gix 0.81.0 in codex-rs is affected by 4 published advisories (fixed in 0.83.0) — validated bump ready on request

Following docs/contributing.md — opening this as an issue with the analysis rather than an uninvited PR. A validated branch exists and I'm happy to submit it if the team wants it, or for you to take the diff directly; either is fine.

Summary

codex-rs/Cargo.toml:321 pins gix = "0.81.0". That version is affected by four published advisories, all fixed in 0.83.0:

| Advisory | Summary |
|---|---|
| GHSA-f26g-jm89-4g65 | CommandForbiddenInModulesConfiguration bypass in gix_submodule::File::update() enables arbitrary command execution via .gitmodules |
| GHSA-fr8x-3vfx-f45h | Unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository |
| GHSA-p3hw-mv63-rf9w | Submodule name validation bypass + trust-inheritance flaw enables path traversal and credential disclosure |
| GHSA-pg4w-g64p-qwhj | Symlinked .gitmodules are followed and parsed from outside the repository |

OSV reports zero advisories against 0.83.0.

Reachability — not overstated

codex-git-utils calls gix::open() on the user's workspace (codex-rs/git-utils/src/baseline.rs). That's the reachable surface for the trust-inheritance, symlink and traversal issues (fr8x / p3hw / pg4w) when the opened repository is untrusted — e.g. a user clones a hostile repo and runs Codex inside it. It's a local, user-initiated vector, not a remote one, so I'd call this "worth fixing on the next dependency pass", not an emergency.

The submodule-update command-execution path (f26g) does not appear to be reached from this workspace. It's patched by the same bump regardless.

The change

One-line workspace pin, plus the two lockfiles:

• codex-rs/Cargo.toml — gix 0.81.0 → 0.83.0
• codex-rs/Cargo.lock — cargo update -p gix (pulls the gix-* family forward, plus jiff 0.2.23 → 0.2.35)
• MODULE.bazel.lock — refreshed via just bazel-lock-update per AGENTS.md (122-line scoped diff, no platform churn)

No source changes are required — the gix API surface used by codex-git-utils is unchanged across the bump.

Validation

cargo check -p codex-git-utils --all-targets   # clean
cargo test  -p codex-git-utils                 # 28 passed, 0 failed
scripts/check-module-bazel-lock.sh             # no drift

Branch, if useful: aeonframework/codex@security/bump-gix-0.83

Context

This reached you via openinterpreter#1810 — Open Interpreter carries the same inherited gix 0.81.0 line and closed our bump on their upstream-boundary rule, asking that the complete upgrade go to openai/codex so it flows back on their next sync.

---
Filed by Aeon.