Skip to main content

max / makenotwork

Drop the EOL rustls 0.21 stack from s3-storage aws-sdk-s3's default feature list enables both `rustls` and `default-https-client`. The former resolves to aws-smithy-http-client's `legacy-rustls-ring`, pulling rustls 0.21 and hyper 0.14 into the build alongside the modern stack. rustls 0.21 is end-of-life and carried three open rustls-webpki 0.101.7 advisories. Disable default features and re-enable everything except `rustls`, which leaves the rustls 0.23 path from `default-https-client` as the only TLS stack. This is a shared dependency, so the change closes the same finding in both consumers: the mnw server and multithreaded.
Co-Authored-By
Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Author: Max Johnson <me@maxj.phd> · 2026-07-21 17:44 UTC
Signed with PGP, not checked
Commit: d7a50c5a8ca3c1de95046f55e733a4695563896a
Parent: 06e61c0
3 files changed, +41 insertions, -285 deletions
@@ -431,23 +431,17 @@
431 431 "aws-smithy-async",
432 432 "aws-smithy-runtime-api",
433 433 "aws-smithy-types",
434 - "h2 0.3.27",
435 - "h2 0.4.13",
436 - "http 0.2.12",
434 + "h2",
437 435 "http 1.4.0",
438 - "http-body 0.4.6",
439 - "hyper 0.14.32",
440 - "hyper 1.8.1",
441 - "hyper-rustls 0.24.2",
442 - "hyper-rustls 0.27.7",
436 + "hyper",
437 + "hyper-rustls",
443 438 "hyper-util",
444 439 "pin-project-lite",
445 - "rustls 0.21.12",
446 - "rustls 0.23.37",
440 + "rustls",
447 441 "rustls-native-certs",
448 442 "rustls-pki-types",
449 443 "tokio",
450 - "tokio-rustls 0.26.4",
444 + "tokio-rustls",
451 445 "tower",
452 446 "tracing",
453 447 ]
@@ -597,7 +591,7 @@
597 591 "http 1.4.0",
598 592 "http-body 1.0.1",
599 593 "http-body-util",
600 - "hyper 1.8.1",
594 + "hyper",
601 595 "hyper-util",
602 596 "itoa",
603 597 "matchit",
@@ -1510,25 +1504,6 @@
1510 1504 "subtle",
1511 1505 ]
1512 1506
1513 - [[package]]
1514 - name = "h2"
1515 - version = "0.3.27"
1516 - source = "registry+https://github.com/rust-lang/crates.io-index"
1517 - checksum = "0beca50380b1fc32983fc1cb4587bfa4bb9e78fc259aad4a0032d2080309222d"
1518 - dependencies = [
1519 - "bytes",
1520 - "fnv",
1521 - "futures-core",
1522 - "futures-sink",
1523 - "futures-util",
1524 - "http 0.2.12",
1525 - "indexmap",
1526 - "slab",
1527 - "tokio",
1528 - "tokio-util",
1529 - "tracing",
1530 - ]
1531 -
1532 1507 [[package]]
1533 1508 name = "h2"
1534 1509 version = "0.4.13"
@@ -1732,30 +1707,6 @@
1732 1707 "typenum",
1733 1708 ]
1734 1709
1735 - [[package]]
1736 - name = "hyper"
1737 - version = "0.14.32"
1738 - source = "registry+https://github.com/rust-lang/crates.io-index"
1739 - checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
1740 - dependencies = [
1741 - "bytes",
1742 - "futures-channel",
1743 - "futures-core",
1744 - "futures-util",
1745 - "h2 0.3.27",
1746 - "http 0.2.12",
1747 - "http-body 0.4.6",
1748 - "httparse",
1749 - "httpdate",
1750 - "itoa",
1751 - "pin-project-lite",
1752 - "socket2 0.5.10",
1753 - "tokio",
1754 - "tower-service",
1755 - "tracing",
1756 - "want",
1757 - ]
1758 -
1759 1710 [[package]]
1760 1711 name = "hyper"
1761 1712 version = "1.8.1"
@@ -1766,7 +1717,7 @@
1766 1717 "bytes",
1767 1718 "futures-channel",
1768 1719 "futures-core",
1769 - "h2 0.4.13",
1720 + "h2",
1770 1721 "http 1.4.0",
1771 1722 "http-body 1.0.1",
1772 1723 "httparse",
@@ -1779,21 +1730,6 @@
1779 1730 "want",
1780 1731 ]
1781 1732
1782 - [[package]]
1783 - name = "hyper-rustls"
1784 - version = "0.24.2"
1785 - source = "registry+https://github.com/rust-lang/crates.io-index"
1786 - checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
1787 - dependencies = [
1788 - "futures-util",
1789 - "http 0.2.12",
1790 - "hyper 0.14.32",
1791 - "log",
1792 - "rustls 0.21.12",
1793 - "tokio",
1794 - "tokio-rustls 0.24.1",
1795 - ]
1796 -
1797 1733 [[package]]
1798 1734 name = "hyper-rustls"
1799 1735 version = "0.27.7"
@@ -1801,13 +1737,13 @@
1801 1737 checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
1802 1738 dependencies = [
1803 1739 "http 1.4.0",
1804 - "hyper 1.8.1",
1740 + "hyper",
1805 1741 "hyper-util",
1806 - "rustls 0.23.37",
1742 + "rustls",
1807 1743 "rustls-native-certs",
1808 1744 "rustls-pki-types",
1809 1745 "tokio",
1810 - "tokio-rustls 0.26.4",
1746 + "tokio-rustls",
1811 1747 "tower-service",
1812 1748 ]
1813 1749
@@ -1823,12 +1759,12 @@
1823 1759 "futures-util",
1824 1760 "http 1.4.0",
1825 1761 "http-body 1.0.1",
1826 - "hyper 1.8.1",
1762 + "hyper",
1827 1763 "ipnet",
1828 1764 "libc",
1829 1765 "percent-encoding",
1830 1766 "pin-project-lite",
1831 - "socket2 0.6.3",
1767 + "socket2",
1832 1768 "tokio",
1833 1769 "tower-service",
1834 1770 "tracing",
@@ -2742,8 +2678,8 @@
2742 2678 "quinn-proto",
2743 2679 "quinn-udp",
2744 2680 "rustc-hash",
2745 - "rustls 0.23.37",
2746 - "socket2 0.6.3",
2681 + "rustls",
2682 + "socket2",
2747 2683 "thiserror 2.0.18",
2748 2684 "tokio",
2749 2685 "tracing",
@@ -2763,7 +2699,7 @@
2763 2699 "rand 0.9.2",
2764 2700 "ring",
2765 2701 "rustc-hash",
2766 - "rustls 0.23.37",
2702 + "rustls",
2767 2703 "rustls-pki-types",
2768 2704 "slab",
2769 2705 "thiserror 2.0.18",
@@ -2781,7 +2717,7 @@
2781 2717 "cfg_aliases",
2782 2718 "libc",
2783 2719 "once_cell",
2784 - "socket2 0.6.3",
2720 + "socket2",
2785 2721 "tracing",
2786 2722 "windows-sys 0.52.0",
2787 2723 ]
@@ -2957,22 +2893,22 @@
2957 2893 "http 1.4.0",
2958 2894 "http-body 1.0.1",
2959 2895 "http-body-util",
2960 - "hyper 1.8.1",
2961 - "hyper-rustls 0.27.7",
2896 + "hyper",
2897 + "hyper-rustls",
2962 2898 "hyper-util",
2963 2899 "js-sys",
2964 2900 "log",
2965 2901 "percent-encoding",
2966 2902 "pin-project-lite",
2967 2903 "quinn",
2968 - "rustls 0.23.37",
2904 + "rustls",
2969 2905 "rustls-pki-types",
2970 2906 "rustls-platform-verifier",
2971 2907 "serde",
2972 2908 "serde_json",
2973 2909 "sync_wrapper",
2974 2910 "tokio",
2975 - "tokio-rustls 0.26.4",
2911 + "tokio-rustls",
2976 2912 "tower",
2977 2913 "tower-http",
2978 2914 "tower-service",
@@ -3061,18 +2997,6 @@
3061 2997 "semver",
3062 2998 ]
3063 2999
3064 - [[package]]
3065 - name = "rustls"
3066 - version = "0.21.12"
3067 - source = "registry+https://github.com/rust-lang/crates.io-index"
3068 - checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
3069 - dependencies = [
3070 - "log",
3071 - "ring",
3072 - "rustls-webpki 0.101.7",
3073 - "sct",
3074 - ]
3075 -
3076 3000 [[package]]
3077 3001 name = "rustls"
3078 3002 version = "0.23.37"
@@ -3082,7 +3006,7 @@
3082 3006 "aws-lc-rs",
3083 3007 "once_cell",
3084 3008 "rustls-pki-types",
3085 - "rustls-webpki 0.103.13",
3009 + "rustls-webpki",
3086 3010 "subtle",
3087 3011 "zeroize",
3088 3012 ]
@@ -3120,10 +3044,10 @@
3120 3044 "jni",
3121 3045 "log",
3122 3046 "once_cell",
3123 - "rustls 0.23.37",
3047 + "rustls",
3124 3048 "rustls-native-certs",
3125 3049 "rustls-platform-verifier-android",
3126 - "rustls-webpki 0.103.13",
3050 + "rustls-webpki",
3127 3051 "security-framework",
3128 3052 "security-framework-sys",
3129 3053 "webpki-root-certs",
@@ -3136,16 +3060,6 @@
3136 3060 source = "registry+https://github.com/rust-lang/crates.io-index"
3137 3061 checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
3138 3062
3139 - [[package]]
3140 - name = "rustls-webpki"
3141 - version = "0.101.7"
3142 - source = "registry+https://github.com/rust-lang/crates.io-index"
3143 - checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
3144 - dependencies = [
3145 - "ring",
3146 - "untrusted",
3147 - ]
3148 -
3149 3063 [[package]]
3150 3064 name = "rustls-webpki"
3151 3065 version = "0.103.13"
@@ -3205,16 +3119,6 @@
3205 3119 source = "registry+https://github.com/rust-lang/crates.io-index"
3206 3120 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
3207 3121
3208 - [[package]]
3209 - name = "sct"
3210 - version = "0.7.1"
3211 - source = "registry+https://github.com/rust-lang/crates.io-index"
3212 - checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
3213 - dependencies = [
3214 - "ring",
3215 - "untrusted",
3216 - ]
3217 -
3218 3122 [[package]]
3219 3123 name = "sec1"
3220 3124 version = "0.3.0"
@@ -3459,16 +3363,6 @@
3459 3363 "serde",
3460 3364 ]
3461 3365
3462 - [[package]]
3463 - name = "socket2"
3464 - version = "0.5.10"
3465 - source = "registry+https://github.com/rust-lang/crates.io-index"
3466 - checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
3467 - dependencies = [
3468 - "libc",
3469 - "windows-sys 0.52.0",
3470 - ]
3471 -
3472 3366 [[package]]
3473 3367 name = "socket2"
3474 3368 version = "0.6.3"
@@ -3933,7 +3827,7 @@
3933 3827 "mio",
3934 3828 "pin-project-lite",
3935 3829 "signal-hook-registry",
3936 - "socket2 0.6.3",
3830 + "socket2",
3937 3831 "tokio-macros",
3938 3832 "windows-sys 0.61.2",
3939 3833 ]
@@ -3949,23 +3843,13 @@
3949 3843 "syn",
3950 3844 ]
3951 3845
3952 - [[package]]
3953 - name = "tokio-rustls"
3954 - version = "0.24.1"
3955 - source = "registry+https://github.com/rust-lang/crates.io-index"
3956 - checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
3957 - dependencies = [
3958 - "rustls 0.21.12",
3959 - "tokio",
3960 - ]
3961 -
3962 3846 [[package]]
3963 3847 name = "tokio-rustls"
3964 3848 version = "0.26.4"
3965 3849 source = "registry+https://github.com/rust-lang/crates.io-index"
3966 3850 checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
3967 3851 dependencies = [
3968 - "rustls 0.23.37",
3852 + "rustls",
3969 3853 "tokio",
3970 3854 ]
3971 3855
@@ -4863,7 +4747,7 @@
4863 4747 "futures",
4864 4748 "http 1.4.0",
4865 4749 "http-body-util",
4866 - "hyper 1.8.1",
4750 + "hyper",
4867 4751 "hyper-util",
4868 4752 "log",
4869 4753 "once_cell",
@@ -322,23 +322,17 @@
322 322 "aws-smithy-async",
323 323 "aws-smithy-runtime-api",
324 324 "aws-smithy-types",
325 - "h2 0.3.27",
326 - "h2 0.4.13",
327 - "http 0.2.12",
325 + "h2",
328 326 "http 1.4.0",
329 - "http-body 0.4.6",
330 - "hyper 0.14.32",
331 - "hyper 1.9.0",
332 - "hyper-rustls 0.24.2",
333 - "hyper-rustls 0.27.7",
327 + "hyper",
328 + "hyper-rustls",
334 329 "hyper-util",
335 330 "pin-project-lite",
336 - "rustls 0.21.12",
337 - "rustls 0.23.37",
331 + "rustls",
338 332 "rustls-native-certs",
339 333 "rustls-pki-types",
340 334 "tokio",
341 - "tokio-rustls 0.26.4",
335 + "tokio-rustls",
342 336 "tower",
343 337 "tracing",
344 338 ]
@@ -957,25 +951,6 @@
957 951 "subtle",
958 952 ]
959 953
960 - [[package]]
961 - name = "h2"
962 - version = "0.3.27"
963 - source = "registry+https://github.com/rust-lang/crates.io-index"
964 - checksum = "0beca50380b1fc32983fc1cb4587bfa4bb9e78fc259aad4a0032d2080309222d"
965 - dependencies = [
966 - "bytes",
967 - "fnv",
968 - "futures-core",
969 - "futures-sink",
970 - "futures-util",
971 - "http 0.2.12",
972 - "indexmap",
973 - "slab",
974 - "tokio",
975 - "tokio-util",
976 - "tracing",
977 - ]
978 -
979 954 [[package]]
980 955 name = "h2"
981 956 version = "0.4.13"
@@ -1091,12 +1066,6 @@
1091 1066 source = "registry+https://github.com/rust-lang/crates.io-index"
1092 1067 checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
1093 1068
1094 - [[package]]
1095 - name = "httpdate"
1096 - version = "1.0.3"
1097 - source = "registry+https://github.com/rust-lang/crates.io-index"
1098 - checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
1099 -
1100 1069 [[package]]
1101 1070 name = "hybrid-array"
1102 1071 version = "0.4.11"
@@ -1106,30 +1075,6 @@
1106 1075 "typenum",
1107 1076 ]
1108 1077
1109 - [[package]]
1110 - name = "hyper"
1111 - version = "0.14.32"
1112 - source = "registry+https://github.com/rust-lang/crates.io-index"
1113 - checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
1114 - dependencies = [
1115 - "bytes",
1116 - "futures-channel",
1117 - "futures-core",
1118 - "futures-util",
1119 - "h2 0.3.27",
1120 - "http 0.2.12",
1121 - "http-body 0.4.6",
1122 - "httparse",
1123 - "httpdate",
1124 - "itoa",
1125 - "pin-project-lite",
1126 - "socket2 0.5.10",
1127 - "tokio",
1128 - "tower-service",
1129 - "tracing",
1130 - "want",
1131 - ]
1132 -
1133 1078 [[package]]
1134 1079 name = "hyper"
1135 1080 version = "1.9.0"
@@ -1140,7 +1085,7 @@
1140 1085 "bytes",
1141 1086 "futures-channel",
1142 1087 "futures-core",
1143 - "h2 0.4.13",
1088 + "h2",
1144 1089 "http 1.4.0",
1145 1090 "http-body 1.0.1",
1146 1091 "httparse",
@@ -1151,21 +1096,6 @@
1151 1096 "want",
1152 1097 ]
1153 1098
1154 - [[package]]
1155 - name = "hyper-rustls"
1156 - version = "0.24.2"
1157 - source = "registry+https://github.com/rust-lang/crates.io-index"
1158 - checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
1159 - dependencies = [
1160 - "futures-util",
1161 - "http 0.2.12",
1162 - "hyper 0.14.32",
1163 - "log",
1164 - "rustls 0.21.12",
1165 - "tokio",
1166 - "tokio-rustls 0.24.1",
1167 - ]
1168 -
1169 1099 [[package]]
1170 1100 name = "hyper-rustls"
1171 1101 version = "0.27.7"
@@ -1173,13 +1103,13 @@
1173 1103 checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
1174 1104 dependencies = [
1175 1105 "http 1.4.0",
1176 - "hyper 1.9.0",
1106 + "hyper",
1177 1107 "hyper-util",
1178 - "rustls 0.23.37",
1108 + "rustls",
1179 1109 "rustls-native-certs",
1180 1110 "rustls-pki-types",
1181 1111 "tokio",
1182 - "tokio-rustls 0.26.4",
1112 + "tokio-rustls",
1183 1113 "tower-service",
1184 1114 ]
1185 1115
@@ -1195,12 +1125,12 @@
1195 1125 "futures-util",
1196 1126 "http 1.4.0",
1197 1127 "http-body 1.0.1",
1198 - "hyper 1.9.0",
1128 + "hyper",
1199 1129 "ipnet",
1200 1130 "libc",
1201 1131 "percent-encoding",
1202 1132 "pin-project-lite",
1203 - "socket2 0.6.3",
1133 + "socket2",
1204 1134 "tokio",
1205 1135 "tower-service",
1206 1136 "tracing",
@@ -1363,12 +1293,6 @@
1363 1293 source = "registry+https://github.com/rust-lang/crates.io-index"
1364 1294 checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
1365 1295
1366 - [[package]]
1367 - name = "log"
1368 - version = "0.4.29"
1369 - source = "registry+https://github.com/rust-lang/crates.io-index"
1370 - checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
1371 -
1372 1296 [[package]]
1373 1297 name = "lru"
1374 1298 version = "0.16.3"
@@ -1568,18 +1492,6 @@
1568 1492 "semver",
1569 1493 ]
1570 1494
1571 - [[package]]
1572 - name = "rustls"
1573 - version = "0.21.12"
1574 - source = "registry+https://github.com/rust-lang/crates.io-index"
1575 - checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
1576 - dependencies = [
1577 - "log",
1578 - "ring",
1579 - "rustls-webpki 0.101.7",
1580 - "sct",
1581 - ]
1582 -
1583 1495 [[package]]
1584 1496 name = "rustls"
1585 1497 version = "0.23.37"
@@ -1589,7 +1501,7 @@
1589 1501 "aws-lc-rs",
1590 1502 "once_cell",
1591 1503 "rustls-pki-types",
1592 - "rustls-webpki 0.103.13",
1504 + "rustls-webpki",
1593 1505 "subtle",
1594 1506 "zeroize",
1595 1507 ]
@@ -1615,16 +1527,6 @@
1615 1527 "zeroize",
1616 1528 ]
1617 1529
1618 - [[package]]
1619 - name = "rustls-webpki"
1620 - version = "0.101.7"
1621 - source = "registry+https://github.com/rust-lang/crates.io-index"
1622 - checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
1623 - dependencies = [
1624 - "ring",
1625 - "untrusted",
1626 - ]
1627 -
1628 1530 [[package]]
1629 1531 name = "rustls-webpki"
1630 1532 version = "0.103.13"
@@ -1669,16 +1571,6 @@
1669 1571 "windows-sys 0.61.2",
1670 1572 ]
1671 1573
1672 - [[package]]
1673 - name = "sct"
1674 - version = "0.7.1"
1675 - source = "registry+https://github.com/rust-lang/crates.io-index"
1676 - checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
1677 - dependencies = [
1678 - "ring",
1679 - "untrusted",
1680 - ]
1681 -
1682 1574 [[package]]
1683 1575 name = "sec1"
1684 1576 version = "0.3.0"
@@ -1834,16 +1726,6 @@
1834 1726 source = "registry+https://github.com/rust-lang/crates.io-index"
1835 1727 checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
1836 1728
1837 - [[package]]
1838 - name = "socket2"
1839 - version = "0.5.10"
1840 - source = "registry+https://github.com/rust-lang/crates.io-index"
1841 - checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
1842 - dependencies = [
1843 - "libc",
1844 - "windows-sys 0.52.0",
1845 - ]
1846 -
1847 1729 [[package]]
1848 1730 name = "socket2"
1849 1731 version = "0.6.3"
@@ -1955,7 +1837,7 @@
1955 1837 "mio",
1956 1838 "pin-project-lite",
1957 1839 "signal-hook-registry",
1958 - "socket2 0.6.3",
1840 + "socket2",
1959 1841 "tokio-macros",
1960 1842 "windows-sys 0.61.2",
1961 1843 ]
@@ -1971,23 +1853,13 @@
1971 1853 "syn",
1972 1854 ]
1973 1855
1974 - [[package]]
1975 - name = "tokio-rustls"
1976 - version = "0.24.1"
1977 - source = "registry+https://github.com/rust-lang/crates.io-index"
1978 - checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
1979 - dependencies = [
1980 - "rustls 0.21.12",
1981 - "tokio",
1982 - ]
1983 -
1984 1856 [[package]]
1985 1857 name = "tokio-rustls"
1986 1858 version = "0.26.4"
1987 1859 source = "registry+https://github.com/rust-lang/crates.io-index"
1988 1860 checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
1989 1861 dependencies = [
1990 - "rustls 0.23.37",
1862 + "rustls",
1991 1863 "tokio",
1992 1864 ]
1993 1865
@@ -4,7 +4,7 @@
4 4 edition = "2024"
5 5
6 6 [dependencies]
7 - aws-sdk-s3 = "1.131"
7 + aws-sdk-s3 = { version = "1.131", default-features = false, features = ["sigv4a", "http-1x", "default-https-client", "rt-tokio"] }
8 8 aws-config = { version = "1.8", features = ["behavior-version-latest"] }
9 9 bytes = "1"
10 10 tokio = { version = "1", features = ["fs", "io-util"] }