Bump reqwest from 0.13.4 to 0.13.5

[dependabot]

Bumps reqwest from 0.13.4 to 0.13.5.

Release notes

Sourced from reqwest's releases.

v0.13.5

tl;dr

• Add Error::is_dns() to identify errors caused by DNS resolution failures.
• Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
• Add TLS version to TlsInfo extension.
• Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
• Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

What's Changed

• fix(blocking): preserve version and extensions in TryFromhttp::Request by @​wwhsaber in seanmonstar/reqwest#3050
• Remove unnecessary clones by @​FranciscoTGouveia in seanmonstar/reqwest#3052
• Add Referrer and Referrer Policy methods to WASM Request API by @​Billy-Sheppard in seanmonstar/reqwest#3049
• chore(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in seanmonstar/reqwest#3058
• feat: add Error::is_dns() to identify DNS resolution failures by @​JoakoI98 in seanmonstar/reqwest#3057
• Fix blocking client timeout panic by @​V-Mann-Nick in seanmonstar/reqwest#3060
• Use LookupIpStrategy::Ipv6AndIpv4 to actually prefer IPv6 when using hickory-dns by @​FalkWoldmann in seanmonstar/reqwest#3063
• feat: Add ClientBuilder::http1_max_headers by @​smaeda-ks in seanmonstar/reqwest#3065
• feat: expose the negotiated TLS version via TlsInfo by @​dennisameling in seanmonstar/reqwest#3067
• fix(error): detect timeouts wrapped in body decode errors by @​raphaelroshan in seanmonstar/reqwest#3064
• Remove unnecessary clones and a cast by @​FranciscoTGouveia in seanmonstar/reqwest#3071
• chore(deps): upgrade base64 to 0.23 by @​paolobarbolini in seanmonstar/reqwest#3074
• perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody by @​spellsaif in seanmonstar/reqwest#3085
• fix(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture::poll by @​spellsaif in seanmonstar/reqwest#3084
• src/async_impl/request.rs_improved_doc_for_json_fn: by @​Athleteg in seanmonstar/reqwest#3082
• fix: proxy could use wrong credentials if many matched by @​seanmonstar in seanmonstar/reqwest#3098

New Contributors

• @​wwhsaber made their first contribution in seanmonstar/reqwest#3050
• @​FranciscoTGouveia made their first contribution in seanmonstar/reqwest#3052
• @​Billy-Sheppard made their first contribution in seanmonstar/reqwest#3049
• @​JoakoI98 made their first contribution in seanmonstar/reqwest#3057
• @​V-Mann-Nick made their first contribution in seanmonstar/reqwest#3060
• @​FalkWoldmann made their first contribution in seanmonstar/reqwest#3063
• @​smaeda-ks made their first contribution in seanmonstar/reqwest#3065
• @​raphaelroshan made their first contribution in seanmonstar/reqwest#3064
• @​spellsaif made their first contribution in seanmonstar/reqwest#3085
• @​Athleteg made their first contribution in seanmonstar/reqwest#3082

Full Changelog: seanmonstar/reqwest@v0.13.4...v0.13.5

Changelog

Sourced from reqwest's changelog.

v0.13.5

• Add Error::is_dns() to identify errors caused by DNS resolution failures.
• Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
• Add TLS version to TlsInfo extension.
• Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
• Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

Commits

• de55373 v0.13.5
• 4d3fe12 fix: proxy could use wrong credentials if many matched (#3098)
• 9f06fd2 docs: improve description of JSON method (#3082)
• 5bdb2f0 perf(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture:...
• ffda263 perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody (#3...
• 4e9a3c7 chore: add pull request template for human-written content
• 17e9bcb chore(deps): upgrade base64 to 0.23 (#3074)
• 221abe9 chore: Remove unnecessary clones and a cast (#3071)
• 99996a1 fix(error): detect timeouts wrapped in body decode errors (#3064)
• fc99bd5 feat: expose the negotiated TLS version via TlsInfo (#3067)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: bf71fa2e-e9fc-4abc-b195-5997fbefc552

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gcomte]

Dependency upgrade assessment — commit f142621fb9bd433d3028a05b6beb552b58c6ca0a

Reqwest 0.13.5 needs no application migration here. Build, formatting, Clippy, 28 unit tests, and 32 integration tests passed. However, fresh audits of both PR and base fail on Rustls 0.23.44 (RUSTSEC-2026-0285). Coordinate an update to Rustls >=0.23.45 and rerun CI before merging. The input snapshot is unchanged.

Findings:

• Scope verified against the read-only base: one Cargo package, no additional workspaces. Cargo.toml remains unchanged with reqwest = "0.13.4"; Cargo.lock upgrades Reqwest 0.13.4 → 0.13.5 and adds Base64 0.23.1 for Reqwest. Base64 0.22.1 remains for hyper-util. No other package versions change.
• Reviewed the official changelog, all 18 commits in the version comparison, and both published crate sources: https://github.com/seanmonstar/reqwest/blob/v0.13.5/CHANGELOG.md and seanmonstar/reqwest@v0.13.4...v0.13.5 . The repository uses blocking::get, error_for_status, and a bounded Read before exact-decimal JSON parsing. These APIs remain supported; the new HTTP/1 header-limit option does not replace the existing 1 MiB body limit.
• No justified API adoption or workaround removal was found. Error::is_dns() is optional diagnostic classification; the app has no DNS-specific handling. The default HTTP/1 header limit remains 100 and blocking timeout remains 30 seconds. TLS-version inspection is unused. Hickory DNS, cookies, WASM referrer APIs, http::Request conversion, custom read timeouts, and decoded-timeout classification are unused. The blocking timeout-overflow fix is internal and concerns enormous configured durations. The multiple-proxy credential fix is internal; this app uses system proxy defaults without registering multiple proxies.
• Base64 0.23 adds configuration options, SIMD engines, and decoding diagnostics; 0.23.1 fixes test compilation on non-SIMD architectures. Reqwest continues using the scalar BASE64_STANDARD encoder for authentication headers, and the application has no direct Base64 calls. Reqwest's Rust minimum remains 1.85; Base64 requires 1.71, both below the project's declared 1.95. Source: published release notes and source in https://static.crates.io/crates/base64/base64-0.23.1.crate .
• Confirmed unresolved medium-severity advisory: both snapshots contain Rustls 0.23.44 in the active default TLS path. RUSTSEC-2026-0285 concerns TLS 1.3 handshake messages accepted across encryption-level boundaries; the patched version is >=0.23.45. This predates the Reqwest update and its earlier green audit is stale. Recommend coordinating the security update with existing maintenance work rather than assuming this PR fixes it. Sources: https://rustsec.org/advisories/RUSTSEC-2026-0285 and GHSA-2mjx-qc3c-rqvc .
• Validation used Rust 1.98 on Linux; the declared minimum and other release platforms were not executed. The nightly unused-dependency check could not start because Cargo lacks Rustup toolchain selection. Subagent startup was unavailable, so no independent reviewer result was obtained. No speculative source changes or redundant tests were added.

The session reported running checks. No independent validation was run for this result.