[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aes	dependencies	minor	0.8 → 0.9
cbc	dependencies	minor	0.1 → 0.2
reqwest	dependencies	minor	0.12 → 0.13
serde_json	dependencies	patch	1.0.151 → 1.0.154
thiserror	dependencies	patch	2.0.20 → 2.0.21
tokio (source)	dev-dependencies	minor	1.53.1 → 1.54.1
tokio (source)	dependencies	minor	1.53.1 → 1.54.1

---

Release Notes

RustCrypto/block-ciphers (aes)

v0.9.3

Compare Source

v0.9.2

Compare Source

v0.9.1

Compare Source

v0.9.0

Compare Source

RustCrypto/block-modes (cbc)

v0.2.1

Compare Source

v0.2.0

Compare Source

seanmonstar/reqwest (reqwest)

v0.13.5

Compare Source

• Add Error::is_dns() to identify errors caused by DNS resolution failures.
• Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
• Add TLS version to TlsInfo extension.
• Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
• Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

v0.13.4

Compare Source

• Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
• Add ClientBuilder::http2_keep_alive_* options for the blocking client.
• Add TLS 1.3 support when using native-tls backend.
• Fix redirect handling to strip sensitive headers when the scheme changes.
• Fix HTTP/3 happy-eyeball connection creation.
• Upgrade hickory-resolver to 0.26.

v0.13.3

Compare Source

• Fix CertificateRevocationList parsing of PEM values.
• Fix logging in resolver to only show host, not full URL.
• Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
• Fix HTTP/3 to handle STOP_SENDING as not an error.
• Fix HTTP/3 pool to remove timed out QUIC connections.
• Fix HTTP/3 connection establishment picking IPv4 and IPv6.
• Upgrade rustls-platform-verifier.
• (wasm) Only use wasm-bindgen on unknown-* targets.

v0.13.2

Compare Source

• Fix HTTP/2 and native-tls ALPN feature combinations.
• Fix HTTP/3 to send h3 ALPN.
• (wasm) fix RequestBuilder::json() from override previously set content-type.

v0.13.1

Compare Source

• Fixes compiling with rustls on Android targets.

v0.13.0

Compare Source

• Breaking changes:
  • rustls is now the default TLS backend, instead of native-tls.
  • rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)
  • rustls-tls has been renamed to rustls.
  • rustls roots features removed, rustls-platform-verifier is used by default.
    • To use different roots, call tls_certs_only(your_roots).
  • native-tls now includes ALPN. To disable, use native-tls-no-alpn.
  • query and form are now crate features, disabled by default.
  • Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).
• Many TLS-related methods renamed to improve autocompletion and discovery, but previous name left in place with a "soft" deprecation. (just documented, no warnings)
  • For example, prefer tls_backend_rustls() over use_rustls_tls().

v0.12.28

• Fix compiling on Windows if TLS and SOCKS features are not enabled.

v0.12.27

• Add ClientBuilder::windows_named_pipe(name) option that will force all requests over that Windows Named Piper.

v0.12.26

• Fix sending Accept-Encoding header only with values configured with reqwest, regardless of underlying tower-http config.

v0.12.25

• Add Error::is_upgrade() to determine if the error was from an HTTP upgrade.
• Fix sending Proxy-Authorization if only username is configured.
• Fix sending Proxy-Authorization to HTTPS proxies when the target is HTTP.
• Refactor internal decompression handling to use tower-http.

v0.12.24

• Refactor cookie handling to an internal middleware.
• Refactor internal random generator.
• Refactor base64 encoding to reduce a copy.
• Documentation updates.

v0.12.23

• Add ClientBuilder::unix_socket(path) option that will force all requests over that Unix Domain Socket.
• Add ClientBuilder::retry(policy) and reqwest::retry::Builder to configure automatic retries.
• Add ClientBuilder::dns_resolver2() with more ergonomic argument bounds, allowing more resolver implementations.
• Add http3_* options to blocking::ClientBuilder.
• Fix default TCP timeout values to enabled and faster.
• Fix SOCKS proxies to default to port 1080
• (wasm) Add cache methods to RequestBuilder.

v0.12.22

• Fix socks proxies when resolving IPv6 destinations.

v0.12.21

• Fix socks proxy to use socks4a:// instead of socks4h://.
• Fix Error::is_timeout() to check for hyper and IO timeouts too.
• Fix request Error to again include URLs when possible.
• Fix socks connect error to include more context.
• (wasm) implement Default for Body.

v0.12.20

• Add ClientBuilder::tcp_user_timeout(Duration) option to set TCP_USER_TIMEOUT.
• Fix proxy headers only using the first matched proxy.
• (wasm) Fix re-adding Error::is_status().

v0.12.19

• Fix redirect that changes the method to GET should remove payload headers.
• Fix redirect to only check the next scheme if the policy action is to follow.
• (wasm) Fix compilation error if cookies feature is enabled (by the way, it's a noop feature in wasm).

v0.12.18

• Fix compilation when socks enabled without TLS.

v0.12.17

• Fix compilation on macOS.

v0.12.16

• Add ClientBuilder::http3_congestion_bbr() to enable BBR congestion control.
• Add ClientBuilder::http3_send_grease() to configure whether to send use QUIC grease.
• Add ClientBuilder::http3_max_field_section_size() to configure the maximum response headers.
• Add ClientBuilder::tcp_keepalive_interval() to configure TCP probe interval.
• Add ClientBuilder::tcp_keepalive_retries() to configure TCP probe count.
• Add Proxy::headers() to add extra headers that should be sent to a proxy.
• Fix redirect::Policy::limit() which had an off-by-1 error, allowing 1 more redirect than specified.
• Fix HTTP/3 to support streaming request bodies.
• (wasm) Fix null bodies when calling Response::bytes_stream().

v0.12.15

• Fix Windows to support both ProxyOverride and NO_PROXY.
• Fix http3 to support streaming response bodies.
• Fix http3 dependency from public API misuse.

v0.12.14

• Fix missing fetch_mode_no_cors(), marking as deprecated when not on WASM.

v0.12.13

• Add Form::into_reader() for blocking multipart forms.
• Add Form::into_stream() for async multipart forms.
• Add support for SOCKS4a proxies.
• Fix decoding responses with multiple zstd frames.
• Fix RequestBuilder::form() from overwriting a previously set Content-Type header, like the other builder methods.
• Fix cloning of request timeout in blocking::Request.
• Fix http3 synchronization of connection creation, reducing unneccesary extra connections.
• Fix Windows system proxy to use ProxyOverride as a NO_PROXY value.
• Fix blocking read to correctly reserve and zero read buffer.
• (wasm) Add support for request timeouts.
• (wasm) Fix Error::is_timeout() to return true when from a request timeout.

v0.12.12

• (wasm) Fix compilation by not compiler tokio/time on WASM.

v0.12.11

• Fix decompression returning an error when HTTP/2 ends with an empty data frame.

v0.12.10

• Add ClientBuilder::connector_layer() to allow customizing the connector stack.
• Add ClientBuilder::http2_max_header_list_size() option.
• Fix propagating body size hint (content-length) information when wrapping bodies.
• Fix decompression of chunked bodies so the connections can be reused more often.

v0.12.9

• Add tls::CertificateRevocationLists support.
• Add crate features to enable webpki roots without selecting a rustls provider.
• Fix connection_verbose() to output read logs.
• Fix multipart::Part::file() to automatically include content-length.
• Fix proxy to internally no longer cache system proxy settings.

v0.12.8

• Add support for SOCKS4 proxies.
• Add multipart::Form::file() method for adding files easily.
• Add Body::wrap() to wrap any http_body::Body type.
• Fix the pool configuration to use a timer to remove expired connections.

v0.12.7

• Revert adding impl Service<http::Request<_>> for Client.

v0.12.6

• Add support for danger_accept_invalid_hostnames for rustls.
• Add impl Service<http::Request<Body>> for Client and &'_ Client.
• Add support for !Sync bodies in Body::wrap_stream().
• Enable happy eyeballs when hickory-dns is used.
• Fix Proxy so that HTTP(S)_PROXY values take precedence over ALL_PROXY.
• Fix blocking::RequestBuilder::header() from unsetting sensitive on passed header values.

v0.12.5

• Add blocking::ClientBuilder::dns_resolver() method to change DNS resolver in blocking client.
• Add http3 feature back, still requiring reqwest_unstable.
• Add rustls-tls-no-provider Cargo feature to use rustls without a crypto provider.
• Fix Accept-Encoding header combinations.
• Fix http3 resolving IPv6 addresses.
• Internal: upgrade to rustls 0.23.

v0.12.4

• Add zstd support, enabled with zstd Cargo feature.
• Add ClientBuilder::read_timeout(Duration), which applies the duration for each read operation. The timeout resets after a successful read.

v0.12.3

• Add FromStr for dns::Name.
• Add ClientBuilder::built_in_webpki_certs(bool) to enable them separately.
• Add ClientBuilder::built_in_native_certs(bool) to enable them separately.
• Fix sending content-length: 0 for GET requests.
• Fix response body content_length() to return value when timeout is configured.
• Fix ClientBuilder::resolve() to use lowercase domain names.

v0.12.2

• Fix missing ALPN when connecting to socks5 proxy with rustls.
• Fix TLS version limits with rustls.
• Fix not detected ALPN h2 from server with native-tls.

v0.12.1

• Fix ClientBuilder::interface() when no TLS is enabled.
• Fix TlsInfo::peer_certificate() being truncated with rustls.
• Fix panic if http2 feature disabled but TLS negotiated h2 in ALPN.
• Fix Display for Error to not include its source error.

serde-rs/json (serde_json)

v1.0.154

Compare Source

• Support preserve_order in no_std builds (#​1333, thanks @​razmser)

v1.0.153

Compare Source

• Report invalid UTF-8 at the first bad byte (#​1345, thanks @​00200200)

v1.0.152

Compare Source

• Preserve sign of -0 in arbitrary_precision mode (#​1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#​1347, thanks @​yuxi-liu-wired)

dtolnay/thiserror (thiserror)

v2.0.21

Compare Source

• Fix parsing of generic unit variants in display expressions (#​459)

tokio-rs/tokio (tokio)

v1.54.1: Tokio v1.54.1

Compare Source

1.54.1 (October 21st, 2026)

Fixed

• time: revert "remove the runtime handle from timers" (#​8692)

v1.54.0: Tokio v1.54.0

Compare Source

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#​8514)

Added

• fs: add File::set_times, File::set_modified, and fs::FileTimes (#​8504)
• net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#​8378)
• runtime: add Builder::max_io_events_per_busy_tick (#​8410)
• runtime: stabilize tokio::runtime::worker_index() (#​8431)
• sync: add SemaphorePermit::semaphore() (#​8482)
• sync: add blocking_acquire methods to Semaphore (#​8269)
• sync: add watch::Receiver::is_closed (#​8481)
• wasm: support JSPI for Emscripten target (#​8285, #​8627)
• wasm: support the wasm32-unknown-emscripten target (#​8281, #​8422, #​8528, #​8628)

Changed

• fs: reject zero in File::set_max_buf_size (#​8449)
• io: make copy_buf cooperative (#​8459)
• io: panic when BufReader or BufStream is created with zero capacity (#​8494)
• io: panic when in-memory pipe is created with zero capacity (#​8397)
• io: reject zero buffer size in copy_bidirectional_with_sizes (#​8454)
• io: support vectored writes in Sink (#​8663)
• net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#​8444)
• net: start accepted sockets as readable and writable (#​8435)
• net: support UCred on Fuchsia (#​8257)
• process: use mio::unix::pipe for Unix child stdio (#​8603)
• runtime: cache-pad the shared injection queue and idle state (#​8622)
• runtime: decide auto-boxing of spawned futures at monomorphization time (#​8414)
• runtime: make enable_io available whenever rt is enabled (#​8387)
• runtime: move block_in_place setup into a non-generic function (#​8315)
• runtime: move the multi-thread inject queue to its own mutex (#​8382)
• runtime: panic when max_io_events_per_tick is zero (#​8476)
• runtime: suggest .await in nested block_on panic message (#​8501)
• sync: avoid atomic reader count in broadcast slots (#​8357)
• sync: use acquire/release orderings in Notify (#​8325)
• time: remove the runtime handle from timers (#​8458)

Fixed

• fs: restore File internal state when op fails (#​8291)
• io: complete zero-length memory stream operations immediately (#​8323)
• io: flush the writer when the reader stalls in copy_buf (#​8424)
• io: keep the shutdown bit when clearing readiness (#​8435)
• io: preserve the full ScheduledIo tick in readiness events (#​8331)
• io: read lines as bytes so a partial line survives an I/O error (#​8400)
• io: retry on ErrorKind::Interrupted in more I/O operations (#​8417, #​8432, #​8448, #​8453, #​8455, #​8460)
• io: use spawn_mandatory_blocking for stdout and stderr (#​8506)
• io: wait for pending operations before BufReader seeks (#​8599)
• net: close CreateFileW handle on SetNamedPipeHandleState failure (#​8418)
• net: fix peer credentials on NetBSD (#​8589)
• net: saturate TcpSocket and UnixSocket listen backlog (#​8511)
• net: treat ENOTCONN as success in UnixStream::shutdown (#​8526)
• runtime: allow building with --all-features without tokio_unstable (#​8401)
• runtime: avoid overflow in shutdown_timeout() (#​8497)
• runtime: fix spawn_blocking hang when only scheduler workers exist (#​8408)
• runtime: fix misleading signal driver panic message (#​8419)
• sync: preserve FIFO lock order when coop budget is exhausted (#​8371)
• sync: use usize for permit count in SemaphorePermit (#​8405)
• time: avoid interval deadline overflow (#​8385)
• time: handle wrapped top-level timer-wheel slots (#​8334)

Unstable

• fs: fall back when io_uring has no IO driver (#​8165)
• metrics: cap log histogram precision (#​8496)
• runtime: add an opt-in sharded spawn_blocking queue (#​8337)
• runtime: expose schedule latency in task hooks (#​8282)
• taskdump: fix idle bookkeeping when a task dump wakes parked workers (#​8372)
• taskdump: skip non-idle tasks during taskdumps (#​8568)

Documented

• docs: fix stray braces and broken links in rustdoc (#​8605)
• fs: document cancellation behavior of tokio::fs (#​8265)
• net: add Safety docs for named pipe from_raw_handle (#​8378)
• net: document that TcpStream::connect returns only the last error (#​8421)
• runtime: add error documentation for runtime::Builder (#​8297)
• runtime: link available_parallelism in worker count docs (#​8625)
• sync: clarify panic behavior of broadcast::channel() (#​8420)
• sync: fix typo in Semaphore documentation (#​8521)

v1.53.3: Tokio v1.53.3

Compare Source

1.53.3 (October 13th, 2026)

Added

• io: add AsyncFd::register and AsyncFd::register_with_interest (#​8587)

Changed

• io: deprecate AsyncFd::{new, with_interest, try_new, try_with_interest} (#​8587)

Fixed

• io: wake and drop DuplexStream wakers outside the lock (#​8618)
• macros: avoid unreachable_code in join! and try_join! for Infallible (#​8518)
• runtime: fix paused time auto-advancing when I/O wakes a task on current_thread (#​8595)
• sync: wake waiters outside the lock when closing a semaphore (#​8529)
• test: fix several flaky tests (#​8196, #​8427, #​8609)

Fixed (unstable)

• rt: keep io_uring op alive when submission fails after push (#​8185)

v1.53.2: Tokio v1.53.2

Compare Source

1.53.2 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#​8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#​8540)
• process: unregister Windows wait before closing child handle (#​8564)
• rt: drop blocking pool mutex before shutting down rejected task (#​8562)
• sync: fix mpsc index wraparound in block reclamation (#​8546)
• sync: forget mpsc Permit before sending value (#​8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#​8548)
• sync: wake broadcast Sender::closed outside mutex (#​8558)
• task: drop replaced waker outside lock in JoinSet (#​8554)
• time: drop timer lock before dropping waker in clear_entry (#​8552)
• time: expire timers directly on shutdown without rotating wheel (#​8570)

Fixed (unstable)

• fs: clamp io_uring read length to u32::MAX (#​8572)
• rt: ignore current_thread task dumps from other runtimes (#​8544)
• rt: preserve io_uring context if a completion waker panics (#​8566)
• sync: fix semaphore use-after-free and permit leak on tracing panic (#​8542)
• taskdump: restore deferred leaf wakes during capture (#​8445)
• time: drop stored waker when cancelling alt timer entry (#​8550)

---

Configuration

📅 Schedule: (in timezone Asia/Jakarta)

• Branch creation
  • "before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 6 additional dependencies were updated

Details:

Package	Change
github.com/klauspost/compress	v1.19.0 -> v1.19.2
github.com/mattn/go-isatty	v0.0.22 -> v0.0.24
github.com/valyala/fasthttp	v1.72.0 -> v1.73.0
golang.org/x/net	v0.56.0 -> v0.57.0
golang.org/x/sys	v0.46.0 -> v0.47.0
golang.org/x/text	v0.38.0 -> v0.40.0

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock

    Updating crates.io index
error: failed to select a version for `reqwest`.
    ... required by package `media-proxy v0.1.0 (/tmp/renovate/repos/github/NezuChan/media-proxy)`
versions that meet the requirements `^0.13` are: 0.13.5, 0.13.4, 0.13.3, 0.13.2, 0.13.1, 0.13.0

package `media-proxy` depends on `reqwest` with feature `rustls-tls` but `reqwest` does not have that feature.
help: available features: __native-tls, __native-tls-alpn, __rustls, __rustls-aws-lc-rs, __tls, blocking, brotli, charset, cookies, default, default-tls, deflate, form, gzip, h2, hickory-dns, http2, http3, json, multipart, native-tls, native-tls-no-alpn, native-tls-vendored, native-tls-vendored-no-alpn, query, rustls, rustls-native-certs, rustls-no-provider, socks, stream, system-proxy, webpki-roots, zstd


failed to select a version for `reqwest` which could resolve this conflict