From 8eee4e699fd476eed1a109a260ca2594ea4ed38b Mon Sep 17 00:00:00 2001 From: Michael Bolin Date: Wed, 22 Apr 2026 09:33:55 -0700 Subject: [PATCH] fix: document cargo deny advisory exceptions --- codex-rs/.cargo/audit.toml | 2 ++ codex-rs/deny.toml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/codex-rs/.cargo/audit.toml b/codex-rs/.cargo/audit.toml index 4d9e4b81ed..4c1f1098f5 100644 --- a/codex-rs/.cargo/audit.toml +++ b/codex-rs/.cargo/audit.toml @@ -4,6 +4,8 @@ ignore = [ "RUSTSEC-2024-0388", # derivative 2.2.0 via starlark; upstream crate is unmaintained "RUSTSEC-2025-0057", # fxhash 0.2.1 via starlark_map; upstream crate is unmaintained "RUSTSEC-2024-0436", # paste 1.0.15 via starlark/ratatui; upstream crate is unmaintained + "RUSTSEC-2026-0097", # rand 0.8.5 via age/codex-secrets, oauth2/rmcp, and codex-windows-sandbox; remove when these paths move to rand >=0.8.6 + "RUSTSEC-2026-0002", # lru 0.12.5 via pinned nornagon/ratatui v0.29.0; remove when ratatui moves to lru >=0.16.3 "RUSTSEC-2024-0320", # yaml-rust via syntect; remove when syntect drops or updates it "RUSTSEC-2025-0141", # bincode via syntect; remove when syntect drops or updates it ] diff --git a/codex-rs/deny.toml b/codex-rs/deny.toml index b153ba80a8..7320e8f7fa 100644 --- a/codex-rs/deny.toml +++ b/codex-rs/deny.toml @@ -75,6 +75,8 @@ ignore = [ { id = "RUSTSEC-2024-0388", reason = "derivative is unmaintained; pulled in via starlark v0.13.0 used by execpolicy/cli/core; no fixed release yet" }, { id = "RUSTSEC-2025-0057", reason = "fxhash is unmaintained; pulled in via starlark_map/starlark v0.13.0 used by execpolicy/cli/core; no fixed release yet" }, { id = "RUSTSEC-2024-0436", reason = "paste is unmaintained; pulled in via ratatui/rmcp/starlark used by tui/execpolicy; no fixed release yet" }, + { id = "RUSTSEC-2026-0097", reason = "rand 0.8.5 is pulled in via age/codex-secrets, oauth2/rmcp, and codex-windows-sandbox; remove when these paths move to rand >=0.8.6" }, + { id = "RUSTSEC-2026-0002", reason = "lru 0.12.5 is pulled in by pinned nornagon/ratatui v0.29.0 used by codex-tui/ansi-to-tui; remove when ratatui moves to lru >=0.16.3" }, # TODO(fcoury): remove this exception when syntect drops yaml-rust and bincode, or updates to versions that have fixed the vulnerabilities. { id = "RUSTSEC-2024-0320", reason = "yaml-rust is unmaintained; pulled in via syntect v5.3.0 used by codex-tui for syntax highlighting; no fixed release yet" }, { id = "RUSTSEC-2025-0141", reason = "bincode is unmaintained; pulled in via syntect v5.3.0 used by codex-tui for syntax highlighting; no fixed release yet" },