Skip to content

chore: sync public mirror from internal #1174

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
evalops-mirror merged 1 commit into from
Sep 21, 2026
Merged

chore: sync public mirror from internal #1174

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .repository-projection.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@
"projection": "deixic-code",
"projectionSchemaVersion": 1,
"sourceRepository": "dx-corp/mono",
"sourceSha": "915d91afd3e2038786a2e1cf12dd920ce17a8316",
"sourceSha": "472723d5518ff0fe2388e859241df115f6388f82",
"destinationRepository": "dx-corp/code",
"priorProjectedBase": "09d57e69e8649768da349fb38eb9c513df0e5d01",
"priorProjectedBase": "b3bfb1dc84e6c93c4798adc2736faadd4ee9b3b2",
"definitionDigest": "cc5446d8982464d5504de96b74641fe6f74b8e430830d0cca507e19fab0041b8",
"toolDigest": "de718162d050963e0c04ca9cbc0e38b1db545e838e587f949bcd9fd8aded6bcd",
"contentDigest": "eeeb25196b828d9c832f1193fd3974f52c00fd422ed308c137262393d8a9b7d4",
"contentDigest": "5e7f7a6047ed2f2dc9bb6226d26da886adebb7e23b19531c950454c84ef70086",
"publicationEligible": true
}
3 changes: 3 additions & 0 deletions deny.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,9 @@
{ id = "RUSTSEC-2024-0436", reason = "paste 1.0.15 unmaintained; proc-macro pulled in by ratatui (production, TUI rendering). No ratatui release has dropped it yet. expires: 2026-10-23" },
{ id = "RUSTSEC-2026-0192", reason = "ttf-parser 0.25.1 unmaintained; pulled in transitively via lopdf 0.42.0 (the fix version for RUSTSEC-2026-0187) via pdf-extract 0.12.0. No known vulnerability; re-check when lopdf/pdf-extract bump their ttf-parser dependency or adopt a maintained fork. expires: 2026-10-23" },

# --- Vulnerabilities without a fixed release ---
{ id = "RUSTSEC-2023-0071", reason = "rsa 0.9.10 (Marvin timing side channel) pulled in by jsonwebtoken 10.4.0 via octocrab 0.54.2 (ambient-agent, production). No fixed rsa release exists; the same advisory is already ignored in products/computer, platform/cerebro and the root workspace cargo-audit step. expires: 2026-10-23" },

Check failure on line 35 in deny.toml

View workflow job for this annotation

GitHub Actions / unresolved-review-threads / unresolved-review-threads

unresolved P1 review thread

Check failure on line 35 in deny.toml

View workflow job for this annotation

GitHub Actions / unresolved-review-threads / unresolved-review-threads

unresolved P1 review thread

Check failure on line 35 in deny.toml

View workflow job for this annotation

GitHub Actions / unresolved-review-threads / unresolved-review-threads

unresolved P1 review thread

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Remove private repository details from the public policy

This rationale publishes internal component names and security-policy state (products/computer, platform/cerebro, and the internal root workspace's cargo-audit exception) in the public mirror. Keep the explanation limited to the public dependency's fixability and exploitability rather than exposing private repository structure or operational policy.

AGENTS.md reference: AGENTS.md:L16-L17

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Remove the unused dependency instead of ignoring its advisory

A repo-wide search finds octocrab only in packages/ambient-agent-rs/Cargo.toml, Cargo.lock, and this rationale; no Rust source uses it. Removing that unused direct dependency would also remove jsonwebtoken 10.4.0 and rsa 0.9.10 from the dependency graph without waiting for an upstream RSA release, whereas this entry makes the advisory gate accept the known vulnerability until October 23.

Useful? React with 👍 / 👎.


# --- Unsound (no known exploitable vulnerability reported here) ---
{ id = "RUSTSEC-2026-0002", reason = "lru 0.12.5: IterMut violates Stacked Borrows (Miri/unsafe-code soundness issue), pulled in by ratatui (production). Not a memory-safety issue under normal (non-Miri) execution; tracked for the next ratatui bump that picks up a fixed lru. expires: 2026-10-23" },
{ id = "RUSTSEC-2026-0285", reason = "rustls <0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level after a key change in the same record (GHSA-2mjx-qc3c-rqvc, CVSS 5.3). Fixed in rustls 0.23.45, published 2026-09-14; that upgrade also resolves aws-lc-rs 1.18.1 and aws-lc-sys 0.45.0, all still inside the 14-day dependency-admission cool-off in security/rust-dependency-admission.toml. Bump the lockfile once they age past it. expires: 2026-09-30" },
Expand Down
Loading