From 1235a5e61cb53630a6cbfea1f30e92a576fd1cf8 Mon Sep 17 00:00:00 2001 From: Lucas Pimentel Date: Thu, 24 Sep 2026 10:57:24 -0400 Subject: [PATCH] chore(deps): ignore RUSTSEC-2026-0285 pending FIPS-certified aws-lc-rs RUSTSEC-2026-0285 (rustls TLS 1.3 handshake messages accepted across encryption level boundaries) is fixed in rustls 0.23.45, but that version requires aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3 certification. Pin the direct rustls dependency below 0.23.45 and waive the advisory in .cargo/audit.toml so cargo audit passes. Mirrors DataDog/datadog-lambda-extension#1389 and DataDog/saluki#2606. --- .cargo/audit.toml | 6 ++++++ crates/datadog-fips/Cargo.toml | 5 ++++- 2 files changed, 10 insertions(+), 1 deletion(-) create mode 100644 .cargo/audit.toml diff --git a/.cargo/audit.toml b/.cargo/audit.toml new file mode 100644 index 00000000..8e88df8d --- /dev/null +++ b/.cargo/audit.toml @@ -0,0 +1,6 @@ +# RUSTSEC-2026-0285 is fixed in rustls >= 0.23.45, but that version requires +# aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3 +# certification. Remove this ignore once a FIPS-certified aws-lc-rs is +# available. +[advisories] +ignore = ["RUSTSEC-2026-0285"] diff --git a/crates/datadog-fips/Cargo.toml b/crates/datadog-fips/Cargo.toml index e09a358d..3c612ffb 100644 --- a/crates/datadog-fips/Cargo.toml +++ b/crates/datadog-fips/Cargo.toml @@ -8,7 +8,10 @@ repository.workspace = true [dependencies] reqwest = { version = "0.12.4", features = ["json", "http2"], default-features = false } -rustls = { version = "0.23.18", default-features = false, features = ["fips"], optional = true } +# Resolved version is intentionally held below 0.23.45 (see .cargo/audit.toml): that version +# requires aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3 certification. +# Do not bump until a FIPS-certified aws-lc-rs is available, or a future `cargo update` will re-bump it. +rustls = { version = ">=0.23.18, <0.23.45", default-features = false, features = ["fips"], optional = true } rustls-native-certs = { version = ">=0.8.1, <0.8.3", optional = true } tracing = { version = "0.1.40", default-features = false }