Upgrade codex and claude to latest

[cramforce]

What changed

Why

Verification

• pnpm test passes
• pnpm lint passes
• pnpm knip passes
• If this adds a matcher: ran it against at least one real repo and confirmed the candidate count is sane

Notes for reviewer

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
deepsec-website	Ready	Preview, v0	Sep 23, 2026 12:57pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
deepsec	Ignored	v0	Sep 23, 2026 12:57pm UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​anthropic-ai/​claude-agent-sdk@​0.3.260 ⏵ 0.3.280	+1		+1
	npm/​@​openai/​codex@​0.153.2-win32-x64 ⏵ 0.156.1			+14
	npm/​@​openai/​codex-sdk@​0.153.2 ⏵ 0.156.1

View full report

[auto-maintain]

🤖 auto-maintain review

Automated, advisory triage for @cramforce's PR. Facts below are read from the GitHub API.

Check	Result
Author's merged PRs (this repo)	69
Account established	✅ (age 6326d · 1154 followers · 98 public repos)
Commits signed/verified	✅ 2/2

Review panel: 🟡 medium highest severity

deepsec maintainer code review: 🟢 low

Dependency upgrades and lockfile updates are consistent; no actionable regressions found.

General code review: 🟡 medium

The dependency upgrade will not be published because the deepsec package version was not incremented.

• packages/deepsec/package.json:3 — Bump the package version with these dependency updates. It remains 2.3.9, so release.yml will detect the already-published version and skip publishing; existing CLI users remain on Codex ^0.153.2 (<0.154.0) instead of receiving 0.156.1.

Scanner and matcher quality: 🟢 low

Dependency-only upgrade is internally synchronized; no scanner or matcher quality regressions found.

Sandbox and credential boundaries: 🟢 low

Pure dependency bump of @anthropic-ai/claude-agent-sdk (0.3.260→0.3.280) and @openai/codex[-sdk] (0.153.2→0.156.1) in packages/deepsec and packages/processor with a consistent lockfile update; no stale references to the old versions remain, both workspaces stay in version lockstep, and no sandbox, egress-allowlist, credential, or command-construction code hardcodes these versions (setup.ts resolves SDK/platform-binary versions dynamically from the installed host package), so no boundary behavior changes in the diff itself.

Durability and distributed state: 🟢 low

No durability or distributed-state issues found in the dependency-only upgrade.

_{Posted by auto-maintain. This automated code review is advisory; a human maintainer makes the call.}