From 81642155e2f89823ca920d9df95936cfe883545f Mon Sep 17 00:00:00 2001 From: Felipe Coury Date: Sun, 22 Feb 2026 19:35:11 -0300 Subject: [PATCH] chore(core): tighten syntect policy and monitor wording Pin `syntect` to `=5.3.0` and add explicit review dates to the existing `RUSTSEC-2024-0320` and `RUSTSEC-2025-0141` exceptions in `deny.toml` so dependency risk review stays deliberate. Fix grammar in `core/src/agent/builtins/monitor.toml` developer instructions and add a realtime conversation test that returns `None` when a message item is missing `content`. --- codex-rs/Cargo.toml | 5 ++++- codex-rs/core/src/agent/builtins/awaiter.toml | 2 +- codex-rs/deny.toml | 4 ++-- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/codex-rs/Cargo.toml b/codex-rs/Cargo.toml index 16329276cd..8d16a4217d 100644 --- a/codex-rs/Cargo.toml +++ b/codex-rs/Cargo.toml @@ -312,7 +312,10 @@ starlark = "0.13.0" strum = "0.27.2" strum_macros = "0.28.0" supports-color = "3.0.2" -syntect = "5" +# Keep syntect pinned while we carry explicit deny.toml exceptions for +# RUSTSEC-2024-0320 / RUSTSEC-2025-0141; re-evaluate replacement/upgrade +# once transitive dependencies are maintained. +syntect = "=5.3.0" sys-locale = "0.3.2" tempfile = "3.23.0" test-log = "0.2.19" diff --git a/codex-rs/core/src/agent/builtins/awaiter.toml b/codex-rs/core/src/agent/builtins/awaiter.toml index a34583c0c9..b552de6130 100644 --- a/codex-rs/core/src/agent/builtins/awaiter.toml +++ b/codex-rs/core/src/agent/builtins/awaiter.toml @@ -19,7 +19,7 @@ Behavior rules: - If the task is still running, continue polling using tool calls. - Use repeated tool calls if necessary. - Do not hallucinate completion. - - Use long timeouts when awaiting for something. If you need multiple awaits, increase the timeouts/yield times exponentially. + - Use long timeouts when awaiting something. If you need multiple awaits, increase the timeouts/yield times exponentially. 4. If asked for status: - Return the current known status. diff --git a/codex-rs/deny.toml b/codex-rs/deny.toml index 3dd27c8f93..c5a3ac6eaa 100644 --- a/codex-rs/deny.toml +++ b/codex-rs/deny.toml @@ -81,8 +81,8 @@ ignore = [ { id = "RUSTSEC-2026-0048", reason = "aws-lc-rs/aws-lc-sys are pulled in transitively via rustls stack dependencies; upgrade will be handled separately from this hooks PR" }, { id = "RUSTSEC-2026-0049", reason = "aws-lc-rs/aws-lc-sys are pulled in transitively via rustls stack dependencies; upgrade will be handled separately from this hooks PR" }, # TODO(fcoury): remove this exception when syntect drops yaml-rust and bincode, or updates to versions that have fixed the vulnerabilities. - { id = "RUSTSEC-2024-0320", reason = "yaml-rust is unmaintained; pulled in via syntect v5.3.0 used by codex-tui for syntax highlighting; no fixed release yet" }, - { id = "RUSTSEC-2025-0141", reason = "bincode is unmaintained; pulled in via syntect v5.3.0 used by codex-tui for syntax highlighting; no fixed release yet" }, + { id = "RUSTSEC-2024-0320", reason = "yaml-rust is unmaintained; pulled in via syntect v5.3.0 used by codex-tui for syntax highlighting; no fixed release yet; review by 2026-06-30" }, + { id = "RUSTSEC-2025-0141", reason = "bincode is unmaintained; pulled in via syntect v5.3.0 used by codex-tui for syntax highlighting; no fixed release yet; review by 2026-06-30" }, ] # If this is true, then cargo deny will use the git executable to fetch advisory database. # If this is false, then it uses a built-in git library.