Config files OpenAI Codex CLI has changed
Config you own — hooks, permission rules, MCP servers, settings — that releases below state a change to. Counted from the release notes we track, newest change first. How a harness is layered.
Security advisories
2 published for Codex CLI, from the GitHub Advisory Database.
Affects up to 0.23.0 · CVE-2025-61260 · Apr 14, 2026
Fixed in 0.39.0 · CVE-2025-59532 · Sep 19, 2025
Release signals
alpha.11
Release 0.156.0-alpha.11Primary source ↗alpha.10
Release 0.156.0-alpha.10Primary source ↗alpha.9
Release 0.156.0-alpha.9Primary source ↗alpha.8
Release 0.156.0-alpha.8Primary source ↗alpha.7
Release 0.156.0-alpha.7Primary source ↗alpha.6
Release 0.156.0-alpha.6Primary source ↗alpha.5
Release 0.156.0-alpha.5Primary source ↗alpha.4
Release 0.156.0-alpha.4Primary source ↗New local TUI sessions now leave reasoning summaries disabled by default, fixing request rejection by providers that do not support them.
- Explicit reasoning-summary settings remain respected. (#46467)
- #46467 Restore none as the TUI reasoning summary default (@celia-oai)
alpha.3
Release 0.156.0-alpha.3Primary source ↗alpha.2
Release 0.156.0-alpha.2Primary source ↗alpha.9.2
Release 0.155.0-alpha.9.2Primary source ↗alpha.1
Release 0.156.0-alpha.1Primary source ↗Added experimental `/voice` conversations with live transcripts and microphone controls on supported builds, enabled through `/experimental`. (#43581, #43651, #44331)
- The TUI now shows live reasoning summaries in the status row and completion timestamps after successful turns. (#43558, #43921)
- Added task hiding, archiving, and deletion in the agents overview, plus worktree ownership details and confirmed deletion of clean managed worktrees. (#43942, #44424, #44433)
- Added Touch ID verification for MCP requests in local TUI sessions on supported Macs. (#43624, #43712, #43715)
- +137 more changes
Read the full release noteHide the full release note
New Features
-
Added experimental
/voiceconversations with live transcripts and microphone controls on supported builds, enabled through/experimental. (#43581, #43651, #44331) -
The TUI now shows live reasoning summaries in the status row and completion timestamps after successful turns. (#43558, #43921)
-
Added task hiding, archiving, and deletion in the agents overview, plus worktree ownership details and confirmed deletion of clean managed worktrees. (#43942, #44424, #44433)
-
Added Touch ID verification for MCP requests in local TUI sessions on supported Macs. (#43624, #43712, #43715)
-
Added configurable daemon update schedules and
codex app-server daemon update; saved threads and active goals can recover after daemon restarts. (#43542, #43562, #44314) -
Amazon Bedrock can now obtain AWS credentials from configured commands, with caching, expiration-based refresh, and authentication recovery. (#44028)
Bug Fixes
-
Accepted prompts are now saved even when compaction fails before a turn starts. (#44487)
-
Fixed missed tmux resizes, transcript viewport restoration, and stale history appearing after switching threads. (#43603, #43889, #43994)
Excerpt ends here — this release continues at the source ↗.
Polled sources
[openai-developers] OpenAI Developers Codex
Product page · not polled
https://developers.openai.com/codex[github-releases] GitHub Releases
GitHub Releases · last read Oct 25, 2026
https://github.com/openai/codex/releases