fix: update aws-sdk-sts to resolve rustls-webpki vulnerabilities

[acarl005]

Summary

Resolves three open Dependabot alerts for rustls-webpki (v0.101.7) by removing the legacy rustls 0.21 TLS backend from the dependency tree:

• Alert #6 — GHSA-82j2-j2ch-gfr8 (high, CVSS 7.5): Denial of service via panic on malformed CRL BIT STRING
• Alert #1 — GHSA-965h-392x-2mh5 (low, CVSS 2.2): URI name constraints incorrectly accepted
• Alert #2 — GHSA-xgp8-3hg3-c2mh (low, CVSS 2.2): Wildcard name constraints incorrectly accepted

What changed

Root cause: aws-sdk-sts = "1" with default features enables the legacy rustls feature on aws-smithy-runtime, which pulls in aws-smithy-http-client/legacy-rustls-ring → rustls 0.21.12 → rustls-webpki 0.101.7. The modern TLS backend (default-https-client) was already enabled separately.

Fix:

1. Changed aws-sdk-sts to default-features = false with only default-https-client and rt-tokio features, removing the legacy TLS backend entirely
2. Regenerated Cargo.lock — rustls 0.21.12, rustls-webpki 0.101.7, hyper-rustls 0.24.2, and tokio-rustls 0.24.1 are no longer present
3. Fixed a futures deprecation (try_next() → try_recv() on UnboundedReceiver) that caused CI to fail on a prior attempt (PR fix: update aws-sdk-sts to resolve rustls-webpki vulnerabilities #9918)

Dependabot context: Dependabot reported security_update_not_possible because rustls-webpki 0.101.7 was the latest version resolvable within the rustls 0.21 constraint. The fix is to remove the rustls 0.21 dependency chain entirely.

Verification

• rustls-webpki 0.101.7 no longer appears in Cargo.lock
• rustls 0.21.12 no longer appears in Cargo.lock

Conversation: https://staging.warp.dev/conversation/65c09fed-26d4-4851-9c44-4a4b4a08f61e
Run: https://oz.staging.warp.dev/runs/019df8de-4414-7d7e-91fe-566ec591e2d4

This PR was generated with Oz.

[oz-for-oss]

@acarl005

I'm starting a first review of this pull request.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[oz-for-oss]

Overview

This PR narrows aws-sdk-sts to the modern HTTPS client/runtime features to remove the legacy rustls 0.21 backend, and updates the SSE event drain loop to use the non-deprecated receiver API.

Concerns

• No blocking concerns found in the available annotated diff. Note: Cargo.lock was marked patch unavailable, so this review could not independently inspect the lockfile removal details from the supplied diff.

Verdict

Found: 0 critical, 0 important, 0 suggestions

Approve

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz