Chris Bookholt
0c28ba5ce2
codex: fix CI failure on PR #30854
2026-07-06 19:11:04 -07:00
Chris Bookholt
fd873645bf
Merge commit '8745d144d4' into codex/psec-4394-git-06-merge-guard
...
# Conflicts:
# codex-rs/git-utils/src/apply.rs
2026-07-06 18:55:29 -07:00
Chris Bookholt
8745d144d4
Merge commit '6602a13645c5c167fb14dae5403b489ffe806542' into codex/psec-4394-git-05b-stage-filters
...
# Conflicts:
# codex-rs/git-utils/src/patch_paths.rs
2026-07-06 16:26:41 -07:00
Chris Bookholt
6602a13645
Merge commit '17446f56e9' into codex/psec-4394-git-05a-apply-filters
2026-07-06 16:14:09 -07:00
Chris Bookholt
17446f56e9
Merge commit '26ce6873cd' into codex/psec-4394-git-04d-guarded-apply
2026-07-06 16:13:42 -07:00
Chris Bookholt
26ce6873cd
test(git): assert Windows sharing violation
2026-07-06 16:13:28 -07:00
Chris Bookholt
1e95101009
Merge commit '39b48cbd26fd3e365705aa2d74403e4c46a77f2e' into codex/psec-4394-git-05a-apply-filters
2026-07-06 16:08:25 -07:00
Chris Bookholt
39b48cbd26
Merge commit '289b572dd0ac7038531cb5b9e197fd73a523b492' into codex/psec-4394-git-04d-guarded-apply
...
# Conflicts:
# codex-rs/git-utils/src/apply.rs
# codex-rs/git-utils/src/patch_paths.rs
2026-07-06 16:07:14 -07:00
Chris Bookholt
143d2f56c8
Merge commit 'a69db7b619bf380327fc7369dd2b0fc98590314d' into codex/psec-4394-git-04c-include-config-authority
...
# Conflicts:
# codex-rs/git-utils/src/apply.rs
# codex-rs/git-utils/src/patch_paths.rs
2026-07-06 15:54:02 -07:00
Chris Bookholt
a69db7b619
fix(deps): update crossbeam-epoch
2026-07-06 15:34:53 -07:00
Chris Bookholt
c56bd60054
fix(git): reject process-relative procfs config
2026-07-06 15:27:36 -07:00
Chris Bookholt
a7bcf8c1a2
Merge branch 'codex/psec-4394-git-04a-config-env' into codex/psec-4394-git-04b-primary-config-authority
2026-07-03 20:32:40 -07:00
Chris Bookholt
f6adc9fbcc
fix(git): preserve patch parsing compatibility
2026-07-03 20:32:11 -07:00
Chris Bookholt
6b986f98ea
Merge branch 'codex/psec-4394-git-05a-apply-filters' into codex/psec-4394-git-05b-stage-filters
2026-07-03 20:12:18 -07:00
Chris Bookholt
79728df6d2
Merge branch 'codex/psec-4394-git-05a-apply-filters' into codex/psec-4394-git-05b-stage-filters
...
# Conflicts:
# codex-rs/git-utils/src/apply.rs
# codex-rs/git-utils/src/patch_paths.rs
2026-07-03 20:12:08 -07:00
Chris Bookholt
cc35a0c884
fix(git): accept empty config count
2026-07-03 20:10:31 -07:00
Chris Bookholt
7311b9f007
Merge branch 'codex/psec-4394-git-04d-guarded-apply' into codex/psec-4394-git-05a-apply-filters
2026-07-03 19:55:34 -07:00
Chris Bookholt
fce28dc63f
Merge branch 'codex/psec-4394-git-04c-include-config-authority' into codex/psec-4394-git-04d-guarded-apply
2026-07-03 19:54:43 -07:00
Chris Bookholt
380d6ebd62
test(git): respect Windows repository handle pinning
2026-07-03 19:53:49 -07:00
Chris Bookholt
ea3a1c1d4d
Merge branch 'codex/psec-4394-git-04d-guarded-apply' into codex/psec-4394-git-05a-apply-filters
2026-07-03 19:16:58 -07:00
Chris Bookholt
62c56ee3ac
Merge branch 'codex/psec-4394-git-04d-guarded-apply' into codex/psec-4394-git-05a-apply-filters
...
# Conflicts:
# codex-rs/git-utils/src/apply.rs
# codex-rs/git-utils/src/git_command.rs
# codex-rs/git-utils/src/git_config.rs
# codex-rs/git-utils/src/git_config_sources/primary_sources.rs
# codex-rs/git-utils/src/git_config_sources_tests.rs
# codex-rs/git-utils/src/git_config_tests.rs
# codex-rs/git-utils/src/guarded_config.rs
# codex-rs/git-utils/src/guarded_config_tests.rs
# codex-rs/git-utils/src/patch_paths.rs
# codex-rs/git-utils/src/patch_paths_tests.rs
# codex-rs/git-utils/src/repository_authority/authority.rs
2026-07-03 19:15:58 -07:00
Chris Bookholt
a61016c0bd
Merge branch 'codex/psec-4394-git-04c-include-config-authority' into codex/psec-4394-git-04d-guarded-apply
2026-07-03 19:08:47 -07:00
Chris Bookholt
7f043fda30
Merge branch 'codex/psec-4394-git-04b-primary-config-authority' into codex/psec-4394-git-04c-include-config-authority
2026-07-03 19:08:36 -07:00
Chris Bookholt
409f1f78e7
test(git): allow staged Windows helper
2026-07-03 19:08:26 -07:00
Chris Bookholt
d018906d57
Merge branch 'codex/psec-4394-git-04c-include-config-authority' into codex/psec-4394-git-04d-guarded-apply
2026-07-03 18:56:20 -07:00
Chris Bookholt
9d8d964f7d
Merge branch 'codex/psec-4394-git-04b-primary-config-authority' into codex/psec-4394-git-04c-include-config-authority
2026-07-03 18:56:05 -07:00
Chris Bookholt
7500615875
Merge branch 'codex/psec-4394-git-04a-config-env' into codex/psec-4394-git-04b-primary-config-authority
2026-07-03 18:55:52 -07:00
Chris Bookholt
f6b6a4951f
fix(git): allow staged config accessor
2026-07-03 18:55:35 -07:00
Chris Bookholt
463eed4400
fix(git): bind guarded patch operations
2026-07-03 18:36:13 -07:00
Chris Bookholt
9c2e1342a4
fix(git): authorize included config sources
2026-07-03 18:34:27 -07:00
Chris Bookholt
3e1688f2cb
fix(git): authorize primary config sources
2026-07-03 18:32:25 -07:00
Chris Bookholt
21ca43303b
fix(git): bind configuration environment
2026-07-03 18:29:53 -07:00
Chris Bookholt
0b46244061
fix(git): satisfy child-layer lint
2026-07-03 18:22:22 -07:00
Chris Bookholt
933f7528a9
Merge branch 'codex/psec-4394-git-05b-stage-filters' into codex/psec-4394-git-06-merge-guard
2026-07-03 17:53:02 -07:00
Chris Bookholt
809d6129a3
test(git): allow platform-specific staging hook
2026-07-03 17:52:35 -07:00
Chris Bookholt
6f6eaa977b
Merge branch 'codex/psec-4394-git-05b-stage-filters' into codex/psec-4394-git-06-merge-guard
...
# Conflicts:
# codex-rs/git-utils/src/patch_paths.rs
2026-07-03 17:48:55 -07:00
Chris Bookholt
92d1967d21
fix(git): bind staging to repository authority
2026-07-03 17:31:39 -07:00
Chris Bookholt
7da7bcc8cd
fix(git): pass native paths to isolated apply
2026-07-03 17:19:26 -07:00
Chris Bookholt
653b79082c
test(git): expose three-way apply failures
2026-07-03 16:31:36 -07:00
Chris Bookholt
49664d3c75
codex/git: isolate three-way reverse staging
2026-07-03 16:13:55 -07:00
Chris Bookholt
6b40c77a0f
fix(git-utils): parse Git boolean syntax consistently
2026-07-03 15:55:43 -07:00
Chris Bookholt
0b31ecb5bb
Merge branch 'codex/psec-4394-git-05b-stage-filters' into codex/psec-4394-git-06-merge-guard
2026-07-02 12:07:32 -07:00
Chris Bookholt
e674ac9a52
Merge branch 'codex/psec-4394-git-05a-apply-filters' into codex/psec-4394-git-05b-stage-filters
2026-07-02 12:07:12 -07:00
Chris Bookholt
80c59de030
Merge branch 'codex/psec-4394-repository-authority' into codex/psec-4394-git-05a-apply-filters
2026-07-02 12:06:50 -07:00
Chris Bookholt
e8e8178e3a
Merge branch 'codex/psec-4394-git-03-path-containment' into codex/psec-4394-repository-authority
2026-07-02 12:06:19 -07:00
Chris Bookholt
f1c0d32986
Merge branch 'codex/psec-4394-git-02-effective-patch-paths' into codex/psec-4394-git-03-path-containment
2026-07-02 12:06:00 -07:00
Chris Bookholt
80d4da92f0
Merge branch 'codex/psec-4394-trusted-git-runner' into codex/psec-4394-git-02-effective-patch-paths
2026-07-02 12:05:45 -07:00
Chris Bookholt
63f6aa5da5
Merge branch 'bookholt/deny-transport-for-local-git' into codex/psec-4394-trusted-git-runner
2026-07-02 12:05:27 -07:00
Chris Bookholt
83e062ebaa
Merge remote-tracking branch 'origin/main' into bookholt/deny-transport-for-local-git
2026-07-02 12:05:07 -07:00
Michael Bolin
0ccb676dd0
fix: address quick-xml security advisories ( #30941 )
...
## Why
The `cargo-deny` job on `main` began failing after
[RUSTSEC-2026-0194](https://rustsec.org/advisories/RUSTSEC-2026-0194 )
and
[RUSTSEC-2026-0195](https://rustsec.org/advisories/RUSTSEC-2026-0195 )
flagged the workspace `quick-xml 0.38.4`. Both denial-of-service issues
are fixed in `quick-xml 0.41.0`.
A `quick-xml 0.39.4` copy must temporarily remain because the latest
`plist` and `wayland-scanner` releases have not adopted 0.41 yet.
Neither retained path accepts attacker-controlled XML at runtime:
`plist` does not exercise the affected APIs, and `wayland-scanner`
parses trusted protocol definitions at build time. Compatible upstream
bumps are already open in
[rust-plist#191](https://github.com/ebarnard/rust-plist/pull/191 ) and
[wayland-rs#938](https://github.com/Smithay/wayland-rs/pull/938 ).
## What changed
- Upgrade the workspace `quick-xml` dependency used by `codex-protocol`
to 0.41.0.
- Refresh `Cargo.lock` and `MODULE.bazel.lock`; this also updates
`plist` to 1.9.0 and `wayland-scanner` to 0.31.10.
- Add synchronized, temporary `cargo-deny` and `cargo-audit` exceptions
for the trusted `quick-xml 0.39.4` paths, with both upstream releases
recorded as the removal condition.
## Testing
- `cargo deny check`
- `just test -p codex-protocol` (238 tests)
- `just bazel-lock-check`
2026-07-02 10:59:00 -07:00
Chris Bookholt