What changed
Bumps @openai/codex and @openai/codex-sdk from ^0.156.1 to ^0.164.0 in packages/deepsec and packages/processor, with the matching pnpm-lock.yaml update.
Why
With a ChatGPT subscription (--model-auth local --agent codex), Codex 0.156.1 can't use gpt-6.1-sol. deepsec init stops at the threat model step with Codex Exec exited with code 1: and no further detail. Running the workspace's own Codex binary with the same login shows the API response:
{"type":"error","status":400,"error":{"type":"invalid_request_error","message":"The 'gpt-6.1-sol' model is not supported when using Codex with a ChatGPT account.","code":"model_not_found"}}A caret range on a 0.x version only matches patch releases, so ^0.156.1 resolves to 0.156.x and new workspaces can't pick up a newer Codex until this range changes.
Verification
-
pnpm testpasses (2417 passed, 1 skipped) -
pnpm lintpasses -
pnpm knippasses - If this adds a matcher: not applicable
pnpm validate exits 0, which also covers pnpm -r build, pnpm bundle, and pnpm typecheck:deepsec.
I also ran pnpm deepsec init <workspace> <app> --model-auth local --agent codex --model gpt-6.1-sol --no-tui against a one-file project, before and after the change:
- On
main(Codex 0.156.1), it fails at Threat model with the error above. - On this branch (Codex 0.164.0), the threat model and both generated-matcher passes complete. The run then pauses with
NO_SCAN_CANDIDATES, which is expected for a project with nothing to scan.
Notes for reviewer
This PR only changes the Codex packages and leaves @anthropic-ai/claude-agent-sdk as it is.
Because of the caret behavior described above, each model that Codex gates by version needs a deepsec release to reach users. A wider range such as >=0.156.1 <1 would avoid that, but 0.x minor releases can change the SDK API, so this PR keeps the existing caret.
Written with AI assistance (Claude Code) and reviewed by me.
Activity
5
socket-security[bot]19d agoReview the following changes in direct dependencies. Learn more about Socket for GitHub.
| Diff | Package | Supply Chain Security | Vulnerability | Quality | Maintenance | License |
|---|---|---|---|---|---|---|
| npm/@openai/codex@0.156.1-win32-x64 ⏵ 0.164.0 | +31 | |||||
| npm/@openai/codex-sdk@0.156.1 ⏵ 0.164.0 | +1 |
auto-maintain[bot]19d ago🤖 auto-maintain review
Automated, advisory triage for @dpanta94's PR. Facts below are read from the GitHub API.
| Check | Result |
|---|---|
| Author's merged PRs (this repo) | 0 — ⚠️ first-time contributor |
| Account established | ✅ (age 3407d · 9 followers · 14 public repos) |
| Commits signed/verified | ✅ 1/1 |
Review panel: 🟡 medium highest severity
deepsec maintainer code review: 🟢 low
The Codex dependency upgrade and lockfile updates are consistent; no actionable issues found.
General code review: 🟢 low
Dependency manifests and lockfile are consistent; no actionable issues found.
Scanner and matcher quality: 🟡 medium
The dependency update is consistent, but it cannot ship without a deepsec version bump.
- packages/deepsec/package.json:38 — The Codex upgrade will not reach npm users because the package remains at already-published version 2.3.10; the release workflow detects the unchanged version and skips publishing. Bump the deepsec package version with this upgrade.
Sandbox and credential boundaries: 🟢 low
Diff is a clean dependency bump of @openai/codex and @openai/codex-sdk from ^0.156.1 to ^0.164.0 in both packages plus a consistent pnpm-lock update with fresh integrity hashes and no stale 0.156 entries; no source, sandbox, credential, or egress code changes. The sandbox bootstrap resolves the Codex version dynamically from the installed package and already handles the ≥0.144 vendor/<triple>/bin/codex layout, and the codex-sdk integration points (CODEX_HOME isolation, env allowlist, codexPathOverride wrapper, sandboxMode/networkAccessEnabled, plugin lockdown) are unaffected by the range change. No actionable boundary findings.
Durability and distributed state: 🟢 low
No durability or distributed-state issues found in the dependency-only upgrade.
Posted by auto-maintain. This automated code review is advisory; a human maintainer makes the call.
dpanta9415d ago@cramforce or maybe @bensabic could i get some eyes on this one please ?
This pull request is a draft
Merging is unavailable until it is marked ready for review.
@dpanta94 is attempting to deploy a commit to the Vercel Labs Team on Vercel.
A member of the Team first needs to authorize it.