diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..7c91c7bda --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,63 @@ +version: 2 +updates: + - package-ecosystem: npm + directories: + - /sdk/typescript + - /plugins/codex-security/mcp-app + - /plugins/codex-security/skills/triage-finding/evals + schedule: + interval: cron + cronjob: "0 9 * * *" + cooldown: + default-days: 7 + exclude: + - openai + - "@openai/*" + groups: + codex: + patterns: + - "@openai/codex" + - "@openai/codex-sdk" + codex-security: + applies-to: security-updates + patterns: + - "@openai/codex" + - "@openai/codex-sdk" + openai: + patterns: + - openai + - "@openai/*" + third-party: + patterns: + - "*" + update-types: + - minor + - patch + commit-message: + prefix: chore + include: scope + + - package-ecosystem: pip + directory: /plugins/codex-security + schedule: + interval: cron + cronjob: "0 9 * * *" + cooldown: + default-days: 7 + exclude: + - openai + commit-message: + prefix: chore + include: scope + + - package-ecosystem: github-actions + directory: / + schedule: + interval: cron + cronjob: "0 9 * * *" + cooldown: + default-days: 7 + exclude: + - "openai/*" + commit-message: + prefix: ci diff --git a/RELEASING.md b/RELEASING.md index 64a6d82d2..42bdd50d1 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -41,6 +41,25 @@ Use `release` and `test` only for changes that do not affect package users. A maintainer can apply `skip-release-notes` to exclude another internal change. That manual label takes precedence over the title category. +## Dependency updates + +Dependabot checks npm packages, Python test dependencies, and GitHub Actions +daily, including weekends. OpenAI dependencies have no release cooldown; other +releases must be at least seven days old. Security updates do not wait for the +version-update cooldown. +Updates still require review and passing CI; nothing is merged automatically. + +Keep `@openai/codex` and `@openai/codex-sdk` on the same exact version across the +TypeScript SDK, MCP app, and triage evals. Dependabot groups their updates across +all three projects, and the SDK tests reject mismatched pins or multiple locked +SDK versions. The evals override Promptfoo's transitive Codex SDK to the direct +SDK dependency so it follows the same update. + +Each pnpm project applies the same seven-day age policy to newly resolved +dependencies, including transitive packages, with `openai` and `@openai/*` exempt. +Committed lockfiles remain installable. The existing Socket release checks remain +in place. + ## Prepare a release 1. Choose the next stable version and update `sdk/typescript/package.json`. diff --git a/plugins/codex-security/mcp-app/package.json b/plugins/codex-security/mcp-app/package.json index c8b6b11b1..9ffcefac7 100644 --- a/plugins/codex-security/mcp-app/package.json +++ b/plugins/codex-security/mcp-app/package.json @@ -12,7 +12,7 @@ }, "dependencies": { "@modelcontextprotocol/sdk": "^1.29.0", - "@openai/codex-sdk": "0.149.1", + "@openai/codex-sdk": "0.151.0", "zod": "^4.3.6" }, "devDependencies": { diff --git a/plugins/codex-security/mcp-app/pnpm-lock.yaml b/plugins/codex-security/mcp-app/pnpm-lock.yaml index 98246750f..954b3782e 100644 --- a/plugins/codex-security/mcp-app/pnpm-lock.yaml +++ b/plugins/codex-security/mcp-app/pnpm-lock.yaml @@ -12,8 +12,8 @@ importers: specifier: ^1.29.0 version: 1.29.0(zod@4.4.3) '@openai/codex-sdk': - specifier: 0.149.1 - version: 0.149.1 + specifier: 0.151.0 + version: 0.151.0 zod: specifier: ^4.3.6 version: 4.4.3 @@ -202,47 +202,47 @@ packages: '@cfworker/json-schema': optional: true - '@openai/codex-sdk@0.149.1': - resolution: {integrity: sha512-R00Rz5327LefZggAxl28r7vFQq1vxa91OxtjZJOsQfAM/MyH8InW5qwwRu6pzUmRGp1E29XrOzm7u1TeV5Yz2A==} + '@openai/codex-sdk@0.151.0': + resolution: {integrity: sha512-vI4gr5ipvVwH4YHW9DGUmaUI1hJzJOCO/0d5NYFnAECsQGEvBmuTocPzRP8yGzLtsYklMnrtGtm2TyBicihVxw==} engines: {node: '>=18'} - '@openai/codex@0.149.1': - resolution: {integrity: sha512-6q5pbcpFbJbqOpkubSDBwXmktQ55aD8eUzGzBF1zASob2DjwhBKDSNGtdZKalfrNJUdTDTPDMmzCXEXs5tMBYA==} + '@openai/codex@0.151.0': + resolution: {integrity: sha512-mhtWmOZRdmWD1jPbLDnQb59BsaVP/V+lXe/OFNR9ZcLZU0UCiBwn98Fcav1ss7sDIlHkuqj6nWd44IPeXoOhJA==} engines: {node: '>=16'} hasBin: true - '@openai/codex@0.149.1-darwin-arm64': - resolution: {integrity: sha512-6X84kTCbnTgPIJ2EdcPsrvwS0Wxsqpa+bCswGmRf4BjhcQ5nPMnBC6yCAaCMj+vrbXQHj+L6sa9FaR4QkmA1qw==} + '@openai/codex@0.151.0-darwin-arm64': + resolution: {integrity: sha512-g7YzpaCZGCw19R/gly3vRPjnLqaW7JcBAu2WQQ6e8PIlvBPmS/gMplIUURMgNO6gi8LsPzdlQtLqkwoeOOlIdg==} engines: {node: '>=16'} cpu: [arm64] os: [darwin] - '@openai/codex@0.149.1-darwin-x64': - resolution: {integrity: sha512-MfLBQLfcElJL9tvj6y45qVHHMGSXCPnQOixuD3/Zq0g1BW/eFizkrGLdn48cFpc+l8cK+gt5nYG5pQYwVs6g4A==} + '@openai/codex@0.151.0-darwin-x64': + resolution: {integrity: sha512-0y+g8TVpP+Fn10mjoKYXER6qYjn29w7xBUsbPXJ6Accu/FoM4Qp4WbKXQPmE0G0yUACTQVZRjzTSsdWUezNgkg==} engines: {node: '>=16'} cpu: [x64] os: [darwin] - '@openai/codex@0.149.1-linux-arm64': - resolution: {integrity: sha512-OqxUfZ1TVvHd18zHPKK/8ZRlpk8Vy11mg5CMHaLxNWldTbwVImDKtSLWT+m8m4NM5Sz4PbjtZMrVT/RfpBW/mQ==} + '@openai/codex@0.151.0-linux-arm64': + resolution: {integrity: sha512-CsLgFeX4TQ6I2Gdrxd2r5UbgIbDLCdtcLAlnMYjr06bCL057MTNGec7Ewb3+Z2DBiMuXCljdTBGqLOePkMV0sQ==} engines: {node: '>=16'} cpu: [arm64] os: [linux] - '@openai/codex@0.149.1-linux-x64': - resolution: {integrity: sha512-Of5fGYgr7tAMsyj6vhXb4/RM/UoA3Zq8BLegUBDC09UNy1XTLGYP/2XD+UX8z3qh0NDwxYdCjFIWdDNijKZggQ==} + '@openai/codex@0.151.0-linux-x64': + resolution: {integrity: sha512-xcVyY1FtwvVYhh2JBmz8fX8CQqFAxO/lxJ2IXsh8x5uwxZVHVl5fZHFHf8JdRaOGG0vpkYmu/DKKVoLd56/DDQ==} engines: {node: '>=16'} cpu: [x64] os: [linux] - '@openai/codex@0.149.1-win32-arm64': - resolution: {integrity: sha512-5K0DmOKGK9Bos627p8sK8ATHjovPK0sDyT6h9Cb+4v+5CW5SGw1HLgjGxoLfJ8g3cg6mtg/pRCXXo2L/j71UVA==} + '@openai/codex@0.151.0-win32-arm64': + resolution: {integrity: sha512-zDWzOoh9wHm+Om1Nhn7os47rAVeSGPh0SnM3YOttdq6iPJz2zn4vBnbGUZjeih1qW/3mvNF3Oyd4owlaHmphmg==} engines: {node: '>=16'} cpu: [arm64] os: [win32] - '@openai/codex@0.149.1-win32-x64': - resolution: {integrity: sha512-G3QXGAg7nyyhqOeooAMUekBCeHd8a1QByhKcVAFyzNBaI06t6Ft7nsF+1SzFS0spuIdU4YyMi5YD26ukADBQUQ==} + '@openai/codex@0.151.0-win32-x64': + resolution: {integrity: sha512-sLT7xvID3jhU6tkzcwRPnMEclKRwUPbpo0mtfxIF9KpdZH3VJV7sM2/kXWXyvUM7Zt/YeyOaeATTEysbRz8Yog==} engines: {node: '>=16'} cpu: [x64] os: [win32] @@ -723,35 +723,35 @@ snapshots: transitivePeerDependencies: - supports-color - '@openai/codex-sdk@0.149.1': + '@openai/codex-sdk@0.151.0': dependencies: - '@openai/codex': 0.149.1 + '@openai/codex': 0.151.0 - '@openai/codex@0.149.1': + '@openai/codex@0.151.0': optionalDependencies: - '@openai/codex-darwin-arm64': '@openai/codex@0.149.1-darwin-arm64' - '@openai/codex-darwin-x64': '@openai/codex@0.149.1-darwin-x64' - '@openai/codex-linux-arm64': '@openai/codex@0.149.1-linux-arm64' - '@openai/codex-linux-x64': '@openai/codex@0.149.1-linux-x64' - '@openai/codex-win32-arm64': '@openai/codex@0.149.1-win32-arm64' - '@openai/codex-win32-x64': '@openai/codex@0.149.1-win32-x64' - - '@openai/codex@0.149.1-darwin-arm64': + '@openai/codex-darwin-arm64': '@openai/codex@0.151.0-darwin-arm64' + '@openai/codex-darwin-x64': '@openai/codex@0.151.0-darwin-x64' + '@openai/codex-linux-arm64': '@openai/codex@0.151.0-linux-arm64' + '@openai/codex-linux-x64': '@openai/codex@0.151.0-linux-x64' + '@openai/codex-win32-arm64': '@openai/codex@0.151.0-win32-arm64' + '@openai/codex-win32-x64': '@openai/codex@0.151.0-win32-x64' + + '@openai/codex@0.151.0-darwin-arm64': optional: true - '@openai/codex@0.149.1-darwin-x64': + '@openai/codex@0.151.0-darwin-x64': optional: true - '@openai/codex@0.149.1-linux-arm64': + '@openai/codex@0.151.0-linux-arm64': optional: true - '@openai/codex@0.149.1-linux-x64': + '@openai/codex@0.151.0-linux-x64': optional: true - '@openai/codex@0.149.1-win32-arm64': + '@openai/codex@0.151.0-win32-arm64': optional: true - '@openai/codex@0.149.1-win32-x64': + '@openai/codex@0.151.0-win32-x64': optional: true '@types/node@25.9.1': diff --git a/plugins/codex-security/mcp-app/pnpm-workspace.yaml b/plugins/codex-security/mcp-app/pnpm-workspace.yaml index 49c0ad742..858ac9cb4 100644 --- a/plugins/codex-security/mcp-app/pnpm-workspace.yaml +++ b/plugins/codex-security/mcp-app/pnpm-workspace.yaml @@ -1,2 +1,8 @@ +minimumReleaseAge: 10080 +minimumReleaseAgeExclude: + - openai + - "@openai/*" +trustLockfile: true + allowBuilds: esbuild: false diff --git a/plugins/codex-security/skills/triage-finding/evals/pnpm-lock.yaml b/plugins/codex-security/skills/triage-finding/evals/pnpm-lock.yaml index ddd0254ce..ddfca3b19 100644 --- a/plugins/codex-security/skills/triage-finding/evals/pnpm-lock.yaml +++ b/plugins/codex-security/skills/triage-finding/evals/pnpm-lock.yaml @@ -5,6 +5,7 @@ settings: excludeLinksFromLockfile: false overrides: + '@openai/codex-sdk': 0.151.0 '@opencode-ai/sdk': 1.14.33 importers: @@ -986,55 +987,10 @@ packages: peerDependencies: zod: ^4.0.0 - '@openai/codex-sdk@0.130.0': - resolution: {integrity: sha512-ICKaZ5zrIDg71AiQcsUToVoe5Icmrc3LwSM5+2z7Cf8F1x6nOaY7/ucpFlr4aH8oDe7t3dangc+MsWZTkdvDFw==} - engines: {node: '>=18'} - '@openai/codex-sdk@0.151.0': resolution: {integrity: sha512-vI4gr5ipvVwH4YHW9DGUmaUI1hJzJOCO/0d5NYFnAECsQGEvBmuTocPzRP8yGzLtsYklMnrtGtm2TyBicihVxw==} engines: {node: '>=18'} - '@openai/codex@0.130.0': - resolution: {integrity: sha512-WGDj+RZ3TXWC/7MlwprgLWOqzpwatPIINPhP3IRzHA0ni+o3QZ4i4xrS2uWwGmHUJ395J5JHwoZAAZYyfJyz6w==} - engines: {node: '>=16'} - hasBin: true - - '@openai/codex@0.130.0-darwin-arm64': - resolution: {integrity: sha512-R9pkGC7kwC8yQ8el5hvBlmugQlcsG/pHMEFgZluu03X9fD2TezGxdq3KqRDRCZuMYl07ILamVEoqknuJ0cq7MA==} - engines: {node: '>=16'} - cpu: [arm64] - os: [darwin] - - '@openai/codex@0.130.0-darwin-x64': - resolution: {integrity: sha512-gJ+7J8djevgtdra+NgDAiQQPW+O3KTsgGfE3E5dpDfww3zS5OCeV0V2dhxqnJdlOjOSDw99o0P2LqBv19mhpRw==} - engines: {node: '>=16'} - cpu: [x64] - os: [darwin] - - '@openai/codex@0.130.0-linux-arm64': - resolution: {integrity: sha512-tFtH0V9/hEI3d9y7zP92BXI9FM4Z3+STNQaOR52Czv18TRtCFUp7CbIUYaToopuq6UBfnE1VKr8RLhwT5FcbmA==} - engines: {node: '>=16'} - cpu: [arm64] - os: [linux] - - '@openai/codex@0.130.0-linux-x64': - resolution: {integrity: sha512-3VcNlez99xdnEf+kB1IOpWv9fICYV9PiGj4sLCO4TCcShLnyxe+YBGa3poknkvXLnMG0qiN9SMnYS2FGrMxQcA==} - engines: {node: '>=16'} - cpu: [x64] - os: [linux] - - '@openai/codex@0.130.0-win32-arm64': - resolution: {integrity: sha512-vdpmiNp57L/arZabltLXn8TyEtNa7W1meOEkr+3R6W/8ZyBt++wuqz1Orv134OT2grrcFJsIVCAIPiqUxCvBkA==} - engines: {node: '>=16'} - cpu: [arm64] - os: [win32] - - '@openai/codex@0.130.0-win32-x64': - resolution: {integrity: sha512-FzMznm7fr5/nbjZgOujZ9Y9AbdGm7ji1FOoWiY3U+srqauvZaTgn6o6aCheSL7kuymu7nTLOO/cAyWV6NuesqQ==} - engines: {node: '>=16'} - cpu: [x64] - os: [win32] - '@openai/codex@0.151.0': resolution: {integrity: sha512-mhtWmOZRdmWD1jPbLDnQb59BsaVP/V+lXe/OFNR9ZcLZU0UCiBwn98Fcav1ss7sDIlHkuqj6nWd44IPeXoOhJA==} engines: {node: '>=16'} @@ -4758,43 +4714,10 @@ snapshots: - ws optional: true - '@openai/codex-sdk@0.130.0': - dependencies: - '@openai/codex': 0.130.0 - optional: true - '@openai/codex-sdk@0.151.0': dependencies: '@openai/codex': 0.151.0 - '@openai/codex@0.130.0': - optionalDependencies: - '@openai/codex-darwin-arm64': '@openai/codex@0.130.0-darwin-arm64' - '@openai/codex-darwin-x64': '@openai/codex@0.130.0-darwin-x64' - '@openai/codex-linux-arm64': '@openai/codex@0.130.0-linux-arm64' - '@openai/codex-linux-x64': '@openai/codex@0.130.0-linux-x64' - '@openai/codex-win32-arm64': '@openai/codex@0.130.0-win32-arm64' - '@openai/codex-win32-x64': '@openai/codex@0.130.0-win32-x64' - optional: true - - '@openai/codex@0.130.0-darwin-arm64': - optional: true - - '@openai/codex@0.130.0-darwin-x64': - optional: true - - '@openai/codex@0.130.0-linux-arm64': - optional: true - - '@openai/codex@0.130.0-linux-x64': - optional: true - - '@openai/codex@0.130.0-win32-arm64': - optional: true - - '@openai/codex@0.130.0-win32-x64': - optional: true - '@openai/codex@0.151.0': optionalDependencies: '@openai/codex-darwin-arm64': '@openai/codex@0.151.0-darwin-arm64' @@ -6980,7 +6903,7 @@ snapshots: '@ibm-generative-ai/node-sdk': 3.2.4 '@modelcontextprotocol/sdk': 1.29.0(zod@4.4.3) '@openai/agents': 0.11.6(ws@8.21.0)(zod@4.4.3) - '@openai/codex-sdk': 0.130.0 + '@openai/codex-sdk': 0.151.0 '@opencode-ai/sdk': 1.14.33 '@playwright/browser-chromium': 1.60.0 '@rollup/rollup-linux-x64-gnu': 4.60.4 diff --git a/plugins/codex-security/skills/triage-finding/evals/pnpm-workspace.yaml b/plugins/codex-security/skills/triage-finding/evals/pnpm-workspace.yaml index 81ff6379d..e6156d156 100644 --- a/plugins/codex-security/skills/triage-finding/evals/pnpm-workspace.yaml +++ b/plugins/codex-security/skills/triage-finding/evals/pnpm-workspace.yaml @@ -1,9 +1,13 @@ packages: - . minimumReleaseAge: 10080 +minimumReleaseAgeExclude: + - openai + - "@openai/*" trustLockfile: true overrides: + "@openai/codex-sdk": "$@openai/codex-sdk" "@opencode-ai/sdk": 1.14.33 onlyBuiltDependencies: diff --git a/sdk/typescript/package.json b/sdk/typescript/package.json index fa937b0c9..fd4cfbb4e 100644 --- a/sdk/typescript/package.json +++ b/sdk/typescript/package.json @@ -65,8 +65,8 @@ "@inquirer/prompts": "8.3.0", "@linear/sdk": "89.0.0", "@octokit/core": "7.0.6", - "@openai/codex": "0.149.1", - "@openai/codex-sdk": "0.149.1", + "@openai/codex": "0.151.0", + "@openai/codex-sdk": "0.151.0", "ajv": "8.20.0", "extract-zip": "2.0.1", "fast-uri": "3.1.5", diff --git a/sdk/typescript/pnpm-lock.yaml b/sdk/typescript/pnpm-lock.yaml index eed94b772..5cc5e560c 100644 --- a/sdk/typescript/pnpm-lock.yaml +++ b/sdk/typescript/pnpm-lock.yaml @@ -18,11 +18,11 @@ importers: specifier: 7.0.6 version: 7.0.6 '@openai/codex': - specifier: 0.149.1 - version: 0.149.1 + specifier: 0.151.0 + version: 0.151.0 '@openai/codex-sdk': - specifier: 0.149.1 - version: 0.149.1 + specifier: 0.151.0 + version: 0.151.0 ajv: specifier: 8.20.0 version: 8.20.0 @@ -741,47 +741,47 @@ packages: react: ^18.0.0 || ^19.0.0 tailwindcss: ^4.0.10 - '@openai/codex-sdk@0.149.1': - resolution: {integrity: sha512-R00Rz5327LefZggAxl28r7vFQq1vxa91OxtjZJOsQfAM/MyH8InW5qwwRu6pzUmRGp1E29XrOzm7u1TeV5Yz2A==} + '@openai/codex-sdk@0.151.0': + resolution: {integrity: sha512-vI4gr5ipvVwH4YHW9DGUmaUI1hJzJOCO/0d5NYFnAECsQGEvBmuTocPzRP8yGzLtsYklMnrtGtm2TyBicihVxw==} engines: {node: '>=18'} - '@openai/codex@0.149.1': - resolution: {integrity: sha512-6q5pbcpFbJbqOpkubSDBwXmktQ55aD8eUzGzBF1zASob2DjwhBKDSNGtdZKalfrNJUdTDTPDMmzCXEXs5tMBYA==} + '@openai/codex@0.151.0': + resolution: {integrity: sha512-mhtWmOZRdmWD1jPbLDnQb59BsaVP/V+lXe/OFNR9ZcLZU0UCiBwn98Fcav1ss7sDIlHkuqj6nWd44IPeXoOhJA==} engines: {node: '>=16'} hasBin: true - '@openai/codex@0.149.1-darwin-arm64': - resolution: {integrity: sha512-6X84kTCbnTgPIJ2EdcPsrvwS0Wxsqpa+bCswGmRf4BjhcQ5nPMnBC6yCAaCMj+vrbXQHj+L6sa9FaR4QkmA1qw==} + '@openai/codex@0.151.0-darwin-arm64': + resolution: {integrity: sha512-g7YzpaCZGCw19R/gly3vRPjnLqaW7JcBAu2WQQ6e8PIlvBPmS/gMplIUURMgNO6gi8LsPzdlQtLqkwoeOOlIdg==} engines: {node: '>=16'} cpu: [arm64] os: [darwin] - '@openai/codex@0.149.1-darwin-x64': - resolution: {integrity: sha512-MfLBQLfcElJL9tvj6y45qVHHMGSXCPnQOixuD3/Zq0g1BW/eFizkrGLdn48cFpc+l8cK+gt5nYG5pQYwVs6g4A==} + '@openai/codex@0.151.0-darwin-x64': + resolution: {integrity: sha512-0y+g8TVpP+Fn10mjoKYXER6qYjn29w7xBUsbPXJ6Accu/FoM4Qp4WbKXQPmE0G0yUACTQVZRjzTSsdWUezNgkg==} engines: {node: '>=16'} cpu: [x64] os: [darwin] - '@openai/codex@0.149.1-linux-arm64': - resolution: {integrity: sha512-OqxUfZ1TVvHd18zHPKK/8ZRlpk8Vy11mg5CMHaLxNWldTbwVImDKtSLWT+m8m4NM5Sz4PbjtZMrVT/RfpBW/mQ==} + '@openai/codex@0.151.0-linux-arm64': + resolution: {integrity: sha512-CsLgFeX4TQ6I2Gdrxd2r5UbgIbDLCdtcLAlnMYjr06bCL057MTNGec7Ewb3+Z2DBiMuXCljdTBGqLOePkMV0sQ==} engines: {node: '>=16'} cpu: [arm64] os: [linux] - '@openai/codex@0.149.1-linux-x64': - resolution: {integrity: sha512-Of5fGYgr7tAMsyj6vhXb4/RM/UoA3Zq8BLegUBDC09UNy1XTLGYP/2XD+UX8z3qh0NDwxYdCjFIWdDNijKZggQ==} + '@openai/codex@0.151.0-linux-x64': + resolution: {integrity: sha512-xcVyY1FtwvVYhh2JBmz8fX8CQqFAxO/lxJ2IXsh8x5uwxZVHVl5fZHFHf8JdRaOGG0vpkYmu/DKKVoLd56/DDQ==} engines: {node: '>=16'} cpu: [x64] os: [linux] - '@openai/codex@0.149.1-win32-arm64': - resolution: {integrity: sha512-5K0DmOKGK9Bos627p8sK8ATHjovPK0sDyT6h9Cb+4v+5CW5SGw1HLgjGxoLfJ8g3cg6mtg/pRCXXo2L/j71UVA==} + '@openai/codex@0.151.0-win32-arm64': + resolution: {integrity: sha512-zDWzOoh9wHm+Om1Nhn7os47rAVeSGPh0SnM3YOttdq6iPJz2zn4vBnbGUZjeih1qW/3mvNF3Oyd4owlaHmphmg==} engines: {node: '>=16'} cpu: [arm64] os: [win32] - '@openai/codex@0.149.1-win32-x64': - resolution: {integrity: sha512-G3QXGAg7nyyhqOeooAMUekBCeHd8a1QByhKcVAFyzNBaI06t6Ft7nsF+1SzFS0spuIdU4YyMi5YD26ukADBQUQ==} + '@openai/codex@0.151.0-win32-x64': + resolution: {integrity: sha512-sLT7xvID3jhU6tkzcwRPnMEclKRwUPbpo0mtfxIF9KpdZH3VJV7sM2/kXWXyvUM7Zt/YeyOaeATTEysbRz8Yog==} engines: {node: '>=16'} cpu: [x64] os: [win32] @@ -3573,35 +3573,35 @@ snapshots: - react-dom - supports-color - '@openai/codex-sdk@0.149.1': + '@openai/codex-sdk@0.151.0': dependencies: - '@openai/codex': 0.149.1 + '@openai/codex': 0.151.0 - '@openai/codex@0.149.1': + '@openai/codex@0.151.0': optionalDependencies: - '@openai/codex-darwin-arm64': '@openai/codex@0.149.1-darwin-arm64' - '@openai/codex-darwin-x64': '@openai/codex@0.149.1-darwin-x64' - '@openai/codex-linux-arm64': '@openai/codex@0.149.1-linux-arm64' - '@openai/codex-linux-x64': '@openai/codex@0.149.1-linux-x64' - '@openai/codex-win32-arm64': '@openai/codex@0.149.1-win32-arm64' - '@openai/codex-win32-x64': '@openai/codex@0.149.1-win32-x64' - - '@openai/codex@0.149.1-darwin-arm64': + '@openai/codex-darwin-arm64': '@openai/codex@0.151.0-darwin-arm64' + '@openai/codex-darwin-x64': '@openai/codex@0.151.0-darwin-x64' + '@openai/codex-linux-arm64': '@openai/codex@0.151.0-linux-arm64' + '@openai/codex-linux-x64': '@openai/codex@0.151.0-linux-x64' + '@openai/codex-win32-arm64': '@openai/codex@0.151.0-win32-arm64' + '@openai/codex-win32-x64': '@openai/codex@0.151.0-win32-x64' + + '@openai/codex@0.151.0-darwin-arm64': optional: true - '@openai/codex@0.149.1-darwin-x64': + '@openai/codex@0.151.0-darwin-x64': optional: true - '@openai/codex@0.149.1-linux-arm64': + '@openai/codex@0.151.0-linux-arm64': optional: true - '@openai/codex@0.149.1-linux-x64': + '@openai/codex@0.151.0-linux-x64': optional: true - '@openai/codex@0.149.1-win32-arm64': + '@openai/codex@0.151.0-win32-arm64': optional: true - '@openai/codex@0.149.1-win32-x64': + '@openai/codex@0.151.0-win32-x64': optional: true '@radix-ui/number@1.1.3': {} diff --git a/sdk/typescript/pnpm-workspace.yaml b/sdk/typescript/pnpm-workspace.yaml index 49c0ad742..858ac9cb4 100644 --- a/sdk/typescript/pnpm-workspace.yaml +++ b/sdk/typescript/pnpm-workspace.yaml @@ -1,2 +1,8 @@ +minimumReleaseAge: 10080 +minimumReleaseAgeExclude: + - openai + - "@openai/*" +trustLockfile: true + allowBuilds: esbuild: false diff --git a/sdk/typescript/tests-ts/skeleton.test.ts b/sdk/typescript/tests-ts/skeleton.test.ts index 5636217c8..f93b66ef5 100644 --- a/sdk/typescript/tests-ts/skeleton.test.ts +++ b/sdk/typescript/tests-ts/skeleton.test.ts @@ -58,6 +58,51 @@ function capture(): { } describe("TypeScript package skeleton", () => { + test("pins one Codex version across the CLI, MCP app, and evals", async () => { + const directories = [ + "sdk/typescript", + "plugins/codex-security/mcp-app", + "plugins/codex-security/skills/triage-finding/evals", + ]; + const manifests = await Promise.all( + directories.map(async (directory) => + JSON.parse( + await readFile( + new URL(`../../../${directory}/package.json`, import.meta.url), + "utf8", + ), + ), + ), + ); + const version = manifests[0].dependencies["@openai/codex"]; + expect(version).toBeTruthy(); + for (const [index, directory] of directories.entries()) { + expect(manifests[index].dependencies["@openai/codex-sdk"]).toBe(version); + const lockfile = Bun.YAML.parse( + await readFile( + new URL(`../../../${directory}/pnpm-lock.yaml`, import.meta.url), + "utf8", + ), + ) as { + packages: Record; + }; + expect( + Object.keys(lockfile.packages).filter((name) => + name.startsWith("@openai/codex-sdk@"), + ), + ).toEqual([`@openai/codex-sdk@${version}`]); + for (const [name, metadata] of Object.entries(lockfile.packages)) { + if (name.startsWith("@openai/codex@")) { + const platform = + metadata.os && metadata.cpu + ? `-${metadata.os[0]}-${metadata.cpu[0]}` + : ""; + expect(name).toBe(`@openai/codex@${version}${platform}`); + } + } + } + }); + test("exports typed attack-path aliases", () => { const dataflow: AttackPathDataflow = { transformations: ["decode archive entry"],