: passed with unrelated global pytest plugins disabled.
• Promptfoo configuration validation and provider initialization: passed; the provider loads Codex SDK 0.151.0 and selects CLI 0.151.0 without model calls.
• Built the bundled plugin, packed the npm package, and validated all 390 archive entries: passed. Full multi-platform test and installed-package coverage is provided by the attached CI runs.

Risk and rollout

This is no longer an eval-only update: shipping SDK and MCP runtime dependencies move from Codex 0.149.1 to 0.151.0, and Promptfoo uses the shared SDK version. Product version numbers and public CLI arguments/defaults are unchanged.

The dependency policy retains normal review and CI requirements and does not enable auto-merge or change Socket checks. No additional dependency-age exception was introduced for this repair.

No model-backed evaluations were run, so these checks do not establish benchmark score equivalence. This PR does not publish packages or containers.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T13:56:15.673919Z	ff19f56	Manual request
🔒 Security Review	✅ Completed 2026-09-01T13:58:04.412561Z	ff19f56	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review

Please review the current head 1d1debf2b72d1180012f41d0e5f2c80b522758e9.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 1d1debf2b7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review

Please review the current head 9d9349c0a2fd25865dbc9944e597337d7c8f29d7.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 9d9349c0a2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

@codex review

Please review the current head ff19f56eee2790aa4ff726fc33e89289482264ba, including the dependency-policy changes already merged from #757 and their reconciliation with main. The merged configuration now has a single MCP workspace minimumReleaseAge setting.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: ff19f56eee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".