Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package openai-codex for openSUSE:Factory checked in at 2026-09-11 18:01:23 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/openai-codex (Old) and /work/SRC/openSUSE:Factory/.openai-codex.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openai-codex" Fri Sep 11 18:01:23 2026 rev:10 rq:1376913 version:0.154.0 Changes: -------- --- /work/SRC/openSUSE:Factory/openai-codex/openai-codex.changes 2026-09-08 17:01:31.677523083 +0200 +++ /work/SRC/openSUSE:Factory/.openai-codex.new.1265/openai-codex.changes 2026-09-11 18:04:45.903445919 +0200 @@ -1,0 +2,24 @@ +Thu Sep 10 05:53:24 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 0.154.0: + * Experimental worktree support for isolated checkouts of new + or forked sessions, with browse and resume + * Answer questions inline while Codex keeps working, keeping + the main draft + * Vim R replace mode with undo and dot-repeat; /copy keeps + formatting and covers status and session fields + * Plugin tools refresh after external upgrades, MCP OAuth + refresh is coordinated, helpers no longer run before trust + is established; resume and fork keep saved permissions + * Drop the deprecated codex mcp-server entry point, now codex mcp +- Rebase codex-drop-v8-code-mode.patch over the new + windows-sandbox-service member; same removals as before +- Regenerate vendor.tar.zst: rmcp 3.1.3 -> 3.2.0 plus routine + bumps; webrtc/gstreamer/cpal stay out of the codex-cli link + graph, so the License tag is unchanged +- Legal-Review-Notice: linked-crate count 876/878 -> 880/882 on + aarch64/x86_64; the vendored dependency licence set is unchanged +- cargo-audit reports the same five advisories as 0.151.0, none + new and none fixable by re-vendoring + +------------------------------------------------------------------- Old: ---- codex-rust-v0.153.4.tar.gz New: ---- codex-rust-v0.154.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openai-codex.spec ++++++ --- /var/tmp/diff_new_pack.iOw7hA/_old 2026-09-11 18:04:48.946573138 +0200 +++ /var/tmp/diff_new_pack.iOw7hA/_new 2026-09-11 18:04:48.948573221 +0200 @@ -17,20 +17,20 @@ Name: openai-codex -Version: 0.153.4 +Version: 0.154.0 Release: 0 Summary: OpenAI Codex coding agent for the terminal # Legal-Review-Notice: upstream codex is Apache-2.0. Everything after that # covers the Rust crates statically linked into the shipped # %%{_bindir}/codex binary, enumerated with # cargo tree --offline -p codex-cli -e normal,no-proc-macro -# against the vendored tree (876 crates on aarch64, 878 on x86_64: 748 -# third-party vendored deps on aarch64 and 750 on x86_64, plus 128 +# against the vendored tree (880 crates on aarch64, 882 on x86_64: 750 +# third-party vendored deps on aarch64 and 752 on x86_64, plus 130 # first-party codex workspace members, which are Apache-2.0 like upstream. # Every one declares a licence, none is missing; only the third-party count # is a licence signal, the workspace one moves whenever upstream adds a # crate). Electing Apache-2.0 where it is offered and MIT otherwise, the -# aarch64 tally is Apache-2.0 649, MIT 174, +# aarch64 tally is Apache-2.0 651, MIT 176, # Unicode-3.0 20, MPL-2.0 12, ISC 7, BSD-3-Clause 6, Zlib 5, BSD-2-Clause 1, # CC0-1.0 1, CDLA-Permissive-2.0 1. # - self_cell 1.2.2 is "Apache-2.0 OR GPL-2.0-only" and is the ONLY crate @@ -119,7 +119,7 @@ The %{_bindir}/codex binary is a multicall executable: the helper programs (apply_patch, codex-linux-sandbox, codex-execve-wrapper) are dispatched from -argv[0], and the remaining tools are subcommands (exec, mcp-server, +argv[0], and the remaining tools are subcommands (exec, mcp, app-server, execpolicy, sandbox, responses-api-proxy, completion, doctor, agents, queue). ++++++ _service ++++++ --- /var/tmp/diff_new_pack.iOw7hA/_old 2026-09-11 18:04:48.991575019 +0200 +++ /var/tmp/diff_new_pack.iOw7hA/_new 2026-09-11 18:04:48.993575102 +0200 @@ -11,11 +11,11 @@ feature and leaves the lockfile, hence the vendored set, untouched. To regenerate: - tar xf codex-rust-v0.153.4.tar.gz - patch -p1 -d codex-rust-v0.153.4 < codex-drop-v8-code-mode.patch - rm -rf codex-rust-v0.153.4/codex-rs/vendor + tar xf codex-rust-v0.154.0.tar.gz + patch -p1 -d codex-rust-v0.154.0 < codex-drop-v8-code-mode.patch + rm -rf codex-rust-v0.154.0/codex-rs/vendor osc service manualrun cargo_vendor - rm -rf codex-rust-v0.153.4 + rm -rf codex-rust-v0.154.0 The codex-rs/vendor removal drops the bundled bubblewrap 0.11.2 C sources, which %prep removes as well - codex uses the system bubblewrap instead. @@ -32,8 +32,7 @@ cargo-audit is NOT clean, and running it inside codex-rs hides most of it: upstream's codex-rs/.cargo/audit.toml ignores 11 advisories, which drops the count from 5 to 1. Audit a bare copy of Cargo.lock instead. As of - 0.153.4, whose Cargo.lock is byte-identical to 0.153.0's, and unchanged - since 0.151.0: + 0.154.0, and unchanged since 0.151.0: RUSTSEC-2026-0185 / CVE-2026-25800 (quinn-proto 0.11.14, fixed 0.11.15) - NOT linked. reqwest gates dep:quinn behind its "http3" feature, which the workspace leaves off, so it never reaches @@ -51,7 +50,7 @@ not anything this package can vendor around. --> <service name="cargo_vendor" mode="manual"> - <param name="srcdir">codex-rust-v0.153.4/codex-rs</param> + <param name="srcdir">codex-rust-v0.154.0/codex-rs</param> <param name="compression">zst</param> <param name="update">false</param> </service> ++++++ codex-drop-v8-code-mode.patch ++++++ --- /var/tmp/diff_new_pack.iOw7hA/_old 2026-09-11 18:04:49.005575604 +0200 +++ /var/tmp/diff_new_pack.iOw7hA/_new 2026-09-11 18:04:49.009575771 +0200 @@ -23,12 +23,13 @@ "codex-home", "cloud-config", "cloud-tasks", -@@ -101,7 +99,6 @@ +@@ -101,8 +99,7 @@ "otel-trace-websocket", "tui", "tools", - "v8-poc", "websocket-client", + "windows-sandbox-service", "worktree", "workload-identity", @@ -185,7 +182,6 @@ ++++++ codex-rust-v0.153.4.tar.gz -> codex-rust-v0.154.0.tar.gz ++++++ /work/SRC/openSUSE:Factory/openai-codex/codex-rust-v0.153.4.tar.gz /work/SRC/openSUSE:Factory/.openai-codex.new.1265/codex-rust-v0.154.0.tar.gz differ: char 15, line 1 ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/openai-codex/vendor.tar.zst /work/SRC/openSUSE:Factory/.openai-codex.new.1265/vendor.tar.zst differ: char 7, line 1
