chore(deps): ignore RUSTSEC-2026-0285 pending FIPS-certified aws-lc-rs - #172
Conversation
RUSTSEC-2026-0285 (rustls TLS 1.3 handshake messages accepted across encryption level boundaries) is fixed in rustls 0.23.45, but that version requires aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3 certification. Pin the direct rustls dependency below 0.23.45 and waive the advisory in .cargo/audit.toml so cargo audit passes. Mirrors DataDog/datadog-lambda-extension#1389 and DataDog/saluki#2606.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The blanket suppression can hide affected non-FIPS consumers, and the remediation documentation is incomplete.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (1)
What changed in this PR
This PR preserves the FIPS dependency posture by pinning rustls below 0.23.45 and suppressing RUSTSEC-2026-0285 pending certified aws-lc-rs support.
Changes:
- Constrains the
datadog-fipsRustls dependency. - Adds a documented workspace-wide audit ignore.
- Leaves
Cargo.lockunchanged.
The workspace-wide suppression may mask advisory exposure in non-FIPS TLS consumers, and the removal documentation should also specify lifting the pin and reapplying the Rustls upgrade.
| File | Description |
|---|---|
crates/datadog-fips/Cargo.toml |
Pins the FIPS Rustls dependency below 0.23.45. |
.cargo/audit.toml |
Configures and documents the advisory suppression. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| # certification. Remove this ignore once a FIPS-certified aws-lc-rs is | ||
| # available. | ||
| [advisories] | ||
| ignore = ["RUSTSEC-2026-0285"] |
What does this PR do?
Waives RUSTSEC-2026-0285 (rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries) in
.cargo/audit.tomland pins the directrustlsdependency indatadog-fipsbelow 0.23.45, socargo audit(and thecargo-auditCI job) passes while rustls stays at 0.23.37.Motivation
The fix for RUSTSEC-2026-0285 requires rustls >= 0.23.45, which requires aws-lc-rs >= 1.18. That pulls in AWS-LC-FIPS 4.x, which has not completed FIPS 140-3 certification; only the 3.x module is NIST CMVP validated. Bumping would therefore regress the FIPS posture of the
datadog-fipscrate. The pin prevents a futurecargo updatefrom silently re-bumping rustls into the non-FIPS-certified range.Mirrors DataDog/datadog-lambda-extension#1389 and DataDog/saluki#2606. Supersedes #170 (closed).
Additional Notes
Removal criteria for the ignore (also documented in
.cargo/audit.toml): remove theRUSTSEC-2026-0285entry and lift the<0.23.45pin once a FIPS-certifiedaws-lc-rssupporting rustls 0.23.45 is available, then re-apply the bump.The repo root is the cargo workspace root, so
rustsec/audit-checkpicks up.cargo/audit.tomlwith no workflow changes (unlike bottlecap, which needed the extraignore:input).Describe how to test/QA your changes
cargo metadata --lockedsucceeds (lockfile satisfies the new constraint without update)cargo auditexits 0: RUSTSEC-2026-0285 ignored, no other advisories added to the ignore list, only the pre-existing allowed warning remains (RUSTSEC-2026-0253)cargo check -p datadog-fipsandcargo check -p datadog-fips --features fipspassCargo.lockis unchanged