ci: ignore three new rustls advisories in cargo-audit, matching the RUSTSEC-2026-0285 waiver

[lym953]

Problem

The "Bottlecap (Rust) / Audit" check fails on every branch, for example #1418. main fails the same way. On 2026-10-14, RustSec published three advisories for rustls 0.23.43, the version in Cargo.lock. cargo audit reports them as vulnerabilities and exits with an error.

Advisory	Problem	Fixed in
RUSTSEC-2026-0346	The Debug output of client session values shows TLS secrets	0.23.46
RUSTSEC-2026-0348	Brotli certificate decompression can allocate 1 GiB before authentication	0.23.46
RUSTSEC-2026-0349	A forged ServerHello can make later connections use only classical key exchange	0.23.46

Why this PR ignores the advisories

We cannot use rustls 0.23.46 yet. The block is the same as for RUSTSEC-2026-0285:

• On crates.io, rustls 0.23.46 requires aws-lc-rs 1.18 or later, the same as 0.23.45.
• aws-lc-rs 1.18 uses AWS-LC-FIPS 4.x, which has no FIPS 140-3 certification yet. Our FIPS builds must use a certified crypto module. For this reason, Revert "chore(deps): bump rustls to 0.23.45" (#1376) #1389 reverted the bump to 0.23.45, and Cargo.toml keeps rustls below 0.23.45.
• The non-FIPS builds do not use aws-lc-rs, but both builds use the same Cargo.lock, so they get the same rustls version.

Impact

• RUSTSEC-2026-0346 applies only to a custom client session store that formats session values with Debug. The bottlecap source has no custom session store.
• RUSTSEC-2026-0348 applies only when the brotli feature of rustls is on. Cargo.lock has no brotli crate, so the feature is off.
• RUSTSEC-2026-0349 can cause a loss of post-quantum protection for some connections. Keys are not disclosed, and authentication is not bypassed.

Fix

Add the three IDs to the two ignore lists for cargo audit:

• bottlecap/.cargo/audit.toml, which local runs read.
• The ignore input of the audit step in rs_ci.yml. CI reads only this list.

Testing

Steps

1. In bottlecap/ on main, run cargo audit --ignore RUSTSEC-2026-0285. This is the command that CI runs.
2. On this branch, run cargo audit with no flags. This reads .cargo/audit.toml.
3. On this branch, run cargo audit --json with the four --ignore flags from rs_ci.yml.

Result

Check	Before	After
cargo audit, CI ignore list	3 vulnerabilities, exit with error	0 vulnerabilities
cargo audit, .cargo/audit.toml	Not run	0 vulnerabilities

cargo-audit 0.22.1 ran on macOS. The CI Audit job on this PR is the check for Linux.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

Accepting additional TLS security advisories requires human confirmation of the exposure and FIPS tradeoff.

0 open findings

What changed in this PR

Extends Bottlecap’s existing rustls audit waiver to three additional advisories while dependency upgrades remain blocked by FIPS certification requirements.

Changes:

• Adds three advisory IDs to both local and CI ignore lists.
• Updates comments explaining the upgrade constraint and waiver removal criteria.

File	Description
bottlecap/​.cargo/​audit.toml	Adds local waivers and updates their rationale.
.github/​workflows/​rs_ci.yml	Synchronizes CI with the local ignore list.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[datadog-prod-us1-3]

 

❌ Errors

Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 1 Pipeline job failed

DataDog/datadog-lambda-extension | bottlecap (arm64, alpine) — 🔄 Retry may pass, looks flaky

View more details · View in GitLab

ℹ️ Info

🔄 Datadog auto-retried 1 job - 0 passed on retry

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: fe722ff | Docs | View more details | Give us feedback!}

[litianningdatadog]

QQ: do we need to make the same change in serverless-compat if so?

[lym953]

QQ: do we need to make the same change in serverless-compat if so?

@litianningdatadog Yes, in DataDog/serverless-components#184