This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+9 more
Affected surfaces
Summary
AI summaryUpdates Verification Notes, shared-skills, and codex across a mixed release.
Full changelog
Patch Release: Stale Codex Cache Guard
This patch prevents removed omo sparkshell prompt guidance from getting promoted into a newly installed LazyCodex plugin cache. The current source prompts were already clean, but an old installed cache could still expose stale sparkshell instructions from skills/ulw-loop/references/full-workflow.md. The installer now scans Codex prompt surfaces before cache promotion and rejects stale sparkshell references across both root prompts and nested component prompt surfaces.
For users, the important bit is simple: update or reinstall LazyCodex and the installed Codex plugin cache should no longer carry removed sparkshell guidance. Existing stale caches are not silently deleted, but the new install path blocks that bad prompt material from being promoted again.
This release also adds a provenance-backed Aside design reference to the shared frontend skill, so frontend briefs for bright AI-browser/product-app surfaces have a cleaner project-original reference path.
Verification Notes
bun run typecheckpassed.bun run test:codexpassed 440/440.- Isolated Codex install verification passed and kept the real
~/.codex/config.tomlunchanged. - Isolated Codex app-server QA proved plugin hooks fired for
sessionStart,userPromptSubmit, andstop. - Publish workflow passed with typecheck, test, Codex compatibility on Ubuntu/macOS/Windows, platform package publishing, npm publishing, LazyCodex smoke, marketplace sync, and GitHub release creation.
- c0be85e39 Merge pull request #5787 from code-yeongyu/release/v4.14.2-source-state
- 8471324a3 Merge pull request #5781 from code-yeongyu/code-yeongyu/fix-sparkshell-residual-calls-20260630
- 460143fca Merge pull request #5782 from code-yeongyu/code-yeongyu/aside-frontend-reference
- 2ec93c5c4 fix(codex): cover component prompt surfaces in sparkshell guard
- 53a3817f1 docs(shared-skills): tighten aside provenance reference
- d9e9404f7 test(shared-skills): cover aside reference contract
- c59cf5020 docs(shared-skills): route aside frontend reference
- 73efefaff docs(shared-skills): add aside design reference
- 4819b0624 fix(codex): reject stale sparkshell prompt surfaces
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v4.19.0 Removes legacy Ralph Loop wiring; introduces Goal feature with automatic config migration.
- v4.6.0 Removed broken direct public binary entrypoints from platform launcher packages, keeping them internal.
- v4.6.0 Removed legacy context-window monitor hook path from active hooks and config surfaces.
- v4.4.0 Removes top‑level `lsp` config key; migration required to `.opencode/lsp.json`.
Beta — feedback welcome: [email protected]