From 2be3dd3ff3afe74205ed341e1eec2ed8f298ee48 Mon Sep 17 00:00:00 2001 From: jif Date: Thu, 5 Nov 2026 11:09:12 +0000 Subject: [PATCH] Ignore the unmaintained pin-utils advisory in dependency audits (#59638) ## Why `pin-utils` 0.1.0 is unmaintained with no patched release and remains a transitive dependency through AWS Smithy and `loom` under `tokio-graceful`. ## What changed Add `RUSTSEC-2026-0441` to the ignore lists in `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml`. Document the dependency paths and remove the exception when they drop `pin-utils`. GitOrigin-RevId: 803d519ad3ad044d49d73ff2a172c6e0b01fc8d3 --- codex-rs/.cargo/audit.toml | 2 ++ codex-rs/deny.toml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/codex-rs/.cargo/audit.toml b/codex-rs/.cargo/audit.toml index 4abf907b90..04183859b4 100644 --- a/codex-rs/.cargo/audit.toml +++ b/codex-rs/.cargo/audit.toml @@ -25,4 +25,6 @@ ignore = [ "RUSTSEC-2026-0410", # zstd-safe 7.2.4 pulls in zstd-sys 2.0.16. Its allocator bug only affects wasm32, and Codex ships native binaries. Remove when the lockfile uses zstd-sys >=2.1.2. # Reviewed 2026-10-29. "RUSTSEC-2026-0418", # libz-sys 1.1.29 via curl-sys/curl in codex-http-client is Windows-only and skips the affected probe; cc is locked to 1.2.55 (<1.6.0). Remove when libz-sys >=1.1.31; reassess if used on Unix with cc >=1.6.0. + # Reviewed 2026-11-05. + "RUSTSEC-2026-0441", # pin-utils 0.1.0 via AWS Smithy and loom under tokio-graceful; unmaintained with no patched release; remove when these paths drop pin-utils ] diff --git a/codex-rs/deny.toml b/codex-rs/deny.toml index e7cc99e554..c35ab7e4b7 100644 --- a/codex-rs/deny.toml +++ b/codex-rs/deny.toml @@ -96,6 +96,8 @@ ignore = [ { id = "RUSTSEC-2026-0410", reason = "zstd-safe 7.2.4 pulls in zstd-sys 2.0.16. Its allocator bug only affects wasm32, and Codex ships native binaries. Remove when the lockfile uses zstd-sys >=2.1.2." }, # Reviewed 2026-10-29. { id = "RUSTSEC-2026-0418", reason = "libz-sys 1.1.29 via curl-sys/curl in codex-http-client is Windows-only and skips the affected probe; cc is locked to 1.2.55 (<1.6.0). Remove when libz-sys >=1.1.31; reassess if used on Unix with cc >=1.6.0." }, + # Reviewed 2026-11-05. + { id = "RUSTSEC-2026-0441", reason = "pin-utils 0.1.0 is unmaintained; pulled in via aws-smithy-http/aws-smithy-runtime/aws-smithy-types and loom under tokio-graceful; no patched release; remove when these dependency paths drop pin-utils" }, ] # If this is true, then cargo deny will use the git executable to fetch advisory database. # If this is false, then it uses a built-in git library.