## What changed
Allow `thread/inject_items` to accept wrapped items with `retention: "default"` or `retention: "always"`, while preserving support for raw response items. Persist explicit policies separately from legacy client-authored metadata.
Carry explicitly retained items through local and remote compaction, context-window changes, and child-agent creation, subject to retention budgets. Preserve history order and keep retained tool exchanges together; require matching calls and outputs to be adjacent in the injection request and both marked `always`.
Update Quinn dependencies and record exceptions for additional Hickory DNSSEC advisories where DNSSEC is disabled.
## Testing
Update injection tests for explicit retention metadata and extend the compaction scenario to cover a retained tool exchange across repeated compaction and restart.
GitOrigin-RevId: 1195a4ed62dc162a62e58bc2ad733262fbabea27
## Why
The Hickory 0.25.2 dependencies used by `codex-network-proxy` through `rama-dns` and `rama-tcp` have five DNSSEC-only advisories. DNSSEC is disabled even with all workspace features enabled.
## What changed
Add matching exceptions to `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml` for `RUSTSEC-2026-0504`, `RUSTSEC-2026-0505`, `RUSTSEC-2026-0511`, `RUSTSEC-2026-0512`, and `RUSTSEC-2026-0514`.
Document that the exceptions must be reassessed before enabling DNSSEC and removed when the Rust/Rama upgrade brings Hickory to version 0.26.2 or later.
GitOrigin-RevId: 506585d84746076f68ec9a0033603533c52f0f7b
## What changed
- Use `std::fs::rename` for atomic file replacement to support overlapping readers on Windows, retaining temporary-file cleanup if publication fails.
- Replace PowerShell fixtures in legacy sandbox capture and ConPTY lifecycle tests with native subprocesses. Keep child markers and output in writable workspaces, prevent inherited capture handles, and use asynchronous waits in ConPTY tests.
- Update the Bazel `rules_rs` Linux zlib package pins and mirrors.
- Temporarily exempt four `hickory-proto` advisories in `cargo-audit` and `cargo-deny`, with removal tied to upgrading Rust to 1.96+ and Rama to use `hickory-proto` 0.26.2 or later.
GitOrigin-RevId: 23d10a023014cc16c100480d1e8bfc2ec87085e3
## Why
`pin-utils` 0.1.0 is unmaintained with no patched release and remains a transitive dependency through AWS Smithy and `loom` under `tokio-graceful`.
## What changed
Add `RUSTSEC-2026-0441` to the ignore lists in `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml`. Document the dependency paths and remove the exception when they drop `pin-utils`.
GitOrigin-RevId: 803d519ad3ad044d49d73ff2a172c6e0b01fc8d3
## Why
Reduce idle RSS after Linux musl conversations unload by using roughly one jemalloc arena per four CPUs.
## What changed
Set `JEMALLOC_SYS_WITH_MALLOC_CONF` to `narenas_ratio:0.25` in both Cargo's environment and Bazel's `tikv-jemalloc-sys` build script environment.
GitOrigin-RevId: fa05961f88b2f2e8716b75f5582eecacb2fc5a8e
## Why
`libz-sys` 1.1.29 is pulled in through `curl-sys`/`curl` in `codex-http-client` only on Windows, where it skips the affected probe. The lockfile also pins `cc` to 1.2.55, below 1.6.0.
## What changed
Add `RUSTSEC-2026-0418` to the `cargo-audit` and `cargo-deny` ignore lists with the rationale. Remove the exception when `libz-sys` reaches 1.1.31 or later, and reassess if it is used on Unix with `cc` 1.6.0 or later.
GitOrigin-RevId: 0e2ffb4686d9c77dfd7f1312aef6a093a803f832
## What changed
Add four advisory exceptions to `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml`, documenting the usage constraints and removal criteria:
- `RUSTSEC-2026-0391`: borrowed contexts are not reused across streams; remove after upgrading to `zstd >=0.14.3` on all paths.
- `RUSTSEC-2026-0398`: the affected seekable feature is disabled; remove after upgrading to `zstd-safe >=8.2.0` on all paths.
- `RUSTSEC-2026-0403`: callers use read decoders or initialized output buffers and discard output on error; remove after upgrading to `zstd-safe >=8.2.0` on all paths.
- `RUSTSEC-2026-0410`: the allocator bug affects `wasm32`, while Codex ships native binaries; remove when the lockfile uses `zstd-sys >=2.1.2`.
GitOrigin-RevId: 556e53be961b01191590e2ca4e9f08dd9f017eac
Add `RUSTSEC-2026-0387` to the `cargo audit` and `cargo deny` ignore lists for `crypto-bigint` 0.5.5, pulled in through `elliptic-curve` 0.13.8.
Document the affected dependency paths and the potential timing leakage during private-key or session-secret operations. Remove the exceptions when those paths use `crypto-bigint` 0.7.6 or later.
GitOrigin-RevId: 7ff42c9b127900ddf772bf1cc88947f6e7dfcd10
## What changed
Expose `connect_windows_proxy` for callers handling a CONNECT `407` response. Use libcurl with the signed-in Windows user's Negotiate or NTLM credentials, then return the authenticated connection with buffered data preserved.
Support HTTP and HTTPS proxies, with default or caller-provided TLS configuration. HTTPS proxies requiring authentication tokens bound to their TLS connection are unsupported.
Enable libcurl's NTLM support in Cargo and Bazel builds.
## Testing
Add a Windows-only test asserting that libcurl provides NTLM, SPNEGO, and SSPI support.
GitOrigin-RevId: 4ed7d2208766404b6125ce2f4b5f91de5616a37f
`codex-secrets` pulls in unmaintained `basic-toml` 0.1.10 through the localization dependencies of `age` 0.12.1, and no patched release is available.
Add `RUSTSEC-2026-0374` to the `cargo audit` and `cargo deny` ignore lists. Document that the exception should be removed when the localization dependencies of `age` migrate off `basic-toml`.
GitOrigin-RevId: 92f31b687e91a73620e6f7f9a1b7c94790d9149d
## What changed
- Negotiate compression over TCP and local sockets with `x-codex-app-server-compression: zstd-stream-v1`. Keep JSON text messages when compression is not negotiated.
- Send compressed JSON as binary messages, retaining a separate zstd stream per direction across messages. Export reusable negotiation and codec helpers.
- Limit decompressed messages to 64 MiB and compression windows to 1 MiB. Close compressed connections on decoding errors or unexpected text messages.
- Add audit and deny ignores for the unmaintained `zvariant`, `zbus_names`, and `zvariant_derive` versions pulled in through `zbus`.
## Testing
Add codec tests for retained history, fallback, size limits, malformed data, and oversized compression windows. Add TCP and local-socket round-trip tests covering negotiation, persistent streams, and ping/pong handling, plus TCP fallback for absent or unsupported offers.
GitOrigin-RevId: 50d3861e8fe4a9c523599a5ab773bec7cb883bf2
## Why
`unsafe-libyaml` is unmaintained and has no patched release. It remains a transitive dependency through `serde_yaml`.
## What changed
Add `RUSTSEC-2024-0449` to the ignore lists in `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml`. Document the dependency path and require removing the exception when the affected users migrate off `serde_yaml`/`unsafe-libyaml`.
GitOrigin-RevId: 6f4cf32e55d2877d90bf00d2c12a1c85f18d229e
## Why
Local secrets storage pulled in the unmaintained `proc-macro-error2` through `age` and `i18n-embed-fl`, requiring an exception for `RUSTSEC-2026-0173`.
## What changed
Upgrade `age` to `0.12.1` and update the Cargo and Bazel lockfiles. The updated dependency chain uses `proc-macro-error3`, allowing removal of the advisory exception from both `cargo-audit` and `cargo-deny` configuration.
GitOrigin-RevId: 7e18dec4d71d9260512f54fbfe71dbe4e6ee8a5d
## What changed
- Upgrade `ratatui`, `ratatui-macros`, `crossterm`, and `ansi-to-tui`, and adapt the TUI to their updated rendering, backend, color-conversion, and cell APIs.
- Use Ratatui's cell-width and continuation-cell metadata when mapping OSC 8 hyperlinks so links remain aligned across wrapped wide glyphs and halfwidth characters with dakuten.
- Preserve explicit hyperlinks in the sign-in success screen and empty MCP state without embedding escape sequences in the text passed to Ratatui.
## Testing
- Add regression coverage for hyperlink placement across wide glyphs and halfwidth dakuten, hyperlink preservation in onboarding and MCP output, and display-width handling.
GitOrigin-RevId: 8460873e5a266923acd0417bc46264845eab0134
## Why
The `cargo-deny` job on `main` began failing after
[RUSTSEC-2026-0194](https://rustsec.org/advisories/RUSTSEC-2026-0194)
and
[RUSTSEC-2026-0195](https://rustsec.org/advisories/RUSTSEC-2026-0195)
flagged the workspace `quick-xml 0.38.4`. Both denial-of-service issues
are fixed in `quick-xml 0.41.0`.
A `quick-xml 0.39.4` copy must temporarily remain because the latest
`plist` and `wayland-scanner` releases have not adopted 0.41 yet.
Neither retained path accepts attacker-controlled XML at runtime:
`plist` does not exercise the affected APIs, and `wayland-scanner`
parses trusted protocol definitions at build time. Compatible upstream
bumps are already open in
[rust-plist#191](https://github.com/ebarnard/rust-plist/pull/191) and
[wayland-rs#938](https://github.com/Smithay/wayland-rs/pull/938).
## What changed
- Upgrade the workspace `quick-xml` dependency used by `codex-protocol`
to 0.41.0.
- Refresh `Cargo.lock` and `MODULE.bazel.lock`; this also updates
`plist` to 1.9.0 and `wayland-scanner` to 0.31.10.
- Add synchronized, temporary `cargo-deny` and `cargo-audit` exceptions
for the trusted `quick-xml 0.39.4` paths, with both upstream releases
recorded as the removal condition.
## Testing
- `cargo deny check`
- `just test -p codex-protocol` (238 tests)
- `just bazel-lock-check`
## Summary
- ignore RUSTSEC-2026-0173 in cargo-deny and cargo-audit config
- document that proc-macro-error2 is pulled in transitively via
i18n-embed-fl/age/codex-secrets
- leave the ignore temporary until codex-secrets moves off age or age
drops i18n-embed-fl
## Validation
- just fmt
- cargo deny check --hide-inclusion-graph
## Why
Windows release artifacts currently import `VCRUNTIME140.dll` and
`VCRUNTIME140_1.dll`. That becomes observable on clean Windows machines
that do not already have the VC++ runtime available globally:
- Desktop Store launches can fail after the app relocates `codex.exe`
out of `WindowsApps`, which means an MSIX-level VCLibs dependency does
not protect the relocated CLI/app-server process.
- The npm CLI path reproduces the same missing-DLL startup failure when
`System32\vcruntime140_1.dll` is hidden and `PATH` is stripped of
incidental fallback copies.
In that setup, the existing Windows binary exits with `0xC0000135` /
`-1073741515` before Codex code runs.
## What changed
- Add `-C target-feature=+crt-static` to the existing MSVC-only Cargo
rustflags in `codex-rs/.cargo/config.toml`.
- Preserve the existing `/STACK:8388608` linker setting in the same
target block.
This keeps the change scoped to Windows MSVC builds and avoids altering
non-Windows or GNU target behavior.
## Verification
I built an x64 Windows release probe with static CRT linkage and the
normal 8 MiB stack reserve, then verified:
- `dumpbin /dependents codex.exe` no longer reports `VCRUNTIME140.dll`
or `VCRUNTIME140_1.dll`.
- `dumpbin /headers codex.exe` reports `800000 size of stack reserve`.
- With `System32\vcruntime140_1.dll` hidden and `PATH` stripped to
Windows system directories only:
- the old npm CLI path exits `-1073741515`
- the rebuilt static-CRT `codex.exe --version` succeeds with exit code
`0`
- the rebuilt TUI starts successfully
I also confirmed `codex.exe app-server --listen ws://127.0.0.1:0` starts
and binds normally with the static-CRT artifact.
## Summary
- Fix marketplace-add local path detection on Windows by using
`Path::is_absolute()`.
- Make marketplace-add local-source tests parse/write TOML through the
same helpers instead of raw string matching.
- Update `rand` 0.9.x to 0.9.3 and document the remaining audited `rand`
0.8.5 advisory exception.
- Refresh `MODULE.bazel.lock` after the Cargo.lock update.
## Why
Latest `main` had two independent CI blockers: marketplace-add tests
were not portable to Windows path/TOML escaping, and cargo-deny still
reported `RUSTSEC-2026-0097` after the recent rustls-webpki fix.
## Validation
- `cargo test -p codex-core marketplace_add -- --nocapture`
- `cargo deny --all-features check`
- `just bazel-lock-check`
- `just fix -p codex-core`
- `just fmt`
- `git diff --check`
## Summary
- Pin Rust git patch dependencies to immutable revisions and make
cargo-deny reject unknown git and registry sources unless explicitly
allowlisted.
- Add checked-in SHA-256 coverage for the current rusty_v8 release
assets, wire those hashes into Bazel, and verify CI override downloads
before use.
- Add rusty_v8 MODULE.bazel update/check tooling plus a Bazel CI guard
so future V8 bumps cannot drift from the checked-in checksum manifest.
- Pin release/lint cargo installs and all external GitHub Actions refs
to immutable inputs.
## Future V8 bump flow
Run these after updating the resolved `v8` crate version and checksum
manifest:
```bash
python3 .github/scripts/rusty_v8_bazel.py update-module-bazel
python3 .github/scripts/rusty_v8_bazel.py check-module-bazel
```
The update command rewrites the matching `rusty_v8_<crate_version>`
`http_file` SHA-256 values in `MODULE.bazel` from
`third_party/v8/rusty_v8_<crate_version>.sha256`. The check command is
also wired into Bazel CI to block drift.
## Notes
- This intentionally excludes RustSec dependency upgrades and
bubblewrap-related changes per request.
- The branch was rebased onto the latest origin/main before opening the
PR.
## Validation
- cargo fetch --locked
- cargo deny check advisories
- cargo deny check
- cargo deny check sources
- python3 .github/scripts/rusty_v8_bazel.py check-module-bazel
- python3 .github/scripts/rusty_v8_bazel.py update-module-bazel
- python3 -m unittest discover -s .github/scripts -p
'test_rusty_v8_bazel.py'
- python3 -m py_compile .github/scripts/rusty_v8_bazel.py
.github/scripts/rusty_v8_module_bazel.py
.github/scripts/test_rusty_v8_bazel.py
- repo-wide GitHub Actions `uses:` audit: all external action refs are
pinned to 40-character SHAs
- yq eval on touched workflows and local actions
- git diff --check
- just bazel-lock-check
## Hash verification
- Confirmed `MODULE.bazel` hashes match
`third_party/v8/rusty_v8_146_4_0.sha256`.
- Confirmed GitHub release asset digests for denoland/rusty_v8
`v146.4.0` and openai/codex `rusty-v8-v146.4.0` match the checked-in
hashes.
- Streamed and SHA-256 hashed all 10 `MODULE.bazel` rusty_v8 asset URLs
locally; every downloaded byte stream matched both `MODULE.bazel` and
the checked-in manifest.
## Pin verification
- Confirmed signing-action pins match the peeled commits for their tag
comments: `sigstore/cosign-installer@v3.7.0`, `azure/login@v2`, and
`azure/trusted-signing-action@v0`.
- Pinned the remaining tag-based action refs in Bazel CI/setup:
`actions/setup-node@v6`, `facebook/install-dotslash@v2`,
`bazelbuild/setup-bazelisk@v3`, and `actions/cache/restore@v5`.
- Normalized all `bazelbuild/setup-bazelisk@v3` refs to the peeled
commit behind the annotated tag.
- Audited Cargo git dependencies: every manifest git dependency uses
`rev` only, every `Cargo.lock` git source has `?rev=<sha>#<same-sha>`,
and `cargo deny check sources` passes with `required-git-spec = "rev"`.
- Shallow-fetched each distinct git dependency repo at its pinned SHA
and verified Git reports each object as a commit.
Vivian Fang