Update Rust crate reqwest to 0.13.0 - abandoned#8319
Update Rust crate reqwest to 0.13.0 - abandoned#8319hash-worker[bot] wants to merge 2 commits intomainfrom
reqwest to 0.13.0 - abandoned#8319Conversation
PR SummaryMedium Risk Overview No code changes are included; any impact will come from Reviewed by Cursor Bugbot for commit 09b509b. Bugbot is set up for automated code reviews on this repo. Configure here. |
🤖 Augment PR SummarySummary: Updates the workspace Rust dependency on 🤖 Was this summary useful? React with 👍 or 👎 |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8319 +/- ##
=======================================
Coverage 62.49% 62.49%
=======================================
Files 1318 1318
Lines 134235 134235
Branches 5521 5521
=======================================
+ Hits 83894 83896 +2
+ Misses 49426 49424 -2
Partials 915 915 Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
d683999 to
f4d15d3
Compare
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
reqwest to 0.13.0reqwest to 0.13.0 - autoclosed
Pull request was closed
reqwest to 0.13.0 - autoclosedreqwest to 0.13.0
f4d15d3 to
09b509b
Compare
|
Semgrep found 1 The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. View Dataflow Graphflowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>libs/@local/hashql/compiletest/src/harness/trial/stats.rs</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/hashintel/hash/blob/09b509b7401f864c848d6a790650cf97731c746d/libs/@local/hashql/compiletest/src/harness/trial/stats.rs#L43 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 43] path</a>"]
end
%% Intermediate
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/hashintel/hash/blob/09b509b7401f864c848d6a790650cf97731c746d/libs/@local/hashql/compiletest/src/harness/trial/stats.rs#L43 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 43] path</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
File0:::invis
%% Connections
Source --> Sink
|
|
Semgrep found 1 Risk: Affected versions of axios are vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') / Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') / Server-Side Request Forgery (SSRF). Axios can be used as a gadget for header injection: if another dependency enables prototype pollution, polluted properties can be merged into Axios request headers and written without CRLF sanitization, allowing request smuggling/SSRF that can reach internal services such as AWS IMDSv2 and potentially lead to credential theft or broader compromise. Fix: Upgrade this library to at least version 1.15.0 at hash/yarn.lock:23147. Reference(s): GHSA-fvcv-3m26-pcqx, CVE-2026-40175 Semgrep found 1 Risk: Affected versions of axios are vulnerable to Server-Side Request Forgery (SSRF) / Unintended Proxy or Intermediary ('Confused Deputy'). Axios does not normalize hostnames before applying Manual Review Advice: A vulnerability from this advisory is reachable if you have Fix: Upgrade this library to at least version 1.15.0 at hash/yarn.lock:23147. Reference(s): GHSA-3p68-rc4w-qgx5, CVE-2025-62718 |
09b509b to
45524ce
Compare
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
reqwest to 0.13.0reqwest to 0.13.0 - abandoned
Autoclosing SkippedThis PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error. |
Benchmark results
|
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| resolve_policies_for_actor | user: empty, selectivity: high, policies: 2002 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: medium, policies: 1001 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: high, policies: 3314 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: medium, policies: 1526 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: high, policies: 2078 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: medium, policies: 1033 | Flame Graph |
policy_resolution_medium
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| resolve_policies_for_actor | user: empty, selectivity: high, policies: 102 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: medium, policies: 51 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: high, policies: 269 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: medium, policies: 107 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: high, policies: 133 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: medium, policies: 63 | Flame Graph |
policy_resolution_none
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| resolve_policies_for_actor | user: empty, selectivity: high, policies: 2 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: medium, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: high, policies: 8 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: medium, policies: 3 | Flame Graph |
policy_resolution_small
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| resolve_policies_for_actor | user: empty, selectivity: high, policies: 52 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: medium, policies: 25 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: high, policies: 94 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: medium, policies: 26 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: high, policies: 66 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: medium, policies: 29 | Flame Graph |
read_scaling_complete
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| entity_by_id;one_depth | 1 entities | Flame Graph | |
| entity_by_id;one_depth | 10 entities | Flame Graph | |
| entity_by_id;one_depth | 25 entities | Flame Graph | |
| entity_by_id;one_depth | 5 entities | Flame Graph | |
| entity_by_id;one_depth | 50 entities | Flame Graph | |
| entity_by_id;two_depth | 1 entities | Flame Graph | |
| entity_by_id;two_depth | 10 entities | Flame Graph | |
| entity_by_id;two_depth | 25 entities | Flame Graph | |
| entity_by_id;two_depth | 5 entities | Flame Graph | |
| entity_by_id;two_depth | 50 entities | Flame Graph | |
| entity_by_id;zero_depth | 1 entities | Flame Graph | |
| entity_by_id;zero_depth | 10 entities | Flame Graph | |
| entity_by_id;zero_depth | 25 entities | Flame Graph | |
| entity_by_id;zero_depth | 5 entities | Flame Graph | |
| entity_by_id;zero_depth | 50 entities | Flame Graph |
read_scaling_linkless
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| entity_by_id | 1 entities | Flame Graph | |
| entity_by_id | 10 entities | Flame Graph | |
| entity_by_id | 100 entities | Flame Graph | |
| entity_by_id | 1000 entities | Flame Graph | |
| entity_by_id | 10000 entities | Flame Graph |
representative_read_entity
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1
|
Flame Graph |
representative_read_entity_type
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| get_entity_type_by_id | Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba
|
Flame Graph |
representative_read_multiple_entities
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| entity_by_property | traversal_paths=0 | 0 | |
| entity_by_property | traversal_paths=255 | 1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true | |
| entity_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false | |
| entity_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true | |
| entity_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true | |
| entity_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true | |
| link_by_source_by_property | traversal_paths=0 | 0 | |
| link_by_source_by_property | traversal_paths=255 | 1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true | |
| link_by_source_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false | |
| link_by_source_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true | |
| link_by_source_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true | |
| link_by_source_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true |
scenarios
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| full_test | query-limited | Flame Graph | |
| full_test | query-unlimited | Flame Graph | |
| linked_queries | query-limited | Flame Graph | |
| linked_queries | query-unlimited | Flame Graph |
|
superseded by #8672 |

This PR contains the following updates:
0.12.24->0.13.00.13.3Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
seanmonstar/reqwest (reqwest)
v0.13.2Compare Source
RequestBuilder::json()from override previously set content-type.v0.13.1Compare Source
v0.13.0Compare Source
rustlsis now the default TLS backend, instead ofnative-tls.rustlscrypto provider defaults to aws-lc instead of ring. (rustls-no-providerexists if you want a different crypto provider)rustls-tlshas been renamed torustls.rustls-platform-verifieris used by default.tls_certs_only(your_roots).native-tlsnow includes ALPN. To disable, usenative-tls-no-alpn.queryandformare now crate features, disabled by default.trust-dns, which was renamedhickory-dnsa while ago).tls_backend_rustls()overuse_rustls_tls().v0.12.28
v0.12.27
ClientBuilder::windows_named_pipe(name)option that will force all requests over that Windows Named Piper.v0.12.26
Accept-Encodingheader only with values configured with reqwest, regardless of underlying tower-http config.v0.12.25
Error::is_upgrade()to determine if the error was from an HTTP upgrade.Proxy-Authorizationif only username is configured.Proxy-Authorizationto HTTPS proxies when the target is HTTP.v0.12.24
v0.12.23
ClientBuilder::unix_socket(path)option that will force all requests over that Unix Domain Socket.ClientBuilder::retry(policy)andreqwest::retry::Builderto configure automatic retries.ClientBuilder::dns_resolver2()with more ergonomic argument bounds, allowing more resolver implementations.http3_*options toblocking::ClientBuilder.RequestBuilder.v0.12.22
v0.12.21
socks4a://instead ofsocks4h://.Error::is_timeout()to check for hyper and IO timeouts too.Errorto again include URLs when possible.DefaultforBody.v0.12.20
ClientBuilder::tcp_user_timeout(Duration)option to setTCP_USER_TIMEOUT.Error::is_status().v0.12.19
cookiesfeature is enabled (by the way, it's a noop feature in wasm).v0.12.18
socksenabled without TLS.v0.12.17
v0.12.16
ClientBuilder::http3_congestion_bbr()to enable BBR congestion control.ClientBuilder::http3_send_grease()to configure whether to send use QUIC grease.ClientBuilder::http3_max_field_section_size()to configure the maximum response headers.ClientBuilder::tcp_keepalive_interval()to configure TCP probe interval.ClientBuilder::tcp_keepalive_retries()to configure TCP probe count.Proxy::headers()to add extra headers that should be sent to a proxy.redirect::Policy::limit()which had an off-by-1 error, allowing 1 more redirect than specified.Response::bytes_stream().v0.12.15
ProxyOverrideandNO_PROXY.v0.12.14
fetch_mode_no_cors(), marking as deprecated when not on WASM.v0.12.13
Form::into_reader()for blockingmultipartforms.Form::into_stream()for asyncmultipartforms.RequestBuilder::form()from overwriting a previously setContent-Typeheader, like the other builder methods.blocking::Request.ProxyOverrideas aNO_PROXYvalue.Error::is_timeout()to return true when from a request timeout.v0.12.12
tokio/timeon WASM.v0.12.11
v0.12.10
ClientBuilder::connector_layer()to allow customizing the connector stack.ClientBuilder::http2_max_header_list_size()option.content-length) information when wrapping bodies.v0.12.9
tls::CertificateRevocationListssupport.connection_verbose()to output read logs.multipart::Part::file()to automatically include content-length.v0.12.8
multipart::Form::file()method for adding files easily.Body::wrap()to wrap anyhttp_body::Bodytype.v0.12.7
impl Service<http::Request<_>>forClient.v0.12.6
danger_accept_invalid_hostnamesforrustls.impl Service<http::Request<Body>>forClientand&'_ Client.!Syncbodies inBody::wrap_stream().hickory-dnsis used.Proxyso thatHTTP(S)_PROXYvalues take precedence overALL_PROXY.blocking::RequestBuilder::header()from unsettingsensitiveon passed header values.v0.12.5
blocking::ClientBuilder::dns_resolver()method to change DNS resolver in blocking client.http3feature back, still requiringreqwest_unstable.rustls-tls-no-providerCargo feature to use rustls without a crypto provider.Accept-Encodingheader combinations.v0.12.4
zstdsupport, enabled withzstdCargo feature.ClientBuilder::read_timeout(Duration), which applies the duration for each read operation. The timeout resets after a successful read.v0.12.3
FromStrfordns::Name.ClientBuilder::built_in_webpki_certs(bool)to enable them separately.ClientBuilder::built_in_native_certs(bool)to enable them separately.content-length: 0for GET requests.content_length()to return value when timeout is configured.ClientBuilder::resolve()to use lowercase domain names.v0.12.2
v0.12.1
ClientBuilder::interface()when no TLS is enabled.TlsInfo::peer_certificate()being truncated with rustls.http2feature disabled but TLS negotiated h2 in ALPN.DisplayforErrorto not include its source error.Configuration
📅 Schedule: Branch creation - "before 4am every weekday,every weekend" (UTC), Automerge - "before 4am every weekday,every weekend" (UTC).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.