deps: update starlark to 0.14.0

codex-rs/.cargo/audit.toml

@@ -1,9 +1,11 @@
 [advisories]
-# Reviewed 2026-04-15. Keep this list in sync with ../deny.toml.
+# Reviewed 2026-05-27. Keep this list in sync with ../deny.toml.
 ignore = [
-    "RUSTSEC-2024-0388", # derivative 2.2.0 via starlark; upstream crate is unmaintained
-    "RUSTSEC-2025-0057", # fxhash 0.2.1 via starlark_map; upstream crate is unmaintained
+    "RUSTSEC-2024-0388", # derivative 2.2.0 via starlark/starlark_syntax; upstream crate is unmaintained
+    "RUSTSEC-2025-0057", # fxhash 0.2.1 via starlark_map/sled; upstream crate is unmaintained
     "RUSTSEC-2024-0436", # paste 1.0.15 via starlark/ratatui; upstream crate is unmaintained
+    "RUSTSEC-2023-0089", # atomic-polyfill via postcard/heapless/pagable; upstream crate is unmaintained
+    "RUSTSEC-2024-0384", # instant via parking_lot/sled/pagable; upstream crate is unmaintained
     "RUSTSEC-2024-0320", # yaml-rust via syntect; remove when syntect drops or updates it
     "RUSTSEC-2025-0141", # bincode via syntect; remove when syntect drops or updates it
     "RUSTSEC-2026-0118", # hickory-proto via rama-dns/rama-tcp; remove when rama updates to hickory 0.26.1 or hickory-net

codex-rs/Cargo.toml

@@ -377,7 +377,7 @@ sqlx = { version = "0.9.0", default-features = false, features = [
     "time",
     "uuid",
 ] }
-starlark = "0.13.0"
+starlark = "0.14.0"
 strum = "0.27.2"
 strum_macros = "0.28.0"
 supports-color = "3.0.2"

codex-rs/deny.toml

@@ -70,11 +70,13 @@ feature-depth = 1
 # A list of advisory IDs to ignore. Note that ignored advisories will still
 # output a note when they are encountered.
 ignore = [
-    # Reviewed 2026-04-15. Keep this list in sync with .cargo/audit.toml.
+    # Reviewed 2026-05-27. Keep this list in sync with .cargo/audit.toml.
     # Each exception must identify the dependency path and removal condition.
-    { id = "RUSTSEC-2024-0388", reason = "derivative is unmaintained; pulled in via starlark v0.13.0 used by execpolicy/cli/core; no fixed release yet" },
-    { id = "RUSTSEC-2025-0057", reason = "fxhash is unmaintained; pulled in via starlark_map/starlark v0.13.0 used by execpolicy/cli/core; no fixed release yet" },
+    { id = "RUSTSEC-2024-0388", reason = "derivative is unmaintained; pulled in via starlark/starlark_syntax v0.14.0 used by execpolicy/cli/core; no fixed starlark release yet" },
+    { id = "RUSTSEC-2025-0057", reason = "fxhash is unmaintained; pulled in via starlark_map/sled under starlark v0.14.0 used by execpolicy/cli/core; no fixed starlark release yet" },
     { id = "RUSTSEC-2024-0436", reason = "paste is unmaintained; pulled in via ratatui/rmcp/starlark used by tui/execpolicy; no fixed release yet" },
+    { id = "RUSTSEC-2023-0089", reason = "atomic-polyfill is unmaintained; pulled in via postcard/heapless/pagable under starlark v0.14.0 used by execpolicy/cli/core; no fixed starlark release yet" },
+    { id = "RUSTSEC-2024-0384", reason = "instant is unmaintained; pulled in via parking_lot/sled/pagable under starlark v0.14.0 used by execpolicy/cli/core; no fixed starlark release yet" },
     # TODO(fcoury): remove this exception when syntect drops yaml-rust and bincode, or updates to versions that have fixed the vulnerabilities.
     { id = "RUSTSEC-2024-0320", reason = "yaml-rust is unmaintained; pulled in via syntect v5.3.0 used by codex-tui for syntax highlighting; no fixed release yet" },
     { id = "RUSTSEC-2025-0141", reason = "bincode is unmaintained; pulled in via syntect v5.3.0 used by codex-tui for syntax highlighting; no fixed release yet" },

codex-rs/execpolicy-legacy/src/arg_matcher.rs

@@ -95,7 +95,7 @@ impl ArgMatcherCardinality {
 }
 
 impl<'v> AllocValue<'v> for ArgMatcher {
-    fn alloc_value(self, heap: &'v Heap) -> Value<'v> {
+    fn alloc_value(self, heap: Heap<'v>) -> Value<'v> {
         heap.alloc_simple(self)
     }
 }

codex-rs/execpolicy-legacy/src/opt.rs

@@ -66,7 +66,7 @@ impl<'v> UnpackValue<'v> for Opt {
 }
 
 impl<'v> AllocValue<'v> for Opt {
-    fn alloc_value(self, heap: &'v Heap) -> Value<'v> {
+    fn alloc_value(self, heap: Heap<'v>) -> Value<'v> {
         heap.alloc_simple(self)
     }
 }

codex-rs/execpolicy-legacy/src/policy_parser.rs

@@ -15,7 +15,6 @@ use starlark::environment::Module;
 use starlark::eval::Evaluator;
 use starlark::syntax::AstModule;
 use starlark::syntax::Dialect;
-use starlark::values::Heap;
 use starlark::values::list::UnpackList;
 use starlark::values::none::NoneType;
 use std::cell::RefCell;
@@ -41,31 +40,28 @@ impl PolicyParser {
         let globals = GlobalsBuilder::extended_by(&[LibraryExtension::Typing])
             .with(policy_builtins)
             .build();
-        let module = Module::new();
-
-        let heap = Heap::new();
-
-        module.set("ARG_OPAQUE_VALUE", heap.alloc(ArgMatcher::OpaqueNonFile));
-        module.set("ARG_RFILE", heap.alloc(ArgMatcher::ReadableFile));
-        module.set("ARG_WFILE", heap.alloc(ArgMatcher::WriteableFile));
-        module.set("ARG_RFILES", heap.alloc(ArgMatcher::ReadableFiles));
-        module.set(
-            "ARG_RFILES_OR_CWD",
-            heap.alloc(ArgMatcher::ReadableFilesOrCwd),
-        );
-        module.set("ARG_POS_INT", heap.alloc(ArgMatcher::PositiveInteger));
-        module.set("ARG_SED_COMMAND", heap.alloc(ArgMatcher::SedCommand));
-        module.set(
-            "ARG_UNVERIFIED_VARARGS",
-            heap.alloc(ArgMatcher::UnverifiedVarargs),
-        );
-
         let policy_builder = PolicyBuilder::new();
-        {
+        Module::with_temp_heap(|module| {
+            let heap = module.heap();
+            module.set("ARG_OPAQUE_VALUE", heap.alloc(ArgMatcher::OpaqueNonFile));
+            module.set("ARG_RFILE", heap.alloc(ArgMatcher::ReadableFile));
+            module.set("ARG_WFILE", heap.alloc(ArgMatcher::WriteableFile));
+            module.set("ARG_RFILES", heap.alloc(ArgMatcher::ReadableFiles));
+            module.set(
+                "ARG_RFILES_OR_CWD",
+                heap.alloc(ArgMatcher::ReadableFilesOrCwd),
+            );
+            module.set("ARG_POS_INT", heap.alloc(ArgMatcher::PositiveInteger));
+            module.set("ARG_SED_COMMAND", heap.alloc(ArgMatcher::SedCommand));
+            module.set(
+                "ARG_UNVERIFIED_VARARGS",
+                heap.alloc(ArgMatcher::UnverifiedVarargs),
+            );
+
             let mut eval = Evaluator::new(&module);
             eval.extra = Some(&policy_builder);
-            eval.eval_module(ast, &globals)?;
-        }
+            eval.eval_module(ast, &globals).map(|_| ())
+        })?;
         let policy = policy_builder.build();
         policy.map_err(|e| starlark::Error::new_kind(starlark::ErrorKind::Other(e.into())))
     }

codex-rs/execpolicy/src/parser.rs

@@ -65,12 +65,13 @@ impl PolicyParser {
         )
         .map_err(Error::Starlark)?;
         let globals = GlobalsBuilder::standard().with(policy_builtins).build();
-        let module = Module::new();
-        {
+        Module::with_temp_heap(|module| {
             let mut eval = Evaluator::new(&module);
             eval.extra = Some(&self.builder);
-            eval.eval_module(ast, &globals).map_err(Error::Starlark)?;
-        }
+            eval.eval_module(ast, &globals)
+                .map(|_| ())
+                .map_err(Error::Starlark)
+        })?;
         self.builder
             .borrow()
             .validate_pending_examples_from(pending_validation_count)?;