Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package openai-codex for openSUSE:Factory checked in at 2026-10-24 22:04:02 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/openai-codex (Old) and /work/SRC/openSUSE:Factory/.openai-codex.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openai-codex" Sat Oct 24 22:04:02 2026 rev:23 rq:1392031 version:0.164.0 Changes: -------- --- /work/SRC/openSUSE:Factory/openai-codex/openai-codex.changes 2026-10-18 19:24:08.147777305 +0200 +++ /work/SRC/openSUSE:Factory/.openai-codex.new.2252680/openai-codex.changes 2026-10-24 22:05:24.320555750 +0200 @@ -1,0 +2,33 @@ +Fri Oct 23 08:47:01 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 0.164.0: + * Reusable prompts and slash commands in ten numbered /presets slots + with a keyboard menu; inline /model and /permissions arguments for + model, reasoning effort, speed and permission profiles + * Viewed and generated image previews in the fullscreen transcript on + terminals with Kitty or Sixel graphics + * Enterprise MCP authentication via Codex account grants and credential + masking for remote Bash and Zsh snapshot sessions; Bedrock setup + wizard enabled by default + * Failed compaction no longer loses conversation history; session resume + restores compressed histories and thread settings; Windows proxy + authentication and hardened sandbox checks for macOS case-variant + paths and replaceable symlinks + * Reduced disk usage from installs and marketplace checkouts; embedded + JavaScript runtime updated to V8 152.2.0 +- Drop codex-bump-gix-0.88.patch and codex-gix-error-anyhow.patch, + obsolete now that upstream ships gix 0.89.0 with the fixed + gix-pack 0.76.0 (boo#1285151): + * CVE-2026-109349: gix-pack aborts on the header of a crafted + pack-version-3 pack file + * CVE-2026-109350: gix-pack misresolves an ofs-delta base distance + on crafted input + * CVE-2026-109351: gix-pack can exhaust memory on the header + object count of a crafted pack file +- Raise the rust build floor to 1.99 for upstream's pinned toolchain +- Rebase codex-drop-v8-code-mode.patch (V8 152.2.0) and + codex-system-libzstd.patch (zip 9.0.0 context) onto the new sources +- Licence set re-derived from the new vendor tree: the tag gains + bzip2-1.0.6 for libbz2-rs-sys, linked via zip 9.0.0 + +------------------------------------------------------------------- Old: ---- codex-bump-gix-0.88.patch codex-gix-error-anyhow.patch codex-rust-v0.163.0.tar.gz New: ---- codex-rust-v0.164.0.tar.gz ----------(Old B)---------- Old: JavaScript runtime updated to V8 152.2.0 - Drop codex-bump-gix-0.88.patch and codex-gix-error-anyhow.patch, obsolete now that upstream ships gix 0.89.0 with the fixed Old: JavaScript runtime updated to V8 152.2.0 - Drop codex-bump-gix-0.88.patch and codex-gix-error-anyhow.patch, obsolete now that upstream ships gix 0.89.0 with the fixed ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openai-codex.spec ++++++ --- /var/tmp/diff_new_pack.UUi8B8/_old 2026-10-24 22:05:30.508815490 +0200 +++ /var/tmp/diff_new_pack.UUi8B8/_new 2026-10-24 22:05:30.511815617 +0200 @@ -17,7 +17,7 @@ Name: openai-codex -Version: 0.163.0 +Version: 0.164.0 Release: 0 Summary: OpenAI Codex coding agent for the terminal # Legal-Review-Notice: upstream codex is Apache-2.0. Everything after that @@ -77,6 +77,19 @@ # Apache-2.0 528, MIT 181, Unicode-3.0 20, MPL-2.0 12, ISC 9, # BSD-3-Clause 9, Zlib 5, BSD-2-Clause 1, CC0-1.0 1, # CDLA-Permissive-2.0 1 - so the tag above is unchanged by this bump. +# 0.164.0 re-derives with the same scope for a bigger vendor tree: 775 +# third-party crates in the codex-cli closure (774 tallied, aws-lc-sys +# itemised separately as before) - Apache-2.0 542, MIT 178, +# Unicode-3.0 20, MPL-2.0 12, ISC 9, BSD-3-Clause 9, Zlib 5, +# BSD-2-Clause 1, CC0-1.0 1, CDLA-Permissive-2.0 1, bzip2-1.0.6 1. +# The newcomer is libbz2-rs-sys 0.2.5 ("bzip2-1.0.6"): upstream moves zip +# 2.4.2 -> 9.0.0 and selects its bzip2-rs feature, which enables both the +# bzip2-sys backend (system lib, see %%install) and bzip2's own default +# backend, so the pure-Rust libbz2 code links in too and the tag gains +# bzip2-1.0.6. constant_time_eq and dunce ("CC0-1.0 OR MIT-0 OR +# Apache-2.0") elect Apache-2.0. Upstream's own gix move (0.81.0 -> +# 0.89.0, gix-pack 0.68.0 -> 0.76.0) retires the boo#1285151 backport: +# codex-bump-gix-0.88.patch and codex-gix-error-anyhow.patch are dropped. # - self_cell 1.2.2 is "Apache-2.0 OR GPL-2.0-only" and is the ONLY crate # anywhere in the graph offering GPL. Apache-2.0 is elected, so this # package carries no GPL obligation; please do not re-derive it as GPL. @@ -110,7 +123,7 @@ # - matchit (MIT AND BSD-3-Clause), encoding_rs, ring and aws-lc-rs similarly # keep ISC / BSD-3-Clause in the tag even when Apache-2.0 is elected as the # crate's primary licence. -License: Apache-2.0 AND MIT AND Unicode-3.0 AND MPL-2.0 AND ISC AND BSD-3-Clause AND Zlib AND BSD-2-Clause AND CC0-1.0 AND CDLA-Permissive-2.0 +License: Apache-2.0 AND MIT AND Unicode-3.0 AND MPL-2.0 AND ISC AND BSD-3-Clause AND Zlib AND BSD-2-Clause AND CC0-1.0 AND CDLA-Permissive-2.0 AND bzip2-1.0.6 URL: https://github.com/openai/codex Source0: https://github.com/openai/codex/archive/refs/tags/rust-v%{version}.tar.gz#/codex-rust-v%{version}.tar.gz Source1: vendor.tar.zst @@ -120,12 +133,8 @@ Patch1: codex-no-startup-update-check.patch # PATCH-FIX-OPENSUSE codex-system-libzstd.patch [email protected] -- link zstd-sys against the system libzstd instead of its bundled copy Patch2: codex-system-libzstd.patch -# PATCH-FIX-OPENSUSE codex-bump-gix-0.88.patch [email protected] -- bump gix 0.81.0 -> 0.88.0 so the lockfile reaches the fixed gix-pack 0.75.0 (boo#1285151) -Patch3: codex-bump-gix-0.88.patch -# PATCH-FIX-OPENSUSE codex-gix-error-anyhow.patch [email protected] -- adapt codex-git-utils to the gix 0.88 gix-error API (boo#1285151) -Patch4: codex-gix-error-anyhow.patch # PATCH-FIX-OPENSUSE codex-disable-daemon-auto-update.patch [email protected] -- distribution policy: the managed daemon must not replace the packaged binary with an upstream download -Patch5: codex-disable-daemon-auto-update.patch +Patch3: codex-disable-daemon-auto-update.patch BuildRequires: cargo BuildRequires: cargo-packaging >= 1.2.0 BuildRequires: cmake @@ -133,7 +142,7 @@ # %%limit_build: cap parallel rustc jobs by available memory (see %%build) BuildRequires: memory-constraints BuildRequires: pkgconfig -BuildRequires: rust >= 1.95 +BuildRequires: rust >= 1.99 BuildRequires: zstd BuildRequires: pkgconfig(bzip2) BuildRequires: pkgconfig(liblzma) ++++++ _service ++++++ --- /var/tmp/diff_new_pack.UUi8B8/_old 2026-10-24 22:05:30.562817776 +0200 +++ /var/tmp/diff_new_pack.UUi8B8/_new 2026-10-24 22:05:30.566817945 +0200 @@ -11,16 +11,11 @@ feature and leaves the lockfile, hence the vendored set, untouched. To regenerate: - tar xf codex-rust-v0.163.0.tar.gz - patch -p1 -d codex-rust-v0.163.0 < codex-drop-v8-code-mode.patch - patch -p1 -d codex-rust-v0.163.0 < codex-bump-gix-0.88.patch - (plus the Cargo.lock the bump resolves to: run cargo update - for gix in codex-rs/ and copy the lock in. The vendored - Cargo.lock overwrites the tarball's at build time, so the - tarball itself stays pristine.) - rm -rf codex-rust-v0.163.0/codex-rs/vendor + tar xf codex-rust-v0.164.0.tar.gz + patch -p1 -d codex-rust-v0.164.0 < codex-drop-v8-code-mode.patch + rm -rf codex-rust-v0.164.0/codex-rs/vendor osc service manualrun cargo_vendor - rm -rf codex-rust-v0.163.0 + rm -rf codex-rust-v0.164.0 The codex-rs/vendor removal drops the bundled bubblewrap 0.11.2 C sources, which %prep removes as well - codex uses the system bubblewrap instead. @@ -65,7 +60,7 @@ bump, not anything this package can vendor around. --> <service name="cargo_vendor" mode="manual"> - <param name="srcdir">codex-rust-v0.163.0/codex-rs</param> + <param name="srcdir">codex-rust-v0.164.0/codex-rs</param> <param name="compression">zst</param> <param name="update">false</param> </service> ++++++ codex-drop-v8-code-mode.patch ++++++ --- /var/tmp/diff_new_pack.UUi8B8/_old 2026-10-24 22:05:30.583818664 +0200 +++ /var/tmp/diff_new_pack.UUi8B8/_new 2026-10-24 22:05:30.587818834 +0200 @@ -58,7 +58,7 @@ url = "2" urlencoding = "2.1" uuid = "1" --v8 = "=150.4.0" +-v8 = "=152.2.0" vt100 = "0.16.2" walkdir = "2.5.0" webbrowser = "1.2.2" ++++++ codex-rust-v0.163.0.tar.gz -> codex-rust-v0.164.0.tar.gz ++++++ /work/SRC/openSUSE:Factory/openai-codex/codex-rust-v0.163.0.tar.gz /work/SRC/openSUSE:Factory/.openai-codex.new.2252680/codex-rust-v0.164.0.tar.gz differ: char 13, line 1 ++++++ codex-system-libzstd.patch ++++++ --- /var/tmp/diff_new_pack.UUi8B8/_old 2026-10-24 22:05:30.621820272 +0200 +++ /var/tmp/diff_new_pack.UUi8B8/_new 2026-10-24 22:05:30.629820611 +0200 @@ -11,10 +11,8 @@ --- a/codex-rs/Cargo.toml +++ b/codex-rs/Cargo.toml -@@ -552,7 +552,7 @@ - winapi-util = "0.1.11" - windows-sys = "0.61.2" - zip = "2.4.2" +@@ -573,5 +573,5 @@ + ] } -zstd = "0.13" +zstd = { version = "0.13", features = ["pkg-config"] } ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/openai-codex/vendor.tar.zst /work/SRC/openSUSE:Factory/.openai-codex.new.2252680/vendor.tar.zst differ: char 7, line 1
