fix(deps): update rust crate reqwest to 0.13 - #177
Open
Romuald Lemesle (RomuDeuxfois) wants to merge 8 commits into
Open
fix(deps): update rust crate reqwest to 0.13#177Romuald Lemesle (RomuDeuxfois) wants to merge 8 commits into
Romuald Lemesle (RomuDeuxfois) wants to merge 8 commits into
Conversation
reqwest 0.13 removed the whole rustls-tls-* feature family, which is why the Renovate bump could not resolve since February. Replace rustls-tls and rustls-tls-native-roots with rustls. Two behaviour changes come with that feature, by design: - crypto provider moves from ring to aws-lc-rs, which adds a cmake and C compiler requirement for aws-lc-sys at build time - roots move from bundled webpki-roots to rustls-platform-verifier, i.e. the OS trust store rather than Mozilla roots plus the system store
Copilot started reviewing on behalf of
Romuald Lemesle (RomuDeuxfois)
August 18, 2026 15:47
View session
There was a problem hiding this comment.
Pull request overview
Updates the Rust HTTP client dependency (reqwest) to the 0.13.x line by aligning feature flags with the renamed TLS feature, and regenerates the lockfile to restore successful dependency resolution.
Changes:
- Bump
reqwestfrom0.12.28→0.13.0and switch TLS feature flags torustls. - Regenerate
Cargo.lockto resolvereqwestto0.13.4and reflect the new transitive dependency graph (notablyaws-lc-*,rustls-platform-verifier, etc.).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| Cargo.toml | Updates reqwest version and replaces removed rustls-tls-* features with rustls. |
| Cargo.lock | Regenerates the lockfile for the new reqwest resolution and updated transitive dependencies. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Romuald Lemesle (RomuDeuxfois)
marked this pull request as draft
August 18, 2026 16:08
reqwest 0.13's `rustls` verifies against the OS trust store only, where 0.12's rustls-tls + rustls-tls-native-roots also trusted the bundled Mozilla roots. Passing those roots through add_root_certificate puts reqwest on Verifier::new_with_extra_roots, i.e. OS store plus bundled roots, so the dependency bump stays behaviour-neutral. Narrowing the trust policy is left to the migrate-out-of-ring work. Also add the symmetric TLS test: the existing one only asserts that an invalid certificate is rejected, which a broken root store satisfies too, so nothing currently fails if public CAs stop resolving.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #177 +/- ##
==========================================
+ Coverage 17.90% 18.24% +0.33%
==========================================
Files 16 16
Lines 966 970 +4
==========================================
+ Hits 173 177 +4
Misses 793 793
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Ports the job proven green on the agent repo: generates a private CA, installs it into the system trust store of each host OS, serves a certificate signed by it with openssl s_server, then runs an #[ignore]d test against that endpoint. No bundled Mozilla root can vouch for the chain, so a pass is evidence that rustls-platform-verifier really reads the store. Host targets only (gnu on Linux rather than the musl release target), since the test has to actually run.
Romuald Lemesle (RomuDeuxfois)
marked this pull request as ready for review
August 28, 2026 15:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
reqwest 0.13 dropped the
rustls-tls-*feature family — hence the Renovate bump (#102) being red since February: it changed the version, not the features.features = [ "blocking", - "rustls-tls", - "rustls-tls-native-roots", + "rustls", "json", ]Cargo.lockregenerated withcargo update -p reqwest: 0.12.28 → 0.13.4, 23 packages added,webpki-rootsremoved.Two intended behaviour changes, since
rustlsexpands to aws-lc-rs + platform-verifier whererustls-tlsexpanded to webpki-roots + ring:windows-arm64Side effect: ring leaves the compiled graph (
cargo tree -i ring --target allis empty), though it stays as an inert lock entry thatcargo auditstill scans.Not compiled locally — no linker on this machine, and aws-lc-sys now needs cmake too. CI decides.