openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-31 19:28:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ignore RUSTSEC-2026-0418 for the Windows-only libz-sys dependency (#58110)

Browse Source 
## Why

`libz-sys` 1.1.29 is pulled in through `curl-sys`/`curl` in `codex-http-client` only on Windows, where it skips the affected probe. The lockfile also pins `cc` to 1.2.55, below 1.6.0.

## What changed

Add `RUSTSEC-2026-0418` to the `cargo-audit` and `cargo-deny` ignore lists with the rationale. Remove the exception when `libz-sys` reaches 1.1.31 or later, and reassess if it is used on Unix with `cc` 1.6.0 or later.

GitOrigin-RevId: 0e2ffb4686d9c77dfd7f1312aef6a093a803f832
This commit is contained in:
swastik-oai
2026-10-29 15:55:50 +00:00
committed by copyberry
parent 2681f8cba2
commit 02ca1e0d99
2 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/.cargo/audit.toml
+2
View File
@@ -23,4 +23,6 @@ ignore = [
"RUSTSEC-2026-0398", # zstd 0.13.3 pulls in zstd-safe 7.2.4 with the affected seekable feature disabled. Remove when all paths use zstd-safe >=8.2.0.
"RUSTSEC-2026-0403", # zstd 0.13.3 pulls in zstd-safe 7.2.4. Codex, tonic and zip use read decoders or initialized output buffers and discard output on error. Remove when all paths use zstd-safe >=8.2.0.
"RUSTSEC-2026-0410", # zstd-safe 7.2.4 pulls in zstd-sys 2.0.16. Its allocator bug only affects wasm32, and Codex ships native binaries. Remove when the lockfile uses zstd-sys >=2.1.2.
# Reviewed 2026-10-29.
"RUSTSEC-2026-0418", # libz-sys 1.1.29 via curl-sys/curl in codex-http-client is Windows-only and skips the affected probe; cc is locked to 1.2.55 (<1.6.0). Remove when libz-sys >=1.1.31; reassess if used on Unix with cc >=1.6.0.
]
codex-rs/deny.toml
+2
View File
@@ -95,6 +95,8 @@ ignore = [
{ id = "RUSTSEC-2026-0398", reason = "zstd 0.13.3 pulls in zstd-safe 7.2.4 with the affected seekable feature disabled. Remove when all paths use zstd-safe >=8.2.0." },
{ id = "RUSTSEC-2026-0403", reason = "zstd 0.13.3 pulls in zstd-safe 7.2.4. Codex, tonic and zip use read decoders or initialized output buffers and discard output on error. Remove when all paths use zstd-safe >=8.2.0." },
{ id = "RUSTSEC-2026-0410", reason = "zstd-safe 7.2.4 pulls in zstd-sys 2.0.16. Its allocator bug only affects wasm32, and Codex ships native binaries. Remove when the lockfile uses zstd-sys >=2.1.2." },
# Reviewed 2026-10-29.
{ id = "RUSTSEC-2026-0418", reason = "libz-sys 1.1.29 via curl-sys/curl in codex-http-client is Windows-only and skips the affected probe; cc is locked to 1.2.55 (<1.6.0). Remove when libz-sys >=1.1.31; reassess if used on Unix with cc >=1.6.0." },
]
# If this is true, then cargo deny will use the git executable to fetch advisory database.
# If this is false, then it uses a built-in git library.