release: bump Codex Security to 0.1.25

[mldangelo-oai]

Summary

Prepare @openai/codex-security 0.1.25 with reviewed release notes for the changes merged since 0.1.24.

Changes

• Bump sdk/typescript/package.json from 0.1.24 to 0.1.25. The pnpm lockfile does not record the root package version and needs no change.
• Update .github/release-notes.md with Windows reliability fixes, PowerShell and UTF-16 source coverage, scoped inventory fixes, and container metadata improvements.
• Include the pnpm dependency-install step for source builds and versioned public documentation links.

This PR changes only release metadata and documentation. The behavior described in the notes is already on main; this PR adds no CLI or SDK surface.

Testing

All focused checks passed:

• git diff --check.
• Release automation validation: stable version, expected tag/manifest agreement, monotonic increase over current npm versions, and a matching release-note marker.
• Verified both versioned documentation links against the source files and section anchors included in this release.
• Prettier 3.2.5: prettier --check .github/release-notes.md sdk/typescript/package.json.
• Bun 1.3.14, from sdk/typescript: bun test --timeout 30000 ./tests-ts/release-automation.test.ts ./tests-ts/release-cut-workflow.test.ts — 285 passed, 0 failed (seed 3721355575).

Full SDK, plugin, and package suites were not run locally for this metadata and documentation change. Required hosted CI remains a merge gate.

Risk and rollout

Merging this bump starts the existing npm release process only after node-ci succeeds for the exact merged commit. Publication uses the protected npm environment. Preparing this PR does not create a release tag or publish a package, GitHub release, or container image.

Before merging, confirm that 0.1.25 remains unpublished, the notes match the final changes since npm-v0.1.24, and required CI and review pass on the current head. Container publication remains separate from npm publication, and existing stable container tags are not updated in place.

Public disclosure review

The branch name, title, description, commit, complete two-file diff, review request, and documentation links contain only public, generic technical details. No logs, screenshots, or attachments are included.

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

Please review the release bump and notes at c6616be.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-30T06:35:43.597860Z	c6616be	Manual request
🔒 Security Review	✅ Completed 2026-08-30T06:35:57.325056Z	c6616be	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: c6616be91d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".