Repository navigation
chore: sync public mirror from internal - #1174
Conversation
|
Resolved 0 review-bot thread(s) on this generated public mirror PR. Review of mirrored code belongs on the mono source PR. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 317cbb33a6
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| { id = "RUSTSEC-2026-0192", reason = "ttf-parser 0.25.1 unmaintained; pulled in transitively via lopdf 0.42.0 (the fix version for RUSTSEC-2026-0187) via pdf-extract 0.12.0. No known vulnerability; re-check when lopdf/pdf-extract bump their ttf-parser dependency or adopt a maintained fork. expires: 2026-10-23" }, | ||
|
|
||
| # --- Vulnerabilities without a fixed release --- | ||
| { id = "RUSTSEC-2023-0071", reason = "rsa 0.9.10 (Marvin timing side channel) pulled in by jsonwebtoken 10.4.0 via octocrab 0.54.2 (ambient-agent, production). No fixed rsa release exists; the same advisory is already ignored in products/computer, platform/cerebro and the root workspace cargo-audit step. expires: 2026-10-23" }, |
There was a problem hiding this comment.
This rationale publishes internal component names and security-policy state (products/computer, platform/cerebro, and the internal root workspace's cargo-audit exception) in the public mirror. Keep the explanation limited to the public dependency's fixability and exploitability rather than exposing private repository structure or operational policy.
AGENTS.md reference: AGENTS.md:L16-L17
Useful? React with 👍 / 👎.
| { id = "RUSTSEC-2026-0192", reason = "ttf-parser 0.25.1 unmaintained; pulled in transitively via lopdf 0.42.0 (the fix version for RUSTSEC-2026-0187) via pdf-extract 0.12.0. No known vulnerability; re-check when lopdf/pdf-extract bump their ttf-parser dependency or adopt a maintained fork. expires: 2026-10-23" }, | ||
|
|
||
| # --- Vulnerabilities without a fixed release --- | ||
| { id = "RUSTSEC-2023-0071", reason = "rsa 0.9.10 (Marvin timing side channel) pulled in by jsonwebtoken 10.4.0 via octocrab 0.54.2 (ambient-agent, production). No fixed rsa release exists; the same advisory is already ignored in products/computer, platform/cerebro and the root workspace cargo-audit step. expires: 2026-10-23" }, |
There was a problem hiding this comment.
A repo-wide search finds octocrab only in packages/ambient-agent-rs/Cargo.toml, Cargo.lock, and this rationale; no Rust source uses it. Removing that unused direct dependency would also remove jsonwebtoken 10.4.0 and rsa 0.9.10 from the dependency graph without waiting for an upstream RSA release, whereas this entry makes the advisory gate accept the known vulnerability until October 23.
Useful? React with 👍 / 👎.
Summary
dx-corp/monodx-corp/codeas a generated public mirror of the private source of truth472723d5518ff0fe2388e859241df115f6388f82b3bfb1dc84e6c93c4798adc2736faadd4ee9b3b22file(s) to copy/update and0stale file(s) to delete0sync-holdlabel to this PR; the sync workflow skips every push while it is setSource-of-truth status
Projection: deixic-code
Source: dx-corp/mono@472723d5518ff0fe2388e859241df115f6388f82
Prior destination base: b3bfb1d
Content SHA-256: 5e7f7a6047ed2f2dc9bb6226d26da886adebb7e23b19531c950454c84ef70086
Result: drift_detected; 2 changed, 0 deleted
Destination-owned content is preserved. Destination CI is a separate health signal.
copy/update .repository-projection.json
copy/update deny.toml
Drift sample
Public-only commits since last generated sync
Validation
Test Plan
maestro-sync-public-release-mirrorworkflow inpublic-treemoderequire-internal-prconfirms internal source PR lineageStaged Rollout
dx-corp/mono@472723d5518ff0fe2388e859241df115f6388f82, including existing hidden/evaluation surfaces, and keeps public package parity behind the established public-source-provenance gate.