Update Reqwest to `0.13.1` by salmonsd · Pull Request #17543 · astral-sh/uv

salmonsd · 2026-01-16T22:20:41Z

Summary

This PR improves the TLS experience by upgrading reqwest to 0.13.1 via #17427

It adds support for three TLS backends via a new hidden --tls-backend flag:

rustls-webpki — bundled Mozilla roots from webpki-root-certs (default)
rustls — platform/system verifier via rustls-platform-verifier
native-tls — native system TLS stack

Custom certificates from SSL_CERT_FILE/SSL_CERT_DIR are merged unconditionally into the root store across all backends using reqwest::tls_merge_certs(), ensuring consistent support in corporate or CI setups without backend-specific gating.

The --native-tls flag and UV_NATIVE_TLS env var are retained for compatibility, mapping to the native-tls backend.

Motivation

reqwest 0.13.1 defaults to rustls as its TLS backend w/ platform verification and removes built-in webpki-roots, and moves its default crypto provider to aws-lc instead of ring (increasing the number of cert signature algos supported) to improve TLS experience.

Changes

Dependency updates
- reqwest → 0.13.1 (pinned)
- reqsign → 0.19.0
- Added direct dependency on webpki-root-certs
- Update to use Reqwest 0.13.1 reqwest-middleware#11
- build: update reqwest to 0.13.1 ambient-id#21
  - ambient-id 0.0.11 ambient-id#31
- build: update Reqwest to 0.13.1 async_http_range_reader#3
TLS backend selection
- Hidden --tls-backend flag: rustls-webpki | rustls | native-tls
- --native-tls preserved (with explicit conflict handling)
- UV_NATIVE_TLS env var maps to native-tls backend
- Default: rustls-webpki
Certificate handling
- Load base roots via webpki-root-certs
- Use reqwest::tls_certs_only to initialize the root store with bundled certs
- Merge custom certs from SSL_CERT_FILE/SSL_CERT_DIR using tls_merge_certs
- Merging is applied unconditionally (no backend gating)
- Reuses reqwest's certificate merging machinery → avoids custom root store or TLS config management
Refactoring & cleanup
- Centralized logic in uv-client/base_client.rs and uv-client/ssl_certs.rs
- Removed dead test code
- Added accept-encoding: identity in registry_client.rs where required
Documentation
- Updated certificates.md:
  - Describes new backends + default
  - Recommends usage patterns (e.g. rustls-webpki for consistency, native-tls for proxies)
  - Explains SSL_CERT_* behavior and migration notes
Testing
- 7 new/expanded tests in uv-client/tests/ssl_certs.rs (loading, precedence, all backends)
- Updated nextest.toml with SSL test profile override
- Refreshed subcommand snapshots

Trade-offs & Future Work

Using webpki-root-certs + tls_certs_only + tls_merge_certs keeps maintenance low and avoids re-implementing root store logic
Manual merging adds control and reduces risk of drift from reqwest internals
--native-tls retained for smooth transition; long-term plan is deprecation
Planned follow-ups:
- Promote --tls-backend to visible/stable
- Introduce --system-certs / --no-system-certs aliases (preview)
- Switch default to rustls (platform verifier) in a future breaking release
- Deprecate --native-tls and UV_NATIVE_TLS

salmonsd · 2026-01-16T22:34:20Z

Will work on failing tests (apologies)

crates/uv-client/src/base_client.rs

musicinmybrain · 2026-01-26T09:53:28Z

We can now also update reqsign to 0.19.0, apache/opendal-reqsign@v0.18.1...v0.19.0, which will remove another user of reqwest 0.12 from the dependency tree.

salmonsd · 2026-01-26T17:17:00Z

We can now also update reqsign to 0.19.0, apache/opendal-reqsign@v0.18.1...v0.19.0, which will remove another user of reqwest 0.12 from the dependency tree.

thanks @musicinmybrain, was waiting for the official release!

Only thing to watch for is axoupdater and the update to axoasset (issue here) to also use reqwest 0.13 to be completely resolved.

salmonsd · 2026-01-29T16:57:23Z

Hey @zanieb, wanted to check-in and see if y'all have a plan for this or if there's anything I can do to help to get this implemented?

zanieb · 2026-02-04T16:14:46Z

crates/uv-cli/src/lib.rs


-    /// Whether to load TLS certificates from the platform's native store [env: UV_NATIVE_TLS=]
+    /// Whether to use the native-tls TLS backend instead of rustls [env: UV_NATIVE_TLS=]
    ///
-    /// By default, uv loads certificates from the bundled `webpki-roots` crate. The
-    /// `webpki-roots` are a reliable set of trust roots from Mozilla, and including them in uv
-    /// improves portability and performance (especially on macOS).
+    /// By default, uv uses the rustls TLS backend, which loads certificates from the platform's
+    /// native certificate store via the `rustls-platform-verifier` crate. This provides a good
+    /// balance of portability and performance across platforms.
    ///
-    /// However, in some cases, you may want to use the platform's native certificate store,
-    /// especially if you're relying on a corporate trust root (e.g., for a mandatory proxy) that's
-    /// included in your system's certificate store.
+    /// However, in some cases, you may want to use the native-tls backend instead, which uses
+    /// the platform's native TLS implementation (e.g., SChannel on Windows, Secure Transport on
+    /// macOS, OpenSSL on Linux).
    #[arg(global = true, long, value_parser = clap::builder::BoolishValueParser::new(), overrides_with("no_native_tls"))]
    pub native_tls: bool,


Hm this is a bit different than what I'd expect. This means that

We now use system certificates by default

There's no way to for users to recover using webpki-riots

Right?

For users, --native-tls was a way to opt-in to reading certificates from the system. I think we'll probably need to make more changes here.

I presume there's a way to recover the webpki-roots behavior?

I think the ideal rollout plan for us is probably something like

Here:

Upgrade to the latest reqwests version

Continue using webpki-roots by default

Add --tls-backend <native-tls|rusttls> to allow choosing the tls backend

Next:

Add rusttls preview feature which uses rusttls instead of native-tls

Next (breaking):

Stabilize using rusttls by default

Next:

Add system-certs-default preview feature which uses system certificates instead of webpki roots

Deprecate --native-tls in favor of --system-certs and --no-system-certs

Next (breaking):

Stabilize the preview behavior

I can look into this more. Looks like webpki-roots is an optional dependency in 0.13.1 but they were removed here in a subsequent commit that hasn't been released yet.

I'll look into it a bit too. We can just depend on webpki-roots directly, I presume?

It's unfortunate the rollout needs to be so many steps but alas that's the way things need to be since we're so widely used.

Yep, we can totally depend on it directly. And totally understand attempting to keep as much existing functionality as possible while allowing for incremental improvements.

So here's what I have as immediate requirements:

depend on webpki-roots directly and support it as default

keep existing --native-tls flag?

add new --tls-backend (hidden?) flag (add support for conflicts_with)

that flag can flex between native-tls and rustls w/ rustls-platform-verifier

Good news, implementation should be manageable (more so than I originally thought). After reviewing the release notes for reqwest, we have the following:

rustls roots features removed, rustls-platform-verifier is used by default.
To use different roots, call tls_certs_only(your_roots)

I'll work to get this implemented.

Scratch that. tls_certs_only() would only work with webpki-root-certs (full X.509 certs) vs webpki-roots (TrustAnchor objects).

So we'll go the route of implementing a rustls config:

use rustls::RootCertStore; // Create a root certificate store, webpki-roots into the store let mut root_store = RootCertStore::empty(); root_store.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned()); // Build a rustls ClientConfig with the root store let mut tls_config = rustls::ClientConfig::builder() .with_root_certificates(root_store) // Use the preconfigured TLS config with reqwest let client = reqwest::Client::builder() .tls_backend_preconfigured(tls_config) .build()?;

Here's the sample webpki-root-certs implementation:

let certs: Result<Vec<reqwest::Certificate>, _> = webpki_root_certs::TLS_SERVER_ROOT_CERTS .iter() .map(|cert_der| reqwest::Certificate::from_der(cert_der)) .collect(); let certs = certs?; let client = reqwest::Client::builder() .tls_backend_rustls() .tls_certs_only(certs) .build()?;

@zanieb ended up going the tls_certs_only() route. I've made comments throughout, let me know what you think.

crates/uv-client/src/base_client.rs

konstin · 2026-02-09T17:19:56Z

All dependency updates are merged and published.

salmonsd · 2026-02-10T17:04:36Z

rebased onto uv 0.10.1 and this commit: 976a368

will work to implement these suggestions: #17543 (comment)

Cargo.toml

salmonsd · 2026-02-18T03:11:27Z

crates/uv-client/src/base_client.rs

+            TlsBackend::Rustls => {
+                let client_builder = client_builder.tls_backend_rustls();
+                // Merge custom certificates for rustls with platform-verifier
+                if !custom_certs.is_empty() {
+                    client_builder.tls_certs_merge(custom_certs.to_vec())
+                } else {
+                    client_builder
+                }
+            }


Decided to keep this in via TlsBackend since it will be under the hidden flag.

salmonsd · 2026-02-18T03:39:32Z

crates/uv-client/src/base_client.rs

+            TlsBackend::RustlsWebpki => {
+                // Convert webpki-root-certs to reqwest::Certificate objects
+                let webpki_certs: Vec<Certificate> = webpki_root_certs::TLS_SERVER_ROOT_CERTS
+                    .iter()
+                    .filter_map(|cert_der| Certificate::from_der(cert_der).ok())
+                    .collect();
+
+                let client_builder = client_builder
+                    .tls_backend_rustls()
+                    .tls_certs_only(webpki_certs);
+
+                // Merge custom certificates on top of webpki-root-certs
+                if !custom_certs.is_empty() {
+                    client_builder.tls_certs_merge(custom_certs.to_vec())
+                } else {
+                    client_builder
+                }
+            }


Ended up using webpki-root-certs here, instead of webpki-roots.

Three reasons:

While slightly larger in size, webpki-root-certs allows to use the new rustls backend, but only with the certs we pass thanks to tls_certs_only. I think this is a better and less complex implementation that still meets our default needs from the previous version.

With webpki-roots, we'd have to pull in rustls, as well, to configure our own RootCertStore to store certs (in addition to auth, cert trust, SNI, ALPN), so that we can use with reqwest's tls_backend_preconfigured method.

Due to tls_backend_preconfigured requiring a TlsConfig, we'd having to parse through the custom cert env vars again to add them to our cert store and handling mTLS inside the building of the root store. While I could have spent some time to find a way a solution, I think this approach is clean.

salmonsd · 2026-02-18T03:42:54Z

crates/uv-client/src/registry_client.rs

+            // Specify identity encoding to prevent double compression from async_http_range_reader and reqwest
+            headers.insert(
+                reqwest::header::ACCEPT_ENCODING,
+                reqwest::header::HeaderValue::from_static("identity"),
+            );


More info here: astral-sh/async_http_range_reader#3 (comment)

salmonsd · 2026-02-18T03:48:45Z

crates/uv/tests/it/run.rs

+    let script = context.temp_dir.child("term_signal.py");
    script.write_str(indoc! {r"
        import os
-        os.kill(os.getpid(), 11)
+
+        os.kill(os.getpid(), 15)
    "})?;
    let status = context.run().arg(script.path()).status()?;
-    assert_eq!(status.code().expect("a status code"), 139);
+    assert_eq!(status.code().expect("a status code"), 143);


Had some issues with this test hanging. Ran this code in my REPL, where it also hung. Open to suggestions.

What is your system? I've never heard of it hanging

yea, it seemed fishy from the jump, but ended up reverting it here after a successful re-run: 27d53ce

crates/uv-test/src/lib.rs

salmonsd · 2026-02-18T03:55:10Z

crates/uv/src/commands/self_update.rs

 use tracing::debug;

-use uv_client::{BaseClientBuilder, WrappedReqwestError};
+use uv_client::BaseClientBuilder;


This removal is related to axoupdater (and depedent axoasset) on an older version of reqwest.

Related:

Support reqwest >= 0.13.0, update feature rustls axodotdev/axoasset#384

Update reqwest to 0.13 axodotdev/axoasset#395

salmonsd · 2026-02-18T03:57:04Z

crates/uv/tests/it/show_settings.rs

            connectivity: Online,
            offline: Disabled,
-            native_tls: false,
+            tls_backend: RustlsWebpki,


Might be overkill, but wanted to show new tls_backend setting working.

konstin · 2026-02-19T08:44:31Z

CI is currently failing because we introduced an openssl dependency.

salmonsd · 2026-02-19T19:59:39Z

CI is currently failing because we introduced an openssl dependency.

I've pushed this commit: salmonsd@93de71f

PR isn't updating for some reason.

…registry_client.rs for cargo build

…ent update

…tp_sync_reader

This reverts commit 2b18f63.

zanieb self-assigned this Jan 16, 2026

salmonsd commented Jan 20, 2026

View reviewed changes

crates/uv-client/src/base_client.rs Outdated Show resolved Hide resolved

salmonsd force-pushed the update-reqwest-tls branch from 9bdfe48 to ec325cf Compare January 28, 2026 21:46

zanieb reviewed Feb 4, 2026

View reviewed changes

crates/uv-client/src/base_client.rs Outdated Show resolved Hide resolved

zanieb reviewed Feb 4, 2026

View reviewed changes

crates/uv-client/src/base_client.rs Outdated Show resolved Hide resolved

zanieb reviewed Feb 4, 2026

View reviewed changes

crates/uv-client/src/base_client.rs Outdated Show resolved Hide resolved

zanieb mentioned this pull request Feb 4, 2026

Upgrade reqwest #17862

Draft

salmonsd mentioned this pull request Feb 10, 2026

Update Rust crate reqsign to 0.19.0 #17935

Open

1 task

salmonsd force-pushed the update-reqwest-tls branch from 311d8ac to 9694a89 Compare February 10, 2026 17:02

konstin reviewed Feb 11, 2026

View reviewed changes

Cargo.toml Show resolved Hide resolved

salmonsd force-pushed the update-reqwest-tls branch from 9694a89 to 2b18f63 Compare February 17, 2026 17:10

salmonsd commented Feb 18, 2026

View reviewed changes

crates/uv-test/src/lib.rs Outdated Show resolved Hide resolved

salmonsd commented Feb 18, 2026

View reviewed changes

salmonsd requested review from konstin and zanieb February 18, 2026 04:00

salmonsd force-pushed the update-reqwest-tls branch from 27d53ce to 1aae7bf Compare February 19, 2026 15:52

konstin added the enhancement New feature or improvement to existing functionality label Feb 19, 2026

salmonsd added 26 commits February 19, 2026 14:07

update uv/Cargo.toml dependencies uv-client/base_client.rs uv-client/…

9e06cfe

…registry_client.rs for cargo build

update uv-client/base_client.rs to enable support for SSL_CERT_* vars

84c6ced

refactor uv-client/ssl_certs.rs and add 7 new test cases for base_cli…

c7d518a

…ent update

remove dead_code no longer needed from uv-client/tests/ssl_certs.rs

6e52732

update nextest.toml add profile override for ssl_certs

7d20485

update certificates.md to reflect new TLS backend

916e5c1

update for new native-tls flag backend

589db7a

update uv/Cargo.toml remove unintentionl patches commit

7482780

update certificates.md prettier

0d3b6e3

cargo fmt

1a3ceb0

update reqsign to 0.19.0

9cee197

fix: remove line comments

383c95f

fix: update base_client.rs to use continue

881bff8

update registry_client.rs to pass accept identiy encoding to async_ht…

58727bb

…tp_sync_reader

update cargo.toml w/ published updated dependencies

8a4c11a

configure tls backend with webpki-root-certs

3cf87e6

update commands with tlsbackend

71c0e45

update tests

0a043df

harden run::exit_status_signal test

81373a8

cargo fmt

335c5e9

pin reqwest, commit lock

6949fde

add debug cert message to insta filters

c8151ca

cargo fmt

c126eb5

update subcommand snapshots

fb68db3

Revert "harden run::exit_status_signal test"

a489d7a

This reverts commit 2b18f63.

use native-tls-vendored to build openssl from source

9026d31

salmonsd force-pushed the update-reqwest-tls branch from 93de71f to 9026d31 Compare February 19, 2026 20:10

Conversation

salmonsd commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Motivation

Changes

Trade-offs & Future Work

Uh oh!

salmonsd commented Jan 16, 2026

Uh oh!

Uh oh!

musicinmybrain commented Jan 26, 2026

Uh oh!

salmonsd commented Jan 26, 2026

Uh oh!

salmonsd commented Jan 29, 2026

Uh oh!

zanieb Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

salmonsd Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

salmonsd Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

konstin commented Feb 9, 2026

Uh oh!

salmonsd commented Feb 10, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

salmonsd Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

konstin commented Feb 19, 2026

Uh oh!

salmonsd commented Feb 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Comments

salmonsd commented Jan 16, 2026 •

edited

Loading

zanieb Feb 4, 2026 •

edited

Loading

salmonsd Feb 4, 2026 •

edited

Loading

salmonsd Feb 4, 2026 •

edited

Loading

salmonsd Feb 18, 2026 •

edited

Loading