Repository navigation
chore: replace yanked async-executor 1.14.0 - #304
Conversation
|
@sfl review |
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
![hemsoft-sfl-reviewer[bot]](https://avatars.githubusercontent.com/in/5406096?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Verdict: PASS • Round 1
Review done by claude-opus-5-5 (adversarial to codex)
The PR changes only Cargo.lock. It replaces the yanked async-executor 1.14.0 with 1.14.1 and updates the matching registry checksum. I found no defects: the new checksum and dependency set match the crates.io index, and every dependent's version requirement still accepts the new version.
🔨 Full-Spectrum Review Summary
Effort: high
Review time: 0m 54s
Token count: Unavailable
| Pass | 🔴 Critical | 🟠 High | 🟡 Medium | ⚪ Low |
|---|---|---|---|---|
| 🔒 Security | 0 | 0 | 0 | 0 |
| ✅ Accuracy | 0 | 0 | 0 | 0 |
| 🧰 Quality & Maintainability | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 |
Key Findings
No material defects found.
Coverage
- Files reviewed:
Cargo.lock
- Context read:
Cargo.tomlrust-toolchain.tomlAGENTS.mdcrates.io-index as/yn/async-executorcrates.io-index ac/ce/accesskit_unixcrates.io-index ks/ni/ksnicrates.io-index sm/ol/smolcrates.io-index zb/us/zbusPR #304 metadata and body
- Verified:
- The compare response's
base_commit.shais1c5b8cc1841f3f4383b01521e8bc47c6da010416and its last commit ise3340780e731ade27ef6c4901201850c6b3adf97. The branch is 1 commit ahead and 0 behind, and the merge base equals the base. - A full byte diff of the base and head
Cargo.lockfrom the contents API shows only lines 368 and 370 changed: the version and the checksum. - The new checksum matches the crates.io index
cksumforasync-executor 1.14.1, which hasyanked:false. The index marks1.14.0asyanked:true. - The normal dependencies of
1.14.1in the index (async-task,concurrent-queue,fastrand,futures-lite,pin-project-lite,slab) match the lock entry. Their locked versions satisfy the stated requirements. - The four dependents accept 1.14.1:
accesskit_unix 0.22.1(^1.5.0),ksni 0.3.6(^1),smol 2.0.2(^1.5.0) andzbus 5.19.0(^1.11.0). 1.14.1declaresrust_version1.63, lower than the 1.65 declared by1.14.0. The toolchain channel isstable.- No workspace
Cargo.tomlpinsasync-executordirectly. The lock contains only oneasync-executorpackage entry.
- The compare response's
- Not verified:
- I did not check that the published 1.14.1 crate content actually fixes upstream issue 163. I relied on index metadata only, not the upstream source diff.
- I did not check the PR body's claims about cargo-audit, cargo tree or test results, because they come from execution I was not allowed to repeat.
- I did not check CI or Package job status for this head. The PR says it is stacked on #303 and not yet merge-ready.
- Runtime behavior of the GPUI executor path
- Tests run: None. Reviewer execution is disabled.
HemSoft full-spectrum review • 3 evidence-based passes • Reviewed head e3340780e731ade27ef6c4901201850c6b3adf97 • SFL v0
|
@sfl review |
|
@codex review |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
✅ Verdict: PASS • Round 2
Since round 1
New: 0; still open (repeated): 0; resolved: 0.
Resolved means no matching finding in this review, not independent proof of a fix.
New (0)
- None.
Still open (repeated) (0)
- None.
Resolved (0)
- None.
Review done by claude-opus-5-5 (adversarial to codex)
The PR changes only Cargo.lock, bumping the transitive async-executor from yanked 1.14.0 to 1.14.1 with a new registry checksum. The dependency list and every other package entry are unchanged. No Critical, High or Medium defect was found within the stated coverage, so nothing blocks approval.
🔨 Full-Spectrum Review Summary
Effort: high
Review time: 0m 45s
Token count: Unavailable
| Pass | 🔴 Critical | 🟠 High | 🟡 Medium | ⚪ Low |
|---|---|---|---|---|
| 🔒 Security | 0 | 0 | 0 | 0 |
| ✅ Accuracy | 0 | 0 | 0 | 0 |
| 🧰 Quality & Maintainability | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 |
Key Findings
No material defects found.
Coverage
- Files reviewed:
Cargo.lock
- Context read:
Cargo.tomlAGENTS.md.gitattributes.cargo/audit.tomlsmol-rs/async-executor Cargo.toml at tag v1.14.1
- Verified:
- The compare
base_commit.shaequalsa444e81a375fad4677b99a6fc09a56dd322ea424and the last commit equalsa3a2eab8a175271d53844489582034bcafd6befd. The status is ahead by 3 and behind by 0. - The compare lists one changed file,
Cargo.lock, with 2 additions and 2 deletions: theasync-executorversion and checksum lines. - At head, the
async-executorentry listsasync-task,concurrent-queue,fastrand,futures-lite,pin-project-liteandslab, all unchanged in the diff. Upstreamv1.14.1Cargo.tomldeclares the same six dependencies. - The upstream tag
v1.14.1exists insmol-rs/async-executor. Its manifest declares version1.14.1andrust-version1.63. async-executoris transitive only: the rootCargo.tomlhas no direct dependency, and the lock dependents areaccesskit_unix,ksni,smolandzbus. A patch bump stays within their semver ranges..cargo/audit.tomlhas an emptyignorelist, so the change adds no advisory exception or policy change.
- The compare
- Not verified:
- The new checksum against the crates.io index, and the yank status of either version: only GitHub API calls were allowed.
- The PR's claimed cargo-audit, cargo tree, clippy and test results, and the pending CI and Package checks: running code was forbidden.
- Whether the upstream use-after-free fix in
1.14.1is reachable or effective in this app at runtime.
- Tests run: None. Reviewer execution is disabled.
HemSoft full-spectrum review • 3 evidence-based passes • Reviewed head a3a2eab8a175271d53844489582034bcafd6befd • SFL v0
Summary
Replace yanked
async-executor 1.14.0with1.14.1. Only that package's version and registry checksum change; all 894 package entries and its dependency list are otherwise unchanged.Upstream issue 163 describes the executor-drop/waker use-after-free, and PR 164 reverts the regression. This change removes the withdrawn dependency; it does not claim the application can reach the upstream trigger.
Merge qualification
Targets main after #303 and fixture repair #305 merged. Current base
a444e81a375fad4677b99a6fc09a56dd322ea424; current heada3a2eab8a175271d53844489582034bcafd6befd. The diff against main is Cargo.lock only and is byte-identical to the original validated lockfile patch.All seven required CI jobs passed in CI run 42121039074. All three conditional Package jobs passed in Package run 42121039139. Fresh authenticated SFL and Codex reviews are clean, with zero unresolved threads.
Acceptance Criteria
async-executor 1.14.1, with the non-yanked registry entry and checksum independently verified.async-executorentry underwarnings.yanked.Definition of Done
a3a2eab8a175271d53844489582034bcafd6befd.msix,macos-appandlinux-debPackage jobs passed on that head.Validation
Initial local validation used stack base
1c5b8cc1841f3f4383b01521e8bc47c6da010416and candidatee3340780e731ade27ef6c4901201850c6b3adf97. Integration with current main preserved the exact two-line lockfile diff, and formatting/diff checks passed again. Current-head full CI and all three Package jobs passed. The metrics log verifies actualMETRICS_BASE: a444e81a375fad4677b99a6fc09a56dd322ea424.cargo tree --locked --target all -i async-executor: pass, only 1.14.1. This shows dependency paths, not runtime reachability.cargo metadata --locked --format-version 1: pass; one executor package at 1.14.1. Validation left lockfile bytes unchanged.scripts/Invoke-RustAdvisoryScan.ps1with pinned cargo-audit 0.22.2, run against both lockfiles with RustSec database26fd2d43f7280a1fb925a3743ec463017afe7119: both exit 0 and report 0 vulnerabilities. The baseline reportsasync-executorunderwarnings.yanked; the candidate reports an empty yanked list.cargo fmt --all --check: pass.cargo test -p codexbar-providers --lib --locked --no-run, then the resulting library binary with isolated synthetic HOME/USERPROFILE, AppData, XDG and temp directories: 356 passed, 0 failed, 5 existing ignored. Includes test: isolate Grok test home directories #303's test-only fixture fix. This suite does not compile or exercise the GPUI executor path.cargo clippy -p codexbar-providers --all-targets --locked -- -D warnings: pass.git diff --check: pass.Risks and deferred work
No production source or dependency policy changed. The scanner was installed at its repository-pinned version into parent-owned temporary storage, outside the project. The lockfile retains the original CRLF convention; Git's patch is two insertions and two deletions. Parent preserved the worker's exact patch, restored only its verified primary-checkout lockfile bytes, and retained the audit HTML unchanged.
Claude Opus 5.5 prepared the bounded lock edit; GPT-6.1 Sol independently verified, packaged and validated it. No local app installation was performed. Hosted Package results are scoped to the repository workflow.
Closes #296
Merge evidence
Checked head
a3a2eab8a175271d53844489582034bcafd6befd. All seven required CI checks and all three triggered Package jobs passed with GitHub Actions integration ID 15368. Authenticated SFL/Codex clean, zero unresolved threads, zero formal approvals required; actual metrics basea444e81a375fad4677b99a6fc09a56dd322ea424. Guarded squash merge landed as6bdbe196e8692dd3b21550e20121a10ce9201600. Mini and Home main both fast-forwarded to this commit. All four changed source-file hashes across this PR, #303 and #305 match their verified worker patches. The audit HTML remains unchanged and untracked.Only the three session-owned merged source branches/worktrees were removed after exact-head merge and live-ref verification. Their source history is bundled outside the repository; ignored content removed was only parent-generated Cargo target caches. Native remotes remain unchanged, with both names independently verified to identify repository ID 1214914496. Main is the sole local branch/worktree and there are no stashes. No local application was installed.