Fix vulnerable Rust and npm dependencies
Clears 83 of the 86 open security advisories against this repo: all 32 HIGH except one, all 45 MEDIUM except one, and 8 of the 9 LOW. The three that remain are explained at the bottom and tracked separately.
Rust
codex-rs/Cargo.toml + Cargo.lock:
| Package | Before → After | Advisories |
|---|---|---|
| gix (pulls gix-fs 0.21.2, gix-pack 0.70.0) | 0.81.0 → 0.83.0 | 6 HIGH |
| openssl | 0.10.75 → 0.10.81 | 5 HIGH, 2 MED, 1 LOW |
| tar | 0.4.45 → 0.4.46 | 3 MED |
| jsonwebtoken | 9.3.1 → 10.4.0 | 1 MED |
| opentelemetry* | 0.31 → 0.32 | 1 MED |
| actix-http | 3.11.2 → 3.13.3 | 1 MED |
| cmov | 0.5.3 → 0.5.4 | 1 MED |
| rand | 0.8.5 → 0.8.6 | 1 LOW |
Two of those needed more than a version bump:
jsonwebtoken 10 no longer picks a crypto backend implicitly. It compiles fine but panics at runtime unless exactly one provider feature is enabled — caught by the codex-agent-identity tests, not by the build. Enabled aws_lc_rs, which is already in the tree via rcgen; the rust_crypto alternative would pull in the rsa crate and its own advisory.
opentelemetry-http 0.32 implements HttpClient for reqwest 0.13 only, while the workspace is on 0.12 and codex-otel's session telemetry exchanges reqwest 0.12 types with its callers. So only the OTLP exporter clients in otel/src/otlp.rs are built against an aliased reqwest 0.13 (already in the tree via rmcp), and the tls_built_in_root_certs(false) + add_root_certificate pair is swapped for its 0.13 equivalent tls_certs_only, which has the same semantics.
npm
Every flagged npm package reaches the tree transitively through sdk/typescript's dev dependencies, so they're pinned via resolutions the way the existing entries are: hono → 4.13.0, @hono/node-server → 1.19.17, brace-expansion, fast-uri, ip-address, js-yaml, ajv, qs, @babel/core, body-parser, diff. Versions were chosen to satisfy the advisories while respecting the workspace's 7-day minimumReleaseAge.
One thing worth a look in review: postcss, nanoid and yaml drop out of the lockfile entirely. They were only present because autoInstallPeers picked up the optional peers of postcss-load-config, and pnpm skips auto-installing a peer that has an override. Nothing here uses them — tsup is configured from tsup.config.ts, not a postcss or yaml config — and pnpm install --frozen-lockfile still builds the SDK, so their advisories go away with them.
Verification
cargo check --workspace --locked --all-targets— cleancargo clippyon the affected crates — no new warningscargo testfor codex-otel (13 unit + 31 integration), codex-git-utils, codex-agent-identity, codex-app-server-transport, codex-login — all passpnpm install --frozen-lockfile+ SDK tsup build — pass- rustfmt clean on the touched files
Pre-existing and unrelated to this PR: rustfmt drift in 13 tui/ files, and the SDK jest tests need a built codex-rs/target/debug/codex binary.
Not fixed here
hickory-proto 0.25.2 (HIGH GHSA-3v94-mw7p-v465, MED GHSA-q2qq-hmj6-3wpp) — arrives via rama-tcp → rama-dns, where it is a mandatory dependency that features can't drop. Only rama 0.3.0 moves to hickory 0.26.1, and that needs a repo-wide rustc 1.96+ bump plus a real API migration of codex-network-proxy (49 measured compile errors). Splitting it out rather than folding a MITM-proxy migration into a dependency bump.
lru 0.12.5 (LOW GHSA-rhfx-m35p-ff5j) — comes via ratatui 0.29, which is patched to the nornagon/ratatui fork and requires lru ^0.12. Needs the fork updated. The workspace's own lru is already 0.16.3.