tl;dr

• Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
• Add ClientBuilder::http2_keep_alive_* options for the blocking client.
• Add TLS 1.3 support when using native-tls backend.
• Fix redirect handling to strip sensitive headers when the scheme changes.
• Fix HTTP/3 happy-eyeball connection creation.
• Upgrade hickory-resolver to 0.26.

What's Changed

• fix(tls): improve rustls-no-provider panic message and add module docs by @smythg4 in #3021
• fix: do not lose the url in error when decoding json by @Dushistov in #3026
• Add tls_sslkeylogfile builder method by @passcod in #2923
• fix(redirect): strip sensitive headers on scheme change across redirects by @SAY-5 in #3034
• chore: upgrade MSRV to 1.85 by @seanmonstar in #3038
• chore: clean up minimal-versions CI job by @seanmonstar in #3039
• fix(http3): use happy eyeballs for h3 connect by @lyuzichong in #3030
• fix: update hickory-resolver to 0.26 and adjust code accordingly by @seanmonstar in #3040
• fix: remove unwrap in hickory initialization by @mat813 in #3041
• feat(https): support TLS 1.3 as min version under native-tls 🎉 by @AverageHelper in #2975
• Expose keep alive configurations in blocking client by @aeb-dev in #3043
• Prepare v0.13.4 by @seanmonstar in #3046

New Contributors

• @smythg4 made their first contribution in #3021
• @Dushistov made their first contribution in #3026
• @SAY-5 made their first contribution in #3034
• @mat813 made their first contribution in #3041
• @AverageHelper made their first contribution in #2975
• @aeb-dev made their first contribution in #3043

Full Changelog: v0.13.3...v0.13.4

• Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
• Add ClientBuilder::http2_keep_alive_* options for the blocking client.
• Add TLS 1.3 support when using native-tls backend.
• Fix redirect handling to strip sensitive headers when the scheme changes.
• Fix HTTP/3 happy-eyeball connection creation.
• Upgrade hickory-resolver to 0.26.

tl;dr

• Fix CertificateRevocationList parsing of PEM values.
• Fix logging in resolver to only show host, not full URL.
• Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
• Fix HTTP/3 to handle STOP_SENDING as not an error.
• Fix HTTP/3 pool to remove timed out QUIC connections.
• Fix HTTP/3 connection establishment picking IPv4 and IPv6.
• Upgrade rustls-platform-verifier.
• (wasm) Only use wasm-bindgen on unknown-* targets.

What's Changed

• Update docs.rs Features by @JamesWiresmith in #2961
• fix: fallback to hickory_resolver's default config if reading /etc/resolv.conf fails by @monosans in #2797
• fix: remove timeout con by @cuiweixie in #2967
• http3: handle stop_sending without error by @anuraaga in #2978
• resolve: debug log to change only host by @lms0806 in #2992
• Edit reference link by @lms0806 in #2996
• docs: more accurate about default HTTP2 window sizes by @seanmonstar in #3007
• [HTTP/3] Optimize IPv6 fallback and enforce HTTPS scheme #2911 by @lyuzichong in #3006
• Upgrade rustls-platform-verifier by @jplatte in #3010
• use wasm-bindgen ecosystem only for wasm32-unknown-* target by @Ludea in #3000
• fix rustls crl pem parsing by @Threated in #3013
• docs(retry): include ReqRep in docsrs by @seanmonstar in #3020

New Contributors

• @JamesWiresmith made their first contribution in #2961
• @monosans made their first contribution in #2797
• @cuiweixie made their first contribution in #2967
• @anuraaga made their first contribution in #2978
• @lms0806 made their first contribution in #2992
• @lyuzichong made their first contribution in #3006
• @Ludea made their first contribution in #3000

Full Changelog: v0.13.2...v0.13.3

• Fix CertificateRevocationList parsing of PEM values.
• Fix logging in resolver to only show host, not full URL.
• Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
• Fix HTTP/3 to handle STOP_SENDING as not an error.
• Fix HTTP/3 pool to remove timed out QUIC connections.
• Fix HTTP/3 connection establishment picking IPv4 and IPv6.
• Upgrade rustls-platform-verifier.
• (wasm) Only use wasm-bindgen on unknown-* targets.

tl;dr

• Fix HTTP/2 and native-tls ALPN feature combinations.
• Fix HTTP/3 to send h3 ALPN.
• (wasm) fix RequestBuilder::json() from override previously set content-type.

What's Changed

• chore(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in #2921
• Update readme for 0.13 by @VojtaStanek in #2926
• fix http2 feature is not enabled for "native-tls" by @fox0 in #2927
• chore(deps): remove unused webpki-roots and rustls-native-certs by @seanmonstar in #2932
• docs: native-tls-alpn has changed to native-tls-no-alpn by @seanmonstar in #2940
• Specify h3 alpn for http3 connector by @passcod in #2929
• update copyright year to 2026 by @taozui472 in #2943
• fix(json): custom content-type overidden by json method for wasm by @Narendran-KT in #2908
• chore: upgrade wasm-streams to v0.5 by @xangelix in #2958
• chore(ci): add windows and linux arm64 to ci by @dennisameling in #2960

New Contributors

• @VojtaStanek made their first contribution in #2926
• @fox0 made their first contribution in #2927
• @passcod made their first contribution in #2929
• @taozui472 made their first contribution in #2943
• @Narendran-KT made their first contribution in #2908
• @xangelix made their first contribution in #2958
• @dennisameling made their first contribution in #2960

Full Changelog: v0.13.1...v0.13.2

• Fix HTTP/2 and native-tls ALPN feature combinations.
• Fix HTTP/3 to send h3 ALPN.
• (wasm) fix RequestBuilder::json() from override previously set content-type.

What's Changed

• http3: depend on quinn/rustls-aws-lc-rs to avoid ring dependency by @djc in #2917
• fix rustls on android by @seanmonstar in #2918

Full Changelog: v0.13.0...v0.13.1

• Fixes compiling with rustls on Android targets.

v0.13.0

• Breaking changes:
  • rustls is now the default TLS backend, instead of native-tls.
  • rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)
  • rustls-tls has been renamed to rustls.
  • rustls roots features removed, rustls-platform-verifier is used by default.
    • To use different roots, call tls_certs_only(your_roots).
  • native-tls now includes ALPN. To disable, use native-tls-no-alpn.
  • query and form are now crate features, disabled by default.
  • Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).
• Many TLS-related methods renamed to improve autocompletion and discovery, but previous name left in place with a "soft" deprecation. (just documented, no warnings)
  • For example, prefer tls_backend_rustls() over use_rustls_tls().

Breaking changes

• rustls is now the default TLS backend, instead of native-tls.
• rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)
• rustls-tls has been renamed to rustls.
• rustls roots features removed, rustls-platform-verifier is used by default.
  • To use different roots, call tls_certs_only(your_roots).
• native-tls now includes ALPN. To disable, use native-tls-no-alpn.
• query and form are now crate features, disabled by default.
• Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).
• Many TLS-related methods renamed to improve autocompletion and discovery, but previous name left in place with a "soft" deprecation. (just documented, no warnings)
  • For example, prefer tls_backend_rustls() over use_rustls_tls().

Pull Requests in General

• start 0.13 dev by @seanmonstar in #2894
• Make serde optional by introducing query, form features, and re-working WASM header parsing by @CathalMullan in #2858
• replace ClientBuilder::dns_resolver with dns_resolver2 by @seanmonstar in #2898
• feat: make Rustls the default TLS provider by @calavera in #2897
• feat: consolidate TLS options with rustls-platform-verifier by @seanmonstar in #2891
• remove long-deprecated methods: trust-dns and non-wasm-cors by @seanmonstar in #2899
• rename rustls-tls feature to just rustls by @seanmonstar in #2900
• remove deprecated features trust-dns and macos-system-configuration by @seanmonstar in #2901
• chore: separate rustls and rustls-no-provider features by @seanmonstar in #2903
• rustls: allow windows to use extra roots by @seanmonstar in #2904
• v0.13.0-rc.1 by @seanmonstar in #2905
• Enable ALPN by default in native-tls by @ducaale in #2907
• v0.13.0 by @seanmonstar in #2915

New Contributors

• @CathalMullan made their first contribution in #2858

Full Changelog: v0.12.28...v0.13.0

👀 Discussion here if you give it try, thanks!

Main breaking changes

• rustls is now default instead of native-tls
• rustls provider defaults to aws-lc instead of ring (rustls-no-provider exists if you want to enable a different one)
• rustls-tls renamed to rustls
• rustls roots features removed, platform-verifier is used instead
  • To use different roots instead, use tls_certs_only(your_roots).
• Many TLS-related methods renamed, but previous name left in place with a "soft" deprecated (just documented, no warnings).
• query and form are now crate features, disabled by default
• Long-deprecated methods and crate features have been removed.

PRs

• start 0.13 dev by @seanmonstar in #2894
• Make serde optional by introducing query, form features, and re-working WASM header parsing by @CathalMullan in #2858
• replace ClientBuilder::dns_resolver with dns_resolver2 by @seanmonstar in #2898
• feat: make Rustls the default TLS provider by @calavera in #2897
• feat: consolidate TLS options with rustls-platform-verifier by @seanmonstar in #2891
• remove long-deprecated methods: trust-dns and non-wasm-cors by @seanmonstar in #2899
• rename rustls-tls feature to just rustls by @seanmonstar in #2900
• remove deprecated features trust-dns and macos-system-configuration by @seanmonstar in #2901
• chore: separate rustls and rustls-no-provider features by @seanmonstar in #2903
• rustls: allow windows to use extra roots by @seanmonstar in #2904
• v0.13.0-rc.1 by @seanmonstar in #2905

New Contributors

• @CathalMullan made their first contribution in #2858

Full Changelog: v0.12.28...v0.13.0-rc.1

What's Changed

• fix: correctly import TokioIo on Windows by @seanmonstar in #2896

Full Changelog: v0.12.27...v0.12.28

• Fix compiling on Windows if TLS and SOCKS features are not enabled.

tl;dr

• Add ClientBuilder::windows_named_pipe(name) option that will force all requests over that Windows Named Pipe.

What's Changed

• chore: Disable unused tokio-util codec feature by @tottoto in #2893
• chore: Use http_body_util::BodyDataStream by @tottoto in #2892
• feat: add windows_named_pipe() option to client builder by @seanmonstar in #2789

Full Changelog: v0.12.26...v0.12.27

• Add ClientBuilder::windows_named_pipe(name) option that will force all requests over that Windows Named Piper.

tl;dr

• Fix sending Accept-Encoding header only with values configured with reqwest, regardless of underlying tower-http config.

What's Changed

• deps: update cookie_store by @seanmonstar in #2886
• fix: disable default compression from tower-http if not enabled in reqwest by @seanmonstar in #2889
• fix(http3): correct compression defaults by @seanmonstar in #2890

Full Changelog: v0.12.25...v0.12.26

• Fix sending Accept-Encoding header only with values configured with reqwest, regardless of underlying tower-http config.

Highlights

• Add Error::is_upgrade() to determine if the error was from an HTTP upgrade.
• Fix sending Proxy-Authorization if only username is configured.
• Fix sending Proxy-Authorization to HTTPS proxies when the target is HTTP.
• Refactor internal decompression handling to use tower-http.

What's Changed

• tests: fix wasm timeout test with uncached response by @seanmonstar in #2853
• docs: document connection pooling behavior by @vinzmyko in #2851
• docs: document WASM client by @vinzmyko in #2859
• chore: minor improvement for docs by @black5box in #2862
• fix: send proxy-authorization even with empty password by @barjin in #2868
• feat(error): add is_upgrade method to detect protocol upgrade errors by @0x676e67 in #2822
• Use decompression from tower-http by @ducaale in #2840
• fix(proxy): forward Proxy-Authorization header to HTTPS proxies for HTTP targets by @0x676e67 in #2872
• v0.12.25 by @seanmonstar in #2880

New Contributors

• @vinzmyko made their first contribution in #2851
• @black5box made their first contribution in #2862
• @barjin made their first contribution in #2868

Full Changelog: v0.12.24...v0.12.25

• Add Error::is_upgrade() to determine if the error was from an HTTP upgrade.
• Fix sending Proxy-Authorization if only username is configured.
• Fix sending Proxy-Authorization to HTTPS proxies when the target is HTTP.
• Refactor internal decompression handling to use tower-http.

• Refactor cookie handling to an internal middleware.
• Refactor internal random generator.
• Refactor base64 encoding to reduce a copy.
• Documentation updates.

• Add ClientBuilder::unix_socket(path) option that will force all requests over that Unix Domain Socket.
• Add ClientBuilder::retry(policy) and reqwest::retry::Builder to configure automatic retries.
• Add ClientBuilder::dns_resolver2() with more ergonomic argument bounds, allowing more resolver implementations.
• Add http3_* options to blocking::ClientBuilder.
• Fix default TCP timeout values to enabled and faster.
• Fix SOCKS proxies to default to port 1080
• (wasm) Add cache methods to RequestBuilder.

• Fix socks proxies when resolving IPv6 destinations.

• Fix socks proxy to use socks4a:// instead of socks4h://.
• Fix Error::is_timeout() to check for hyper and IO timeouts too.
• Fix request Error to again include URLs when possible.
• Fix socks connect error to include more context.
• (wasm) implement Default for Body.

• Add ClientBuilder::tcp_user_timeout(Duration) option to set TCP_USER_TIMEOUT.
• Fix proxy headers only using the first matched proxy.
• (wasm) Fix re-adding Error::is_status().

• Fix redirect that changes the method to GET should remove payload headers.
• Fix redirect to only check the next scheme if the policy action is to follow.
• (wasm) Fix compilation error if cookies feature is enabled (by the way, it's a noop feature in wasm).

• Fix compilation when socks enabled without TLS.

• Fix compilation on macOS.

• Add ClientBuilder::http3_congestion_bbr() to enable BBR congestion control.
• Add ClientBuilder::http3_send_grease() to configure whether to send use QUIC grease.
• Add ClientBuilder::http3_max_field_section_size() to configure the maximum response headers.
• Add ClientBuilder::tcp_keepalive_interval() to configure TCP probe interval.
• Add ClientBuilder::tcp_keepalive_retries() to configure TCP probe count.
• Add Proxy::headers() to add extra headers that should be sent to a proxy.
• Fix redirect::Policy::limit() which had an off-by-1 error, allowing 1 more redirect than specified.
• Fix HTTP/3 to support streaming request bodies.
• (wasm) Fix null bodies when calling Response::bytes_stream().

• Fix Windows to support both ProxyOverride and NO_PROXY.
• Fix http3 to support streaming response bodies.
• Fix http3 dependency from public API misuse.

• Fix missing fetch_mode_no_cors(), marking as deprecated when not on WASM.

• Add Form::into_reader() for blocking multipart forms.
• Add Form::into_stream() for async multipart forms.
• Add support for SOCKS4a proxies.
• Fix decoding responses with multiple zstd frames.
• Fix RequestBuilder::form() from overwriting a previously set Content-Type header, like the other builder methods.
• Fix cloning of request timeout in blocking::Request.
• Fix http3 synchronization of connection creation, reducing unneccesary extra connections.
• Fix Windows system proxy to use ProxyOverride as a NO_PROXY value.
• Fix blocking read to correctly reserve and zero read buffer.
• (wasm) Add support for request timeouts.
• (wasm) Fix Error::is_timeout() to return true when from a request timeout.

• (wasm) Fix compilation by not compiler tokio/time on WASM.

• Fix decompression returning an error when HTTP/2 ends with an empty data frame.

• Add ClientBuilder::connector_layer() to allow customizing the connector stack.
• Add ClientBuilder::http2_max_header_list_size() option.
• Fix propagating body size hint (content-length) information when wrapping bodies.
• Fix decompression of chunked bodies so the connections can be reused more often.

• Add tls::CertificateRevocationLists support.
• Add crate features to enable webpki roots without selecting a rustls provider.
• Fix connection_verbose() to output read logs.
• Fix multipart::Part::file() to automatically include content-length.
• Fix proxy to internally no longer cache system proxy settings.

• Add support for SOCKS4 proxies.
• Add multipart::Form::file() method for adding files easily.
• Add Body::wrap() to wrap any http_body::Body type.
• Fix the pool configuration to use a timer to remove expired connections.

• Revert adding impl Service<http::Request<_>> for Client.

• Add support for danger_accept_invalid_hostnames for rustls.
• Add impl Service<http::Request<Body>> for Client and &'_ Client.
• Add support for !Sync bodies in Body::wrap_stream().
• Enable happy eyeballs when hickory-dns is used.
• Fix Proxy so that HTTP(S)_PROXY values take precedence over ALL_PROXY.
• Fix blocking::RequestBuilder::header() from unsetting sensitive on passed header values.

• Add blocking::ClientBuilder::dns_resolver() method to change DNS resolver in blocking client.
• Add http3 feature back, still requiring reqwest_unstable.
• Add rustls-tls-no-provider Cargo feature to use rustls without a crypto provider.
• Fix Accept-Encoding header combinations.
• Fix http3 resolving IPv6 addresses.
• Internal: upgrade to rustls 0.23.

• Add zstd support, enabled with zstd Cargo feature.
• Add ClientBuilder::read_timeout(Duration), which applies the duration for each read operation. The timeout resets after a successful read.

• Add FromStr for dns::Name.
• Add ClientBuilder::built_in_webpki_certs(bool) to enable them separately.
• Add ClientBuilder::built_in_native_certs(bool) to enable them separately.
• Fix sending content-length: 0 for GET requests.
• Fix response body content_length() to return value when timeout is configured.
• Fix ClientBuilder::resolve() to use lowercase domain names.

• Fix missing ALPN when connecting to socks5 proxy with rustls.
• Fix TLS version limits with rustls.
• Fix not detected ALPN h2 from server with native-tls.

• Fix ClientBuilder::interface() when no TLS is enabled.
• Fix TlsInfo::peer_certificate() being truncated with rustls.
• Fix panic if http2 feature disabled but TLS negotiated h2 in ALPN.
• Fix Display for Error to not include its source error.

v0.12.0

• Upgrade to hyper, http, and http-body v1.
• Add better support for converting to and from http::Request and http::Response.
• Add http2 optional cargo feature, default on.
• Add charset optional cargo feature, default on.
• Add macos-system-configuration cargo feature, default on.
• Change all optional dependencies to no longer be exposed as implicit features.
• Add ClientBuilder::interface(str) to specify the local interface to bind to.
• Experimental: disables the http3 feature temporarily.

• Add hickory-dns feature, deprecating trust-dns.
• (wasm) Fix Form::text() to not set octet-stream for plain text fields.

• Revert system-configuration upgrade, which broke MSRV on macOS.

• Fix Certificate::from_pem_bundle() parsing.
• Fix Apple linker errors from detecting system proxies.

• Add Certificate::from_pem_bundle() to add a bundle.
• Add http3_prior_knowledge() to blocking client builder.
• Remove Sync bounds requirement for Body::wrap_stream().
• Fix HTTP/2 to retry REFUSED_STREAM requests.
• Fix instances of converting Url to Uri that could panic.

• Add Proxy::custom_http_auth(val) for setting the raw Proxy-Authorization header when connecting to proxies.
• Fix redirect to reject locations that are not http:// or https://.
• Fix setting nodelay when TLS is enabled but URL is HTTP.
• (wasm) Add ClientBuilder::user_agent(val).
• (wasm) add multipart::Form::headers(headers).

• Fix compilation on Windows when trust-dns is enabled.

• Add automatically detecting macOS proxy settings.
• Add ClientBuilder::tls_info(bool), which will put tls::TlsInfo into the response extensions.
• Fix trust-dns resolver from possible hangs.
• Fix connect timeout to be split among multiple IP addresses.

• Fix deflate decompression back to using zlib, as outlined in the spec.

• Add ClientBuilder::http1_ignore_invalid_headers_in_responses() option.
• Add ClientBuilder::http1_allow_spaces_after_header_name_in_responses() option.
• Add support for ALL_PROXY environment variable.
• Add support for use_preconfigured_tls when combined with HTTP/3.
• Fix deflate decompression from using the zlib decoder.
• Fix Response::{text, text_with_charset}() to strip BOM characters.
• Fix a panic when HTTP/3 is used if UDP isn't able to connect.
• Fix some dependencies for HTTP/3.
• Increase MSRV to 1.63.

• Fix RequestBuilder::json() method from overriding a previously set content-type header. An existing value will be left in place.
• Upgrade internal dependencies for rustls and compression.

• Upgrade internal dependencies of Experimental HTTP/3 to use quinn v0.9
• (wasm) Fix blob url support

• Chore: set MSRV in Cargo.toml.
• Docs: fix build on docs.rs

• Add RequestBuilder methods to split and reconstruct from its parts.
• Add experimental HTTP/3 support.
• Fix connection_verbose to log write_vectored calls.
• (wasm) Make requests actually cancel if the future is dropped.

• Adds Proxy::no_proxy(url) that works like the NO_PROXY environment variable.
• Adds multipart::Part::headers(headers) method to add custom headers.
• (wasm) Add Response::bytes_stream().
• Perf: several internal optimizations reducing copies and memory allocations.

• Add ClientBuilder::dns_resolver() option for custom DNS resolvers.
• Add ClientBuilder::tls_sni(bool) option to enable or disable TLS Server Name Indication.
• Add Identity::from_pkcs8_pem() constructor when using native-tls.
• Fix redirect::Policy::limited(0) from following any redirects.

• Add ClientBuilder::resolve_to_addrs() which allows a slice of IP addresses to be specified for a single host.
• Add Response::upgrade() to await whether the server agrees to an HTTP upgrade.

• Add HTTP/2 keep-alive configuration methods on ClientBuilder.
• Add ClientBuilder::http1_allow_obsolete_multiline_headers_in_responses().
• Add impl Service<Request> for Client and &'_ Client.
• (wasm) Add RequestBuilder::basic_auth().
• Fix RequestBuilder::header to not override sensitive if user explicitly set on a HeaderValue.
• Fix rustls parsing of elliptic curve private keys.
• Fix Proxy URL parsing of some invalid targets.

• Add Error::url() to access the URL of an error.
• Add Response::extensions() to access the http::Extensions of a response.
• Fix rustls-native-certs to log an error instead of panicking when loading an invalid system certificate.
• Fix passing Basic Authorization header to proxies.

• Add ClientBuilder::http09_responses(bool) option to allow receiving HTTP/0.9 responses.
• Fix HTTP/2 to retry requests interrupted by an HTTP/2 graceful shutdown.
• Fix proxy loading from environment variables to ignore empty values.

• Update internal webpki-roots dependency.

• Add blocking::ClientBuilder::resolve() option, matching the async builder.
• Implement From<tokio::fs::File> for Body.
• Fix blocking request-scoped timeout applying to bodies as well.
• (wasm) Fix request bodies using multipart vs formdata.
• Update internal rustls to 0.20.

• (wasm) Fix request bodies more.

• Add ClientBuilder::http1_only() method.
• Add tls::Version type, and ClientBuilder::min_tls_version() and ClientBuilder::max_tls_version() methods.
• Implement TryFrom<Request> for http::Request.
• Implement Clone for Identity.
• Fix NO_PROXYenvironment variable parsing to more closely match curl's. Comma-separated entries are now trimmed for whitespace, and * is allowed to match everything.
• Fix redirection to respect https_only option.
• (wasm) Add Body::as_bytes() method.
• (wasm) Fix sometimes wrong conversation of bytes into a JsValue.
• (wasm) Avoid dependency on serde-serialize feature.

• Add ClientBuilder::resolve() option to override DNS resolution for specific domains.
• Add native-tls-alpn Cargo feature to use ALPN with the native-tls backend.
• Add ClientBuilder::deflate() option and deflate Cargo feature to support decoding response bodies using deflate.
• Add RequestBuilder::version() to allow setting the HTTP version of a request.
• Fix allowing "invalid" certificates with the rustls-tls backend, when the server uses TLS v1.2 or v1.3.
• (wasm) Add try_clone to Request and RequestBuilder

• Add impl From<hyper::Body> for reqwest::Body.
• (wasm) Add credentials mode methods to RequestBuilder.