Michael Bolin
3cf3c1c738
merge commit for archive created by Sapling
2025-09-16 21:25:12 -07:00
Michael Bolin
0749ef5999
fix: ensure pnpm is installed before running npm install
2025-09-16 21:25:03 -07:00
Michael Bolin
791d7b125f
fix: make GitHub Action publish to npm using trusted publishing ( #3431 )
2025-09-16 20:33:59 -07:00
Michael Bolin
d4f773a870
merge commit for archive created by Sapling
2025-09-16 20:14:52 -07:00
Michael Bolin
fba4b27243
fix: have the GitHub Action publish to npm
2025-09-16 20:14:46 -07:00
Michael Bolin
5e4345772d
Merge 6c39f1b9a1 into sapling-pr-archive-bolinfest
2025-09-16 20:09:03 -07:00
Michael Bolin
6c39f1b9a1
fix: have the GitHub Action publish to npm
2025-09-16 20:08:59 -07:00
Michael Bolin
250f7a6de1
Merge db44ab9a4a into sapling-pr-archive-bolinfest
2025-09-16 19:58:24 -07:00
Michael Bolin
db44ab9a4a
fix: have the GitHub Action publish to npm
2025-09-16 19:58:15 -07:00
dedrisian-oai
72733e34c4
Add dev message upon review out ( #3758 )
...
Proposal: We want to record a dev message like so:
```
{
"type": "message",
"role": "user",
"content": [
{
"type": "input_text",
"text": "<user_action>
<context>User initiated a review task. Here's the full review output from reviewer model. User may select one or more comments to resolve.</context>
<action>review</action>
<results>
{findings_str}
</results>
</user_action>"
}
]
},
```
Without showing in the chat transcript.
Rough idea, but it fixes issue where the user finishes a review thread,
and asks the parent "fix the rest of the review issues" thinking that
the parent knows about it.
### Question: Why not a tool call?
Because the agent didn't make the call, it was a human. + we haven't
implemented sub-agents yet, and we'll need to think about the way we
represent these human-led tool calls for the agent.
2025-09-16 18:43:32 -07:00
Jeremy Rose
b8d2b1a576
restyle thinking outputs ( #3755 )
...
<img width="1205" height="930" alt="Screenshot 2025-09-16 at 2 23 18 PM"
src="https://github.com/user-attachments/assets/bb2494f1-dd59-4bc9-9c4e-740605c999fd "
/>
2025-09-16 16:42:43 -07:00
dedrisian-oai
7fe4021f95
Review mode core updates ( #3701 )
...
1. Adds the environment prompt (including cwd) to review thread
2. Prepends the review prompt as a user message (temporary fix so the
instructions are not replaced on backend)
3. Sets reasoning to low
4. Sets default review model to `gpt-5-codex`
2025-09-16 13:36:51 -07:00
Dylan
11285655c4
fix: Record EnvironmentContext in SendUserTurn ( #3678 )
...
## Summary
SendUserTurn has not been correctly handling updates to policies. While
the tui protocol handles this in `Op::OverrideTurnContext`, the
SendUserTurn should be appending `EnvironmentContext` messages when the
sandbox settings change. MCP client behavior should match the cli
behavior, so we update `SendUserTurn` message to match.
## Testing
- [x] Added prompt caching tests
2025-09-16 11:32:20 -07:00
Ahmed Ibrahim
244687303b
Persist search items ( #3745 )
...
Let's record the search items because they are part of the history.
2025-09-16 18:02:15 +00:00
pakrym-oai
5e2c4f7e35
Update azure model provider example ( #3680 )
...
Make the section linkable.
2025-09-16 08:43:29 -07:00
Dylan
a8026d3846
fix: read-only escalations ( #3673 )
...
## Summary
Splitting out this smaller fix from #2694 - fixes the sandbox
permissions so Chat / read-only mode tool definition matches
expectations
## Testing
- [x] Tested locally
<img width="1271" height="629" alt="Screenshot 2025-09-15 at 2 51 19 PM"
src="https://github.com/user-attachments/assets/fcb247e4-30b6-4199-80d7-a2876d79ad7d "
/>
2025-09-15 19:01:10 -07:00
easong-openai
45bccd36b0
fix permissions alignment
2025-09-15 17:34:04 -07:00
dependabot[bot]
404c126fc3
chore(deps): bump wildmatch from 2.4.0 to 2.5.0 in /codex-rs ( #3619 )
...
Bumps [wildmatch](https://github.com/becheran/wildmatch ) from 2.4.0 to
2.5.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/becheran/wildmatch/releases ">wildmatch's
releases</a>.</em></p>
<blockquote>
<h2>v2.5.0</h2>
<p><a
href="https://redirect.github.com/becheran/wildmatch/pull/27 ">becheran/wildmatch#27</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/becheran/wildmatch/commit/b39902c120687e152f0835b21af51fa8e213231f "><code>b39902c</code></a>
chore: Release wildmatch version 2.5.0</li>
<li><a
href="https://github.com/becheran/wildmatch/commit/87a8cf4c8056149da42443593b5535e1fbeaee66 "><code>87a8cf4</code></a>
Merge pull request <a
href="https://redirect.github.com/becheran/wildmatch/issues/28 ">#28</a>
from smichaku/micha/fix-unicode-case-insensitive-matching</li>
<li><a
href="https://github.com/becheran/wildmatch/commit/a3ab4903f58626c17adac6edcdb0bbeacee778d7 "><code>a3ab490</code></a>
fix: Fix unicode matching for non-ASCII characters</li>
<li>See full diff in <a
href="https://github.com/becheran/wildmatch/compare/v2.4.0...v2.5.0 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-15 12:57:17 -07:00
dependabot[bot]
88027552dd
chore(deps): bump serde from 1.0.219 to 1.0.223 in /codex-rs ( #3618 )
...
Bumps [serde](https://github.com/serde-rs/serde ) from 1.0.219 to
1.0.223.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/serde-rs/serde/releases ">serde's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.223</h2>
<ul>
<li>Fix serde_core documentation links (<a
href="https://redirect.github.com/serde-rs/serde/issues/2978 ">#2978</a>)</li>
</ul>
<h2>v1.0.222</h2>
<ul>
<li>Make <code>serialize_with</code> attribute produce code that works
if respanned to 2024 edition (<a
href="https://redirect.github.com/serde-rs/serde/issues/2950 ">#2950</a>,
thanks <a href="https://github.com/aytey "><code>@aytey</code></a>)</li>
</ul>
<h2>v1.0.221</h2>
<ul>
<li>Documentation improvements (<a
href="https://redirect.github.com/serde-rs/serde/issues/2973 ">#2973</a>)</li>
<li>Deprecate <code>serde_if_integer128!</code> macro (<a
href="https://redirect.github.com/serde-rs/serde/issues/2975 ">#2975</a>)</li>
</ul>
<h2>v1.0.220</h2>
<ul>
<li>Add a way for data formats to depend on serde traits without waiting
for serde_derive compilation: <a
href="https://docs.rs/serde_core ">https://docs.rs/serde_core </a> (<a
href="https://redirect.github.com/serde-rs/serde/issues/2608 ">#2608</a>,
thanks <a
href="https://github.com/osiewicz "><code>@osiewicz</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/serde-rs/serde/commit/6c316d7cb5f3780d2a418d277a756516beeacc42 "><code>6c316d7</code></a>
Release 1.0.223</li>
<li><a
href="https://github.com/serde-rs/serde/commit/a4ac0c2bc6625ee83ddf4b35f11eca48f90ebae2 "><code>a4ac0c2</code></a>
Merge pull request <a
href="https://redirect.github.com/serde-rs/serde/issues/2978 ">#2978</a>
from dtolnay/htmlrooturl</li>
<li><a
href="https://github.com/serde-rs/serde/commit/ed76364f877a6ebc653a0339dcea89b9e3cc7507 "><code>ed76364</code></a>
Change serde_core's html_root_url to docs.rs/serde_core</li>
<li><a
href="https://github.com/serde-rs/serde/commit/57e21a1afa280ae982f19aea2776318fbcd711be "><code>57e21a1</code></a>
Release 1.0.222</li>
<li><a
href="https://github.com/serde-rs/serde/commit/bb58726133fb30b89ccea3e357eb91f4b2d460a0 "><code>bb58726</code></a>
Merge pull request <a
href="https://redirect.github.com/serde-rs/serde/issues/2950 ">#2950</a>
from aytey/fix_lifetime_issue_2024</li>
<li><a
href="https://github.com/serde-rs/serde/commit/3f6925125bae7837d918da63f2dba6efabad8dec "><code>3f69251</code></a>
Delete unneeded field of MapDeserializer</li>
<li><a
href="https://github.com/serde-rs/serde/commit/fd4decf2fe36a8e4408aefc493960141b8b0cd02 "><code>fd4decf</code></a>
Merge pull request <a
href="https://redirect.github.com/serde-rs/serde/issues/2976 ">#2976</a>
from dtolnay/content</li>
<li><a
href="https://github.com/serde-rs/serde/commit/00b1b6b2b5e6154eba81e2ad8c6a43b945583ad0 "><code>00b1b6b</code></a>
Move Content's Deserialize impl from serde_core to serde</li>
<li><a
href="https://github.com/serde-rs/serde/commit/cf141aa8c79a40fe7b7c5ac5dbfd28802f2e01f4 "><code>cf141aa</code></a>
Move Content's Clone impl from serde_core to serde</li>
<li><a
href="https://github.com/serde-rs/serde/commit/ff3aee490abff5267cac86f07e0301aa6d441760 "><code>ff3aee4</code></a>
Release 1.0.221</li>
<li>Additional commits viewable in <a
href="https://github.com/serde-rs/serde/compare/v1.0.219...v1.0.223 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-15 12:56:20 -07:00
Michael Bolin
ca8bd09d56
chore: simplify dep so serde=1 in Cargo.toml ( #3664 )
...
With this change, dependabot should just have to update `Cargo.lock` for
`serde`, e.g.:
- https://github.com/openai/codex/pull/3617
- https://github.com/openai/codex/pull/3618
2025-09-15 19:22:29 +00:00
Michael Bolin
d1fe339573
Merge b641f56cf9 into sapling-pr-archive-bolinfest
2025-09-15 12:02:39 -07:00
Michael Bolin
b641f56cf9
chore: simplify dep so serde=1 in Cargo.toml
2025-09-15 12:02:32 -07:00
dependabot[bot]
39ed8a7d26
chore(deps): bump serde_json from 1.0.143 to 1.0.145 in /codex-rs ( #3617 )
...
Bumps [serde_json](https://github.com/serde-rs/json ) from 1.0.143 to
1.0.145.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/serde-rs/json/releases ">serde_json's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.145</h2>
<ul>
<li>Raise serde version requirement to >=1.0.220</li>
</ul>
<h2>v1.0.144</h2>
<ul>
<li>Switch serde dependency to serde_core (<a
href="https://redirect.github.com/serde-rs/json/issues/1285 ">#1285</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/serde-rs/json/commit/efa66e3a1d61459ab2d325f92ebe3acbd6ca18b1 "><code>efa66e3</code></a>
Release 1.0.145</li>
<li><a
href="https://github.com/serde-rs/json/commit/23679e2b9d7e4dcaef797ca7c51a4ffb6fce9f36 "><code>23679e2</code></a>
Add serde version constraint</li>
<li><a
href="https://github.com/serde-rs/json/commit/fc27bafbf740abc5e5733ec1dd2b5ae25695f895 "><code>fc27baf</code></a>
Release 1.0.144</li>
<li><a
href="https://github.com/serde-rs/json/commit/caef3c6ea69e126d18ee8b43dcc2c89d81207815 "><code>caef3c6</code></a>
Ignore uninlined_format_args pedantic clippy lint</li>
<li><a
href="https://github.com/serde-rs/json/commit/81ba3aaaff5c3736dd8b762dd1a0cf992bf60593 "><code>81ba3aa</code></a>
Merge pull request <a
href="https://redirect.github.com/serde-rs/json/issues/1285 ">#1285</a>
from dtolnay/serdecore</li>
<li><a
href="https://github.com/serde-rs/json/commit/d21e8ce7a7cc0bab2d53293de42b6343ef1d9144 "><code>d21e8ce</code></a>
Switch serde dependency to serde_core</li>
<li><a
href="https://github.com/serde-rs/json/commit/6beb6cd596a00f8838dc0cfc8876ed8fd065896f "><code>6beb6cd</code></a>
Merge pull request <a
href="https://redirect.github.com/serde-rs/json/issues/1286 ">#1286</a>
from dtolnay/up</li>
<li><a
href="https://github.com/serde-rs/json/commit/1dbc803749213eca37080cc7f29f5aee3ac18941 "><code>1dbc803</code></a>
Raise required compiler to Rust 1.61</li>
<li><a
href="https://github.com/serde-rs/json/commit/0bf5d87003aebbbb2b46c96e668283215971d98d "><code>0bf5d87</code></a>
Enforce trybuild >= 1.0.108</li>
<li><a
href="https://github.com/serde-rs/json/commit/d12e943590208da738c092db92c34b39796a2538 "><code>d12e943</code></a>
Update actions/checkout@v4 -> v5</li>
<li>See full diff in <a
href="https://github.com/serde-rs/json/compare/v1.0.143...v1.0.145 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-15 11:58:57 -07:00
Michael Bolin
50b080d20d
merge commit for archive created by Sapling
2025-09-15 11:55:06 -07:00
Michael Bolin
7c861991fa
fix: vendor ripgrep in the npm module
2025-09-15 11:54:59 -07:00
Michael Bolin
3d66c8460e
Merge 34cb2225ab into sapling-pr-archive-bolinfest
2025-09-15 11:11:33 -07:00
Michael Bolin
34cb2225ab
fix: vendor ripgrep in the npm module
2025-09-15 11:11:27 -07:00
Michael Bolin
44907b0fd3
Merge 9a01542d1d into sapling-pr-archive-bolinfest
2025-09-15 11:03:00 -07:00
Michael Bolin
9a01542d1d
fix: vendor ripgrep in the npm module
2025-09-15 11:02:50 -07:00
Michael Bolin
2df7f7efe5
chore: restore prerelease logic in rust-release.yml ( #3659 )
...
Revert #3645 .
2025-09-15 17:52:49 +00:00
Michael Bolin
15e858f4ed
Merge 8c2fd35453 into sapling-pr-archive-bolinfest
2025-09-15 10:37:21 -07:00
Michael Bolin
8c2fd35453
chore: restore prerelease logic in rust-release.yml
2025-09-15 10:37:14 -07:00
Jeremy Rose
0560079c41
notifications on approvals and turn end ( #3329 )
...
uses OSC 9 to notify when a turn ends or approval is required. won't
work in vs code or terminal.app but iterm2/kitty/wezterm supports it :)
2025-09-15 10:22:02 -07:00
Michael Bolin
0de154194d
fix: change MIN_ANIMATION_HEIGHT so show_animation is calculated correctly ( #3656 )
...
Reported height was `20` instead of `21`, so `area.height >=
MIN_ANIMATION_HEIGHT` was `false` and therefore `show_animation` was
`false`, so the animation never displayed.
2025-09-15 10:02:53 -07:00
Michael Bolin
022fadec4d
merge commit for archive created by Sapling
2025-09-15 09:49:58 -07:00
Michael Bolin
89db8ae521
fix: change MIN_ANIMATION_HEIGHT so show_animation is calculated correctly
2025-09-15 09:49:46 -07:00
ae
5c583fe89b
feat: tweak onboarding strings ( #3650 )
2025-09-15 08:49:37 -07:00
easong-openai
cf63cbf153
fix stray login url characters persisting in login ( #3639 )
...
<img width="885" height="177" alt="image"
src="https://github.com/user-attachments/assets/d396e0a5-f303-494f-bab1-f7af57b88a3e "
/>
Fixes this.
2025-09-15 15:44:53 +00:00
pakrym-oai
b1c291e2bb
Add file reference guidelines to gpt-5 prompt ( #3651 )
2025-09-15 08:35:30 -07:00
Thibault Sottiaux and Michael Bolin
934d728946
feat: skip animations on small terminals ( #3647 )
...
Changes:
- skip the welcome animation when the terminal area is below 60x21
- skip the model upgrade animation when the terminal area is below 60x24
to avoid clipping
---------
Co-authored-by: Michael Bolin <mbolin@openai.com >
2025-09-15 08:30:32 -07:00
Michael Bolin
f037b2fd56
chore: rename ( #3648 )
2025-09-15 08:17:13 -07:00
Michael Bolin
be26c5b93e
Merge 14bca55b44 into sapling-pr-archive-bolinfest
2025-09-15 08:01:03 -07:00
Michael Bolin
14bca55b44
chore: rename
2025-09-15 07:59:59 -07:00
Thibault Sottiaux
d60cbed691
fix: add references ( #3633 )
2025-09-15 07:48:22 -07:00
Michael Bolin
6aafe37752
chore: set prerelease:true for now ( #3645 )
2025-09-15 07:17:46 -07:00
Michael Bolin
4be95fdea8
Merge da6086f865 into sapling-pr-archive-bolinfest
2025-09-15 07:07:13 -07:00
Michael Bolin
da6086f865
chore: set prerelease:true for now
2025-09-15 07:07:04 -07:00
jimmyfraiture2
d555b68469
fix: race condition unified exec ( #3644 )
...
Fix race condition without storing an rx in the session
2025-09-15 06:52:39 -07:00
ae
9baa5c33da
feat: update splash ( #3631 )
...
- Update splash styling.
- Add center truncation for long paths.
(Uses new `center_truncate_path` utility.)
- Update the suggested commands.
## New splash
<img width="560" height="326" alt="image"
src="https://github.com/user-attachments/assets/b80d7075-f376-4019-a464-b96a78b0676d "
/>
## Example with truncation:
<img width="524" height="317" alt="image"
src="https://github.com/user-attachments/assets/b023c5cc-0bf0-4d21-9b98-bfea85546eda "
/>
2025-09-15 06:44:40 -07:00
dependabot[bot]
fdf4a68646
chore(deps): bump tracing-subscriber from 0.3.19 to 0.3.20 in /codex-rs ( #3620 )
...
Bumps [tracing-subscriber](https://github.com/tokio-rs/tracing ) from
0.3.19 to 0.3.20.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tokio-rs/tracing/releases ">tracing-subscriber's
releases</a>.</em></p>
<blockquote>
<h2>tracing-subscriber 0.3.20</h2>
<p><strong>Security Fix</strong>: ANSI Escape Sequence Injection
(CVE-TBD)</p>
<h2>Impact</h2>
<p>Previous versions of tracing-subscriber were vulnerable to ANSI
escape sequence injection attacks. Untrusted user input containing ANSI
escape sequences could be injected into terminal output when logged,
potentially allowing attackers to:</p>
<ul>
<li>Manipulate terminal title bars</li>
<li>Clear screens or modify terminal display</li>
<li>Potentially mislead users through terminal manipulation</li>
</ul>
<p>In isolation, impact is minimal, however security issues have been
found in terminal emulators that enabled an attacker to use ANSI escape
sequences via logs to exploit vulnerabilities in the terminal
emulator.</p>
<h2>Solution</h2>
<p>Version 0.3.20 fixes this vulnerability by escaping ANSI control
characters in when writing events to destinations that may be printed to
the terminal.</p>
<h2>Affected Versions</h2>
<p>All versions of tracing-subscriber prior to 0.3.20 are affected by
this vulnerability.</p>
<h2>Recommendations</h2>
<p>Immediate Action Required: We recommend upgrading to
tracing-subscriber 0.3.20 immediately, especially if your
application:</p>
<ul>
<li>Logs user-provided input (form data, HTTP headers, query parameters,
etc.)</li>
<li>Runs in environments where terminal output is displayed to
users</li>
</ul>
<h2>Migration</h2>
<p>This is a patch release with no breaking API changes. Simply update
your Cargo.toml:</p>
<pre lang="toml"><code>[dependencies]
tracing-subscriber = "0.3.20"
</code></pre>
<h2>Acknowledgments</h2>
<p>We would like to thank <a href="http://github.com/zefr0x ">zefr0x</a>
who responsibly reported the issue at
<code>security@tokio.rs </code>.</p>
<p>If you believe you have found a security vulnerability in any
tokio-rs project, please email us at <code>security@tokio.rs </code>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tokio-rs/tracing/commit/4c52ca5266a3920fc5dfeebda2accf15ee7fb278 "><code>4c52ca5</code></a>
fmt: fix ANSI escape sequence injection vulnerability (<a
href="https://redirect.github.com/tokio-rs/tracing/issues/3368 ">#3368</a>)</li>
<li><a
href="https://github.com/tokio-rs/tracing/commit/f71cebe41e4c12735b1d19ca804428d4ff7d905d "><code>f71cebe</code></a>
subscriber: impl Clone for EnvFilter (<a
href="https://redirect.github.com/tokio-rs/tracing/issues/3360 ">#3360</a>)</li>
<li><a
href="https://github.com/tokio-rs/tracing/commit/3a1f571102b38bcdca13d59f3c454989d179055d "><code>3a1f571</code></a>
Fix CI (<a
href="https://redirect.github.com/tokio-rs/tracing/issues/3361 ">#3361</a>)</li>
<li><a
href="https://github.com/tokio-rs/tracing/commit/e63ef57f3d686abe3727ddd586eb9af73d6715b7 "><code>e63ef57</code></a>
chore: prepare tracing-attributes 0.1.30 (<a
href="https://redirect.github.com/tokio-rs/tracing/issues/3316 ">#3316</a>)</li>
<li><a
href="https://github.com/tokio-rs/tracing/commit/6e59a13b1a7bcdd78b8b5a7cbcf70a0b2cdd76f0 "><code>6e59a13</code></a>
attributes: fix tracing::instrument regression around shadowing (<a
href="https://redirect.github.com/tokio-rs/tracing/issues/3311 ">#3311</a>)</li>
<li><a
href="https://github.com/tokio-rs/tracing/commit/e4df76127538aa8370d7dee32a6f84bbec6bbf10 "><code>e4df761</code></a>
tracing: update core to 0.1.34 and attributes to 0.1.29 (<a
href="https://redirect.github.com/tokio-rs/tracing/issues/3305 ">#3305</a>)</li>
<li><a
href="https://github.com/tokio-rs/tracing/commit/643f392ebb73c4fb856f56a78c066c82582dd22c "><code>643f392</code></a>
chore: prepare tracing-attributes 0.1.29 (<a
href="https://redirect.github.com/tokio-rs/tracing/issues/3304 ">#3304</a>)</li>
<li><a
href="https://github.com/tokio-rs/tracing/commit/d08e7a6eea1833810ea527e18ea03b08cd402c9d "><code>d08e7a6</code></a>
chore: prepare tracing-core 0.1.34 (<a
href="https://redirect.github.com/tokio-rs/tracing/issues/3302 ">#3302</a>)</li>
<li><a
href="https://github.com/tokio-rs/tracing/commit/6e70c571d319a033d5f37c885ccf99aa675a9eac "><code>6e70c57</code></a>
tracing-subscriber: count numbers of enters in <code>Timings</code> (<a
href="https://redirect.github.com/tokio-rs/tracing/issues/2944 ">#2944</a>)</li>
<li><a
href="https://github.com/tokio-rs/tracing/commit/c01d4fd9def2fb061669a310598095c789ca0a32 "><code>c01d4fd</code></a>
fix docs and enable CI on <code>main</code> branch (<a
href="https://redirect.github.com/tokio-rs/tracing/issues/3295 ">#3295</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/tokio-rs/tracing/compare/tracing-subscriber-0.3.19...tracing-subscriber-0.3.20 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-15 00:51:33 -07:00
Michael Bolin