openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-08 20:40:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ignore the unmaintained pin-utils advisory in dependency audits (#59638)

Browse Source 
## Why

`pin-utils` 0.1.0 is unmaintained with no patched release and remains a transitive dependency through AWS Smithy and `loom` under `tokio-graceful`.

## What changed

Add `RUSTSEC-2026-0441` to the ignore lists in `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml`. Document the dependency paths and remove the exception when they drop `pin-utils`.

GitOrigin-RevId: 803d519ad3ad044d49d73ff2a172c6e0b01fc8d3
This commit is contained in:
jif
2026-11-05 11:22:06 +00:00
committed by copyberry
parent d4902cedbf
commit 2be3dd3ff3
2 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/.cargo/audit.toml
+2
View File
@@ -25,4 +25,6 @@ ignore = [
"RUSTSEC-2026-0410", # zstd-safe 7.2.4 pulls in zstd-sys 2.0.16. Its allocator bug only affects wasm32, and Codex ships native binaries. Remove when the lockfile uses zstd-sys >=2.1.2.
# Reviewed 2026-10-29.
"RUSTSEC-2026-0418", # libz-sys 1.1.29 via curl-sys/curl in codex-http-client is Windows-only and skips the affected probe; cc is locked to 1.2.55 (<1.6.0). Remove when libz-sys >=1.1.31; reassess if used on Unix with cc >=1.6.0.
# Reviewed 2026-11-05.
"RUSTSEC-2026-0441", # pin-utils 0.1.0 via AWS Smithy and loom under tokio-graceful; unmaintained with no patched release; remove when these paths drop pin-utils
]