[duncanista]

Overview

Jira: SVLS-9989

The Trivy Lockfile Scan fails on main and on every PR. It flags 3 rustls 0.23.43 advisories:

GHSA	RustSec	Severity	Title
GHSA-c8m5-c952-6cm4	RUSTSEC-2026-0346	medium	Debug impls for client session values expose TLS secrets
GHSA-h2v8-394m-p7vv	RUSTSEC-2026-0348	low	Brotli certificate decompression can allocate up to 1 GiB before authentication
GHSA-w44r-93j7-qv28	RUSTSEC-2026-0349	low	Unauthenticated ServerHello can downgrade later connections

The Rust advisory check (Audit) already ignores these 3, for the same reason as GHSA-2mjx-qc3c-rqvc (RUSTSEC-2026-0285), which is already in .trivyignore.yaml. The fix is rustls >= 0.23.46. That version needs aws-lc-rs >= 1.18, which moves the fips build to the AWS-LC-FIPS 4.0 module. NIST has not certified AWS-LC-FIPS 4.0 yet; it is still in review. The certified modules are 3.x and older.

This PR adds the 3 GHSA ids to .trivyignore.yaml with that reason, so the two ignore lists match again. Remove all 4 rustls entries, and the matching Rust advisory ignores, when AWS-LC-FIPS 4.0 is certified and rustls is bumped.

It does not depend on any other PR. It touches the same file as #1469, so the second one to merge needs a small rebase.

Testing

Ran the same scan as the Lockfile Scan job (trivy 0.69.3, fs bottlecap, --ignore-unfixed, --exit-code 1, this ignore file):

• main: exit 1, Total: 3 (LOW: 2, MEDIUM: 1), the 3 GHSA ids above.
• this branch: exit 0, no findings.
• .trivyignore.yaml parses as YAML with 5 entries.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T18:51:07.867526Z	5ebb053	New commits
🔒 Security Review	✅ Completed 2026-10-29T18:54:30.938170Z	5ebb053	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🔵 Needs a closer look

Suppressing three known TLS advisories requires security/FIPS owner confirmation of risk acceptance and the AWS-LC-FIPS certification constraint, which repository inspection alone cannot establish.

No open issues 🎉

What changed in this PR

Updates the Trivy lockfile scan’s ignore list to cover three rustls advisories whose fixes are blocked by pending AWS-LC-FIPS 4.x certification.

Changes:

• Adds three GHSA entries matching the configured Rust advisory ignores.
• Documents the upgrade constraint and directs removal alongside the corresponding Rust advisory ignores.

File	Description
.trivyignore.yaml	Adds three rustls advisory exceptions with rationale and removal guidance.

_{Review effort: Balanced}

[datadog-prod-us1-5]

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 5ebb053 | Docs | Give us feedback!}