fix(deps): bump 10 HIGH CVEs in codex-rs (aws-lc-sys, quinn-proto, rustls-webpki)

[KooshaPari]

User description

Summary

Cascades the heliosCLI PR #233 CVE pattern into the codex-rs subtree. Stacked on top of #525 (workspace unblock).

Closes 10 of 11 HIGH advisories surfaced by cargo audit:

Crate	From	To	Closes
aws-lc-sys	0.37.0	0.40.0	RUSTSEC-2026-0044/0045/0046/0047/0048
quinn-proto	0.11.13	0.11.14	RUSTSEC-2026-0037
rustls-webpki	0.103.9	0.103.13	RUSTSEC-2026-0049/0098/0099/0104

Lock-file updates only; no workspace declaration changes.

The 11th advisory: RUSTSEC-2023-0071 (rsa Marvin attack)

No upstream fix has been released. The rsa maintainers have not shipped a patched version. The crate enters our graph transitively through sqlx's native-tls / mysql backends that are not exercised in production code paths. Suppressed in codex-rs/.cargo/audit.toml with an explanatory comment and re-evaluation pointer.

Verification

$ cargo audit --json | jq '.vulnerabilities.list | length'
0

Zero vulnerabilities, 5 informational warnings (pre-existing unmaintained/unsound — not the rsa CVE).

Test plan

• cargo audit reports 0 vulnerabilities (down from 11)
• rsa CVE suppression has explicit justification + tracking pointer
• Stacked on fix(workspace): unblock codex-rs cargo resolution #525 workspace unblock

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

---

Note

Medium Risk
Lockfile-only crypto/TLS dependency bumps can change native build/link behavior and runtime TLS/QUIC behavior, so regressions are possible despite no app code changes. The added cargo-audit ignore for RUSTSEC-2023-0071 reduces signal until it’s revisited when upstream ships a fix.

Overview
Updates codex-rs dependency resolutions to remediate multiple HIGH RustSec advisories by bumping aws-lc-sys 0.37.0→0.40.0, quinn-proto 0.11.13→0.11.14, and rustls-webpki 0.103.9→0.103.13 (via Cargo.lock changes only).

Adds a documented suppression in codex-rs/.cargo/audit.toml for RUSTSEC-2023-0071 (rsa Marvin attack) with justification and a pointer to re-evaluate once an upstream fix is released.

^{Reviewed by Cursor Bugbot for commit 62fa61e. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Ignore the unpatched RSA advisory in the security audit, with a note pointing to the upstream tracking issue.

What Changed

• The audit list now skips the RSA Marvin attack advisory because no fixed release is available yet
• The entry includes a clear reason and a link for re-checking when an upstream fix lands

Impact

✅ Fewer false alarm security scan results
✅ Clearer audit reports
✅ Easier follow-up on the remaining RSA advisory

🔄 Retrigger CodeAnt AI Review

Details

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[gemini-code-assist]

Code Review

This pull request updates several dependencies, including aws-lc-sys, quinn-proto, and rustls-webpki, and adds a suppression for the RUSTSEC-2023-0071 security advisory in audit.toml. Feedback suggests that rather than suppressing the advisory, the project should aim to remove the unused sqlx features that transitively include the vulnerable rsa crate, thereby eliminating the security risk and reducing binary size.

[gemini-code-assist]

While suppressing RUSTSEC-2023-0071 is a valid stopgap when no upstream fix exists, the justification notes that the rsa crate is pulled in via sqlx backends (mysql/native-tls) that are not used in production.

In Cargo.lock (lines 8706-8707), it appears that sqlx-mysql and sqlx-postgres are indeed being included in the dependency graph. Since the workspace Cargo.toml (lines 249-258) only enables the sqlite feature and explicitly sets default-features = false, it is highly likely that another crate in the workspace is enabling these extra drivers (possibly by depending on sqlx without disabling default features).

Recommendation: Instead of suppression, consider identifying and removing the unused mysql and postgres features from the workspace. Removing these unused features would eliminate the vulnerable rsa crate from the dependency graph entirely, which is a more robust security fix than suppression and also reduces binary size.

[codeant-ai]

CodeAnt AI finished reviewing your PR.