deps: update starlark to 0.14.0

codex-rs/.cargo/audit.toml

@@ -1,9 +1,11 @@
 [advisories]
-# Reviewed 2026-04-15. Keep this list in sync with ../deny.toml.
+# Reviewed 2026-05-27. Keep this list in sync with ../deny.toml.
 ignore = [
-    "RUSTSEC-2024-0388", # derivative 2.2.0 via starlark; upstream crate is unmaintained
-    "RUSTSEC-2025-0057", # fxhash 0.2.1 via starlark_map; upstream crate is unmaintained
+    "RUSTSEC-2024-0388", # derivative 2.2.0 via starlark/starlark_syntax; upstream crate is unmaintained
+    "RUSTSEC-2025-0057", # fxhash 0.2.1 via starlark_map/sled; upstream crate is unmaintained
     "RUSTSEC-2024-0436", # paste 1.0.15 via starlark/ratatui; upstream crate is unmaintained
+    "RUSTSEC-2023-0089", # atomic-polyfill via postcard/heapless/pagable; upstream crate is unmaintained
+    "RUSTSEC-2024-0384", # instant via parking_lot/sled/pagable; upstream crate is unmaintained
     "RUSTSEC-2024-0320", # yaml-rust via syntect; remove when syntect drops or updates it
     "RUSTSEC-2025-0141", # bincode via syntect; remove when syntect drops or updates it
     "RUSTSEC-2026-0118", # hickory-proto via rama-dns/rama-tcp; remove when rama updates to hickory 0.26.1 or hickory-net

codex-rs/Cargo.toml

@@ -131,30 +131,30 @@ license = "Apache-2.0"
 [workspace.dependencies]
 # Internal
 app_test_support = { path = "app-server/tests/common" }
-codex-analytics = { path = "analytics" }
 codex-agent-graph-store = { path = "agent-graph-store" }
 codex-agent-identity = { path = "agent-identity" }
+codex-analytics = { path = "analytics" }
 codex-ansi-escape = { path = "ansi-escape" }
 codex-api = { path = "codex-api" }
-codex-aws-auth = { path = "aws-auth" }
 codex-app-server = { path = "app-server" }
-codex-app-server-transport = { path = "app-server-transport" }
-codex-app-server-daemon = { path = "app-server-daemon" }
 codex-app-server-client = { path = "app-server-client" }
+codex-app-server-daemon = { path = "app-server-daemon" }
 codex-app-server-protocol = { path = "app-server-protocol" }
 codex-app-server-test-client = { path = "app-server-test-client" }
+codex-app-server-transport = { path = "app-server-transport" }
 codex-apply-patch = { path = "apply-patch" }
 codex-arg0 = { path = "arg0" }
 codex-async-utils = { path = "async-utils" }
+codex-aws-auth = { path = "aws-auth" }
 codex-backend-client = { path = "backend-client" }
 codex-chatgpt = { path = "chatgpt" }
 codex-cli = { path = "cli" }
 codex-client = { path = "codex-client" }
-codex-collaboration-mode-templates = { path = "collaboration-mode-templates" }
 codex-cloud-config = { path = "cloud-config" }
 codex-cloud-tasks-client = { path = "cloud-tasks-client" }
 codex-cloud-tasks-mock-client = { path = "cloud-tasks-mock-client" }
 codex-code-mode = { path = "code-mode" }
+codex-collaboration-mode-templates = { path = "collaboration-mode-templates" }
 codex-config = { path = "config" }
 codex-connectors = { path = "connectors" }
 codex-context-fragments = { path = "context-fragments" }
@@ -163,47 +163,46 @@ codex-core-api = { path = "core-api" }
 codex-core-plugins = { path = "core-plugins" }
 codex-core-skills = { path = "core-skills" }
 codex-exec = { path = "exec" }
-codex-file-system = { path = "file-system" }
 codex-exec-server = { path = "exec-server" }
 codex-execpolicy = { path = "execpolicy" }
+codex-experimental-api-macros = { path = "codex-experimental-api-macros" }
 codex-extension-api = { path = "ext/extension-api" }
-codex-goal-extension = { path = "ext/goal" }
-codex-guardian = { path = "ext/guardian" }
-codex-image-generation-extension = { path = "ext/image-generation" }
 codex-external-agent-migration = { path = "external-agent-migration" }
 codex-external-agent-sessions = { path = "external-agent-sessions" }
-codex-experimental-api-macros = { path = "codex-experimental-api-macros" }
 codex-features = { path = "features" }
 codex-feedback = { path = "feedback" }
-codex-install-context = { path = "install-context" }
 codex-file-search = { path = "file-search" }
+codex-file-system = { path = "file-system" }
 codex-file-watcher = { path = "file-watcher" }
 codex-git-utils = { path = "git-utils" }
+codex-goal-extension = { path = "ext/goal" }
+codex-guardian = { path = "ext/guardian" }
 codex-hooks = { path = "hooks" }
+codex-image-generation-extension = { path = "ext/image-generation" }
+codex-install-context = { path = "install-context" }
 codex-keyring-store = { path = "keyring-store" }
 codex-linux-sandbox = { path = "linux-sandbox" }
 codex-lmstudio = { path = "lmstudio" }
 codex-login = { path = "login" }
-codex-message-history = { path = "message-history" }
-codex-memories-extension = { path = "ext/memories" }
-codex-web-search-extension = { path = "ext/web-search" }
-codex-memories-read = { path = "memories/read" }
-codex-memories-write = { path = "memories/write" }
 codex-mcp = { path = "codex-mcp" }
 codex-mcp-server = { path = "mcp-server" }
+codex-memories-extension = { path = "ext/memories" }
+codex-memories-read = { path = "memories/read" }
+codex-memories-write = { path = "memories/write" }
+codex-message-history = { path = "message-history" }
+codex-model-provider = { path = "model-provider" }
 codex-model-provider-info = { path = "model-provider-info" }
 codex-models-manager = { path = "models-manager" }
 codex-network-proxy = { path = "network-proxy" }
 codex-ollama = { path = "ollama" }
 codex-otel = { path = "otel" }
 codex-plugin = { path = "plugin" }
-codex-model-provider = { path = "model-provider" }
 codex-process-hardening = { path = "process-hardening" }
+codex-prompts = { path = "prompts" }
 codex-protocol = { path = "protocol" }
 codex-realtime-webrtc = { path = "realtime-webrtc" }
-codex-prompts = { path = "prompts" }
-codex-responses-api-proxy = { path = "responses-api-proxy" }
 codex-response-debug-context = { path = "response-debug-context" }
+codex-responses-api-proxy = { path = "responses-api-proxy" }
 codex-rmcp-client = { path = "rmcp-client" }
 codex-rollout = { path = "rollout" }
 codex-rollout-trace = { path = "rollout-trace" }
@@ -242,6 +241,7 @@ codex-utils-stream-parser = { path = "utils/stream-parser" }
 codex-utils-string = { path = "utils/string" }
 codex-utils-template = { path = "utils/template" }
 codex-v8-poc = { path = "v8-poc" }
+codex-web-search-extension = { path = "ext/web-search" }
 codex-windows-sandbox = { path = "windows-sandbox-rs" }
 core_test_support = { path = "core/tests/common" }
 mcp_test_support = { path = "mcp-server/tests/common" }
@@ -274,8 +274,8 @@ clap_complete = "4"
 color-eyre = "0.6.3"
 constant_time_eq = "0.3.1"
 crossbeam-channel = "0.5.15"
-crypto_box = { version = "0.9.1", features = ["seal"] }
 crossterm = "0.28.1"
+crypto_box = { version = "0.9.1", features = ["seal"] }
 csv = "1.3.1"
 ctor = "0.6.3"
 deno_core_icudata = "0.77.0"
@@ -384,7 +384,7 @@ sqlx = { version = "0.9.0", default-features = false, features = [
     "time",
     "uuid",
 ] }
-starlark = "0.13.0"
+starlark = "0.14.2"
 strum = "0.27.2"
 strum_macros = "0.28.0"
 supports-color = "3.0.2"
@@ -407,13 +407,16 @@ tokio-tungstenite = { version = "0.28.0", features = [
 tokio-util = "0.7.18"
 toml = "0.9.5"
 toml_edit = "0.24.0"
+tonic = { version = "0.14.3", default-features = false, features = [
+    "channel",
+    "codegen",
+] }
+tonic-prost = "0.14.3"
 tracing = "0.1.44"
 tracing-appender = "0.2.3"
 tracing-opentelemetry = "0.32.0"
 tracing-subscriber = "0.3.22"
 tracing-test = "0.2.5"
-tonic = { version = "0.14.3", default-features = false, features = ["channel", "codegen"] }
-tonic-prost = "0.14.3"
 tree-sitter = "0.25.10"
 tree-sitter-bash = "0.25"
 ts-rs = "11"
@@ -494,9 +497,9 @@ ignored = [
 debug = "limited"
 
 [profile.dev-small]
+debug = "none"
 inherits = "dev"
 opt-level = 0
-debug = "none"
 strip = "symbols"
 
 [profile.release]
@@ -510,8 +513,8 @@ strip = "symbols"
 codegen-units = 1
 
 [profile.profiling]
-inherits = "release"
 debug = "full"
+inherits = "release"
 lto = false
 strip = false
 

codex-rs/deny.toml

@@ -70,11 +70,13 @@ feature-depth = 1
 # A list of advisory IDs to ignore. Note that ignored advisories will still
 # output a note when they are encountered.
 ignore = [
-    # Reviewed 2026-04-15. Keep this list in sync with .cargo/audit.toml.
+    # Reviewed 2026-05-27. Keep this list in sync with .cargo/audit.toml.
     # Each exception must identify the dependency path and removal condition.
-    { id = "RUSTSEC-2024-0388", reason = "derivative is unmaintained; pulled in via starlark v0.13.0 used by execpolicy/cli/core; no fixed release yet" },
-    { id = "RUSTSEC-2025-0057", reason = "fxhash is unmaintained; pulled in via starlark_map/starlark v0.13.0 used by execpolicy/cli/core; no fixed release yet" },
+    { id = "RUSTSEC-2024-0388", reason = "derivative is unmaintained; pulled in via starlark/starlark_syntax v0.14.0 used by execpolicy/cli/core; no fixed starlark release yet" },
+    { id = "RUSTSEC-2025-0057", reason = "fxhash is unmaintained; pulled in via starlark_map/sled under starlark v0.14.0 used by execpolicy/cli/core; no fixed starlark release yet" },
     { id = "RUSTSEC-2024-0436", reason = "paste is unmaintained; pulled in via ratatui/rmcp/starlark used by tui/execpolicy; no fixed release yet" },
+    { id = "RUSTSEC-2023-0089", reason = "atomic-polyfill is unmaintained; pulled in via postcard/heapless/pagable under starlark v0.14.0 used by execpolicy/cli/core; no fixed starlark release yet" },
+    { id = "RUSTSEC-2024-0384", reason = "instant is unmaintained; pulled in via parking_lot/sled/pagable under starlark v0.14.0 used by execpolicy/cli/core; no fixed starlark release yet" },
     # TODO(fcoury): remove this exception when syntect drops yaml-rust and bincode, or updates to versions that have fixed the vulnerabilities.
     { id = "RUSTSEC-2024-0320", reason = "yaml-rust is unmaintained; pulled in via syntect v5.3.0 used by codex-tui for syntax highlighting; no fixed release yet" },
     { id = "RUSTSEC-2025-0141", reason = "bincode is unmaintained; pulled in via syntect v5.3.0 used by codex-tui for syntax highlighting; no fixed release yet" },

codex-rs/execpolicy-legacy/src/arg_matcher.rs

@@ -95,7 +95,7 @@ impl ArgMatcherCardinality {
 }
 
 impl<'v> AllocValue<'v> for ArgMatcher {
-    fn alloc_value(self, heap: &'v Heap) -> Value<'v> {
+    fn alloc_value(self, heap: Heap<'v>) -> Value<'v> {
         heap.alloc_simple(self)
     }
 }

codex-rs/execpolicy-legacy/src/opt.rs

@@ -66,7 +66,7 @@ impl<'v> UnpackValue<'v> for Opt {
 }
 
 impl<'v> AllocValue<'v> for Opt {
-    fn alloc_value(self, heap: &'v Heap) -> Value<'v> {
+    fn alloc_value(self, heap: Heap<'v>) -> Value<'v> {
         heap.alloc_simple(self)
     }
 }

codex-rs/execpolicy-legacy/src/policy_parser.rs

@@ -15,7 +15,6 @@ use starlark::environment::Module;
 use starlark::eval::Evaluator;
 use starlark::syntax::AstModule;
 use starlark::syntax::Dialect;
-use starlark::values::Heap;
 use starlark::values::list::UnpackList;
 use starlark::values::none::NoneType;
 use std::cell::RefCell;
@@ -41,31 +40,28 @@ impl PolicyParser {
         let globals = GlobalsBuilder::extended_by(&[LibraryExtension::Typing])
             .with(policy_builtins)
             .build();
-        let module = Module::new();
-
-        let heap = Heap::new();
-
-        module.set("ARG_OPAQUE_VALUE", heap.alloc(ArgMatcher::OpaqueNonFile));
-        module.set("ARG_RFILE", heap.alloc(ArgMatcher::ReadableFile));
-        module.set("ARG_WFILE", heap.alloc(ArgMatcher::WriteableFile));
-        module.set("ARG_RFILES", heap.alloc(ArgMatcher::ReadableFiles));
-        module.set(
-            "ARG_RFILES_OR_CWD",
-            heap.alloc(ArgMatcher::ReadableFilesOrCwd),
-        );
-        module.set("ARG_POS_INT", heap.alloc(ArgMatcher::PositiveInteger));
-        module.set("ARG_SED_COMMAND", heap.alloc(ArgMatcher::SedCommand));
-        module.set(
-            "ARG_UNVERIFIED_VARARGS",
-            heap.alloc(ArgMatcher::UnverifiedVarargs),
-        );
-
         let policy_builder = PolicyBuilder::new();
-        {
+        Module::with_temp_heap(|module| {
+            let heap = module.heap();
+            module.set("ARG_OPAQUE_VALUE", heap.alloc(ArgMatcher::OpaqueNonFile));
+            module.set("ARG_RFILE", heap.alloc(ArgMatcher::ReadableFile));
+            module.set("ARG_WFILE", heap.alloc(ArgMatcher::WriteableFile));
+            module.set("ARG_RFILES", heap.alloc(ArgMatcher::ReadableFiles));
+            module.set(
+                "ARG_RFILES_OR_CWD",
+                heap.alloc(ArgMatcher::ReadableFilesOrCwd),
+            );
+            module.set("ARG_POS_INT", heap.alloc(ArgMatcher::PositiveInteger));
+            module.set("ARG_SED_COMMAND", heap.alloc(ArgMatcher::SedCommand));
+            module.set(
+                "ARG_UNVERIFIED_VARARGS",
+                heap.alloc(ArgMatcher::UnverifiedVarargs),
+            );
+
             let mut eval = Evaluator::new(&module);
             eval.extra = Some(&policy_builder);
-            eval.eval_module(ast, &globals)?;
-        }
+            eval.eval_module(ast, &globals).map(|_| ())
+        })?;
         let policy = policy_builder.build();
         policy.map_err(|e| starlark::Error::new_kind(starlark::ErrorKind::Other(e.into())))
     }

codex-rs/execpolicy/src/parser.rs

@@ -65,12 +65,13 @@ impl PolicyParser {
         )
         .map_err(Error::Starlark)?;
         let globals = GlobalsBuilder::standard().with(policy_builtins).build();
-        let module = Module::new();
-        {
+        Module::with_temp_heap(|module| {
             let mut eval = Evaluator::new(&module);
             eval.extra = Some(&self.builder);
-            eval.eval_module(ast, &globals).map_err(Error::Starlark)?;
-        }
+            eval.eval_module(ast, &globals)
+                .map(|_| ())
+                .map_err(Error::Starlark)
+        })?;
         self.builder
             .borrow()
             .validate_pending_examples_from(pending_validation_count)?;