Evidence record / codex
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-codex-dependency-audits-retain-an-explicit-unmaintained-package-exception
Dependency audits retain an explicit unmaintained-package exception. Stable suppresses RUSTSEC-2026-0374 in cargo audit and cargo deny, retaining basic-toml 0.1.10 through age localization dependencies in codex-secrets. RustSec classifies the 20 October notice as informational unmaintained-package status with no patched release. It is an exception, not a repaired exploitable vulnerability.
Channel: tagged-release. Half: defect. Date: 2026-10-23.
Operator consequence: Record the exception and remove it when age localization migrates away from basic-toml. A clean dependency-audit result must be read with its ignore list.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-codex-dependency-audits-retain-an-explicit-unmaintained-package-exception
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-codex-dependency-audits-retain-an-explicit-unmaintained-package-exceptiongithub.com/openai/codex/commit/4dbd9d30ea0466ec5bb1524f24c56cfc8ee4c5b1official docs2026-10-24-codex-dependency-audits-retain-an-explicit-unmaintained-package-exceptionrustsec.org/advisories/RUSTSEC-2026-0374.html
Versioned source: run artifact