openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-10 20:26:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(core): tighten syntect policy and monitor wording

Browse Source 
Pin `syntect` to `=5.3.0` and add explicit review dates to the
existing `RUSTSEC-2024-0320` and `RUSTSEC-2025-0141` exceptions in
`deny.toml` so dependency risk review stays deliberate.

Fix grammar in `core/src/agent/builtins/monitor.toml` developer
instructions and add a realtime conversation test that returns `None`
when a message item is missing `content`.
This commit is contained in:
Felipe Coury
2026-02-22 19:35:11 -03:00
committed by Felipe Coury
parent f704629368
commit 81642155e2
3 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
codex-rs/Cargo.toml
View File

@@ -312,7 +312,10 @@ starlark = "0.13.0"
strum = "0.27.2"
strum_macros = "0.28.0"
supports-color = "3.0.2"
syntect = "5"
# Keep syntect pinned while we carry explicit deny.toml exceptions for
# RUSTSEC-2024-0320 / RUSTSEC-2025-0141; re-evaluate replacement/upgrade
# once transitive dependencies are maintained.
syntect = "=5.3.0"
sys-locale = "0.3.2"
tempfile = "3.23.0"
test-log = "0.2.19"

2
codex-rs/core/src/agent/builtins/awaiter.toml
View File

@@ -19,7 +19,7 @@ Behavior rules:
- If the task is still running, continue polling using tool calls.
- Use repeated tool calls if necessary.
- Do not hallucinate completion.
- Use long timeouts when awaiting for something. If you need multiple awaits, increase the timeouts/yield times exponentially.
- Use long timeouts when awaiting something. If you need multiple awaits, increase the timeouts/yield times exponentially.
4. If asked for status:
- Return the current known status.

4
codex-rs/deny.toml
View File

@@ -81,8 +81,8 @@ ignore = [
{ id = "RUSTSEC-2026-0048", reason = "aws-lc-rs/aws-lc-sys are pulled in transitively via rustls stack dependencies; upgrade will be handled separately from this hooks PR" },
{ id = "RUSTSEC-2026-0049", reason = "aws-lc-rs/aws-lc-sys are pulled in transitively via rustls stack dependencies; upgrade will be handled separately from this hooks PR" },
# TODO(fcoury): remove this exception when syntect drops yaml-rust and bincode, or updates to versions that have fixed the vulnerabilities.
{ id = "RUSTSEC-2024-0320", reason = "yaml-rust is unmaintained; pulled in via syntect v5.3.0 used by codex-tui for syntax highlighting; no fixed release yet" },
{ id = "RUSTSEC-2025-0141", reason = "bincode is unmaintained; pulled in via syntect v5.3.0 used by codex-tui for syntax highlighting; no fixed release yet" },
{ id = "RUSTSEC-2024-0320", reason = "yaml-rust is unmaintained; pulled in via syntect v5.3.0 used by codex-tui for syntax highlighting; no fixed release yet; review by 2026-06-30" },
{ id = "RUSTSEC-2025-0141", reason = "bincode is unmaintained; pulled in via syntect v5.3.0 used by codex-tui for syntax highlighting; no fixed release yet; review by 2026-06-30" },
]
# If this is true, then cargo deny will use the git executable to fetch advisory database.
# If this is false, then it uses a built-in git library.