build(deps): bump reqwest to 0.13, refresh dependencies#65
Conversation
- reqwest 0.12 -> 0.13: the `rustls-tls` feature was removed in 0.13, which broke dependency resolution in CI - 0.13's `rustls` feature hardwires the aws-lc-rs provider (C FFI, awkward for the musl static build), so use `rustls-no-provider` and install ring as the process default provider in the JWKS client, keeping the pure-Rust default and dropping aws-lc-rs from the tree - roots now resolve via rustls-platform-verifier (system store with bundled Mozilla roots as fallback) - refresh anyhow, envoy-types, getrandom and transitive deps Supersedes #62.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughSummary by CodeRabbit
Walkthrough
ChangesTLS Provider Wiring
Estimated code review effort🎯 2 (Simple) | ⏱️ ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Cargo.toml`:
- Around line 72-78: The JWKS client setup currently relies on the platform
verifier and does not add any custom roots, which can break in musl or minimal
images. Update the dependency/configuration around reqwest and rustls so the
JWKS trust store is explicit, using the relevant JWKS initialization path in
JwksCache::new and the rustls-no-provider setup. If explicit roots are not being
added, document that a system CA bundle is required for those environments.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: c3affa94-ae22-4b1e-a4be-cf362214a014
📒 Files selected for processing (2)
Cargo.tomlsrc/auth/jwks.rs
|
| Filename | Overview |
|---|---|
| Cargo.toml | Bumps reqwest 0.12→0.13, replaces removed rustls-tls feature with rustls-no-provider, adds explicit rustls 0.23 (ring + tls12) and webpki-roots 1 dependencies; no breaking API changes to dependents. |
| src/auth/jwks.rs | Adds build_tls_config() to construct a per-config rustls ClientConfig using the ring provider and bundled Mozilla roots, then passes it via tls_backend_preconfigured — eliminates the previous process-global install_default() side effect cleanly. |
Reviews (2): Last reviewed commit: "fix(auth): pin self-contained rustls TLS..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
reqwest 0.13's rustls-no-provider leaves the client on the platform verifier with no bundled roots, which breaks TLS to the JWKS endpoint on musl / scratch / distroless images that ship no system CA bundle. It also required installing a process-global ring provider as a side effect of the JwksCache constructor, an ordering hazard for library/test callers. Hand reqwest a fully preconfigured rustls ClientConfig instead: the ring provider is set per-config (no global install_default) and Mozilla's root store is bundled via webpki-roots, restoring reqwest 0.12's self-contained behaviour. Verified the exact config path handshakes against a live JWKS endpoint.
|
@coderabbitai review |
✅ Action performedReview finished.
|
1 participant
Summary
Updates dependencies (including the major
reqwestbump) and fixes the resulting API/feature changes so the workspace builds cleanly. Supersedes #62, which bumpedreqwestto 0.13 without adapting the removedrustls-tlsfeature and so failed CI at thecargo metadatastage.Changes
reqwest0.12 → 0.13. Therustls-tlsfeature was removed in 0.13 (root cause of the chore(deps): update reqwest requirement from 0.12 to 0.13 #62 failure).rustlsfeature hardwires the aws-lc-rs provider (C FFI, awkward for thex86_64-unknown-linux-muslstatic build). Switched torustls-no-providerand keep the pure-Rust ring provider —aws-lc-rsis gone from the dependency tree entirely.ClientConfig: ring provider set per-config (no process-globalinstall_defaultside effect) and Mozilla's root store bundled viawebpki-roots. This keeps the binary self-contained — no system CA bundle needed — so it works on musl / scratch / distroless images, matching reqwest 0.12's oldrustls-tlsbehaviour.anyhow,envoy-types,getrandomand transitive deps.No public API change.
Testing
cargo build/cargo nextest run✅ 132/132cargo check --features redis✅cargo check --no-default-features --features aws_lc_rs✅RUSTFLAGS=-Dwarnings cargo clippy --all-targets✅ no warningscargo fmt --check✅cargo deny check advisories✅cargo publish --dry-run✅aws-lc-rsis gone from the tree;ringis the sole crypto providerCloses #62