[github-actions]

npm 0.4.8 hotfix scope

The maintainer explicitly authorized the npm 0.4.8 dependency/CI hotfix. The earlier hold for the unrelated Windows release is superseded. PRs #141, #142, #143 and #140 have passed current-head CI plus Codex Code/Security Review and were merged. This PR includes their combined main state.

fast-uri 3.1.9 fixes development-only URI parsing advisories. npm audit, including development dependencies, and runtime-only audit both report zero vulnerabilities. npm runtime dependencies and CLI/JSON contracts are unchanged. Windows standalone remains 0.5.0 on its separate windows-v* release channel. The generated Windows history below describes earlier standalone work, not a new npm breaking change.

Local npm ci/check/lint/test (287 passed, 3 Linux-only skipped), tarball smoke and diff check all passed for 0.4.8. Latest-head CI and automatic code/security reviews are pending. Version files and changelog were generated by Release Please; the version override was recorded as Release-As: 0.4.8 in the security fix merge commit.

🤖 I have created a release beep boop

0.4.8 (2026-10-27)

⚠ BREAKING CHANGES

• windows: Windows RC and stable output use the codex-unlock-windows schema with explicit releaseChannel and maturity flags. Historical alpha parsing and the npm CLI JSON contract remain unchanged.

Features

• experimental: add diagnostic-only Rust Windows prototype (#164) (22857b3)
• experimental: add standalone Windows diagnostic preview (#170) (36e3bf6)
• prepare standalone Windows diagnostic alpha releases (#172) (815c56e)
• windows: prepare diagnostic RC and stable qualification (#177) (1bb8746)
• windows: select stable release plan after qualified RC (#179) (2893745)

Bug Fixes

• deps: patch URI parsing advisories and refresh development dependencies (37074a5)

---

This PR was generated with Release Please. See documentation.

Final merge gate

Merged at bf52923db8c2a22d262bd702ca5c6a2cd8e2a960 after 40 successful checks plus one neutral CodeQL summary, and a completed current-head Codex Security Review without findings. The maintainer explicitly instructed publication without waiting for the still-running Code Review; no completed Code Review is claimed for this release PR. Repository protections were not bypassed. npm publication is being verified through the standard OIDC release workflow.

Published and verified

• npm latest: 0.4.8
• GitHub release: https://github.com/abruption/codex-unlock/releases/tag/v0.4.8
• Final source/tag SHA: bf52923db8c2a22d262bd702ca5c6a2cd8e2a960
• Final main CI: https://github.com/abruption/codex-unlock/actions/runs/40431275021 (success)
• OIDC publication/provenance workflow: https://github.com/abruption/codex-unlock/actions/runs/40431275142 (all three jobs succeeded)
• Registry tarball is byte-identical to the verified CI artifact; SHA-256 aaf7c2f1ee1fe9b7ccd2e2a9322fb1d2f71a8f93152517fdc1105e34651d108c. Published shrinkwrap contains only the runtime tree (fs-ext-extra-prebuilt and nan), without fast-uri/development dependencies.
• Windows standalone remains 0.5.0. No Windows release was rebuilt or published.

[abruption]

This npm-channel proposal is held as Draft while the maintainer's confirmed scope is the standalone Windows diagnostic 0.5.0 release (#174, #177, #178).

The 1.0.0 proposal follows the Windows-only breaking-change note for the new RC/stable JSON schema. The npm CLI's JSON contract and runtime have not been changed by that schema migration. This PR does not promote or publish the Windows executable and must not be merged as a substitute for the Windows release. The Windows channel uses its own windows-v* tags and release plan; npm remains on its existing stable version until separately scoped and reviewed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-27T01:01:01.320197Z	da58d41	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-27T01:04:22.355284Z	da58d41	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🤖 Created releases:

• v0.4.8

🌻