Update Rust crate reqwest to 0.13.3

[oxide-renovate]

This PR contains the following updates:

Package	Type	Update	Change
reqwest	workspace.dependencies	minor	0.12.23 → 0.13.3

---

Release Notes

seanmonstar/reqwest (reqwest)

v0.13.3

Compare Source

• Fix CertificateRevocationList parsing of PEM values.
• Fix logging in resolver to only show host, not full URL.
• Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
• Fix HTTP/3 to handle STOP_SENDING as not an error.
• Fix HTTP/3 pool to remove timed out QUIC connections.
• Fix HTTP/3 connection establishment picking IPv4 and IPv6.
• Upgrade rustls-platform-verifier.
• (wasm) Only use wasm-bindgen on unknown-* targets.

v0.13.2

Compare Source

tl;dr

• Fix HTTP/2 and native-tls ALPN feature combinations.
• Fix HTTP/3 to send h3 ALPN.
• (wasm) fix RequestBuilder::json() from override previously set content-type.

What's Changed

• chore(deps): bump actions/checkout from 5 to 6 by @​dependabot[bot] in #​2921
• Update readme for 0.13 by @​VojtaStanek in #​2926
• fix http2 feature is not enabled for "native-tls" by @​fox0 in #​2927
• chore(deps): remove unused webpki-roots and rustls-native-certs by @​seanmonstar in #​2932
• docs: native-tls-alpn has changed to native-tls-no-alpn by @​seanmonstar in #​2940
• Specify h3 alpn for http3 connector by @​passcod in #​2929
• update copyright year to 2026 by @​taozui472 in #​2943
• fix(json): custom content-type overidden by json method for wasm by @​Narendran-KT in #​2908
• chore: upgrade wasm-streams to v0.5 by @​xangelix in #​2958
• chore(ci): add windows and linux arm64 to ci by @​dennisameling in #​2960

New Contributors

• @​VojtaStanek made their first contribution in #​2926
• @​fox0 made their first contribution in #​2927
• @​passcod made their first contribution in #​2929
• @​taozui472 made their first contribution in #​2943
• @​Narendran-KT made their first contribution in #​2908
• @​xangelix made their first contribution in #​2958
• @​dennisameling made their first contribution in #​2960

Full Changelog: seanmonstar/reqwest@v0.13.1...v0.13.2

v0.13.1

Compare Source

What's Changed

• http3: depend on quinn/rustls-aws-lc-rs to avoid ring dependency by @​djc in #​2917
• fix rustls on android by @​seanmonstar in #​2918

Full Changelog: seanmonstar/reqwest@v0.13.0...v0.13.1

v0.13.0

Compare Source

Breaking changes

• rustls is now the default TLS backend, instead of native-tls.
• rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)
• rustls-tls has been renamed to rustls.
• rustls roots features removed, rustls-platform-verifier is used by default.
  • To use different roots, call tls_certs_only(your_roots).
• native-tls now includes ALPN. To disable, use native-tls-no-alpn.
• query and form are now crate features, disabled by default.
• Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).
• Many TLS-related methods renamed to improve autocompletion and discovery, but previous name left in place with a "soft" deprecation. (just documented, no warnings)
  • For example, prefer tls_backend_rustls() over use_rustls_tls().

Pull Requests in General

• start 0.13 dev by @​seanmonstar in #​2894
• Make serde optional by introducing query, form features, and re-working WASM header parsing by @​CathalMullan in #​2858
• replace ClientBuilder::dns_resolver with dns_resolver2 by @​seanmonstar in #​2898
• feat: make Rustls the default TLS provider by @​calavera in #​2897
• feat: consolidate TLS options with rustls-platform-verifier by @​seanmonstar in #​2891
• remove long-deprecated methods: trust-dns and non-wasm-cors by @​seanmonstar in #​2899
• rename rustls-tls feature to just rustls by @​seanmonstar in #​2900
• remove deprecated features trust-dns and macos-system-configuration by @​seanmonstar in #​2901
• chore: separate rustls and rustls-no-provider features by @​seanmonstar in #​2903
• rustls: allow windows to use extra roots by @​seanmonstar in #​2904
• v0.13.0-rc.1 by @​seanmonstar in #​2905
• Enable ALPN by default in native-tls by @​ducaale in #​2907
• v0.13.0 by @​seanmonstar in #​2915

New Contributors

• @​CathalMullan made their first contribution in #​2858

Full Changelog: seanmonstar/reqwest@v0.12.28...v0.13.0

v0.12.28

Compare Source

What's Changed

• fix: correctly import TokioIo on Windows by @​seanmonstar in #​2896

Full Changelog: seanmonstar/reqwest@v0.12.27...v0.12.28

v0.12.27

Compare Source

tl;dr

• Add ClientBuilder::windows_named_pipe(name) option that will force all requests over that Windows Named Pipe.

What's Changed

• chore: Disable unused tokio-util codec feature by @​tottoto in #​2893
• chore: Use http_body_util::BodyDataStream by @​tottoto in #​2892
• feat: add windows_named_pipe() option to client builder by @​seanmonstar in #​2789

Full Changelog: seanmonstar/reqwest@v0.12.26...v0.12.27

v0.12.26

Compare Source

tl;dr

• Fix sending Accept-Encoding header only with values configured with reqwest, regardless of underlying tower-http config.

What's Changed

• deps: update cookie_store by @​seanmonstar in #​2886
• fix: disable default compression from tower-http if not enabled in reqwest by @​seanmonstar in #​2889
• fix(http3): correct compression defaults by @​seanmonstar in #​2890

Full Changelog: seanmonstar/reqwest@v0.12.25...v0.12.26

v0.12.25

Compare Source

Highlights

• Add Error::is_upgrade() to determine if the error was from an HTTP upgrade.
• Fix sending Proxy-Authorization if only username is configured.
• Fix sending Proxy-Authorization to HTTPS proxies when the target is HTTP.
• Refactor internal decompression handling to use tower-http.

What's Changed

• tests: fix wasm timeout test with uncached response by @​seanmonstar in #​2853
• docs: document connection pooling behavior by @​vinzmyko in #​2851
• docs: document WASM client by @​vinzmyko in #​2859
• chore: minor improvement for docs by @​black5box in #​2862
• fix: send proxy-authorization even with empty password by @​barjin in #​2868
• feat(error): add is_upgrade method to detect protocol upgrade errors by @​0x676e67 in #​2822
• Use decompression from tower-http by @​ducaale in #​2840
• fix(proxy): forward Proxy-Authorization header to HTTPS proxies for HTTP targets by @​0x676e67 in #​2872
• v0.12.25 by @​seanmonstar in #​2880

New Contributors

• @​vinzmyko made their first contribution in #​2851
• @​black5box made their first contribution in #​2862
• @​barjin made their first contribution in #​2868

Full Changelog: seanmonstar/reqwest@v0.12.24...v0.12.25

v0.12.24

Compare Source

Highlights

• Refactor cookie handling to an internal middleware.
• Refactor internal random generator.
• Refactor base64 encoding to reduce a copy.
• Documentation updates.

What's Changed

• build(deps): silence unused deps in WASM build by @​0x676e67 in #​2799
• perf(util): avoid extra copy when base64 encoding by @​0x676e67 in #​2805
• docs: fix method name in changelog entry by @​johannespfrang in #​2807
• chore: Align the name usage of TotalTimeout by @​Xuanwo in #​2657
• refactor(cookie): add CookieService by @​linyihai in #​2787
• Fixes typo in retry max_retries_per_request doc comment re 2813 by @​dmackinn in #​2824
• test(multipart): fix build failure with no-default-features by @​0x676e67 in #​2801
• refactor(cookie): avoid duplicate cookie insertion by @​0x676e67 in #​2834

New Contributors

• @​johannespfrang made their first contribution in #​2807
• @​dmackinn made their first contribution in #​2824

Full Changelog: seanmonstar/reqwest@v0.12.23...v0.12.24

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • "after 8pm,before 6am"
• Automerge
  • "after 8pm,before 6am"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.