build(deps): refresh the lockfile and move the Bugzilla client to reqwest 0.13 - #64
Merged
Conversation
A plain `cargo update` (not `--workspace`) moves 19 packages, all semver-compatible, with no manifest edit required. `matchit` and `reqwest` stay held back behind a semver-major boundary -- axum pins `matchit = "=0.8.4"` exactly, and the reqwest 0.13 move is a separate, behavior-changing PR per AGENTS.md's one-logical-change rule. Two of the moves are not boring enough to wave through: - `darling` 0.23 -> 0.24 now requires exactly rustc 1.88.0, the workspace's declared MSRV. There is zero headroom left: the next darling MSRV bump, however it arrives, breaks the rust-msrv job. Recorded here rather than silently absorbed, since it changes what "at MSRV" means for this workspace's proc-macro host compiler. - `rmcp`/`rmcp-macros` 3.1.0 -> 3.1.1 touch tool-handler context and list_tools cache hints, both areas the rmcp usage notes reason about explicitly. Reviewed against the 3.1.1 source in the local registry: `ListToolsResult`'s field set (result_type, meta, next_cursor, ttl_ms, cache_scope, tools) is unchanged, so the hand-written struct literal in list_tools stays exhaustive and correct; every StreamableHttpServerConfig field is still the ten already tabulated; and message_has_per_request_protocol_version / skips_the_handshake still route on mere presence of the `_meta` key, not on which revision it names. The three stale rmcp-3.1.0 citations in the usage notes are updated to 3.1.1 accordingly. clap/clap_complete/clap_mangen also move, which feeds the committed man page and shell completions that rust-assets-drift gates on CI. Regenerated them with bugwarden-gen and the tree came back byte-identical, as expected -- this CLI hand-writes its own synopsis and uses none of the clap_mangen 0.3.1/0.3.2 synopsis changes. Verified: cargo fmt --check, cargo clippy --workspace --all-targets and cargo clippy -p bugwarden --features gen --all-targets (both -D warnings), cargo test --workspace --all-targets --locked (all green, including the guard/list_tools/handshake/http-transport suites called out for extra scrutiny), cargo deny check and cargo audit (both clean, with the same five pre-existing duplicate-version warnings as before the update and no new ones).
The shipped binary linked reqwest 0.12 exclusively; 0.13 was already in the graph through rmcp's dev-facing `reqwest` feature and this workspace's own test dependencies. That duplication cost only test-build time, but it meant the test process linked both rustls crypto providers at once (ring via 0.12, aws-lc-rs via 0.13) -- the classic rustls 0.23 "no process-level CryptoProvider" ambiguity, sitting there waiting to be tripped by an unrelated change. Three of reqwest 0.13's breaking changes land directly on bugwarden-core/src/client.rs: - `query` is now opt-in. `apply_auth`'s `?api_key=` mode and quicksearch_syntax_html both call `.query(...)` -- without the feature this is a compile error on the API-key path, so it has to be added, not routed around. - `rustls-tls` is renamed `rustls`, and the new feature pulls rustls-platform-verifier: trust anchors move from the bundled Mozilla webpki-roots set to the OS trust store, and the default crypto provider becomes aws-lc-rs instead of ring. For a Bugzilla instance behind a corporate or internal CA this is usually the better default, but it is operator-visible, so it is recorded in both the module doc comment and a new DESIGN.md paragraph rather than absorbed silently as a feature rename. - `system-proxy` becomes a feature. bugwarden-core already builds with `default-features = false`, and 0.12 honored `HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY` unconditionally; migrating without adding this feature would silently stop honoring them in exactly the proxied corporate networks this server targets. Added alongside `query`, `json` and `rustls`. `Error::without_url()` is unchanged, so I12's sanitization holds as written; the existing `api_key_absent_from_transport_error_i12` test already drives the query-path key (BugzillaClient::new(.., false, ..) selects query auth), so no new test was needed to cover it. The `Client::builder().timeout().user_agent().build()` call site in client.rs needed no changes -- the 0.13 builder renames are soft-deprecated, not breaking. bugwarden's own dev-dependency on reqwest 0.13 (used directly by http_transport_wiremock.rs for its bare-metal HTTP assertions) stays: its feature set (`rustls` only) is a strict subset of bugwarden-core's, so it does not reintroduce a second lockfile entry -- `cargo tree -p bugwarden -e normal` and the lockfile itself now show exactly one `reqwest` version, down from the pre-existing 0.12/0.13 pair. Verified: cargo fmt --check, both clippy invocations, cargo test --workspace --all-targets --locked (all green, guard_wiremock's I12 tests and user_agent_wiremock included), cargo deny check and cargo audit (both clean; aws-lc-sys's license set needed no new deny.toml entry because it was already reachable through the pre-existing reqwest 0.13 dev/test dependency), and `cargo build --release --locked -p bugwarden` on aarch64-apple-darwin. The x86_64-unknown-linux-gnu release leg was not built locally (no Linux toolchain on this machine); CI's ubuntu-latest `rust` job already compiles this same graph, including aws-lc-sys, on every push, so that leg is validated before merge but was not separately reproduced here.
3 tasks
plusky
pushed a commit
that referenced
this pull request
Aug 7, 2026
PR #64 moved bugwarden-core to reqwest 0.13, switching Bugzilla's certificate validation from bundled webpki-roots to the OS trust store via rustls-platform-verifier. DESIGN.md documented the upside only; an operator building a scratch/distroless image got a TLS handshake error with nothing pointing at the missing CA bundle, and the C-toolchain build requirement and proxy behavior were undocumented for README readers. Extend the DESIGN.md TLS paragraph with the failure mode, the operator's fix (install ca-certificates or mount the host bundle), and the bundled-roots alternative considered and rejected. Add a README 'TLS trust anchors and proxies' subsection under Installation with the same facts in current-state framing plus a copy-pasteable Containerfile snippet, and note the aws-lc-sys C-toolchain requirement in the From-source section. Closes #65.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two self-contained commits, reviewed and verified independently (each
builds/tests/lints clean on its own):
build(deps): refresh the lockfile to latest compatible versions—a plain
cargo update(19 semver-compatible packages), with thermcp 3.1.0 -> 3.1.1 bump reviewed against its actual source
(
ListToolsResult's field set,StreamableHttpServerConfig'sfield table, and the
_meta-presence routing trap are allunchanged) and the packaged man page / completions regenerated
(byte-identical).
matchitandreqwestare correctly held backbehind their semver-major boundaries.
build(core): move the Bugzilla client to reqwest 0.13— adds thenow-opt-in
queryfeature (required by the?api_key=auth path),renames
rustls-tlstorustls(adopting reqwest 0.13's newdefault: aws-lc-rs crypto provider + OS trust store via
rustls-platform-verifier, instead of ring + bundledwebpki-roots), and adds
system-proxysoHTTPS_PROXY/HTTP_PROXY/NO_PROXYstay honored. This also collapses thepre-existing reqwest 0.12/0.13 duplicate-version pair in the
lockfile down to one.
DESIGN.md invariants touched
Error::without_url()is unchanged in 0.13; the existingapi_key_absent_from_transport_error_i12test already drives thequery-based auth path (BugzillaClient::new(.., false, ..)), sono new test was needed.
trust anchor moves from bundled Mozilla
webpki-rootsto the OStrust store, and the crypto provider moves from
ringtoaws-lc-rs. Recorded inbugwarden-core/src/lib.rsand a newDESIGN.md paragraph. Deliberate and, for a Bugzilla instance behind
a corporate/internal CA, an improvement — but it is a real behavior
change from the previous release, not a transparent dependency bump.
Verification (both commits, independently)
cargo fmt --checkcargo clippy --workspace --all-targets -- -D warningscargo clippy -p bugwarden --features gen --all-targets -- -D warningscargo test --workspace --all-targets --locked(all green, 357tests; guard/attachment/user_agent wiremock suites specifically
checked)
cargo deny check/cargo audit(clean; no new duplicate-versionwarnings beyond what already existed;
aws-lc-sys's license wasalready allowed via the pre-existing reqwest 0.13 dev/test
dependency, so no
deny.tomlchange is needed)cargo build --release --locked -p bugwardenonaarch64-apple-darwinNot verified locally
cargo +1.88 build --workspace --locked(mirrorsrust-msrv): no1.88 toolchain available on the machine this was built on; deferred
to CI.
x86_64-unknown-linux-gnurelease leg: no Linux toolchainavailable locally. CI's
ubuntu-latestrustjob already compilesthis same dependency graph (including
aws-lc-sys) on every push,so this is validated by CI on this PR before merge.