Bump esplora-client to 0.13 to switch from `reqwest` to `bitreq`
What the developer wrote
Authored by Matt Corallo
Bump esplora-client to 0.13 to switch from `reqwest` to `bitreq`
...fixing MSRV builds
What changed, and why it matters
This commit updates a dependency used to talk to Esplora blockchain servers from version 0.12 to 0.13, switching the underlying HTTP library from reqwest to bitreq. It also removes two CI workarounds that pinned older versions of idna_adapter and hyper-rustls to keep older Rust compiler (MSRV) builds working. The stated purpose is to fix MSRV builds, not to fix a security vulnerability. There is no direct evidence in the commit or supplied references that this change addresses an exploitable security issue.
Treat as routine dependency maintenance. If security review is desired, verify whether esplora-client 0.13 or bitreq addresses any disclosed vulnerabilities by checking upstream release notes and the bitreq/reqwest changelogs, but this commit itself does not demonstrate a security fix.
Security signals we found
Dependency version bump (esplora-client 0.12 -> 0.13)
HTTP backend switch (reqwest -> bitreq) in a transitive dependency
Removal of MSRV pins for idna_adapter and hyper-rustls
No security-related keywords or CVE references in commit message
Evidence from the diff
The patch bumps lightning-transaction-sync’s optional esplora-client dependency from 0.12 to 0.13. The new release replaces reqwest with bitreq as the HTTP backend, which removes transitive dependencies on hyper-rustls and idna_adapter. Consequently, the CI script no longer needs to pin those crates to older MSRV-compatible versions. The diff is purely a build/dependency maintenance change with no code-level security fix visible.
Changed components
lightning-transaction-sync/Cargo.tomlci/ci-tests-common.shesplora-client optional dependencyMSRV CI pipelineInspect captured patch +1 / −7
diff --git a/ci/ci-tests-common.sh b/ci/ci-tests-common.sh
index a14928d..f5313f7 100755
--- a/ci/ci-tests-common.sh
+++ b/ci/ci-tests-common.sh
@@ -17,12 +17,6 @@ PIN_RELEASE_DEPS # pin the release dependencies in our main workspace
# The backtrace v0.3.75 crate relies on rustc 1.82
[ "$RUSTC_MINOR_VERSION" -lt 82 ] && cargo update -p backtrace --precise "0.3.74" --quiet
-# Starting with version 1.2.0, the `idna_adapter` crate has an MSRV of rustc 1.81.0.
-[ "$RUSTC_MINOR_VERSION" -lt 81 ] && cargo update -p idna_adapter --precise "1.1.0" --quiet
-
-# Starting with version 0.27.8, the `hyper-rustls` crate has an MSRV of rustc 1.85.0.
-[ "$RUSTC_MINOR_VERSION" -lt 85 ] && cargo update -p hyper-rustls --precise "0.27.7" --quiet
-
# Starting with version 1.9.0, the `zeroize` crate uses Rust 2024.
[ "$RUSTC_MINOR_VERSION" -lt 85 ] && cargo update -p zeroize --precise "1.8.2" --quiet
diff --git a/lightning-transaction-sync/Cargo.toml b/lightning-transaction-sync/Cargo.toml
index d504cd2..077ac2c 100644
--- a/lightning-transaction-sync/Cargo.toml
+++ b/lightning-transaction-sync/Cargo.toml
@@ -37,7 +37,7 @@ lightning = { version = "0.3.0", path = "../lightning", default-features = false
lightning-macros = { version = "0.2", path = "../lightning-macros", default-features = false }
bitcoin = { version = "0.32.2", default-features = false }
futures = { version = "0.3", optional = true }
-esplora-client = { version = "0.12", default-features = false, optional = true }
+esplora-client = { version = "0.13", default-features = false, optional = true }
electrum-client = { version = "0.25", optional = true, default-features = false, features = ["proxy"] }
[dev-dependencies]
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.