v0.13.0-rc.1

[seanmonstar]

Main breaking changes

• rustls is now default instead of native-tls
• rustls provider defaults to aws-lc instead of ring (rustls-no-provider exists if you want to enable a different one)
• rustls-tls renamed to rustls
• rustls roots features removed, platform-verifier is used instead
  • To use different roots instead, use tls_certs_only(your_roots).
• Many TLS-related methods renamed, but previous name left in place with a "soft" deprecated (just documented, no warnings).
• query and form are now crate features, disabled by default
• Long-deprecated methods and crate features have been removed.

PRs

• start 0.13 dev by @seanmonstar in start 0.13 dev #2894
• Make serde optional by introducing query, form features, and re-working WASM header parsing by @CathalMullan in Make serde optional by introducing query, form features, and re-working WASM header parsing #2858
• replace ClientBuilder::dns_resolver with dns_resolver2 by @seanmonstar in replace ClientBuilder::dns_resolver with dns_resolver2 #2898
• feat: make Rustls the default TLS provider by @calavera in feat: make Rustls the default TLS provider #2897
• feat: consolidate TLS options with rustls-platform-verifier by @seanmonstar in feat: consolidate TLS options with rustls-platform-verifier #2891
• remove long-deprecated methods: trust-dns and non-wasm-cors by @seanmonstar in remove long-deprecated methods: trust-dns and non-wasm-cors #2899
• rename rustls-tls feature to just rustls by @seanmonstar in rename rustls-tls feature to just rustls #2900
• remove deprecated features trust-dns and macos-system-configuration by @seanmonstar in remove deprecated features trust-dns and macos-system-configuration #2901
• chore: separate rustls and rustls-no-provider features by @seanmonstar in chore: separate rustls and rustls-no-provider features #2903
• rustls: allow windows to use extra roots by @seanmonstar in rustls: allow windows to use extra roots #2904
• v0.13.0-rc.1 by @seanmonstar in v0.13.0-rc.1 #2905

New Contributors

• @CathalMullan made their first contribution in Make serde optional by introducing query, form features, and re-working WASM header parsing #2858

Full Changelog: v0.12.28...v0.13.0-rc.1

---

This discussion was created from the release v0.13.0-rc.1.

[michaelklishin]

I have tried upgrading a not-entirely-trivial library that uses reqwest and it turned out to be very straightforward michaelklishin/rabbitmq-http-api-rs#103.

In part because I already had a non-default list of features but even then, not a single failure across ≈ 250 integration tests.

Nice work!

[decathorpe]

I had (probably wrongly) assumed that this switch would happen with rustls v0.24 (i.e. after rustls/rustls#2395 is resolved) - because I assume adapting to these changes on the rustls side will require more breaking changes in reqwest?

[seanmonstar]

I checked with @djc, and it doesn't seem like the upgrade internally in reqwest will cause any external breakage. reqwest doesn't expose rustls types in its public API. As for whether it will include a crypto provider by default, that also shouldn't be a problem, because reqwest has always claimed to be opinionated and picks defaults. We can continue to include a default provider, and rustls-no-provider would still be available.

Is there anything else you notice that would be disruptive?

[decathorpe]

No - I think that addresses my concerns, thanks!

[paolobarbolini]

axum v0.9 will switch to serde_html_form (see tokio-rs/axum@cae6bc3).

Given that serde_urlencoded has had little maintenance in the last 4 years, this could be a good occasion to switch.
/cc @jplatte

[jplatte]

For clarity:

• this is my crate
• it's a fork of serde_urlencoded that I created to support repeats of the same parameter - as in foo=x&foo=y, which is what browsers send when a form contains a <select name="foo" multiple> with multiple options being selected (and IIRC also in some other situations)
• I just released a new version that removes some deviations from serde_urlencoded
• there should be no cases where it errors when serde_urlencoded succeeds
• it currently depends on indexmap for deserialization (can probably feature-gate this since reqwest only cares about serialization? would be a breaking change, but I don't mind)

[seanmonstar]

I don't think making this change would be breaking, since it would change from erroring to allowing something new. So this can wait.

Though I'm undecided if I want to, there's also been asks to switch to serde_qs, but the lack of a standard has held it back. (foo=x&foo=y vs foo[]=x&foo[]=y vs foo[0]=x&foo[1]=y, etc).

[PlasmaPower]

Is there documentation anywhere of how webpki-roots should be used with reqwest now? In #2885 you mention "For anyone still wanting that, they can call tls_certs_only(webpki_certs)" but it's unclear how this is supposed to work (or if it can work at all), as webpki_roots::TLS_SERVER_ROOTS is an instance of rustls_pki_types::TrustAnchor which does not have the full certificate by design.

[djc]

You'll need to use webpki-root-certs instead of webpki-roots.

[bgw]

This comment was useful, thanks. I ran into the same issue and got stuck, not realizing that there is both webpki-roots and webpki-root-certs.

If anyone wants a code example, here's what I ended up doing: https://github.com/vercel/next.js/pull/88869/changes