Skip to content

chore(deps): align Codex 0.151.0 and dependency cooldowns - #755

Open
mldangelo-oai wants to merge 4 commits into
mainfrom
mdangelo/codex/triage-sdk-0.151.0
Open

chore(deps): align Codex 0.151.0 and dependency cooldowns#755
mldangelo-oai wants to merge 4 commits into
mainfrom
mdangelo/codex/triage-sdk-0.151.0

Conversation

@mldangelo-oai

@mldangelo-oai mldangelo-oai commented Aug 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

Update the Codex CLI and SDK to 0.151.0 across the shipping TypeScript SDK, MCP app, and triage evaluation harness. This PR also includes the dependency-update policy from #757, which was merged into this branch.

Reconcile the branch with current main and fix the duplicate minimumReleaseAge key that prevented pnpm from installing MCP app dependencies in CI and container builds.

Changes

  • Pin Codex to 0.151.0 in all three projects and keep Promptfoo's transitive Codex SDK aligned with the eval harness's direct dependency.
  • Preserve unrelated dependency resolutions, including Promptfoo and the OpenCode SDK, and retain the existing cross-project Codex version regression check.
  • Include daily Dependabot checks for npm, Python, and GitHub Actions, with grouped Codex updates, no release cooldown for OpenAI packages, and a seven-day cooldown for other version updates.
  • Apply the matching pnpm release-age policy without changing committed-lockfile installability or build-script permissions.
  • Merge main without rewriting branch history, retain the centralized pnpm 11.19.0 toolchain, and remove the duplicate MCP workspace setting from the merged configuration.

Testing

  • Reproduced the original duplicated mapping key (9:1) failure with the merged branch before the fix.
  • All 11 deterministic triage and SastBench harness scripts: passed.
  • Required plugin Ruff lint, Ruff formatting, and portable source compatibility checks: passed with Ruff 0.16.1.
  • Plugin source boundary check and git diff --check: passed.
  • Compared all three lockfiles with main: exactly one Codex 0.151.0 package set in each; unrelated dependency graphs are unchanged.
  • Frozen installs for the SDK, MCP app, and eval harness: passed with pnpm 11.19.0.
  • SDK and MCP typechecks, SDK formatting, and all 14 SDK skeleton tests: passed.
  • All nine portable-source checker regression tests: passed with unrelated global pytest plugins disabled.
  • Promptfoo configuration validation and provider initialization: passed; the provider loads Codex SDK 0.151.0 and selects CLI 0.151.0 without model calls.
  • Built the bundled plugin, packed the npm package, and validated all 390 archive entries: passed. Full multi-platform test and installed-package coverage is provided by the attached CI runs.

Risk and rollout

This is no longer an eval-only update: shipping SDK and MCP runtime dependencies move from Codex 0.149.1 to 0.151.0, and Promptfoo uses the shared SDK version. Product version numbers and public CLI arguments/defaults are unchanged.

The dependency policy retains normal review and CI requirements and does not enable auto-merge or change Socket checks. No additional dependency-age exception was introduced for this repair.

No model-backed evaluations were run, so these checks do not establish benchmark score equivalence. This PR does not publish packages or containers.

Public disclosure review

  • No customer, partner, prospect, or user identities, data, or identifying details are included.
  • No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
  • I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

@mldangelo-oai
mldangelo-oai marked this pull request as ready for review August 30, 2026 14:01
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-09-01T13:56:15.673919Z ff19f56 Manual request
🔒 Security Review ✅ Completed 2026-09-01T13:58:04.412561Z ff19f56 New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@mldangelo-oai

mldangelo-oai commented Aug 30, 2026

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the current head 1d1debf2b72d1180012f41d0e5f2c80b522758e9.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 30, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 1d1debf2b7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@mldangelo-oai

mldangelo-oai commented Aug 30, 2026

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the current head 9d9349c0a2fd25865dbc9944e597337d7c8f29d7.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 30, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 9d9349c0a2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@mldangelo-oai mldangelo-oai mentioned this pull request Aug 30, 2026
Merged
3 tasks
@mldangelo-oai
chore(deps): add cooldowns and unify Codex dependencies (#757)
94a25b3 
* chore(deps): automate updates with a release cooldown

* fix(deps): group Codex security updates

* fix(deps): use the supported daily update schedule
@mldangelo-oai
fix(build): reconcile dependency policy with main
ff19f56
@mldangelo-oai mldangelo-oai changed the title chore(evals): update Codex SDK to 0.151.0 chore(deps): align Codex 0.151.0 and dependency cooldowns Sep 1, 2026
@mldangelo-oai

mldangelo-oai commented Sep 1, 2026

Copy link
Copy Markdown
Collaborator Author

@codex review

Please review the current head ff19f56eee2790aa4ff726fc33e89289482264ba, including the dependency-policy changes already merged from #757 and their reconciliation with main. The merged configuration now has a single MCP workspace minimumReleaseAge setting.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 1, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: ff19f56eee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mldangelo-oai