[github-actions]

npm 0.4.9 security hotfix

The maintainer requested this patch release after merging #184. It requires Node ^22.23.4 || ^24.22.1; older patches are no longer supported. Updating codex-unlock does not upgrade Node, so users must update their runtime separately. Node 26 remains unsupported. Runtime source, native dependency pins, and recovery policy are unchanged. Windows standalone remains 0.5.0.

#187 records the explicit one-release Release-As: 0.4.9 selection; the patch number does not hide the Node compatibility change. Release Please generated all version/changelog files. #186 is excluded. #184 final PR checks (57) and post-merge main CI passed; its Security Review completed without findings. Code Review completion is not claimed.

The final 0.4.9 artifact is undergoing local five-check validation and current-head CI. Publication uses the existing OIDC workflow without token files or protection bypasses.

🤖 I have created a release beep boop

0.4.9 (2026-10-28)

⚠ BREAKING CHANGES

• Node 22 versions below 22.23.4 and Node 24 versions below 24.22.1 are no longer supported.

Bug Fixes

• require patched Node 22 and 24 security baselines (#184) (0c9ecfc)

Documentation

• document Node security hotfix compatibility (ce84a24)

---

This PR was generated with Release Please. See documentation.

Final release gate

At release head 8ee46f92c9a57cdb892456c255035b65cce1ff88, all 45 checks passed and current-head Codex Code Review and Security Review completed without findings. Local five-check validation for 0.4.9 passed (291 tests: 288 passed, 3 Linux-only skipped); full and production-only audits both reported zero vulnerabilities. Merged as c747271d986df8bf6001c7dc6d609d6b89b0e152 using normal protection gates.

The earlier preparation-main CI 40630844733 timed out waiting for the first synthetic unlock lease on macOS Intel/Node 24. Its original failure log was preserved and only failed jobs were rerun; no assertion or product timeout was weakened. The final release PR matrix passed independently. Publication and final-main verification are in progress.

Publication verified

• npm latest is 0.4.9, with required Node range ^22.23.4 || ^24.22.1 and registry provenance metadata present.
• Release: https://github.com/abruption/codex-unlock/releases/tag/v0.4.9
• Final source/tag: c747271d986df8bf6001c7dc6d609d6b89b0e152
• OIDC build/publication: https://github.com/abruption/codex-unlock/actions/runs/40631616702 (success)
• Final main CI: https://github.com/abruption/codex-unlock/actions/runs/40631616587 (success)
• Registry tarball is byte-identical to the verified CI artifact; SHA-256 af42f9cd3a57a7e20b6d83b35a8290ae8ab0b4f79d338ee694aa61bf86e9aaf0. Runtime-only shrinkwrap and exact native dependency pin verified.
• Clean temporary-prefix installation on macOS arm64 / Node 24.22.1: version 0.4.9, help exit 0, native addon loaded. Existing user installation and real Codex sessions were not changed.
• The preparation-main failed job rerun succeeded without code/assertion/timeout changes. The original failure log remains preserved.
• Temporary release worktrees removed; branch refs, validation evidence and pre-existing research worktrees preserved.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T04:13:31.622513Z	8ee46f9	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-28T04:14:46.819850Z	8ee46f9	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🤖 Created releases:

• v0.4.9

🌻