chore(deps): add cooldowns and unify Codex dependencies

.github/dependabot.yml

@@ -0,0 +1,63 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directories:
+      - /sdk/typescript
+      - /plugins/codex-security/mcp-app
+      - /plugins/codex-security/skills/triage-finding/evals
+    schedule:
+      interval: cron
+      cronjob: "0 9 * * *"
+    cooldown:
+      default-days: 7
+      exclude:
+        - openai
+        - "@openai/*"
+    groups:
+      codex:
+        patterns:
+          - "@openai/codex"
+          - "@openai/codex-sdk"
+      codex-security:
+        applies-to: security-updates
+        patterns:
+          - "@openai/codex"
+          - "@openai/codex-sdk"
+      openai:
+        patterns:
+          - openai
+          - "@openai/*"
+      third-party:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    commit-message:
+      prefix: chore
+      include: scope
+
+  - package-ecosystem: pip
+    directory: /plugins/codex-security
+    schedule:
+      interval: cron
+      cronjob: "0 9 * * *"
+    cooldown:
+      default-days: 7
+      exclude:
+        - openai
+    commit-message:
+      prefix: chore
+      include: scope
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: cron
+      cronjob: "0 9 * * *"
+    cooldown:
+      default-days: 7
+      exclude:
+        - "openai/*"
+    commit-message:
+      prefix: ci

RELEASING.md

@@ -41,6 +41,25 @@ Use `release` and `test` only for changes that do not affect package users. A
 maintainer can apply `skip-release-notes` to exclude another internal change.
 That manual label takes precedence over the title category.
 
+## Dependency updates
+
+Dependabot checks npm packages, Python test dependencies, and GitHub Actions
+daily, including weekends. OpenAI dependencies have no release cooldown; other
+releases must be at least seven days old. Security updates do not wait for the
+version-update cooldown.
+Updates still require review and passing CI; nothing is merged automatically.
+
+Keep `@openai/codex` and `@openai/codex-sdk` on the same exact version across the
+TypeScript SDK, MCP app, and triage evals. Dependabot groups their updates across
+all three projects, and the SDK tests reject mismatched pins or multiple locked
+SDK versions. The evals override Promptfoo's transitive Codex SDK to the direct
+SDK dependency so it follows the same update.
+
+Each pnpm project applies the same seven-day age policy to newly resolved
+dependencies, including transitive packages, with `openai` and `@openai/*` exempt.
+Committed lockfiles remain installable. The existing Socket release checks remain
+in place.
+
 ## Prepare a release
 
 1. Choose the next stable version and update `sdk/typescript/package.json`.

plugins/codex-security/mcp-app/package.json

@@ -12,7 +12,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@openai/codex-sdk": "0.149.1",
+    "@openai/codex-sdk": "0.151.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {

plugins/codex-security/mcp-app/pnpm-workspace.yaml

@@ -1,2 +1,8 @@
+minimumReleaseAge: 10080
+minimumReleaseAgeExclude:
+  - openai
+  - "@openai/*"
+trustLockfile: true
+
 allowBuilds:
   esbuild: false

plugins/codex-security/skills/triage-finding/evals/pnpm-workspace.yaml

@@ -1,9 +1,13 @@
 packages:
   - .
 minimumReleaseAge: 10080
+minimumReleaseAgeExclude:
+  - openai
+  - "@openai/*"
 trustLockfile: true
 
 overrides:
+  "@openai/codex-sdk": "$@openai/codex-sdk"
   "@opencode-ai/sdk": 1.14.33
 
 onlyBuiltDependencies:

sdk/typescript/package.json

@@ -65,8 +65,8 @@
     "@inquirer/prompts": "8.3.0",
     "@linear/sdk": "89.0.0",
     "@octokit/core": "7.0.6",
-    "@openai/codex": "0.149.1",
-    "@openai/codex-sdk": "0.149.1",
+    "@openai/codex": "0.151.0",
+    "@openai/codex-sdk": "0.151.0",
     "ajv": "8.20.0",
     "extract-zip": "2.0.1",
     "fast-uri": "3.1.5",