fix: update aws-sdk-sts to resolve rustls-webpki vulnerabilities

[acarl005]

Closes #10070

Summary

Disable the legacy rustls default feature on aws-sdk-sts to remove the transitive dependency on vulnerable rustls-webpki versions.

Vulnerabilities Resolved

• GHSA-82j2-j2ch-gfr8 — HIGH (CVSS 7.5): rustls-webpki denial of service via panic on malformed CRL BIT STRING
• GHSA-965h-392x-2mh5 — LOW (CVSS 2.2): webpki URI name constraints incorrectly accepted
• GHSA-xgp8-3hg3-c2mh — LOW (CVSS 2.2): webpki wildcard name constraints incorrectly accepted

Root Cause

aws-sdk-sts = "1" (with default features) includes a rustls feature that enables aws-smithy-runtime/tls-rustls → aws-smithy-http-client/legacy-rustls-ring. This legacy TLS backend pulls in rustls 0.21.12 → rustls-webpki 0.101.7 (vulnerable). The modern TLS backend (default-https-client → rustls-aws-lc → rustls 0.23) was already enabled separately.

Dependabot could not fix this because it can't modify feature flags — it reported the latest installable rustls-webpki was 0.101.7.

Change

In app/Cargo.toml, changed:

- aws-sdk-sts = "1"
+ aws-sdk-sts = { version = "1", default-features = false, features = ["default-https-client", "rt-tokio"] }

This drops the rustls feature (legacy TLS) while keeping default-https-client (modern TLS via rustls 0.23 + aws-lc-rs) and rt-tokio.

Removed Dependencies

The following legacy crates are completely removed from Cargo.lock:

• rustls-webpki 0.101.7
• rustls 0.21.12
• hyper-rustls 0.24.2
• tokio-rustls 0.24.1
• h2 0.3.x
• hyper 0.14.x
• sct

Verification

• cargo audit confirms the three rustls-webpki advisories no longer appear
• Only rustls-webpki 0.103.13 and rustls 0.23.40 remain in the lockfile

Co-Authored-By: Oz oz-agent@warp.dev

Conversation: https://staging.warp.dev/conversation/47650e53-d221-4216-afb7-f99130dfed60
Run: https://oz.staging.warp.dev/runs/019de96b-0fc5-791e-b920-7280b5471474

This PR was generated with Oz.

[oz-for-oss]

@acarl005

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[oz-for-oss]

Overview

This PR disables the legacy rustls default feature on aws-sdk-sts while retaining default-https-client and rt-tokio, which addresses the vulnerable legacy rustls-webpki dependency path described in the PR.

Concerns

• No blocking correctness, dependency, or security concerns were found in the annotated diff.

Verdict

Found: 0 critical, 0 important, 0 suggestions

Approve

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz