From aa2b6ced3a38c342c11fb439f03a0a32a70d5eef Mon Sep 17 00:00:00 2001 From: "sentry-junior[bot]" <264270552+sentry-junior[bot]@users.noreply.github.com> Date: Thu, 22 Oct 2026 13:57:09 +0000 Subject: [PATCH 1/2] build(deps): Drop vendored webpki root bundles Use the system trust store for sqlx (tls-rustls-ring-native-roots) and enable reqwest's default-tls directly instead of sentry's native-tls feature, which pulls ureq and webpki-root-certs into Cargo.lock even though they are never built. Co-Authored-By: Markus Unterwaditzer --- Cargo.lock | 106 +++++++++-------------------------------------------- Cargo.toml | 6 ++- 2 files changed, 22 insertions(+), 90 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 0709b11c..2a258356 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -654,17 +654,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb" dependencies = [ "const-oid", - "pem-rfc7468 0.7.0", - "zeroize", -] - -[[package]] -name = "der" -version = "0.8.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "71fd89660b2dc699704064e59e9dba0147b903e85319429e131620d022be411b" -dependencies = [ - "pem-rfc7468 1.0.0", + "pem-rfc7468", "zeroize", ] @@ -2172,15 +2162,6 @@ dependencies = [ "base64ct", ] -[[package]] -name = "pem-rfc7468" -version = "1.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9" -dependencies = [ - "base64ct", -] - [[package]] name = "percent-encoding" version = "2.3.2" @@ -2219,7 +2200,7 @@ version = "0.7.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f" dependencies = [ - "der 0.7.10", + "der", "pkcs8", "spki", ] @@ -2230,7 +2211,7 @@ version = "0.10.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7" dependencies = [ - "der 0.7.10", + "der", "spki", ] @@ -2773,6 +2754,18 @@ dependencies = [ "zeroize", ] +[[package]] +name = "rustls-native-certs" +version = "0.8.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4a073f5dc7469f984c52ad2752b63b0807745133b6de880b7b64c1ac4c48aec4" +dependencies = [ + "openssl-probe", + "rustls-pki-types", + "schannel", + "security-framework", +] + [[package]] name = "rustls-pki-types" version = "1.14.1" @@ -2871,7 +2864,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "507ac2be9bf2da56c831da57faf1dadd81f434bd282935cdb06193d0c94e8811" dependencies = [ "httpdate", - "native-tls", "reqwest", "sentry-backtrace", "sentry-contexts", @@ -2881,7 +2873,6 @@ dependencies = [ "sentry-panic", "sentry-tracing", "tokio", - "ureq", ] [[package]] @@ -3191,7 +3182,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d" dependencies = [ "base64ct", - "der 0.7.10", + "der", ] [[package]] @@ -3232,6 +3223,7 @@ dependencies = [ "once_cell", "percent-encoding", "rustls", + "rustls-native-certs", "serde", "serde_json", "sha2", @@ -3241,7 +3233,6 @@ dependencies = [ "tokio-stream", "tracing", "url", - "webpki-roots 0.26.11", ] [[package]] @@ -3484,6 +3475,7 @@ dependencies = [ "prost-types", "rand 0.8.6", "rdkafka", + "reqwest", "rmp-serde", "rstest", "sentry", @@ -3981,35 +3973,6 @@ version = "0.9.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1" -[[package]] -name = "ureq" -version = "3.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0" -dependencies = [ - "base64", - "der 0.8.0", - "log", - "native-tls", - "percent-encoding", - "rustls-pki-types", - "ureq-proto", - "utf8-zero", - "webpki-root-certs", -] - -[[package]] -name = "ureq-proto" -version = "0.6.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e994ba84b0bd1b1b0cf92878b7ef898a5c1760108fe7b6010327e274917a808c" -dependencies = [ - "base64", - "http", - "httparse", - "log", -] - [[package]] name = "url" version = "2.5.8" @@ -4023,12 +3986,6 @@ dependencies = [ "serde_derive", ] -[[package]] -name = "utf8-zero" -version = "0.8.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e" - [[package]] name = "utf8_iter" version = "1.0.4" @@ -4258,33 +4215,6 @@ dependencies = [ "wasm-bindgen", ] -[[package]] -name = "webpki-root-certs" -version = "1.0.10" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb" -dependencies = [ - "rustls-pki-types", -] - -[[package]] -name = "webpki-roots" -version = "0.26.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9" -dependencies = [ - "webpki-roots 1.0.10", -] - -[[package]] -name = "webpki-roots" -version = "1.0.10" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9" -dependencies = [ - "rustls-pki-types", -] - [[package]] name = "whoami" version = "1.6.1" diff --git a/Cargo.toml b/Cargo.toml index b335ecc9..36d90933 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -45,12 +45,14 @@ sentry = { version = "0.41.0", default-features = false, features = [ "contexts", "debug-images", "panic", - "transport", + "reqwest", # additional features "tracing", "logs", ] } sentry_protos = "0.22.0" +# TLS for sentry's transport. Not using sentry's `native-tls` feature, which pulls ureq + webpki-root-certs into Cargo.lock. +reqwest = { version = "0.12", default-features = false, features = ["default-tls"] } serde = "1.0.214" serde_bytes = "0.11" serde_yaml = "0.9.34" @@ -58,7 +60,7 @@ sha2 = "0.10.8" sqlx = { version = "0.8.6", features = [ "sqlite", "runtime-tokio", - "tls-rustls-ring-webpki", + "tls-rustls-ring-native-roots", "chrono", "postgres", ] } From 9d0fe03874661b2d0d747be9707ffff4a5b10507 Mon Sep 17 00:00:00 2001 From: "sentry-junior[bot]" <264270552+sentry-junior[bot]@users.noreply.github.com> Date: Thu, 22 Oct 2026 15:00:42 +0000 Subject: [PATCH 2/2] build(deps): Note reqwest must track sentry's reqwest version --- Cargo.toml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Cargo.toml b/Cargo.toml index 36d90933..0470aef2 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -52,6 +52,8 @@ sentry = { version = "0.41.0", default-features = false, features = [ ] } sentry_protos = "0.22.0" # TLS for sentry's transport. Not using sentry's `native-tls` feature, which pulls ureq + webpki-root-certs into Cargo.lock. +# Keep this on the same reqwest version as the `sentry` crate. When upgrading sentry (newer releases use reqwest 0.13), +# bump this too, otherwise Cargo builds two reqwest copies and sentry's copy loses this TLS feature. reqwest = { version = "0.12", default-features = false, features = ["default-tls"] } serde = "1.0.214" serde_bytes = "0.11"