From 0c7362d121d1c7f69540262425fd4e2209fd8e8d Mon Sep 17 00:00:00 2001 From: swastik-oai Date: Mon, 12 Oct 2026 13:32:11 +0000 Subject: [PATCH] Ignore the unsafe-libyaml advisory in dependency audits (#53382) ## Why `unsafe-libyaml` is unmaintained and has no patched release. It remains a transitive dependency through `serde_yaml`. ## What changed Add `RUSTSEC-2024-0449` to the ignore lists in `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml`. Document the dependency path and require removing the exception when the affected users migrate off `serde_yaml`/`unsafe-libyaml`. GitOrigin-RevId: 6f4cf32e55d2877d90bf00d2c12a1c85f18d229e --- codex-rs/.cargo/audit.toml | 1 + codex-rs/deny.toml | 1 + 2 files changed, 2 insertions(+) diff --git a/codex-rs/.cargo/audit.toml b/codex-rs/.cargo/audit.toml index f9129fb150..acfe09b22f 100644 --- a/codex-rs/.cargo/audit.toml +++ b/codex-rs/.cargo/audit.toml @@ -2,6 +2,7 @@ # Reviewed 2026-07-02. Keep this list in sync with ../deny.toml. ignore = [ "RUSTSEC-2024-0388", # derivative 2.2.0 via starlark/starlark_syntax; upstream crate is unmaintained + "RUSTSEC-2024-0449", # unsafe-libyaml via serde_yaml in skills, ext/skills, core-plugins, external-agent-migration; remove when migrated off serde_yaml/unsafe-libyaml "RUSTSEC-2025-0057", # fxhash 0.2.1 via starlark_map/bm25; upstream crate is unmaintained "RUSTSEC-2024-0436", # paste 1.0.15 via starlark/v8; upstream crate is unmaintained "RUSTSEC-2023-0089", # atomic-polyfill via postcard/heapless/pagable; upstream crate is unmaintained diff --git a/codex-rs/deny.toml b/codex-rs/deny.toml index ea7fdc149f..31c5517af0 100644 --- a/codex-rs/deny.toml +++ b/codex-rs/deny.toml @@ -73,6 +73,7 @@ ignore = [ # Reviewed 2026-07-02. Keep this list in sync with .cargo/audit.toml. # Each exception must identify the dependency path and removal condition. { id = "RUSTSEC-2024-0388", reason = "derivative is unmaintained; pulled in via starlark/starlark_syntax v0.14.2 used by execpolicy/cli/core; no fixed starlark release yet" }, + { id = "RUSTSEC-2024-0449", reason = "unsafe-libyaml 0.2.11 is unmaintained; pulled in via serde_yaml 0.9 by skills, ext/skills, core-plugins, and external-agent-migration; no patched release; remove when these users migrate off serde_yaml/unsafe-libyaml" }, { id = "RUSTSEC-2025-0057", reason = "fxhash is unmaintained; pulled in via starlark_map under starlark v0.14.2 used by execpolicy/cli/core and bm25 used by core; remove when upstream dependencies drop fxhash" }, { id = "RUSTSEC-2024-0436", reason = "paste is unmaintained; pulled in via starlark/v8 used by execpolicy/code-mode; no fixed release yet" }, { id = "RUSTSEC-2023-0089", reason = "atomic-polyfill is unmaintained; pulled in via postcard/heapless/pagable under starlark v0.14.2 used by execpolicy/cli/core; no fixed starlark release yet" },