Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fea0f92080
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| **Scan failure reason on the scan page**: When a scan fails, the reason reported by the engine now appears on the scan detail page instead of leaving you with no explanation. | ||
|
|
||
| **Bot PR scanning on GitHub**: Pull requests opened by bots (Dependabot, Renovate, GitHub Actions, and similar) are now scanned and reviewed on GitHub, matching the behavior already in place for GitLab and Bitbucket. |
There was a problem hiding this comment.
This states that bot-opened PRs are scanned unconditionally, but code-review/config.mdx:80-84 documents that automatic review occurs only when the provider identifies the bot as trusted for the target repository; untrusted bots and outside contributors are not auto-scanned. This will mislead users whose bot PR originates from an untrusted account or fork, so qualify the announcement with the trust requirement.
Useful? React with 👍 / 👎.
PRs #70, #71 and #73 were each generated from the same baseline (c5f6cff) over a widening commit window, so they described the same release three times with conflicting details. This folds them into a single September 18 entry: - keeps every distinct item across the three drafts, including the GitLab tag/commit scan target that only #70 and #71 caught - fixes the API key claim (personal settings, not org settings) to match #70/#71 and the merged personal settings page - reframes bot PR review on GitHub as the fix it is, since the August 3 entry already announced the feature, and keeps it consistent with the trusted-bot wording in code-review/config.mdx - edits the copy to the changelog's existing voice and fixes the Prettier failure on the original branch Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Superseded by #73, which merges this entry with #70 into a single September 18, 2026 changelog entry. All three PRs were generated from the same baseline ( |
* docs: add changelog entry for September 18, 2026 * docs: consolidate Sept 15/16/18 changelog drafts into one entry PRs #70, #71 and #73 were each generated from the same baseline (c5f6cff) over a widening commit window, so they described the same release three times with conflicting details. This folds them into a single September 18 entry: - keeps every distinct item across the three drafts, including the GitLab tag/commit scan target that only #70 and #71 caught - fixes the API key claim (personal settings, not org settings) to match #70/#71 and the merged personal settings page - reframes bot PR review on GitHub as the fix it is, since the August 3 entry already announced the feature, and keeps it consistent with the trusted-bot wording in code-review/config.mdx - edits the copy to the changelog's existing voice and fixes the Prettier failure on the original branch Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: setlin-hacktron <280193300+setlin-hacktron@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2 participants
Documentation TODOs
These shipped features still need docs. The changelog links only to pages that already exist - add or update these, then link them:
/platform/repositories/azure-devopsshould document that AI-powered fix PRs are now supported for Azure DevOps, including setup requirements./platform/organization-settingsor/platform/account-settingsshould document that every member (not just admins) can create and manage their own API keys./platform/account-settingsshould be updated to reflect the merged page structure (Profile, Security, Connected accounts, Preferences, Sessions, Organizations)./platform/on-premisesshould document the license lifecycle: when the banner appears (30 days before expiry), what the grace deadline means, and what stays accessible after the gate./platform/on-premisesor a new license page should cover reading license details (expiry, seats, products) from org settings and where to renew./platform/on-premisesand/platform/repositories/gitlabshould document that GitLab MR review is now available on appliances and what configuration is required./platform/repositories/github-enterprise-servershould document the GitHub App connection option for on-prem alongside the existing PAT option./platform/on-premisesshould describe the first-run onboarding overlay for appliance operators./white-box-pentest/quickstartor a new scan-target page should note that GitLab targets can be pinned to a specific tag or commit SHA./platform/dashboardshould document the Application filter and how it scopes every dashboard widget including the security score./platform/project-management/linearshould document the outbound sync: triage actions on any surface move the linked Linear issue to the matching state, and dispatching a fix moves it to In Progress.Note
Low Risk
Documentation-only changelog update with no product or infrastructure code changes.
Overview
Publishes the September 16, 2026 changelog entry and bumps the automation marker to
last-prod-sha=f003dc9a7…so future releases insert below the new baseline.The new
<Update>block documents that release in one place: a redesigned findings table and drawer (tray header, navigation, overflow menu), OWASP Top 10:2025, CWE, and fix recommendation on findings, and Linear issue status sync when findings are triaged or a fix is dispatched. It also covers PR Review dashboard Application scoping, scan failure reasons on the scan page, GitHub bot PR scanning, and remediation behavior (auto-close when the fix lands elsewhere, stale-diff retries, Azure DevOps fix PRs).Additional notes call out GitLab tag/commit scan targets, member self-serve API keys and unified Personal settings, smaller UX wins (PDF reports, global search severity), and a batch of on-prem items (license banner/gate, license details in org settings, GitLab MR UI, GHES via GitHub App, guided onboarding), with links to existing docs pages.
Reviewed by Cursor Bugbot for commit fea0f92. Bugbot is set up for automated code reviews on this repo. Configure here.