github/codex
4
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-19 16:17:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ignore the unsafe-libyaml advisory in dependency audits (#53382)

Browse Source 
## Why

`unsafe-libyaml` is unmaintained and has no patched release. It remains a transitive dependency through `serde_yaml`.

## What changed

Add `RUSTSEC-2024-0449` to the ignore lists in `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml`. Document the dependency path and require removing the exception when the affected users migrate off `serde_yaml`/`unsafe-libyaml`.

GitOrigin-RevId: 6f4cf32e55d2877d90bf00d2c12a1c85f18d229e
This commit is contained in:
swastik-oai
2026-10-12 13:39:54 +00:00
committed by copyberry
parent 6c372fbef4
commit 0c7362d121
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/.cargo/audit.toml
+1
View File
@@ -2,6 +2,7 @@
# Reviewed 2026-07-02. Keep this list in sync with ../deny.toml.
ignore = [
"RUSTSEC-2024-0388", # derivative 2.2.0 via starlark/starlark_syntax; upstream crate is unmaintained
"RUSTSEC-2024-0449", # unsafe-libyaml via serde_yaml in skills, ext/skills, core-plugins, external-agent-migration; remove when migrated off serde_yaml/unsafe-libyaml
"RUSTSEC-2025-0057", # fxhash 0.2.1 via starlark_map/bm25; upstream crate is unmaintained
"RUSTSEC-2024-0436", # paste 1.0.15 via starlark/v8; upstream crate is unmaintained
"RUSTSEC-2023-0089", # atomic-polyfill via postcard/heapless/pagable; upstream crate is unmaintained
codex-rs/deny.toml
+1
View File
@@ -73,6 +73,7 @@ ignore = [
# Reviewed 2026-07-02. Keep this list in sync with .cargo/audit.toml.
# Each exception must identify the dependency path and removal condition.
{ id = "RUSTSEC-2024-0388", reason = "derivative is unmaintained; pulled in via starlark/starlark_syntax v0.14.2 used by execpolicy/cli/core; no fixed starlark release yet" },
{ id = "RUSTSEC-2024-0449", reason = "unsafe-libyaml 0.2.11 is unmaintained; pulled in via serde_yaml 0.9 by skills, ext/skills, core-plugins, and external-agent-migration; no patched release; remove when these users migrate off serde_yaml/unsafe-libyaml" },
{ id = "RUSTSEC-2025-0057", reason = "fxhash is unmaintained; pulled in via starlark_map under starlark v0.14.2 used by execpolicy/cli/core and bm25 used by core; remove when upstream dependencies drop fxhash" },
{ id = "RUSTSEC-2024-0436", reason = "paste is unmaintained; pulled in via starlark/v8 used by execpolicy/code-mode; no fixed release yet" },
{ id = "RUSTSEC-2023-0089", reason = "atomic-polyfill is unmaintained; pulled in via postcard/heapless/pagable under starlark v0.14.2 used by execpolicy/cli/core; no fixed starlark release yet" },