[HemSoft]

Risk level: 4/10 (codexbar)
Worked on by: gpt-6.1-sol on Home, for Franz.

Closes #333. Prerequisite for #332.

Update locked rustix from 1.1.5 to 1.1.6 to resolve RUSTSEC-2026-0486.
The required security scan denied the old lock's unsound xattr buffer handling.
The tagged upstream source contains the correction;
actual CodexBar reachability has not been established.

Only Cargo.lock changes in the net diff. Rustix is the only changed package
version among 894 locked packages; Cargo also normalized existing windows-sys
edges. No application, manifest, workflow or security policy changes remain.

Validation

• Local required format, workspace Clippy with warnings denied and workspace
  tests passed: 1,114 passed, six ignored, plus the native subprocess fixture.
• All seven required checks in CI43045328611 passed, including
  the unchanged security scanner. All three Package jobs
  passed after failed-only retries on verified hosted DNS recovery evidence.
• Head f5ba4b0 has exactly the same Git tree as
  reviewed head e453844; git diff is empty.
• SFL Round 1 PASS remains authenticated, unedited and
  complete, with zero unresolved threads. The charter's CI-only PASS reuse rule
  applies. gh x status --refresh reports checks pass and AI - for the changed
  commit ID; this is recorded without manufacturing a current-SHA bot verdict.
• Effective rules require no formal approval, retain all seven checks from
  integration 15368, enforce strict base currency and provide no bypass actor.

Council: not required for this compatible upstream patch. Owner remains
chief-dispatch-8fcc69c4-codexbar-parser through guarded merge, main CI, source
sync and parser PR332 delivery. Existing audit bytes, branches and worktrees
are preserved. No application or browser was launched.

[HemSoft]

@sfl review

[hemsoft-sfl-reviewer]

✅ Verdict: PASS • Round 1

Confidence: 8/10 · Project risk: 4/10 (codexbar)

Review done by claude-opus-5-5 (adversarial to codex)

The PR changes only Cargo.lock. It bumps rustix from 1.1.5 to 1.1.6 to clear RUSTSEC-2026-0486, and it moves 13 crates' windows-sys dependency edges from 0.61.2 to 0.60.2, 0.52.0 or 0.48.0, versions already in the lock. I found no evidenced defect: no package is added or removed, rustix 1.1.6's declared windows-sys range (>=0.52, <0.62) covers the new edge, and the head's security-scan check passed. The cross-platform Rust jobs were still running when I read them.

🔨 Full-Spectrum Review Summary

Effort: high
Review time: 1m 48s
Token count: Unavailable

Pass	🔴 Critical	🟠 High	🟡 Medium	⚪ Low
🔒 Security	0	0	0	0
✅ Accuracy	0	0	0	0
🧰 Quality & Maintainability	0	0	0	0
Total	0	0	0	0

Key Findings

No material defects found.

Coverage

• Files reviewed:
  • Cargo.lock
• Context read:
  • Cargo.toml
  • rust-toolchain.toml
  • .github/workflows/ci.yml
  • crates/codexbar-app/Cargo.toml
  • crates/codexbar-core/Cargo.toml
  • crates/codexbar-metrics/Cargo.toml
  • crates/codexbar-providers/Cargo.toml
  • crates/codexbar-store/Cargo.toml
  • bytecodealliance/rustix Cargo.toml at v1.1.6
  • bytecodealliance/rustix compare v1.1.5...v1.1.6 file list
  • PR #334 title and body
• Verified:
  • gh api user returned HemSoft under the per-process GH_CONFIG_DIR profile
  • The compare's base_commit.sha is 899bf3fe7c589ce45ca7ca96c9684d43e1f956d1, its last commit is e453844dafb9a98d7591adecdc28c0af03365ac8, and it is 1 ahead and 0 behind
  • The diff touches only Cargo.lock (+15/-15)
  • I parsed both lockfiles: 894 packages each, and the only package version change is rustix 1.1.5 to 1.1.6 with a new checksum
  • Dependency edges changed for 13 crates, all on windows-sys (anstyle-query, anstyle-wincon, dirs-sys 0.5.0, errno, muda, quinn-udp, socket2, tempfile, tray-icon, uds_windows, winapi-util, winreg, rustix). All four windows-sys versions (0.48.0, 0.52.0, 0.60.2, 0.61.2) are locked at both base and head, so nothing new gets compiled
  • Upstream rustix 1.1.6 declares windows-sys >=0.52, <0.62 and linux-raw-sys 0.12, matching the head lock's edges and its unchanged linux-raw-sys entry
  • The workspace uses resolver = "3" with no rust-version in any member manifest, and Cargo.toml is unchanged
  • The head's security-scan check run (cargo-audit per ci.yml) completed with success, and build and rust-mutations succeeded
  • The workspace pins no rustix, tempfile or windows-sys directly, so no manifest constraint is bypassed
• Not verified:
  • Whether each moved crate's own windows-sys requirement allows the older version: I didn't read the other 12 crates' manifests. CI's --locked builds would catch a mismatch
  • rust (windows-latest), rust (ubuntu-latest), rust (macos-latest), msix, linux-deb, macos-app and rust-metrics were queued or in progress at review time
  • The PR body says cargo moved the edges to versions "required by" crate metadata. The reason cargo moved them is unproven; the prior 0.61.2 edges may also have been allowed
  • The 1.1.5 to 1.1.6 upstream source diff (36 files, including src/fs/xattr.rs +218/-14) beyond its file list, and whether codexbar can reach the unsound xattr path
  • The RustSec advisory text and its patched range, beyond the passing security-scan result
• Tests run: None. Reviewer execution is disabled.

---

HemSoft full-spectrum review • 3 evidence-based passes • Reviewed head e453844dafb9a98d7591adecdc28c0af03365ac8 • SFL v0