fix(deps): update rust crate reqwest to 0.13 - #222
Draft
Romuald Lemesle (RomuDeuxfois) wants to merge 5 commits into
Draft
fix(deps): update rust crate reqwest to 0.13#222Romuald Lemesle (RomuDeuxfois) wants to merge 5 commits into
Romuald Lemesle (RomuDeuxfois) wants to merge 5 commits into
Conversation
reqwest 0.13 removed the whole rustls-tls-* feature family, which is why the Renovate bump could not resolve since February. Replace rustls-tls and rustls-tls-native-roots with rustls. Two behaviour changes come with that feature, by design: - crypto provider moves from ring to aws-lc-rs, which adds a cmake and C compiler requirement for aws-lc-sys at build time - roots move from bundled webpki-roots to rustls-platform-verifier, i.e. the OS trust store rather than Mozilla roots plus the system store
Copilot started reviewing on behalf of
Romuald Lemesle (RomuDeuxfois)
August 18, 2026 15:47
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the project’s HTTP client dependency to reqwest 0.13 by switching to the new rustls feature name (replacing the removed rustls-tls-* feature family) and regenerating Cargo.lock so dependency resolution succeeds again.
Changes:
- Bump
reqwestfrom0.12.15to0.13.0inCargo.toml. - Replace
reqwestfeaturesrustls-tls/rustls-tls-native-rootswith the newrustlsfeature. - Regenerate
Cargo.lock, pulling in the updated reqwest dependency graph (includingaws-lc-*/cmakerelated build deps).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| Cargo.toml | Updates reqwest version and switches to the new rustls feature for reqwest 0.13 compatibility. |
| Cargo.lock | Regenerated lockfile to reflect reqwest 0.13.x resolution and updated transitive dependencies. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Romuald Lemesle (RomuDeuxfois)
marked this pull request as draft
August 18, 2026 16:08
reqwest 0.13's `rustls` verifies against the OS trust store only, where 0.12's rustls-tls + rustls-tls-native-roots also trusted the bundled Mozilla roots. Passing those roots through add_root_certificate puts reqwest on Verifier::new_with_extra_roots, i.e. OS store plus bundled roots, so the dependency bump stays behaviour-neutral. Narrowing the trust policy is left to the migrate-out-of-ring work. Also add the symmetric TLS test: the existing one only asserts that an invalid certificate is rejected, which a broken root store satisfies too, so nothing currently fails if public CAs stop resolving.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #222 +/- ##
==========================================
+ Coverage 31.86% 32.26% +0.39%
==========================================
Files 12 12
Lines 681 685 +4
==========================================
+ Hits 217 221 +4
Misses 464 464
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Adds a CI job that generates a private CA, installs it into the system trust store of each host OS, serves a certificate signed by it with openssl s_server, then runs an #[ignore]d test against that endpoint. No bundled Mozilla root can vouch for the chain, so a pass is evidence that rustls-platform-verifier really reads the store — which test_valid_certificate_is_accepted cannot show, since the bundled roots satisfy it on their own. Host targets only (gnu on Linux rather than the musl release target), since the test has to actually run.
MSYS path conversion turned /CN=... into C:/Program Files/Git/CN=..., failing the certificate generation on the Windows runner only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
reqwest 0.13 dropped the
rustls-tls-*feature family — hence the Renovate bump (#140) being red since February: it changed the version, not the features.features = [ "blocking", - "rustls-tls", - "rustls-tls-native-roots", + "rustls", "json", ]Cargo.lockregenerated withcargo update -p reqwest: 0.12.28 → 0.13.4, 23 packages added,webpki-rootsremoved.Two intended behaviour changes, since
rustlsexpands to aws-lc-rs + platform-verifier whererustls-tlsexpanded to webpki-roots + ring:windows-arm64Side effect: ring leaves the compiled graph (
cargo tree -i ring --target allis empty), though it stays as an inert lock entry thatcargo auditstill scans.Not compiled locally — no linker on this machine, and aws-lc-sys now needs cmake too. CI decides.