Revert "chore(deps): bump rustls to 0.23.45" (#1376) - #1389
Conversation
Reverts the bump of rustls to 0.23.45 because that version requires aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x. AWS-LC-FIPS 4.x has not completed FIPS 140-3 certification yet; only the 3.x module is NIST CMVP validated, so the bump regressed our FIPS posture. This mirrors the approach taken in saluki#2606: DataDog/saluki#2606
Reverting rustls to 0.23.37 reintroduces RUSTSEC-2026-0285 (TLS 1.3 handshake messages accepted across encryption-level boundaries), which is fixed in rustls >= 0.23.45. That version requires aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3 certification, so we accept and ignore the advisory via bottlecap/.cargo/audit.toml until a FIPS-certified aws-lc-rs is available. This mirrors the approach taken in saluki#2606: DataDog/saluki#2606
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The rustls requirement does not enforce an upper bound and may silently reintroduce incompatible versions.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (1)
What changed in this PR
Reverts the rustls upgrade to preserve FIPS-compatible AWS-LC versions while accepting the reintroduced advisory.
Changes:
- Restores older
rustlsand AWS-LC dependency versions. - Adds the
RUSTSEC-2026-0285audit ignore. - Documents the intended dependency hold.
| File | Description |
|---|---|
bottlecap/Cargo.toml |
Documents the FIPS-driven version constraint. |
bottlecap/Cargo.lock |
Restores compatible dependency versions. |
bottlecap/.cargo/audit.toml |
Ignores the accepted rustls advisory. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6ffdef947d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
#172) RUSTSEC-2026-0285 (rustls TLS 1.3 handshake messages accepted across encryption level boundaries) is fixed in rustls 0.23.45, but that version requires aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3 certification. Pin the direct rustls dependency below 0.23.45 and waive the advisory in .cargo/audit.toml so cargo audit passes. Mirrors DataDog/datadog-lambda-extension#1389 and DataDog/saluki#2606.
Overview
Reverts #1376, which bumped
rustlsto 0.23.45.rustls0.23.45 requiresaws-lc-rs>= 1.18, which pulls inAWS-LC-FIPS4.x.AWS-LC-FIPS4.x has not completed FIPS 140-3 certification; only the 3.x module is NIST CMVP validated. The bump therefore regressed our FIPS posture for FIPS builds, and this PR restoresrustls0.23.37,aws-lc-rs1.16.2,aws-lc-fips-sys0.13.13, andaws-lc-sys0.39.0.Because reverting reintroduces RUSTSEC-2026-0285, the advisory is accepted and ignored via
bottlecap/.cargo/audit.tomlso thecargo-auditCI job keeps passing. This mirrors the approach taken in DataDog/saluki#2606.Removal criteria for the ignore: remove the
RUSTSEC-2026-0285entry frombottlecap/.cargo/audit.toml(and theCargo.tomlcomment) once a FIPS-certifiedaws-lc-rssupportingrustls0.23.45 is available, then re-apply the bump.Testing
cargo metadata --lockedsucceeds inbottlecap/: reverted lockfile still satisfiesCargo.toml.cargo auditinbottlecap/exits 0: RUSTSEC-2026-0285 is ignored, no other advisories added to the ignore list, only the 9 pre-existing allowed warnings remain.cargo fmt --checkpasses.