Skip to content

Update libz-sys to fix the CI advisory check - #3135

Merged
Eliah Kagan (EliahKagan) merged 1 commit into
GitoxideLabs:mainfrom
EliahKagan:codex/fix-rustsec-2026-0418
Oct 29, 2026
Merged

Update libz-sys to fix the CI advisory check#3135
Eliah Kagan (EliahKagan) merged 1 commit into
GitoxideLabs:mainfrom
EliahKagan:codex/fix-rustsec-2026-0418

Conversation

@EliahKagan

@EliahKagan EliahKagan commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

This PR bumps the transitive libz-sys dependency in Cargo.lock to fix RUSTSEC-2026-0418. The following text is written by GPT-6.1 Sol in Codex:

The cargo-deny-advisories job on main fails for RUSTSEC-2026-0418. Update the locked libz-sys from 1.1.29 to the patched 1.1.31 release, which removes compiler-probe logging that can expose build environment variables when used with cc 1.6.0 or later on Unix.

Only the version and checksum in Cargo.lock change. The dependency comes through gix-transport → curl → curl-sys → libz-sys.

Validation:

  • cargo deny --workspace --all-features --locked check advisories passed, using the repository's policy with the advisory database path redirected to temporary storage.
  • GIX_TEST_IGNORE_ARCHIVES=1 cargo test -p gix-transport --features http-client-curl --locked passed: 66 tests and a successful build of libz-sys 1.1.31.
  • git diff --check passed.

I am Codex, an AI agent working at Eliah Kagan's request. This change was prompted by the failing advisory check on main.

@EliahKagan
Update libz-sys to fix the CI advisory check
1f9dd4f 
The `cargo-deny-advisories` job on `main` fails for
[RUSTSEC-2026-0418](https://rustsec.org/advisories/RUSTSEC-2026-0418).
`libz-sys` can log build environment variables when used with `cc` 1.6.0
or later on Unix, exposing them through saved build-script output.

Update the workspace lockfile from `libz-sys` 1.1.29 to the patched
1.1.31 release, which removes the probe-command logging. This dependency
is brought in through `curl-sys` for the curl HTTP transport.
EliahKagan
EliahKagan commented Oct 29, 2026
View reviewed changes

@EliahKagan EliahKagan left a comment •
edited
Loading

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm doing final review, rereading claims in the commit message and PR description and checking for accuracy, then I'll enable auto-merge. (The delay on this is CI anyway, so I have time to check this without slowing anything else down.)

Update: LGTM

@EliahKagan
Eliah Kagan (EliahKagan) marked this pull request as ready for review October 29, 2026 16:24
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-29T16:25:59.425009Z 1f9dd4f Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@EliahKagan
Eliah Kagan (EliahKagan) merged commit fd482fb into GitoxideLabs:main Oct 29, 2026
32 checks passed
@EliahKagan
Eliah Kagan (EliahKagan) deleted the codex/fix-rustsec-2026-0418 branch October 29, 2026 17:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@EliahKagan