Finding / codex
2026-10-24-codex-dependency-audits-retain-an-explicit-unmaintained-package-exception
Dependency audits retain an explicit unmaintained-package exception. Stable suppresses RUSTSEC-2026-0374 in cargo audit and cargo deny, retaining basic-toml 0.1.10 through age localization dependencies in codex-secrets. RustSec classifies the 20 October notice as informational unmaintained-package status with no patched release. It is an exception, not a repaired exploitable vulnerability.
Channel: tagged-release. Half: defect. Date: 2026-10-23.
Operator consequence: Record the exception and remove it when age localization migrates away from basic-toml. A clean dependency-audit result must be read with its ignore list.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-codex-dependency-audits-retain-an-explicit-unmaintained-package-exception
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-codex-dependency-audits-retain-an-explicit-unmaintained-package-exceptiongithub.com/openai/codex/commit/4dbd9d30ea0466ec5bb1524f24c56cfc8ee4c5b1official docs2026-10-24-codex-dependency-audits-retain-an-explicit-unmaintained-package-exceptionrustsec.org/advisories/RUSTSEC-2026-0374.html