Update Reqwest to `0.13.1` by salmonsd · Pull Request #17543 · astral-sh/uv

salmonsd · 2026-01-16T22:20:41Z

Summary

This PR improves the TLS experience by upgrading reqwest to 0.13.1 via #17427

It adds support for three TLS backends via a new hidden --tls-backend flag:

rustls-webpki — bundled Mozilla roots from webpki-root-certs (default)
rustls — platform/system verifier via rustls-platform-verifier
native-tls — native system TLS stack

Custom certificates from SSL_CERT_FILE/SSL_CERT_DIR are merged unconditionally into the root store across all backends using reqwest::tls_merge_certs(), ensuring consistent support in corporate or CI setups without backend-specific gating.

The --native-tls flag and UV_NATIVE_TLS env var are retained for compatibility, mapping to the native-tls backend.

Motivation

reqwest 0.13.1 defaults to rustls as its TLS backend w/ platform verification and removes built-in webpki-roots, and moves its default crypto provider to aws-lc instead of ring (increasing the number of cert signature algos supported) to improve TLS experience.

Changes

Dependency updates
- reqwest → 0.13.1 (pinned)
- reqsign → 0.19.0
- Added direct dependency on webpki-root-certs
- Update to use Reqwest 0.13.1 reqwest-middleware#11
- build: update reqwest to 0.13.1 ambient-id#21
  - ambient-id 0.0.11 ambient-id#31
- build: update Reqwest to 0.13.1 async_http_range_reader#3
TLS backend selection
- Hidden --tls-backend flag: rustls-webpki | rustls | native-tls
- --native-tls preserved (with explicit conflict handling)
- UV_NATIVE_TLS env var maps to native-tls backend
- Default: rustls-webpki
Certificate handling
- Load base roots via webpki-root-certs
- Use reqwest::tls_certs_only to initialize the root store with bundled certs
- Merge custom certs from SSL_CERT_FILE/SSL_CERT_DIR using tls_merge_certs
- Merging is applied unconditionally (no backend gating)
- Reuses reqwest's certificate merging machinery → avoids custom root store or TLS config management
Refactoring & cleanup
- Centralized logic in uv-client/base_client.rs and uv-client/ssl_certs.rs
- Removed dead test code
- Added accept-encoding: identity in registry_client.rs where required
Documentation
- Updated certificates.md:
  - Describes new backends + default
  - Recommends usage patterns (e.g. rustls-webpki for consistency, native-tls for proxies)
  - Explains SSL_CERT_* behavior and migration notes
Testing
- 7 new/expanded tests in uv-client/tests/ssl_certs.rs (loading, precedence, all backends)
- Updated nextest.toml with SSL test profile override
- Refreshed subcommand snapshots

Trade-offs & Future Work

Using webpki-root-certs + tls_certs_only + tls_merge_certs keeps maintenance low and avoids re-implementing root store logic
Manual merging adds control and reduces risk of drift from reqwest internals
--native-tls retained for smooth transition; long-term plan is deprecation
Planned follow-ups:
- Promote --tls-backend to visible/stable
- Introduce --system-certs / --no-system-certs aliases (preview)
- Switch default to rustls (platform verifier) in a future breaking release
- Deprecate --native-tls and UV_NATIVE_TLS

salmonsd · 2026-01-16T22:34:20Z

Will work on failing tests (apologies)

crates/uv-client/src/base_client.rs

musicinmybrain · 2026-01-26T09:53:28Z

We can now also update reqsign to 0.19.0, apache/opendal-reqsign@v0.18.1...v0.19.0, which will remove another user of reqwest 0.12 from the dependency tree.

salmonsd · 2026-01-26T17:17:00Z

We can now also update reqsign to 0.19.0, apache/opendal-reqsign@v0.18.1...v0.19.0, which will remove another user of reqwest 0.12 from the dependency tree.

thanks @musicinmybrain, was waiting for the official release!

Only thing to watch for is axoupdater and the update to axoasset (issue here) to also use reqwest 0.13 to be completely resolved.

salmonsd · 2026-01-29T16:57:23Z

Hey @zanieb, wanted to check-in and see if y'all have a plan for this or if there's anything I can do to help to get this implemented?

crates/uv-cli/src/lib.rs

crates/uv-client/src/base_client.rs

konstin · 2026-02-09T17:19:56Z

All dependency updates are merged and published.

salmonsd · 2026-02-10T17:04:36Z

rebased onto uv 0.10.1 and this commit: 976a368

will work to implement these suggestions: #17543 (comment)

Cargo.toml

crates/uv-client/src/base_client.rs

salmonsd · 2026-02-18T03:42:54Z

crates/uv-client/src/registry_client.rs

+            // Specify identity encoding to prevent double compression from async_http_range_reader and reqwest
+            headers.insert(
+                reqwest::header::ACCEPT_ENCODING,
+                reqwest::header::HeaderValue::from_static("identity"),
+            );


More info here: astral-sh/async_http_range_reader#3 (comment)

crates/uv/tests/it/run.rs

crates/uv-test/src/lib.rs

salmonsd · 2026-02-18T03:55:10Z

crates/uv/src/commands/self_update.rs

 use tracing::debug;

-use uv_client::{BaseClientBuilder, WrappedReqwestError};
+use uv_client::BaseClientBuilder;


This removal is related to axoupdater (and depedent axoasset) on an older version of reqwest.

Related:

Support reqwest >= 0.13.0, update feature rustls axodotdev/axoasset#384

Update reqwest to 0.13 axodotdev/axoasset#395

crates/uv/tests/it/show_settings.rs

konstin · 2026-02-19T08:44:31Z

CI is currently failing because we introduced an openssl dependency.

crates/uv-client/src/base_client.rs

…tly skipping

Needed for WinGet in #17543 The `windows-latest` label already changed https://github.blog/changelog/2025-07-31-github-actions-new-apis-and-windows-latest-migration-notice/ I don't think this should affect users.

codspeed-hq · 2026-03-17T20:50:24Z

Merging this PR will not alter performance

❌ 1 regressed benchmark
✅ 4 untouched benchmarks

⚠️ Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	`BASE`	`HEAD`	Efficiency
❌	WallTime	`resolve_warm_jupyter_universal`	142.3 ms	146.7 ms	-3.05%

_{Comparing salmonsd:update-reqwest-tls (fa1fd36) with main (7b3170d)}

The following user-facing changes are included here: - `aws-lc` is used instead of `ring` for a cryptography backend - Expands our certificate signature algorithm support to include ECDSA_P256_SHA512, ECDSA_P384_SHA512, ECDSA_P521_SHA256, ECDSA_P521_SHA384, and ECDSA_P521_SHA512 - `--native-tls` is deprecated in favor of a new `--system-certs` flag, avoiding confusion with the TLS implementation used (we use `rustls` not `native-tls`, see prior confusion at #11595) - NASM is a new build requirement on Windows, it is required by `aws-lc` on x86-64 and i386 - `rustls-platform-verifier` is used instead of `rustls-native-certs` for system certificate verification - On macOS, certificate validation is now delegated to `Security.framework` (`SecTrust`). Performance when using `--system-certs` is improved by avoiding exporting and parsing all the certificates from the keychain at startup. - On Windows, certificate validation is now delegated to `CertGetCertificateChain` and `CertVerifyCertificateChainPolicy` - On Linux, certificate validation should be approximately unchanged - Some previously failing chains may succeed, and some previously accepted chains may fail; generally, this should result in behavior closer matching browsers and other native applications - macOS and Windows may now perform live OCSP fetches for early revocation, which could add latency to some requests - Empty `SSL_CERT_FILE` values are ignored (for consistency with `SSL_CERT_DIR`) The following internal changes are included here: - Certificate loading has been refactored to use a newtype with helper methods - The certificate tests have been rewritten - We use `webpki-root-certs` instead of `webpki-roots`, see #17543 (comment) - We request `identity` encoding for range requests, see astral-sh/async_http_range_reader#3 (comment) - Various dependencies (including forks) updates to versions which use reqwest 0.13+ This is a replacement of #17543 with an updated description. See that pull request for prior discussion. I've made the following changes from the initial approach there: - Previously, the `native-tls` TLS implementation was added which included an OpenSSL build. We don't currently use the `native-tls` implementation, but the `--native-tls` flag there was erroneously updated to enable it. - Previously, there was a `--tls-backend` flag to toggle between `native-tls` and `rustls`. Since we currently always use `rustls`, this is deferred to future work (if we need it at all). - Previously, there were unintentional breaking changes to `SSL_CERT_FILE` and `SSL_CERT_DIR` handling, including merging with the base certificates instead of replacing them, dropping support for OpenSSL hash-named certificate files, skipping deduplication of certificates. Here, we retain use of `rustls-native-certs` for loading certificates from the system as it handles these edge cases. Closes #17427 --------- Co-authored-by: salmonsd <22984014+salmonsd@users.noreply.github.com>

salmonsd · 2026-03-23T18:40:51Z

Closing in favor of #18550

zanieb · 2026-03-23T18:48:06Z

Thank you for your work on this!

The following user-facing changes are included here: - `aws-lc` is used instead of `ring` for a cryptography backend - Expands our certificate signature algorithm support to include ECDSA_P256_SHA512, ECDSA_P384_SHA512, ECDSA_P521_SHA256, ECDSA_P521_SHA384, and ECDSA_P521_SHA512 - `--native-tls` is deprecated in favor of a new `--system-certs` flag, avoiding confusion with the TLS implementation used (we use `rustls` not `native-tls`, see prior confusion at #11595) - NASM is a new build requirement on Windows, it is required by `aws-lc` on x86-64 and i386 - `rustls-platform-verifier` is used instead of `rustls-native-certs` for system certificate verification - On macOS, certificate validation is now delegated to `Security.framework` (`SecTrust`). Performance when using `--system-certs` is improved by avoiding exporting and parsing all the certificates from the keychain at startup. - On Windows, certificate validation is now delegated to `CertGetCertificateChain` and `CertVerifyCertificateChainPolicy` - On Linux, certificate validation should be approximately unchanged - Some previously failing chains may succeed, and some previously accepted chains may fail; generally, this should result in behavior closer matching browsers and other native applications - macOS and Windows may now perform live OCSP fetches for early revocation, which could add latency to some requests - Empty `SSL_CERT_FILE` values are ignored (for consistency with `SSL_CERT_DIR`) The following internal changes are included here: - Certificate loading has been refactored to use a newtype with helper methods - The certificate tests have been rewritten - We use `webpki-root-certs` instead of `webpki-roots`, see #17543 (comment) - We request `identity` encoding for range requests, see astral-sh/async_http_range_reader#3 (comment) - Various dependencies (including forks) updates to versions which use reqwest 0.13+ This is a replacement of #17543 with an updated description. See that pull request for prior discussion. I've made the following changes from the initial approach there: - Previously, the `native-tls` TLS implementation was added which included an OpenSSL build. We don't currently use the `native-tls` implementation, but the `--native-tls` flag there was erroneously updated to enable it. - Previously, there was a `--tls-backend` flag to toggle between `native-tls` and `rustls`. Since we currently always use `rustls`, this is deferred to future work (if we need it at all). - Previously, there were unintentional breaking changes to `SSL_CERT_FILE` and `SSL_CERT_DIR` handling, including merging with the base certificates instead of replacing them, dropping support for OpenSSL hash-named certificate files, skipping deduplication of certificates. Here, we retain use of `rustls-native-certs` for loading certificates from the system as it handles these edge cases. Closes #17427 --------- Co-authored-by: salmonsd <22984014+salmonsd@users.noreply.github.com>

zanieb self-assigned this Jan 16, 2026

salmonsd commented Jan 20, 2026

View reviewed changes

crates/uv-client/src/base_client.rs Outdated Show resolved Hide resolved

salmonsd force-pushed the update-reqwest-tls branch from 9bdfe48 to ec325cf Compare January 28, 2026 21:46

zanieb reviewed Feb 4, 2026

View reviewed changes

crates/uv-cli/src/lib.rs Show resolved Hide resolved

zanieb reviewed Feb 4, 2026

View reviewed changes

crates/uv-client/src/base_client.rs Outdated Show resolved Hide resolved

zanieb reviewed Feb 4, 2026

View reviewed changes

crates/uv-client/src/base_client.rs Outdated Show resolved Hide resolved

zanieb reviewed Feb 4, 2026

View reviewed changes

crates/uv-client/src/base_client.rs Outdated Show resolved Hide resolved

zanieb mentioned this pull request Feb 4, 2026

Upgrade reqwest #17862

Closed

salmonsd mentioned this pull request Feb 10, 2026

Update Rust crate reqsign to 0.20.0 #17935

Merged

1 task

salmonsd force-pushed the update-reqwest-tls branch from 311d8ac to 9694a89 Compare February 10, 2026 17:02

konstin reviewed Feb 11, 2026

View reviewed changes

Cargo.toml Outdated Show resolved Hide resolved

salmonsd force-pushed the update-reqwest-tls branch from 9694a89 to 2b18f63 Compare February 17, 2026 17:10

salmonsd commented Feb 18, 2026

View reviewed changes

crates/uv-client/src/base_client.rs Outdated Show resolved Hide resolved

salmonsd commented Feb 18, 2026

View reviewed changes

crates/uv-client/src/base_client.rs Outdated Show resolved Hide resolved

salmonsd commented Feb 18, 2026

View reviewed changes

crates/uv/tests/it/run.rs Outdated Show resolved Hide resolved

salmonsd commented Feb 18, 2026

View reviewed changes

crates/uv-test/src/lib.rs Outdated Show resolved Hide resolved

salmonsd commented Feb 18, 2026

View reviewed changes

crates/uv/tests/it/show_settings.rs Outdated Show resolved Hide resolved

salmonsd requested review from konstin and zanieb February 18, 2026 04:00

salmonsd force-pushed the update-reqwest-tls branch from 27d53ce to 1aae7bf Compare February 19, 2026 15:52

konstin added the enhancement New feature or improvement to existing functionality label Feb 19, 2026

zanieb added 2 commits March 17, 2026 11:57

Add note on NASM to CONTRIBUTING

58a4333

Remove duplicate doc comment on Certificates::from_env

066c4af

salmonsd commented Mar 17, 2026

View reviewed changes

crates/uv-client/src/base_client.rs Outdated Show resolved Hide resolved

zanieb added 3 commits March 17, 2026 12:19

Remove remaining native-tls-vendored dependency

180f456

Log directory entry errors in Certificates::from_dir instead of silen…

cbcdc98

…tly skipping

Remove exact version pin on reqwest

6aecc7d

zanieb force-pushed the update-reqwest-tls branch from 9ab78c4 to 6aecc7d Compare March 17, 2026 17:22

Improve interactions between --native-tls and --system-certs

c545d8e

zanieb mentioned this pull request Mar 17, 2026

Upgrade the release build runners from Windows 2022 -> 2025 #18528

Merged

zanieb added 2 commits March 17, 2026 15:27

Use rustls-native-certs for loading

0052d48

Merge branch 'main' into 17543-update-reqwest-tls

0ed7bb3

zanieb added 11 commits March 17, 2026 16:06

Iterate on the certificate handling

5d70e42

Clear UV_SYSTEM_CERTS during tests

11a4c8a

Skip test on Windows

b18b35f

Reduce clones

f415ebf

Document filter_map in to_reqwest_certs

7e1f96b

Use From<CertificateResult> for Certificates

4a6dd17

Extend the comment around identity encoding

cdb8e89

Add configuration file support for system-certs

655151a

Use a consistent deprecation note style

9cbfe71

Fixups

601007a

Regenerate uv.schema.json

fa1fd36

zanieb mentioned this pull request Mar 18, 2026

Upgrade reqwest to 0.13 #18550

Merged

salmonsd closed this Mar 23, 2026

Conversation

salmonsd commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Motivation

Changes

Trade-offs & Future Work

Uh oh!

salmonsd commented Jan 16, 2026

Uh oh!

Uh oh!

musicinmybrain commented Jan 26, 2026

Uh oh!

salmonsd commented Jan 26, 2026

Uh oh!

salmonsd commented Jan 29, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

konstin commented Feb 9, 2026

Uh oh!

salmonsd commented Feb 10, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

salmonsd Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

salmonsd Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

konstin commented Feb 19, 2026

Uh oh!

Uh oh!

codspeed-hq bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Performance Changes

Uh oh!

salmonsd commented Mar 23, 2026

Uh oh!

zanieb commented Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

salmonsd commented Jan 16, 2026 •

edited

Loading

salmonsd Feb 18, 2026 •

edited

Loading

codspeed-hq bot commented Mar 17, 2026 •

edited

Loading