release: bump Codex Security to 0.1.19

[mldangelo-oai]

Summary

Prepare Codex Security 0.1.19 after the Cloud publication feature landed in #612. This pull request advances the package version and replaces the maintenance placeholder with a reviewed summary of the user-facing changes since 0.1.18.

Changes

• Bump @openai/codex-security from 0.1.18 to 0.1.19.
• Highlight publication of one or more completed scans to Codex Security Cloud, including interactive or explicit scan selection and upload-free --dry-run validation.
• Document the file-backed ChatGPT sign-in and authorized-account requirements for live Cloud uploads.
• Highlight saved-scan selection for Linear publication by scan ID, unique prefix, latest, or the interactive picker.
• Link both highlights to the version-matched public documentation used by the generated GitHub release.

Testing

• git diff --check
• Release-note header matched node sdk/typescript/scripts/release-automation.mjs version sdk/typescript/package.json: 0.1.19
• node sdk/typescript/scripts/release-automation.mjs release-tag tag refs/tags/npm-v0.1.19 npm-v0.1.19 sdk/typescript/package.json
• node sdk/typescript/scripts/release-automation.mjs require-increase 0.1.19 0.1.18
• npm exec --yes --package=prettier@3.2.5 -- prettier --check .github/release-notes.md
• Exact-head author/reviewer pass and two-pass prepublish review gate on 996c498e99bcb4638ac37e32984c0f2307f009e7: no findings

The pushed head leaves package testing to the required pull-request CI. The merged feature PR completed its own implementation and cross-platform validation before landing on main.

Risk and rollout

This pull request changes release metadata only. The 0.1.19 package includes the Cloud publication behavior already merged on main. Live uploads require explicit file-backed ChatGPT credentials and an account authorized for Cloud publication; --dry-run does not upload or require a login. Existing Linear publication gains saved-scan selectors without changing its destination or credential behavior.

After merge, successful node-ci on main triggers the release-cut workflow, followed by protected npm publication and GitHub release creation for 0.1.19. npm publication remains gated by the protected npm environment.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-23T23:00:35.853687Z	134e60b	Manual request
🔒 Security Review	✅ Completed 2026-08-23T23:00:55.541042Z	134e60b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 134e60b186

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[mldangelo-oai]

Closing this release PR because npm-v0.1.18 already matches current main, and no runtime or substantive package changes have landed since that release. Publishing 0.1.19 as latest would change version metadata only and prompt 0.1.18 clients to update without receiving new behavior. We can cut the next release after a real package delta lands, or open a new release PR with a documented artifact-repair rationale if one is needed.

[kmbroai]

Critical review

Reviewed 134e60b186ac5dc394229b612b17621283cb3c52. The metadata is internally consistent, but I would defer this PR unless there is a concrete operational reason to publish identical runtime contents again.

Necessity

The complete diff changes only the package version and release summary. I also compared the current main snapshot 227fc32ac47c9ac5d78f6dd246d8899673a67858 with npm-v0.1.18: GitHub reports them identical, zero commits ahead. There is no new runtime fix, dependency update, packaging repair, or user-visible capability here.

A fresh version can be warranted to repair a failed publication or intentionally republish changed package contents, but neither is established by this diff or description. Otherwise this adds another release, verification cycle, and upgrade decision without delivering a benefit. Prefer attaching 0.1.19 and accurate notes to the next actual maintenance fix. This is a necessity recommendation, not a claim that the version bump itself is broken.

Correctness and simplification

The version marker in release-notes.md matches package.json, and the maintenance summary does not incorrectly repeat 0.1.18's features. No source refactor or additional release configuration is needed.

If this is intentionally held open while fixes land, the statement that there are no additional behavior changes must be refreshed against the actual release commit. Do not merge stale notes after unrelated runtime PRs land, and do not describe a successful metadata check as proof that publication happened.

Verification

On this head, the existing release helper's version, release-tag, and require-increase 0.1.19 0.1.18 commands all succeeded under Node 22.13.1. I verified the two-file diff and the live tag-to-main comparison. I did not publish, create a tag, query npm availability for 0.1.19, or rerun the full package suite.

[faizan-oai]

Reviewed the two-file metadata change and verified the version, release-tag, and version-increase checks. No blocking correctness issue on this head; required CI is green.

[faizan-oai]

Re-reviewed the release metadata and refreshed Cloud/Linear highlights against the functionality merged on main. All 223 focused release/workflow tests, the version/tag/increase checks, and release-note validation pass. Required CI is green on this exact head. No blocking findings.