This release adds 3 notable features for engineering teams evaluating rollout.
Published 1mo
AI Agents & Assistants
✓ No known CVEs patched
✓ No known CVEs patched in this version
Affected surfaces
deps
Summary
AI summaryUpdates Changelog Full Changelog: https://github.com/openai/codex/compare/rust-v0.142.1...rust-v0.142.2, Bug Fixes, and New Features across a mixed release.
Full changelog
New Features
- MCP tools now use tool search by default when supported, improving tool discovery while preserving compatibility with older models and providers. (#29486)
- macOS authentication clients can honor system proxy, PAC, and WPAD settings when
respect_system_proxyis enabled. (#26709) - Plugins can provide dedicated dark-mode logos through local manifests and remote catalogs. (#29488)
- Apps can display richer safety-buffering UI using server-provided visibility and faster-model metadata. (#29473)
Bug Fixes
- Remote plugin catalogs now return curated featured-plugin rankings. (#29485)
- Expired Amazon Bedrock credentials now produce actionable recovery guidance instead of a generic authorization error. (#28992)
- Remote stdio MCP servers now accept absolute working directories written in the remote platform’s path format. (#29493)
- Remote HTTP(S) image inputs now return clear model-visible validation errors; inline data URLs and local images remain supported. (#29417, #29419)
- PowerShell commands containing executable AST regions the safety classifier cannot inspect now require approval. (#24092)
- Code Mode now warns when the selected model lacks the required metadata. (#29490)
Chores
- Updated bundled OpenSSL and esbuild dependencies to patched releases. (#29487, #29489)
- Successful formatter runs are now quiet while failures still show diagnostics. (#29467)
Changelog
Full Changelog: https://github.com/openai/codex/compare/rust-v0.142.1...rust-v0.142.2
- #28769 Register full CDP requirements feature @syuan-oai
- #29485 [codex] fetch featured IDs for remote plugins @ericning-o
- #29487 Upgrade bundled OpenSSL to 3.6.3 @jif-oai
- #29489 [codex] Update esbuild to 0.28.1 @pakrym-oai
- #29488 [plugins] Add dark-mode logo metadata @drewschuster-openai
- #29249 [codex] migrate environment context to model world state @pakrym-oai
- #29494 core: wrap token budget window context @bolinfest
- #29417 [codex] replace remote images with model-visible error text @rka-oai
- #28360 feat(core): store turn_id on ResponseItem metadata @owenlin0
- #29486 [codex] Use tool search for MCP tools by default @sayan-oai
- #29501 path-uri: clarify host-native path conversion @anp-oai
- #29504 fix: world state response item test @celia-oai
- #26704 TUI Plugin Sharing 4 - cover remote plugin catalog flows @canvrno-oai
- #29419 [codex] reject remote images at app-server ingress @rka-oai
- #28992 chore: improve expired Bedrock credential errors @celia-oai
- #29467 Make formatter output quiet on success @anp-oai
- #26709 PAC 4 - Add macOS system proxy resolver @canvrno-oai
- #29490 chore: warn when Code Mode lacks model metadata @celia-oai
- #29493 mcp: accept foreign absolute cwd for remote stdio @anp-oai
- #29473 Propagate safety buffering treatment metadata @fc-oai
- #24092 [codex] Reject unlowered PowerShell AST regions @bookholt-oai
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About codex
All releases →Related context
Related tools
Earlier breaking changes
- vrust-v0.134.0 Makes `--profile` the primary profile selector and rejects legacy selectors.
Beta — feedback welcome: [email protected]