This release updates vulnerable dependencies across the web app, API, SDK and runner.

On self-hosted setups that override HOME, Codex runs no longer wait indefinitely on their first turn. Agent runs send the correct project even without an authorization header. The model picker shows a readable Kimi K3.1 Pro label, and session names no longer show a lock icon.