openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-21 17:48:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ignore the basic-toml advisory in dependency audits (#55547)

Browse Source 
`codex-secrets` pulls in unmaintained `basic-toml` 0.1.10 through the localization dependencies of `age` 0.12.1, and no patched release is available.

Add `RUSTSEC-2026-0374` to the `cargo audit` and `cargo deny` ignore lists. Document that the exception should be removed when the localization dependencies of `age` migrate off `basic-toml`.

GitOrigin-RevId: 92f31b687e91a73620e6f7f9a1b7c94790d9149d
This commit is contained in:
jif
2026-10-20 11:55:08 +00:00
committed by copyberry
parent b2aa07db8a
commit 4dbd9d30ea
2 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/.cargo/audit.toml
+2
View File
@@ -15,4 +15,6 @@ ignore = [
"RUSTSEC-2026-0370", # zvariant 4.2.0 via zbus 4.4.0 in Linux TUI and keyring/secret-service; remove when those paths migrate off the retired standalone crates
"RUSTSEC-2026-0371", # zbus_names 3.0.0 via zbus 4.4.0 in Linux TUI and keyring/secret-service; remove when those paths migrate off the retired standalone crates
"RUSTSEC-2026-0372", # zvariant_derive 4.2.0 via zbus 4.4.0 in Linux TUI and keyring/secret-service; remove when those paths migrate off the retired standalone crates
# Reviewed 2026-10-20.
"RUSTSEC-2026-0374", # basic-toml 0.1.10 via i18n-config/i18n-embed-fl under age 0.12.1 in codex-secrets; no patched release; remove when age's localization dependencies migrate off basic-toml
]
codex-rs/deny.toml
+2
View File
@@ -87,6 +87,8 @@ ignore = [
{ id = "RUSTSEC-2026-0370", reason = "zvariant 4.2.0 is unmaintained; pulled in via zbus 4.4.0 by Linux TUI accessibility integration and keyring/secret-service; remove when those paths migrate off the retired standalone crates" },
{ id = "RUSTSEC-2026-0371", reason = "zbus_names 3.0.0 is unmaintained; pulled in via zbus 4.4.0 by Linux TUI accessibility integration and keyring/secret-service; remove when those paths migrate off the retired standalone crates" },
{ id = "RUSTSEC-2026-0372", reason = "zvariant_derive 4.2.0 is unmaintained; pulled in via zbus 4.4.0 by Linux TUI accessibility integration and keyring/secret-service; remove when those paths migrate off the retired standalone crates" },
# Reviewed 2026-10-20.
{ id = "RUSTSEC-2026-0374", reason = "basic-toml 0.1.10 is unmaintained; pulled in via i18n-config/i18n-embed-fl under age 0.12.1 used by codex-secrets; no patched release; remove when age's localization dependencies migrate off basic-toml" },
]
# If this is true, then cargo deny will use the git executable to fetch advisory database.
# If this is false, then it uses a built-in git library.