chore(workspace): tighten quality gates (#2230)

fluxer_svc/Cargo.toml

@@ -5,7 +5,7 @@ edition.workspace = true
 license.workspace = true
 
 [dependencies]
-anyhow = "1.0.102"
+anyhow = "1.0.104"
 async-nats = "0.49"
 async-trait = "0.1"
 axum = { version = "0.8.9", default-features = false, features = ["http1", "tokio"] }
@@ -17,7 +17,6 @@ libc = "0.2"
 moka = { version = "0.12.15", features = ["future"] }
 rmp-serde = "1.3"
 rustls = { version = "0.23", features = ["ring"] }
-rustls-pemfile = "2.2"
 scylla = { version = "1.6.0", features = ["chrono-04"], optional = true }
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.150"

fluxer_svc/src/postgres.rs

@@ -4,9 +4,11 @@ use crate::config::ServiceConfig;
 use anyhow::Context;
 use chrono::{DateTime, Utc};
 use deadpool_postgres::{Client, Manager, Pool, Runtime, Transaction};
-use rustls::RootCertStore;
+use rustls::{
+    RootCertStore,
+    pki_types::{CertificateDer, pem::PemObject},
+};
 use serde_json::{Map, Number, Value};
-use std::io::Cursor;
 use std::str::FromStr;
 use tokio_postgres::{Config as PgConfig, Row, Statement, config::SslMode, types::ToSql};
 use tokio_postgres_rustls::MakeRustlsConnect;
@@ -99,9 +101,8 @@ fn build_tls_connector(ca_pem: Option<&str>) -> anyhow::Result<MakeRustlsConnect
     let _ = rustls::crypto::ring::default_provider().install_default();
     if let Some(ca_pem) = ca_pem.filter(|value| !value.trim().is_empty()) {
         let normalized = ca_pem.replace("\\n", "\n");
-        let mut reader = Cursor::new(normalized.as_bytes());
         let mut roots = RootCertStore::empty();
-        for cert in rustls_pemfile::certs(&mut reader) {
+        for cert in CertificateDer::pem_slice_iter(normalized.as_bytes()) {
             roots.add(cert.context("failed to parse FLUXER_POSTGRES_SSL_CA certificate")?)?;
         }
         if roots.is_empty() {