release: bump Codex Security to 0.1.27

.github/release-notes.md

@@ -1,33 +1,41 @@
-<!-- release-version: 0.1.26 -->
+<!-- release-version: 0.1.27 -->
 
+<!-- release-section: highlights:start -->
 ## Highlights
 
-- Classify finding severity with custom rubrics and supporting context through
-  the CLI and SDK. Saved assessments can be reused for Linear publication
-  without changing the original findings or sealed scan artifacts. See
-  [severity classification](https://github.com/openai/codex-security/blob/npm-v0.1.26/sdk/typescript/README.md#classify-finding-severity).
-- Match repeated findings across scan history, preserving confirmed identities
-  and related-finding relationships. Automatic matching restores batching, and
-  confirmed-finding lookups are faster.
-- Open draft GitLab merge requests for verified patches with the existing
-  `--create-pr` option, including self-hosted GitLab. See
-  [patch publication](https://github.com/openai/codex-security/blob/npm-v0.1.26/sdk/typescript/README.md#validate-and-patch-findings).
-- Report component scan progress in headless runs and exclude replayed usage
-  events with identical timestamps from scan budgets.
-- Preserve analytics settings in finding workflows and allow 120 seconds for
-  the bundled plugin's MCP server to start.
-- Require an explicit request before invoking the security fix verification
-  skill during other work.
+- port source and test report checks to TypeScript ([#768](https://github.com/openai/codex-security/pull/768))
+- port custom validation to TypeScript ([#792](https://github.com/openai/codex-security/pull/792))
+- add Python-free Unix OS primitives ([#794](https://github.com/openai/codex-security/pull/794))
+- add Python-free Windows OS primitives ([#795](https://github.com/openai/codex-security/pull/795))
+- add Python-free musl native artifacts ([#796](https://github.com/openai/codex-security/pull/796))
+- bundle verified native runtime artifacts ([#797](https://github.com/openai/codex-security/pull/797))
+- preserve Windows filenames in native helpers ([#798](https://github.com/openai/codex-security/pull/798))
+- port security policy resolution to TypeScript ([#799](https://github.com/openai/codex-security/pull/799))
+- budget package installation and verification ([#834](https://github.com/openai/codex-security/pull/834))
+- open ready pull requests ([#833](https://github.com/openai/codex-security/pull/833))
+- draft SECURITY.md for owner review ([#536](https://github.com/openai/codex-security/pull/536))
+- resolve Windows Node to an absolute executable ([#788](https://github.com/openai/codex-security/pull/788))
+- shard automatic component planning for large repositories ([#845](https://github.com/openai/codex-security/pull/845))
+- import CSV and JSON findings as saved scans ([#850](https://github.com/openai/codex-security/pull/850))
+- add a feedback command ([#854](https://github.com/openai/codex-security/pull/854))
+- improve scan usage and cost reports ([#853](https://github.com/openai/codex-security/pull/853))
+- recover interrupted Deep Scans and bulk campaigns ([#835](https://github.com/openai/codex-security/pull/835))
+- reject owned plugin keys inside Codex profiles ([#861](https://github.com/openai/codex-security/pull/861))
+- include CommonJS and TypeScript module extensions in scan inventories ([#859](https://github.com/openai/codex-security/pull/859))
+- include workflow files in diff inventories ([#820](https://github.com/openai/codex-security/pull/820))
+- accept a UTF-8 byte order mark in imported findings JSON ([#856](https://github.com/openai/codex-security/pull/856))
+- authenticate deep workers with OpenAI API keys ([#870](https://github.com/openai/codex-security/pull/870))
+- drop canonical document size limits that do not exist ([#868](https://github.com/openai/codex-security/pull/868))
+- pin native Rust formatting edition ([#863](https://github.com/openai/codex-security/pull/863))
+- detect a Linear URL contradiction over plain HTTP ([#867](https://github.com/openai/codex-security/pull/867))
+- pipeline dedupe with configurable concurrency ([#852](https://github.com/openai/codex-security/pull/852))
+- disable reasoning summaries by default for Bedrock ([#869](https://github.com/openai/codex-security/pull/869))
+- reuse scan authentication for patch and validation ([#871](https://github.com/openai/codex-security/pull/871))
+- bump smol-toml from 1.6.1 to 1.7.1 in /sdk/typescript ([#873](https://github.com/openai/codex-security/pull/873))
+<!-- release-section: highlights:end -->
 
+<!-- release-section: upgrades:start -->
 ## Upgrade notes
 
-- GitLab patch publication requires an installed and authenticated `glab` CLI.
-  For self-hosted GitLab, configure the host as described in the patch
-  publication documentation above.
-- Severity classification is opt-in. Without a rubric, it inherits the
-  finding's existing severity without a model call.
-- With `--max-cost`, automatic history matching makes at most one extra model
-  call. If matching needs more context, the completed scan is retained and a
-  warning directs you to run `scans match --all` explicitly.
-
-The categorized list below contains the individual changes.
+Review compatibility and document any required migration steps before releasing.
+<!-- release-section: upgrades:end -->

.github/release-pr-state.json

@@ -0,0 +1,14 @@
+{
+  "baseVersion": "0.1.26",
+  "baseCommit": "2536d104deef9bca8ced84c6f6263b915418253b",
+  "sections": {
+    "highlights": {
+      "generatedHash": "488ce0a2eadd5a3718a22b68227f42dbba6f3f57b1ad9259cc850c397318a977",
+      "humanOwned": false
+    },
+    "upgrades": {
+      "generatedHash": "68d4c3318e7ef9c9bc7e5f85be654e3c5ffc027eed6f48b6e3607d091bdbbfb4",
+      "humanOwned": false
+    }
+  }
+}

sdk/typescript/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openai/codex-security",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "description": "TypeScript SDK and CLI for Codex Security",
   "license": "Apache-2.0",
   "author": "OpenAI",