Update to hyper-rustls

[evanmb27]

Would it be possible to update hyper-rustls to the latest version? We'd appreciate it if that work could be prioritized. We have been using launchdarkly-server-sdk, and it's now been flagged as a security issue because it depends on this package which is using an older version of hyper-rustls that relies on rustls-native-certs which is an unsupported package with an archived repo. Thanks!

[keelerm84]

Good afternoon, and thank you for your report.

Are you able to provide the security report you are seeing? That would help us to better understand the exact nature of the issue.

which is using an older version of hyper-rustls that relies on rustls-native-certs which is an unsupported package with an archived repo

The latest version of hyper-rustls also relies on rustls-native-certs. Are you certain updating is sufficient to satisfy these security requirements?

Additionally, that repository isn't archived from what I can tell. Maybe that is no longer a concern?

[kantielope]

Hi I’m Evan’s teammate but he is now on PTO so I’m trying to contribute to this correspondence in his stead. From what I can tell the archived repo he was referring to is actually rustls-pemfile which is a dependency of rustls-native-certs v0.6.3 which is a dependency of hyper-rustls v0.24.2 which is a dependency of current eventsource-client. That archived repo is the one that seems to be causing the issue

[kantielope]

The PEM parsing code from rustls-pemfile is now in rustls-pki-types since 1.9.0. This was brought to our attention via cargo audit which we have to run for PR gates, so this usage of an unmaintained repo is blocking our internal PRs

[keelerm84]

Thank you for your patience on this issue @evanmb27 and @kantielope

We have just released v0.17.0 of this crate. This version no longer depends directly on hyper-rustls. Rather, it uses the new https://github.com/launchdarkly/rust-sdk-transport crate, which in turn has optional support for hyper-rustls.

By default, v0.17.0 should depend on the latest (v0.27) of hyper-rustls.

Let me know if you run into any issues!