The Wire · Showcase
CODEX PATCHES WINDOWS SANDBOX BUG WHILE PYTHON SDK SHIPS IMAGE API FIX
By RepoJournal · Filed · About OpenAI
Codex fixed a critical Windows sandbox git vulnerability that broke worktree handling, and the Python SDK is already on its second patch in hours after an imagegen regression slipped through.
Codex's Windows sandbox was silently failing on git worktrees because the safe.directory injection followed symlinks to internal `.git/worktrees/` paths that the dubious-ownership check rejected [1]. That's now fixed. In parallel, the vendored Bubblewrap dependency got yanked forward to 0.11.2 to pull in a setuid security update [2], though the real story is upstream is deprecating setuid builds entirely—expect that to ripple through sandbox initialization soon. On the app-server side, two architectural shifts landed: the skills watcher moved out of codex-core to let app-server own cache invalidation and change notifications [4], and MCP elicitations now route through Guardian approval when opted-in [5], closing the gap Browser Use prompts were exploiting. A state DB revert [3] keeps the newer session/thread identity tracking but restores optional plumbing—no impact for most deployments. The Python SDK shipped 2.35.0 with image API updates [6], then immediately hotfixed 2.35.1 because the imagegen size enum regressed [7]—if you pulled 2.35.0 in the last few hours, upgrade now.
Action items
- → Upgrade openai-python to 2.35.1 if you deployed 2.35.0 in the last 4 hours openai/openai-python [immediate]
- → Pull Codex with Windows sandbox worktree fix before next production deploy openai/codex [plan]
- → Monitor for Bubblewrap setuid deprecation breaking changes in next quarter openai/codex [monitor]
References
- [1] [codex] Fix Windows sandbox git safe.directory for worktrees (#21409) openai/codex
- [2] vendor: update bubblewrap to 0.11.2 (#21389) openai/codex
- [3] Revert state DB injection and agent graph store (#21481) openai/codex
- [4] Move skills watcher to app-server (#21287) openai/codex
- [5] Route opted-in MCP elicitations through Guardian ↗ openai/codex
- [6] v2.35.0 ↗ openai/openai-python
- [7] release: 2.35.1 ↗ openai/openai-python
FAQ
- What changed in OpenAI on May 7, 2026?
- Codex fixed a critical Windows sandbox git vulnerability that broke worktree handling, and the Python SDK is already on its second patch in hours after an imagegen regression slipped through.
- What should OpenAI teams do about it?
- Upgrade openai-python to 2.35.1 if you deployed 2.35.0 in the last 4 hours • Pull Codex with Windows sandbox worktree fix before next production deploy • Monitor for Bubblewrap setuid deprecation breaking changes in next quarter
- Which OpenAI repositories shipped on May 7, 2026?
- openai/codex, openai/openai-python