chore(deps): bump rustls to 0.23.45

[lucaspimentel]

Summary

Updates rustls in Cargo.lock from 0.23.37 to 0.23.45.

Transitive lockfile updates: rustls-webpki 0.103.15, aws-lc-rs 1.18.1, aws-lc-sys 0.45.0, aws-lc-fips-sys 0.14.2.

Verification

• cargo check --workspace --all-targets: clean
• cargo test --workspace: 273/274 pass; the single failure (test_mini_agent_tcp_handles_requests) is pre-existing on main and unrelated

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T18:02:58.672073Z	082d610	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[lucaspimentel]

@DataDog review

[datadog-datadog-prod-us1-2]

More details

The new AWS-LC system packages include the required pkg-config dependency. The rustls and webpki entries remain consistent with these updates.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 082d610 · @DataDog review to ask questions}

[lucaspimentel]

Converting to draft for now to prevent merging. See DataDog/saluki#2606 for details.

[lucaspimentel]

Closing in favor of holding rustls at 0.23.37 for now: #172

RUSTSEC-2026-0285 is fixed in rustls 0.23.45, but that version requires aws-lc-rs >= 1.18, which pulls in aws-lc-fips-sys 0.14.x (AWS-LC-FIPS 4.x). AWS-LC-FIPS 4.x has not completed FIPS 140-3 certification; only the 3.x module is NIST CMVP validated, so merging this would regress the FIPS posture of the datadog-fips crate.

The advisory is instead waived in .cargo/audit.toml (with the direct rustls dependency pinned below 0.23.45 so a future cargo update cannot re-bump it), so the cargo-audit CI job keeps passing. This mirrors DataDog/datadog-lambda-extension#1389 and DataDog/saluki#2606.

Re-apply this bump once a FIPS-certified aws-lc-rs supporting rustls 0.23.45 is available.