mirror of
https://github.com/openai/codex.git
synced 2026-09-11 20:36:49 +00:00
0ccb676dd0
## Why The `cargo-deny` job on `main` began failing after [RUSTSEC-2026-0194](https://rustsec.org/advisories/RUSTSEC-2026-0194) and [RUSTSEC-2026-0195](https://rustsec.org/advisories/RUSTSEC-2026-0195) flagged the workspace `quick-xml 0.38.4`. Both denial-of-service issues are fixed in `quick-xml 0.41.0`. A `quick-xml 0.39.4` copy must temporarily remain because the latest `plist` and `wayland-scanner` releases have not adopted 0.41 yet. Neither retained path accepts attacker-controlled XML at runtime: `plist` does not exercise the affected APIs, and `wayland-scanner` parses trusted protocol definitions at build time. Compatible upstream bumps are already open in [rust-plist#191](https://github.com/ebarnard/rust-plist/pull/191) and [wayland-rs#938](https://github.com/Smithay/wayland-rs/pull/938). ## What changed - Upgrade the workspace `quick-xml` dependency used by `codex-protocol` to 0.41.0. - Refresh `Cargo.lock` and `MODULE.bazel.lock`; this also updates `plist` to 1.9.0 and `wayland-scanner` to 0.31.10. - Add synchronized, temporary `cargo-deny` and `cargo-audit` exceptions for the trusted `quick-xml 0.39.4` paths, with both upstream releases recorded as the removal condition. ## Testing - `cargo deny check` - `just test -p codex-protocol` (238 tests) - `just bazel-lock-check`
16 lines
1.3 KiB
TOML
16 lines
1.3 KiB
TOML
[advisories]
|
|
# Reviewed 2026-07-02. Keep this list in sync with ../deny.toml.
|
|
ignore = [
|
|
"RUSTSEC-2024-0388", # derivative 2.2.0 via starlark/starlark_syntax; upstream crate is unmaintained
|
|
"RUSTSEC-2025-0057", # fxhash 0.2.1 via starlark_map/bm25; upstream crate is unmaintained
|
|
"RUSTSEC-2024-0436", # paste 1.0.15 via starlark/ratatui; upstream crate is unmaintained
|
|
"RUSTSEC-2023-0089", # atomic-polyfill via postcard/heapless/pagable; upstream crate is unmaintained
|
|
"RUSTSEC-2024-0320", # yaml-rust via syntect; remove when syntect drops or updates it
|
|
"RUSTSEC-2025-0141", # bincode via syntect; remove when syntect drops or updates it
|
|
"RUSTSEC-2026-0118", # hickory-proto via rama-dns/rama-tcp; remove when rama updates to hickory 0.26.1 or hickory-net
|
|
"RUSTSEC-2026-0119", # hickory-proto via rama-dns/rama-tcp; remove when rama updates to hickory 0.26.1 or hickory-net
|
|
"RUSTSEC-2026-0173", # proc-macro-error2 via i18n-embed-fl/age/codex-secrets; remove when local secrets storage migrates off age or age drops i18n-embed-fl
|
|
"RUSTSEC-2026-0194", # quick-xml via plist/syntect and wayland-scanner; trusted inputs only; remove when rust-plist#191 and wayland-rs#938 are released
|
|
"RUSTSEC-2026-0195", # quick-xml via plist/syntect and wayland-scanner; trusted inputs only; remove when rust-plist#191 and wayland-rs#938 are released
|
|
]
|