build(deps): clear all 8 open dependabot alerts

[moonming]

What

Clears all 8 open dependabot alerts (2 high / 3 moderate / 3 low) on the default branch. They collapse into 4 distinct advisories; every one is fixed by upgrade — nothing is dismissed.

Alerts	Advisory	Package	Fix
#2 #10 #11 (moderate)	CVE-2026-25537 — type confusion with exp/nbf when not required	jsonwebtoken 9.3.1 (runtime: inbound OIDC/JWT auth in aisix-proxy, SA token minting in aisix-provider-vertex)	→ 10.4.0, aws_lc_rs backend
#6 (high)	GHSA-82j2-j2ch-gfr8 — panic on malformed CRL BIT STRING	rustls-webpki 0.103.12	→ 0.103.13 (lock bump)
#3 #4 (low)	GHSA-xgp8-3hg3-c2mh / GHSA-965h-392x-2mh5 — name-constraint bypasses, unpatched in the 0.101 line	rustls-webpki 0.101.7 (via retired rustls 0.21 connector)	eliminated from the tree (see below)
#1 (high)	CVE-2025-62518 — tokio-tar PAX header desync, no patched tokio-tar release	tokio-tar 0.3.1 (dev-only: testcontainers in aisix-admin)	testcontainers 0.23 → 0.27, which uses the patched astral-tokio-tar fork
#5 (low)	GHSA-cq8v-f236-94qc — unsoundness with a custom logger	rand 0.8.5 (aisix-proxy + redis)	→ 0.8.7 (lock bump)

Key decisions

jsonwebtoken 10 backend choice. v10 made the crypto backend an explicit feature. aws_lc_rs reuses the aws-lc-rs 1.16 already in the tree (process-wide rustls provider installed in main()), so this adds no second crypto stack. Our 9.x API usage (encode/decode/Validation/JwkSet/ErrorKind) is source-compatible with 10.4 — zero code changes; all JWT-auth unit tests (signature tampering, alg confusion, kid selection, claim enforcement) pass unchanged. Not 11.0.0: it landed 10 days ago with breaking API churn (non_exhaustive enums, Header.extras rework) and no security content beyond 10.3.0.

Legacy AWS connector removal (the real fix for the webpki 0.101 alerts). rustls-webpki 0.101.7 cannot be patched in place — the fixes only exist in 0.103. It entered via aws-sdk-bedrockruntime's legacy rustls feature → aws-smithy-runtime/tls-rustls → hyper 0.14 + rustls 0.21 connector. That connector is dead code here: every Bedrock client is built on upstream_tls::aws_http_client() (aws-smithy-http-client, rustls 0.23 / aws-lc), and upstream_http.rs carries a guard enforcing exactly that. Swapping the feature to default-https-client on aws-config + aws-sdk-bedrockruntime removes rustls 0.21, rustls-webpki 0.101.7, and hyper 0.14's TLS path from Cargo.lock entirely. On aws-config 1.8 the old rustls feature is already just an alias for the modern client, so that half is a no-op rename.

testcontainers is dev-only. tokio-tar never ships in the gateway binary ([dev-dependencies] of aisix-admin). Upgraded rather than dismissed because the patched fork is a drop-in via testcontainers ≥ 0.25.

Verification

• cargo build --workspace --all-features — clean
• cargo test --workspace --all-features — 1,300+ tests, 0 failed
• cargo clippy --workspace --all-targets --all-features — no warnings; cargo fmt --check clean
• Cargo.lock after: single rustls (0.23.38), single rustls-webpki (0.103.13), no tokio-tar, jsonwebtoken 10.4.0, testcontainers 0.27.3, rand 0.8.7
• The one Docker-gated #[ignore] etcd roundtrip test compiles against 0.27; a local run failed only at docker pull (this machine currently can't reach Docker Hub) — before any testcontainers code path under test. CI ignores it by design.

After merge, the 8 alerts should auto-resolve on the next dependabot scan of main.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Maintenance
  • Updated security and networking components to newer implementations.
  • Improved compatibility and reliability across supported cloud integrations.
  • Refreshed testing infrastructure to support more consistent validation.
  • No user-facing API or feature changes were introduced.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ab317c1f-43d4-4737-af6d-e473387fc5a6

📥 Commits

Reviewing files that changed from the base of the PR and between 1df7716 and 6405586.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• Cargo.toml
• crates/aisix-provider-vertex/Cargo.toml
• crates/aisix-proxy/Cargo.toml

---

📝 Walkthrough

Walkthrough

The pull request updates AWS Bedrock HTTP client features, upgrades the testcontainers dependency, and changes jsonwebtoken to version 10 with aws_lc_rs in two crates.

Changes

Dependency updates

Layer / File(s)	Summary
AWS and test dependency configuration Cargo.toml	AWS Bedrock dependencies now use default-https-client. The testcontainers dependency now uses version 0.27.
JWT dependency configuration crates/aisix-provider-vertex/Cargo.toml, crates/aisix-proxy/Cargo.toml	Both crates now use jsonwebtoken version 10 with the aws_lc_rs feature.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: jarvis9443

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states that the pull request updates dependencies to resolve all eight open Dependabot alerts.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
E2e Test Quality Review	✅ Passed	Dependency-only diff; existing JWT and Bedrock E2E suites cover gateway flows, and the real-etcd round trip covers testcontainers. No test changes or hidden ordering were introduced.
Security Check	✅ Passed	The PR changes only dependency manifests and Cargo.lock; no logging, storage, authorization, ownership, secret-resolution, or handler code changed. TLS and JWT paths remain secured.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch build/dependabot-security-sweep

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}