I don't understand why we need rustls-webpki even though it's not used in the code

It's a transitive dependency (ureq depends on rustls, which depends on rustls-webpki). Adding an it as an explicit dependency tells Cargo's version resolver to use that version as the minimum, which is higher than what it would otherwise have chosen.

Let's merge this before we get any further Dependabot e-mails.

It's a transitive dependency (ureq depends on rustls, which depends on rustls-webpki). Adding an it as an explicit dependency tells Cargo's version resolver to use that version as the minimum, which is higher than what it would otherwise have chosen.

It's not really necessary to add it. You can just run cargo update -p rustls-webpki to bump the transitive dep in Cargo.lock. This will not affect library consumers, but those would be expected to update their own lock files.

Let's remove it next time we update Cargo.toml then, as it's not causing any issue right now.