migrate hyper to reqwest #11
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This was referenced Apr 3, 2025
|
@adnanademovic: it'd be great if you could review, merge & release this and then bump this is also a good reason to not combine that release with switching to |
`hyper` v0.10 is extremely outdated, the current release is v1.6. this old version pulls in vulnerable dependencies (incl. `hyper` v0.10 itself). rather than upgrading to `hyper` v1.6 i opted to replace it with `reqwest` since this crate here is not `async` and `hyper` v1 is completely `async`. due to the very limited amount of features needed from `hyper` (just executing HTTP POST requests) it can instead be replaced with the much simpler `reqwest` crate. while it hasn't hit v1.0 yet it is very widely used (nearly 200 million downloads on crates.io). this is a breaking change for consumers since the URLs can now just be passed as strings rather than having to call `.parse()?` on the string. note that this is similar to, but not the same as, adnanademovic#8. fixes adnanademovic#9
code changes done using `cargo fix --edition`
rursprung
force-pushed
the
migrate-hyper-to-reqwest
branch
from
215825c to
eac04e6
Compare
rursprung
added a commit
to rursprung/rosrust
that referenced
this pull request
May 15, 2025
this updates to the latest `xml-rpc` version. note that at the moment this does not yet build since it hasn't been released yet. this requires adnanademovic/xml-rpc-rs#11 to be merged & released first. for the time being you can use this by using `[patch.crates-io]` in your `Cargo.toml` and overwrite both `rosrust` and `xml-rpc`. this update is needed to resolve various security vulnerabilities coming from outdated versions of `hyper` which are being pulled in via `xml-rpc`. with this, `cargo-audit` is happy again.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
please see the individual commit messages for further details.
i realise that this is similar to #8 from @jakobbraun, however this PR completely removes
hyperand it does not add anasyncversion of the API. i think removing the outdatedhyperdependency (and the vulnerabilities coming from it) is the most pressing issue.note that this is a breaking change for consumers, so you might want to use that chance to just ditch the blocking API (currently the only one available) and replace it with an
asyncAPI (most of the rust ecosystem - at the very least anything doing I/O - seems to have gone down that route, and for good reasons). i've raised #12 for this.nevertheless i think that merging & releasing this PR would be a good first step, you can then just remove the
blocking::from thereqwestmodule name and add the necessaryasync/awaitkeywords. having a last non-asyncrelease without the outdatedhyperdependency would allow clients which are not (yet)asyncto at least get rid of the security warnings coming from the outdatedhyperdependency, giving them a two-step migration path (first get rid of insecure dependencies and then switch toasync).fixes #9