mirror of
https://github.com/hanzoai/codex.git
synced 2026-10-30 14:59:26 +00:00
swastik-oaiandcopyberry
0c7362d121
## Why `unsafe-libyaml` is unmaintained and has no patched release. It remains a transitive dependency through `serde_yaml`. ## What changed Add `RUSTSEC-2024-0449` to the ignore lists in `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml`. Document the dependency path and require removing the exception when the affected users migrate off `serde_yaml`/`unsafe-libyaml`. GitOrigin-RevId: 6f4cf32e55d2877d90bf00d2c12a1c85f18d229e
16 lines
1.4 KiB
TOML
16 lines
1.4 KiB
TOML
[advisories]
|
|
# Reviewed 2026-07-02. Keep this list in sync with ../deny.toml.
|
|
ignore = [
|
|
"RUSTSEC-2024-0388", # derivative 2.2.0 via starlark/starlark_syntax; upstream crate is unmaintained
|
|
"RUSTSEC-2024-0449", # unsafe-libyaml via serde_yaml in skills, ext/skills, core-plugins, external-agent-migration; remove when migrated off serde_yaml/unsafe-libyaml
|
|
"RUSTSEC-2025-0057", # fxhash 0.2.1 via starlark_map/bm25; upstream crate is unmaintained
|
|
"RUSTSEC-2024-0436", # paste 1.0.15 via starlark/v8; upstream crate is unmaintained
|
|
"RUSTSEC-2023-0089", # atomic-polyfill via postcard/heapless/pagable; upstream crate is unmaintained
|
|
"RUSTSEC-2024-0320", # yaml-rust via syntect; remove when syntect drops or updates it
|
|
"RUSTSEC-2025-0141", # bincode via syntect; remove when syntect drops or updates it
|
|
"RUSTSEC-2026-0118", # hickory-proto via rama-dns/rama-tcp; remove when rama updates to hickory 0.26.1 or hickory-net
|
|
"RUSTSEC-2026-0119", # hickory-proto via rama-dns/rama-tcp; remove when rama updates to hickory 0.26.1 or hickory-net
|
|
"RUSTSEC-2026-0194", # quick-xml via plist/syntect and wayland-scanner; trusted inputs only; remove when rust-plist#191 and wayland-rs#938 are released
|
|
"RUSTSEC-2026-0195", # quick-xml via plist/syntect and wayland-scanner; trusted inputs only; remove when rust-plist#191 and wayland-rs#938 are released
|
|
]
|