fix(application): patch rustls advisory RUSTSEC-2026-0285

[Marcel Bindseil (bindsi)]

Pull Request

IMPORTANT: Before submitting, please remove all sensitive data, secrets, tokens, or confidential information. Ensure you've redacted any NDA-covered information, IP addresses, resource names, or security-related details that shouldn't be publicly disclosed.

Description

Upgrade the HTTP broker and media-capture service lockfiles to rustls 0.23.45 to resolve RUSTSEC-2026-0285. This addresses the shared Cargo Audit failure affecting the open Dependabot PRs without weakening the existing audit policy.

Related Issue

Relates to #793, #798, #802, #806, #807, and #808. These dependency PRs remain separate and must be refreshed and validated after this fix merges.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Blueprint modification or addition
• Component modification or addition
• Documentation update
• CI/CD pipeline change
• Other (please describe):

Implementation Details

• Update rustls from 0.23.40 to 0.23.45 in the HTTP broker and from 0.23.41 to 0.23.45 in media capture.
• Update rustls-webpki to 0.103.15 in both lockfiles, plus the required broker crypto dependencies aws-lc-rs 1.18.1 and aws-lc-sys 0.45.0.
• Generate both updates with cargo update -p rustls --precise 0.23.45; leave manifests, application source, and advisory exceptions unchanged.

Testing Performed

• Terraform plan/apply
• Blueprint deployment test
• Unit tests
• Integration tests
• Bug fix includes regression test (see Test Policy)
• Manual validation
• Other: security audit and focused dependency compilation

cargo-audit 0.22.1 with --deny warnings passed for all 18 tracked Cargo lockfiles using the unchanged repository .github/audit.toml policy. Focused cargo check --locked passed for the changed crypto packages in both service dependency graphs. git diff --check origin/main...HEAD passed.

Full HTTP broker compilation was attempted on macOS but is unavailable there: the unchanged Azure MQTT SDK references Linux-only TcpTlsRx/TcpTlsTx and TLS constants. Full service builds and tests remain pending in Linux CI; no application test pass is claimed.

Validation Steps

1. Run the existing Dependency Audit workflow, retaining its advisory configuration and --deny warnings setting.
2. Run the existing Linux Rust service build/test jobs for the HTTP broker and media-capture service.
3. Confirm the required PR Validation Gate succeeds before merging.

Checklist

• I have updated the documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed
• I have run terraform fmt on all Terraform code
• I have run terraform validate on all Terraform code
• I have run az bicep format on all Bicep code
• I have run az bicep build to validate all Bicep code
• I have checked for any sensitive data/tokens that should not be committed
• Lint checks pass (run applicable linters for changed file types)

Security Review

• No credentials, secrets, or tokens are hardcoded or logged
• RBAC and identity changes follow least-privilege principles
• No new network exposure or public endpoints introduced without justification
• Dependency additions or updates have been reviewed for known vulnerabilities
• Container image changes use pinned digests or SHA references

Additional Notes

The Checkov/ecdsa finding in #808 and transient Grype download failures in #806 are separate follow-ups. This PR changes only the two affected Rust lockfiles.

Screenshots (if applicable)

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 31.79%. Comparing base (dbd4581) to head (1742a60).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #809   +/-   ##
=======================================
  Coverage   31.79%   31.79%           
=======================================
  Files          40       40           
  Lines        6017     6017           
=======================================
  Hits         1913     1913           
  Misses       4104     4104           

Flag	Coverage Δ
rust	31.79% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.