[pront]

Summary

Update the VRL pin from bcf249e0 to 508e5ec1, bringing in zstd security updates, platform certificate verification for http_request, and reduced cloning of unused assignment results.

VRL's HTTP update also enables AWS-LC, so clients can no longer infer a unique Rustls provider. Select Ring explicitly for MQTT and use a shared vector_lib::tls::install_default_crypto_provider() helper during CLI startup and topology construction. This initializes the process-wide provider before building components, including when Vector is embedded through its library APIs, while preserving any provider already installed. This also covers NATS, GreptimeDB metrics, Docker over HTTPS, and Zerobus proxy connections without depending on component startup order.

References

Upstream VRL changes

Vector configuration

No configuration changes are required.

How did you test this PR?

• The default-feature build passes cargo check on macOS arm64 with Rust 1.96.1, including vendored Kafka. Focused Clippy checks pass for MQTT, NATS, GreptimeDB metrics, Docker, Zerobus, remap, and VRL networking.
• A focused runtime reproduction with both Rustls providers enabled fails to initialize MQTT TLS before the feature change and succeeds afterward. No external broker was used.
• Regression coverage includes MQTT provider selection, isolated startup tests for Docker HTTPS and Zerobus proxy setup, and construction of a TLS-enabled GreptimeDB topology without CLI initialization. The topology test covers both an unset provider and preservation of a preinstalled provider. Unit tests were not executed at the author's request.
• Formatting, Markdown, and the regenerated license inventory pass checks.

Does this PR include user facing changes?

• Yes. Changelog omitted at maintainer request; covered by no-changelog.
• No.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T19:21:57.450509Z	ea7895a	New commits
🔒 Security Review	✅ Completed 2026-10-28T19:21:50.202406Z	ea7895a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadoghq-integration]

More details

Static inspection supports the TLS provider handling for MQTT, NATS, and GreptimeDB metrics when both Rustls providers are enabled, including preservation of an existing default provider. Runtime TLS initialization was not exercised.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit fc8cd2e}

[JinchengCao]

Looks like we’re still missing Docker over HTTPS and Zerobus with a proxy. Both can still panic with Ring + AWS-LC if nothing has set the default provider yet. Could we move the provider setup somewhere shared, before components are built, and keep any provider that’s already installed?

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8120ae73cb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".