chore(deps): bump socket2 from 0.6.2 to 0.6.5 in /codex-rs

[dependabot]

Bumps socket2 from 0.6.2 to 0.6.5.

Changelog

Sourced from socket2's changelog.

0.6.5

• Add support for Emscripten (wasm32) (rust-lang/socket2#660).
• Add support for NuttX (rust-lang/socket2#663).
• Enable Socket::(set_)tos_v4 on illumos (rust-lang/socket2#662).

0.6.4

• Implement Send for MsgHdr(Mut) (rust-lang/socket2#650).
• Add support for horizonOS/n3ds (rust-lang/socket2#653).
• Switch QNX 8.0 and 7.1 to use TCP_KEEPIDLE instead of TCP_KEEPALIVE (rust-lang/socket2#654).
• Fixed an issue on Windows where for Socket::only_v6 sometimes booleans are 1 byte other times it's 4 bytes (rust-lang/socket2#655).

0.6.3

• Added support for wasm32-wasip2.
• Added Socket::(set_)ip_transparent_v6.
• Added Socket::set_tcp_ack_frequency.
• Support windows-sys v0.61 in addition to v0.60.

POTENTIALLY BREAKING The MSRV of windows-sys v0.61 is 1.71. To use socket2 with its MSRV of 1.70, please downgrade windows-sys to v0.60.x. This can be done using: cargo update windows-sys --precise 0.60.2

Commits

• 239dd83 Release v0.6.5
• 4b7a11c nuttx: type IovLen to c_ulong
• 8f1c684 Support NuttX
• 9f30d66 Enable Socket::(set_)tos_v4 on illumos
• f305cc9 Define keepalive options for Emscripten
• f9dff09 Add support for wasm32-unknown-emscripten (#660)
• 9f41644 Release v0.6.4
• 5f64403 Special case assume_init for Bool on Windows (#655)
• c93d95a Split target_os = "nto" cfg by env so io-sock variants use TCP_KEEPIDLE (#654)
• 27c0204 Port to horizon-os/n3ds (#653)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #484 @ 42ceed2 — lens: correctness+security+gates, reviewer unresolved-account001 (1 of 1)

Exact candidate reviewed against freshly fetched origin/main at 710cd4739a93c5a76af95e72909affe72013b32f.

What I read:

• git log --oneline origin/main..HEAD and git diff origin/main...HEAD --stat: one commit, one changed file (codex-rs/Cargo.lock, 13 insertions/13 deletions).
• Full diff of codex-rs/Cargo.lock.
• Surrounding workspace dependency declaration in codex-rs/Cargo.toml, direct socket2 use and coverage in codex-rs/shell-escalation/src/unix/socket.rs and escalate_server.rs, Bazel lock generation/check wiring in MODULE.bazel, justfile, scripts/check-module-bazel-lock.sh, .github/workflows/bazel.yml, and the upstream socket2 0.6.3–0.6.5 changelog/commit range.
• package.json: it declares no test script and no typecheck script.

Commands and evidence:

• git rev-parse HEAD; git rev-parse origin/main; git status --short; git log --oneline origin/main..HEAD; git diff origin/main...HEAD --stat — exit 0.
• git diff origin/main...HEAD -- codex-rs/Cargo.lock — exit 0.
• bun install — exit 0; setup only, 521 packages installed. This is NOT the repo test result.
• Repo-declared typecheck gate: DOES NOT EXIST (package.json has no typecheck script); pass/fail counts not applicable.
• Repo-declared test gate: DOES NOT EXIST (package.json has no test script); pass/fail counts not applicable.
• gh pr view 484 --repo hasna/codewith --json statusCheckRollup — exit 0; forge rollup at review time: 19 SUCCESS, 1 FAILURE, 3 SKIPPED, 4 IN_PROGRESS.
• gh run view 30945439460 --repo hasna/codewith --job 92114136957 --log-failed — exit 1 because the parent workflow was still in progress, so logs were not yet available; diagnostic only, not a gate.
• gh api repos/hasna/codewith/actions/jobs/92114136957 --jq '{name,conclusion,status,steps}' — exit 0; the failed job's Check MODULE.bazel.lock is up to date step is FAILURE and bazel test //... is SKIPPED.

Forge checks read by name and conclusion:

• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — FAILURE.
• cla — SUCCESS.
• Check for spelling errors — SUCCESS.
• Blob size policy — SUCCESS.
• cargo-deny — SUCCESS.
• build-test — SUCCESS.
• Build Codewith Linux CLI — SUCCESS.
• Detect changed areas — SUCCESS.
• python-sdk — SUCCESS.
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — IN_PROGRESS (no conclusion yet).
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS.
• Format / etc — SUCCESS.
• sdks — SUCCESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED.
• cargo shear — SUCCESS.
• Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — IN_PROGRESS (no conclusion yet).
• Argument comment lint package — SKIPPED.
• Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS.
• Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — IN_PROGRESS (no conclusion yet).
• Argument comment lint - Linux — IN_PROGRESS (no conclusion yet).
• Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS.
• Argument comment lint - Windows — SUCCESS.
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS.
• [code]smith — SKIPPED.

Blocking P0/P1 findings:

• P1 — required build gate is broken: this PR changes codex-rs/Cargo.lock but does not include the coupled MODULE.bazel.lock refresh required by crate.from_cargo. The authoritative Linux Bazel job reproduced the defect at Check MODULE.bazel.lock is up to date, preventing bazel test //... from running. Remedy: run the repo-owned just bazel-lock-update lane for this exact head, commit the resulting MODULE.bazel.lock, push, and obtain a green focused re-run.

No other source-level P0/P1 correctness or security defect was found. The socket2 patch update preserves the Unix API used by shell escalation; its only potentially breaking changelog note is the windows-sys 0.61 MSRV of Rust 1.71, below this repo's Rust 1.95 toolchain.

Non-blocking follow-ups:

• The root package.json declares no test gate. This is a real verification-coverage finding, but it is not a blocker for this Rust lockfile PR and does not authorize inventing a lane-local gate.
• The root package.json also declares no typecheck script; no typecheck was invented.

[andrei-hasna]

[REVIEW-FIX] #484 @ 4751a10

Fixed the named blocking defect from the 42ceed2c review:

• Regenerated MODULE.bazel.lock from the updated codex-rs/Cargo.lock using the repo-owned Bazel wrapper. The generated diff is exactly one metadata replacement: socket2_0.6.2 → socket2_0.6.5.
• .github/scripts/run_bazel_with_buildbuddy.py mod deps --lockfile_mode=update — exit 0.
• ./scripts/check-module-bazel-lock.sh — exit 0.
• shield review on the staged lockfile change — exit 0, no security issues.
• Commit 4751a105aa21b1096a26b5c78048bf5247275a21 pushed to dependabot/cargo/codex-rs/socket2-0.6.5; git push exit 0.

The prior NO_GO names 42ceed2c and is now stale. I will issue the same reviewer's focused verdict only after the new head's authoritative forge checks complete.

[andrei-hasna]

[REVIEW] GO — #484 @ 4751a10 — lens: correctness+security+gates, reviewer unresolved-account001 (1 of 1)

Focused re-review scope

• Re-reviewed only the named blocker from the initial pass: codex-rs/MODULE.bazel.lock did not match the socket2 0.6.5 Cargo lock update.
• The remediation commit 4751a105aa21b1096a26b5c78048bf5247275a21 changes the stale Bazel socket2 metadata from 0.6.2 to 0.6.5 and introduces no unrelated source change.
• Read the complete final diff against fresh origin/main at 710cd4739a93, plus the surrounding socket2 manifests/usages and Bazel lock/update/check wiring.

Commands and measured results

• bun install — exit 0. Setup only; not a repo test gate. Package install completed successfully; no test count applies.
• just bazel-lock-update — exit 127 because just is not installed on this lane. This was an attempted remediation command, not a declared gate.
• .github/scripts/run_bazel_with_buildbuddy.py mod deps --lockfile_mode=update — exit 0. Lane remediation command; refreshed the Bazel lock through the repository wrapper.
• ./scripts/check-module-bazel-lock.sh — exit 0; 1 lock-consistency check passed, 0 failed.
• git diff --cached --check — exit 0; 1 staged diff check passed, 0 failed.
• shield review — exit 0; 0 security findings.
• python3 .codewith/skills/babysit-pr/scripts/gh_pr_watch.py --pr 484 --repo hasna/codewith --retry-failed-now — exit 0; 1 bounded rerun triggered.
• gh pr view 484 --repo hasna/codewith --json statusCheckRollup — exit 0; 40 SUCCESS, 3 SKIPPED, 0 failure, 0 pending.

Declared package gates

• package.json declares no test script. The repo therefore declares no package test gate; I did not invent one.
• package.json declares no typecheck script. I did not invent one.
• The absence of a declared package test gate is recorded as a non-blocking repository finding; authoritative validation for this PR is the forge rollup below.

Final forge rollup read from statusCheckRollup

• SUCCESS — Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu
• SUCCESS — cla
• SUCCESS — Check for spelling errors
• SUCCESS — Blob size policy
• SUCCESS — cargo-deny
• SUCCESS — build-test
• SUCCESS — Build Codewith Linux CLI
• SUCCESS — Detect changed areas
• SUCCESS — python-sdk
• SUCCESS — metadata
• SUCCESS — Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl
• SUCCESS — Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4
• SUCCESS — Format / etc
• SUCCESS — sdks
• SUCCESS — Build release x86_64-unknown-linux-gnu
• SUCCESS — Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4
• SUCCESS — Build ptrcomp-sandbox x86_64-unknown-linux-gnu
• SUCCESS — Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4
• SUCCESS — Build release aarch64-unknown-linux-gnu
• SUCCESS — Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4
• SUCCESS — Build ptrcomp-sandbox aarch64-unknown-linux-gnu
• SUCCESS — Build release x86_64-apple-darwin
• SUCCESS — Build ptrcomp-sandbox x86_64-apple-darwin
• SUCCESS — Build release aarch64-apple-darwin
• SUCCESS — Build ptrcomp-sandbox aarch64-apple-darwin
• SUCCESS — Build release x86_64-unknown-linux-musl
• SUCCESS — Build ptrcomp-sandbox x86_64-unknown-linux-musl
• SUCCESS — Build release aarch64-unknown-linux-musl
• SUCCESS — Build ptrcomp-sandbox aarch64-unknown-linux-musl
• SKIPPED — Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main)
• SUCCESS — cargo shear
• SUCCESS — Build ptrcomp-sandbox x86_64-pc-windows-msvc from source
• SUCCESS — Build ptrcomp-sandbox aarch64-pc-windows-msvc from source
• SKIPPED — Argument comment lint package
• SUCCESS — Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu
• SUCCESS — Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm
• SUCCESS — Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu
• SUCCESS — Argument comment lint - Linux
• SUCCESS — Verify release build on windows-latest for x86_64-pc-windows-gnullvm
• SUCCESS — Argument comment lint - Windows
• SUCCESS — Bazel test on windows-latest for x86_64-pc-windows-gnullvm
• SUCCESS — CI results (required)
• SKIPPED — [code]smith

CI retry classification

• The first musl attempt failed only fleet_comms::tests::command_fails_open_without_conversations_cli: 126 passed, 1 failed, with failed to write hook stdin: Broken pipe (os error 32).
• That missing-CLI child-stdin race is outside this two-lockfile dependency diff. The one bounded rerun passed without a code change, confirming it as unrelated/flaky rather than a regression from socket2 0.6.5.

Blocking P0/P1 findings

• None remain. The named Bazel lock blocker is fixed and its required forge gate now passes.

Non-blocking follow-ups

• The repository declares no package-level test gate or typecheck gate in package.json; no optional command was promoted into a blocker.