chore(deps): bump tonic-prost from 0.14.3 to 0.14.5 in /codex-rs

[dependabot]

Bumps tonic-prost from 0.14.3 to 0.14.5.

Commits

• 3f7caf3 chore: prepare v0.14.5 release (#2516)
• 3f56644 grpc(chore): add missing copyright notices (#2513)
• 1769c91 feat(xds): implement xDS subscription worker (#2478)
• 56f8c6d feat(grpc): Add TCP listener API in the Runtime trait + tests for server cred...
• 149f366 feat(grpc) Add channel credentials API + Insecure credentials (#2495)
• cd5b32f chore: prepare 0.14.4 release (#2504)
• 27640d2 fix(web): allow space after : in grpc-status (#2506)
• 0c26ee1 Fix permission of a series of files (#2502)
• c25daa6 fix(ci): remove comment from manifest to unblock version parsing (#2501)
• 3efc5f9 chore(doc): Replace doc_auto_cfg config with doc_cfg (#2428)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #568 @ 3da6566 — lens: correctness+security+gates, reviewer Hostus (1 of 1)

Candidate and source review

• git rev-parse HEAD — exit 0 — 3da6566a8723ba36c2b76f6c03bb757ea6fe7452.
• git rev-parse origin/main — exit 0 — 0abe3a6b3560564abaac17c674155fe26fbf2e74.
• git log --oneline origin/main..HEAD — exit 0 — one commit: 3da6566a8 chore(deps): bump tonic-prost from 0.14.3 to 0.14.5 in /codex-rs.
• git diff origin/main...HEAD --stat — exit 0 — one changed file, codex-rs/Cargo.lock, 27 insertions and 27 deletions.
• Read the complete lockfile diff plus the surrounding workspace dependency declaration, codex-rs/config/Cargo.toml, generated tonic/prost call sites, Bazel workflow lock check, lock-check script, justfile recipes, and Bazel dependency-update guidance.

Commands and gates

• bun install — exit 0 — setup only, not a repository test gate; 521 packages installed, 0 reported failures. It generated an untracked local bun.lock, which is not part of the reviewed candidate.
• The root package.json declares no typecheck script.
• The root package.json declares no test script, so this repository declares no test gate there. I did not invent a replacement gate.
• gh pr view 568 --repo hasna/codewith --json statusCheckRollup with safe projection to check name/status/conclusion — exit 0 — 28 checks: 19 SUCCESS, 5 FAILURE, 1 CANCELLED, 3 SKIPPED.

Forge checks read

• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — FAILURE
• cla — SUCCESS
• Check for spelling errors — SUCCESS
• Blob size policy — SUCCESS
• cargo-deny — SUCCESS
• build-test — SUCCESS
• Build Codewith Linux CLI — SUCCESS
• Detect changed areas — SUCCESS
• python-sdk — SUCCESS
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — FAILURE
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS
• Format / etc — SUCCESS
• sdks — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED
• cargo shear — SUCCESS
• Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — FAILURE
• Argument comment lint package — SKIPPED
• Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — FAILURE
• Argument comment lint - Linux — CANCELLED
• Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Argument comment lint - Windows — SUCCESS
• CI results (required) — FAILURE
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• [code]smith — SKIPPED

Blocking P0/P1 findings

• P1, required build-gate failure: the PR changes a Rust dependency in codex-rs/Cargo.lock but does not update MODULE.bazel.lock. The GNU Bazel job failed at the declared Check MODULE.bazel.lock is up to date step. The repository-owned scripts/check-module-bazel-lock.sh requires just bazel-lock-update and committing the updated lockfile. This is currently reachable on this exact head and blocks merge until the Bazel lock is regenerated and the affected required lane passes.
• No separate reachable P0/P1 correctness, secrets, security, data/session-integrity, or unsafe-mutation defect was found in the reviewed lockfile-only change.

Non-blocking follow-ups

• The root package declares neither a test script nor a typecheck script. This is recorded as repository gate coverage, not used as a blocker and not replaced with an invented command.
• The musl Bazel test, GNU Bazel clippy, and GNU release-build lanes timed out after 170 minutes; the Linux argument-comment job exceeded its time limit. Their current conclusions remain red/cancelled, but this review does not relabel timeout evidence as a code defect without a reproduced candidate-caused failure.

[andrei-hasna]

Remediation pushed at 75a9d90a57af6c1586794aae188f0df4c6bd23ee.

• Regenerated MODULE.bazel.lock with just bazel-lock-update — exit 0.
• The generated diff is one metadata substitution: tonic-prost_0.14.3 to tonic-prost_0.14.5.
• Re-ran the affected repository lock-alignment check, just bazel-lock-check — exit 0.
• Ran gitleaks git --staged --redact=100 --no-banner . before commit — exit 0, no leaks found.
• Scanned the outgoing one-commit range before push — exit 0, no leaks found; the pre-push hook also scanned one commit.

The prior NO_GO is now stale because it names the previous head. Focused re-review remains limited to the named Bazel lock defect and its direct CI regressions on the new head.

[andrei-hasna]

[REVIEW] GO — #568 @ 75a9d90 — lens: correctness+security+gates, reviewer Hostus (1 of 1)

Focused re-review after remediation cycle 1.

Read:

• git log --oneline origin/main..HEAD against fetched origin/main 0abe3a6 — exit 0.
• git diff origin/main...HEAD --stat and the full diff for codex-rs/Cargo.lock and MODULE.bazel.lock — exit 0; final candidate is 28 insertions and 28 deletions across two generated lockfiles.
• Surrounding workspace dependency declarations, the codex-config consumer manifest and generated call sites, Bazel lock-generation/check scripts, and the failed GitHub Actions logs.
• git diff --check origin/main...HEAD — exit 0; 0 whitespace errors.
• git status --short after review-artifact cleanup — exit 0; clean.

Commands and evidence:

• bun install — exit 0; 521 packages installed, 0 install failures. This was setup, not a repository test gate.
• just bazel-lock-update — exit 0; regenerated the Bzlmod lock metadata after the Cargo dependency update.
• THE LANE'S CHOSEN COMMAND: just bazel-lock-check — exit 0; 1 lock-alignment check passed, 0 failed. This verified the named remediation and is not being presented as a package.json test gate.
• gitleaks git --staged --redact=100 --no-banner . — exit 0; 0 findings before commit.
• Post-commit gitleaks range scan for the remediation commit — exit 0; 1 commit scanned, 0 findings.
• gh pr view 568 --repo hasna/codewith --json statusCheckRollup — exit 0; 43 checks total: 40 SUCCESS, 3 SKIPPED, 0 FAILURE, 0 CANCELLED, 0 pending.
• Failed-job rerun 1 of 3 for Bazel run 31552858019 — trigger exit 0. The previously failing GNU test, musl test, Windows shard 4, and Windows aggregate all completed SUCCESS on attempt 2. The exact candidate-specific lock check was already green before that rerun.

Declared repository gates:

• package.json declares no test script. This repository declares no test gate.
• package.json declares no typecheck script. No typecheck gate was invented.
• The forge's required checks are therefore the authoritative gates read here.

Forge checks read by name and conclusion:

• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• cla — SUCCESS
• Check for spelling errors — SUCCESS
• Blob size policy — SUCCESS
• cargo-deny — SUCCESS
• build-test — SUCCESS
• Build Codewith Linux CLI — SUCCESS
• Detect changed areas — SUCCESS
• python-sdk — SUCCESS
• metadata — SUCCESS
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS
• Format / etc — SUCCESS
• sdks — SUCCESS
• Build release x86_64-unknown-linux-gnu — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS
• Build ptrcomp-sandbox x86_64-unknown-linux-gnu — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS
• Build release aarch64-unknown-linux-gnu — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS
• Build ptrcomp-sandbox aarch64-unknown-linux-gnu — SUCCESS
• Build release x86_64-apple-darwin — SUCCESS
• Build ptrcomp-sandbox x86_64-apple-darwin — SUCCESS
• Build release aarch64-apple-darwin — SUCCESS
• Build ptrcomp-sandbox aarch64-apple-darwin — SUCCESS
• Build release x86_64-unknown-linux-musl — SUCCESS
• Build ptrcomp-sandbox x86_64-unknown-linux-musl — SUCCESS
• Build release aarch64-unknown-linux-musl — SUCCESS
• Build ptrcomp-sandbox aarch64-unknown-linux-musl — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED
• cargo shear — SUCCESS
• Build ptrcomp-sandbox x86_64-pc-windows-msvc from source — SUCCESS
• Build ptrcomp-sandbox aarch64-pc-windows-msvc from source — SUCCESS
• Argument comment lint package — SKIPPED
• Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Argument comment lint - Linux — SUCCESS
• Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Argument comment lint - Windows — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• CI results (required) — SUCCESS
• [code]smith — SKIPPED

Blocking P0/P1 findings: none. The prior P1 was a broken required Bazel lock-consistency gate; commit 75a9d90 regenerated MODULE.bazel.lock, the focused check passes, and the forge lock step passes.

Non-blocking follow-up:

• package.json provides neither a test script nor a typecheck script. This is recorded as the requested repository-gate finding; it does not override the fully green authoritative forge rollup or create an undeclared blocker.