chore(deps): bump reqwest from 0.12.28 to 0.13.4 in /personal-sysadmin by dependabot[bot] · Pull Request #124 · hyperpolymath/ambientops

dependabot · 2026-05-28T01:43:43Z

Bumps reqwest from 0.12.28 to 0.13.4.

Release notes

v0.13.4

tl;dr

Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.

Add ClientBuilder::http2_keep_alive_* options for the blocking client.

Add TLS 1.3 support when using native-tls backend.

Fix redirect handling to strip sensitive headers when the scheme changes.

Fix HTTP/3 happy-eyeball connection creation.

Upgrade hickory-resolver to 0.26.

What's Changed

fix(tls): improve rustls-no-provider panic message and add module docs by @smythg4 in seanmonstar/reqwest#3021

fix: do not lose the url in error when decoding json by @Dushistov in seanmonstar/reqwest#3026

Add tls_sslkeylogfile builder method by @passcod in seanmonstar/reqwest#2923

fix(redirect): strip sensitive headers on scheme change across redirects by @SAY-5 in seanmonstar/reqwest#3034

chore: upgrade MSRV to 1.85 by @seanmonstar in seanmonstar/reqwest#3038

chore: clean up minimal-versions CI job by @seanmonstar in seanmonstar/reqwest#3039

fix(http3): use happy eyeballs for h3 connect by @lyuzichong in seanmonstar/reqwest#3030

fix: update hickory-resolver to 0.26 and adjust code accordingly by @seanmonstar in seanmonstar/reqwest#3040

fix: remove unwrap in hickory initialization by @mat813 in seanmonstar/reqwest#3041

feat(https): support TLS 1.3 as min version under native-tls 🎉 by @AverageHelper in seanmonstar/reqwest#2975

Expose keep alive configurations in blocking client by @aeb-dev in seanmonstar/reqwest#3043

Prepare v0.13.4 by @seanmonstar in seanmonstar/reqwest#3046

New Contributors

@smythg4 made their first contribution in seanmonstar/reqwest#3021

@Dushistov made their first contribution in seanmonstar/reqwest#3026

@SAY-5 made their first contribution in seanmonstar/reqwest#3034

@mat813 made their first contribution in seanmonstar/reqwest#3041

@AverageHelper made their first contribution in seanmonstar/reqwest#2975

@aeb-dev made their first contribution in seanmonstar/reqwest#3043

Full Changelog: seanmonstar/reqwest@v0.13.3...v0.13.4

v0.13.3

tl;dr

Fix CertificateRevocationList parsing of PEM values.

Fix logging in resolver to only show host, not full URL.

Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.

Fix HTTP/3 to handle STOP_SENDING as not an error.

Fix HTTP/3 pool to remove timed out QUIC connections.

Fix HTTP/3 connection establishment picking IPv4 and IPv6.

Upgrade rustls-platform-verifier.

(wasm) Only use wasm-bindgen on unknown-* targets.

What's Changed

Update docs.rs Features by @JamesWiresmith in seanmonstar/reqwest#2961

fix: fallback to hickory_resolver's default config if reading /etc/resolv.conf fails by @monosans in seanmonstar/reqwest#2797

fix: remove timeout con by @cuiweixie in seanmonstar/reqwest#2967

http3: handle stop_sending without error by @anuraaga in seanmonstar/reqwest#2978

... (truncated)

Changelog

Sourced from reqwest's changelog.

v0.13.4

Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.

Add ClientBuilder::http2_keep_alive_* options for the blocking client.

Add TLS 1.3 support when using native-tls backend.

Fix redirect handling to strip sensitive headers when the scheme changes.

Fix HTTP/3 happy-eyeball connection creation.

Upgrade hickory-resolver to 0.26.

v0.13.3

Fix CertificateRevocationList parsing of PEM values.

Fix logging in resolver to only show host, not full URL.

Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.

Fix HTTP/3 to handle STOP_SENDING as not an error.

Fix HTTP/3 pool to remove timed out QUIC connections.

Fix HTTP/3 connection establishment picking IPv4 and IPv6.

Upgrade rustls-platform-verifier.

(wasm) Only use wasm-bindgen on unknown-* targets.

v0.13.2

Fix HTTP/2 and native-tls ALPN feature combinations.

Fix HTTP/3 to send h3 ALPN.

(wasm) fix RequestBuilder::json() from override previously set content-type.

v0.13.1

Fixes compiling with rustls on Android targets.

v0.13.0

Breaking changes:

rustls is now the default TLS backend, instead of native-tls.

rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)

rustls-tls has been renamed to rustls.

rustls roots features removed, rustls-platform-verifier is used by default.

To use different roots, call tls_certs_only(your_roots).

native-tls now includes ALPN. To disable, use native-tls-no-alpn.

query and form are now crate features, disabled by default.

Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).

Many TLS-related methods renamed to improve autocompletion and discovery, but previous name left in place with a "soft" deprecation. (just documented, no warnings)

For example, prefer tls_backend_rustls() over use_rustls_tls().

Commits

11489b3 v0.13.4
d31ffbb feat: Expose HTTP2 keep alive configurations in blocking client (#3043)
79ed0d7 feat: support TLS 1.3 as min version under native-tls 🎉 (#2975)
fb7bf6a fix: remove unwrap in hickory initialization (#3041)
3da616f fix: update hickory-resolver to 0.26 and adjust code accordingly (#3040)
c77e7b2 fix(http3): use happy eyeballs for h3 connect (#3030)
9cbb65b chore: clean up minimal-versions CI job (#3039)
17a7dc5 chore: upgrade MSRV to 1.85 (#3038)
03db63a fix(redirect): strip sensitive headers on scheme change across redirects (#3034)
4b813a8 feat: add tls_sslkeylogfile builder method (#2923)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [reqwest](https://github.com/seanmonstar/reqwest) from 0.12.28 to 0.13.4. - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](seanmonstar/reqwest@v0.12.28...v0.13.4) --- updated-dependencies: - dependency-name: reqwest dependency-version: 0.13.4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

….13.4

…andards#301) (#153) ## Summary - Adds the canonical estate `ignore: dependency-name "*" version-update:semver-major` block to each non-github-actions ecosystem entry in `.github/dependabot.yml` - 9 entries get the ignore (5 cargo: root + czech-file-knife + panoptes + personal-sysadmin + displace; mix; npm; pip; nix). github-actions is left as-is per estate doc — SHA pins make action majors safe. - Brings ambientops into conformance with standards#301 / docs/DEPENDABOT-POLICY.adoc ## Context Per the 2026-05-29 echidna incident (#120-#124 broke main for ~24h), unattended dependabot semver-major merges fly through the estate validation gates (K9 / A2ML / language-policy) but break the actual compile gates on subsequent pushes. Estate policy now: majors land via author-supplied PRs paired with call-site updates. This PR closes 7 risky in-flight dependabot PRs as superseded: - #147 reqwest 0.12.28→0.13.4 (0.x minor breaking) - #145 config 0.14.1→0.15.23 (0.x minor breaking, multi-version) - #144 symphonia 0.5.5→0.6.0 (0.x minor breaking) - #146 thiserror 1.0.69→2.0.18 (major) - #142 colored 2.2.0→3.1.1 (major) - #136 rusqlite 0.31.0→0.40.0 (0.x huge jump) - #135 nix 0.30.1→0.31.3 (0.x minor breaking) Each needs a paired code-side migration that hasn't been done; this PR parks them safely via the canonical policy. ## Test plan - [ ] dependabot config check passes (YAML valid) - [ ] CI green (existing gates) - [ ] After merge, dependabot does not re-file the 7 closed PRs

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels May 28, 2026

hyperpolymath approved these changes May 29, 2026

View reviewed changes

Merge branch 'main' into dependabot/cargo/personal-sysadmin/reqwest-0…

ef14da0

….13.4

hyperpolymath merged commit 9cd1139 into main May 29, 2026
21 of 23 checks passed

hyperpolymath deleted the dependabot/cargo/personal-sysadmin/reqwest-0.13.4 branch May 29, 2026 00:26

hyperpolymath mentioned this pull request May 30, 2026

chore(deps): apply estate dependabot policy — ignore semver-major (standards#301) #153

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump reqwest from 0.12.28 to 0.13.4 in /personal-sysadmin#124

chore(deps): bump reqwest from 0.12.28 to 0.13.4 in /personal-sysadmin#124
hyperpolymath merged 2 commits into
mainfrom
dependabot/cargo/personal-sysadmin/reqwest-0.13.4

dependabot Bot commented on behalf of github May 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 28, 2026

v0.13.4

tl;dr

What's Changed

New Contributors

v0.13.3

tl;dr

What's Changed

v0.13.4

v0.13.3

v0.13.2

v0.13.1

v0.13.0

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant