Remove curl dependency from crates-io crate by arlosi · Pull Request #16936 · rust-lang/cargo

arlosi · 2026-04-23T19:13:14Z

What does this PR try to resolve?

Converts the crates-io crate to be HTTP Client agnostic. It now uses a trait to execute HTTP requests. This enables users of the library to use any HTTP library they like, rather than only supporting curl.

Within cargo, an HttpClient using http_async is added (which uses curl internally).

cc #16845

How to test and review this PR?

Commit by commit. Could be tested on on live crates.io, but I have not done this.

rustbot · 2026-04-23T19:13:20Z

r? @weihanglo

rustbot has assigned @weihanglo.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Why was this reviewer chosen?

The reviewer was selected based on:

Owners of files modified in this PR: @ehuss, @epage, @weihanglo
@ehuss, @epage, @weihanglo expanded to ehuss, epage, weihanglo
Random selection from ehuss, epage, weihanglo

arlosi · 2026-04-23T21:28:02Z

This is a breaking change for the crates-io crate which removes curl and requires users to provide their own HTTP client implementation using curl or another http request library.

@rfcbot fcp merge cargo

weihanglo · 2026-04-24T15:32:56Z

See #16936 (comment).

@rfcbot fcp merge cargo

rust-rfcbot · 2026-04-24T15:32:58Z

Team member @weihanglo has proposed to merge this. The next step is review by the rest of the tagged team members:

No concerns currently listed.

Once a majority of reviewers approve (and at most 2 approvals are outstanding), this will enter its final comment period. If you spot a major issue that hasn't been raised at any point in this process, please speak up!

See this document for info about what commands tagged team members can give me.

weihanglo · 2026-04-24T15:57:24Z


 [dependencies]
-curl.workspace = true
+http.workspace = true


Should we enhance docs talking about how to restore the curl backend behavior?

If it is not worthy, leave it :)

View changes since the review

I'm kinda split about that. I have a branch that adds a curl feature to provide a CurlClient that implements the trait and gives users a way back to the old behavior. However, since Cargo wouldn't be enabling the feature, it would have less coverage.

0xPoe

Thanks!

View changes since this review

weihanglo

Looks good. Thanks!

View changes since this review

rust-rfcbot · 2026-04-28T14:03:45Z

🔔 This is now entering its final comment period, as per the review above. 🔔

The request_blocking method does not use the `Client`-level timeout management, since it blocks, running the request on the current thread. This leaves the request_blocking method with no timeout configured. The change adds the timeout for consistency with the `http::http_handle` method.

This is needed since in our testing framework we use file:// URLs. With upload(true), the test files are overwritten as empty before they are read. This leads to the yank tests failing. In a real (non-file://) registry api, this would have no impact.

This is a breaking change in the crates-io crate. It removes the dependency on curl. Users using this crate will need to provide their own implementation of the HttpClient trait using curl or another http request library.

rustbot · 2026-04-28T15:53:15Z

This PR was rebased onto a different master commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

weihanglo · 2026-04-28T17:00:00Z

I don't think this require 10-day full FCP as it is a major version release not a breaking change in Cargo itself. Let's merge it right now.

Update cargo submodule 10 commits in eb9b60f1f6604b5e022c56be31692c215b8ba11d..4f9b52075316e9ced380c8fa492858048d5758b6 2026-04-24 20:52:07 +0000 to 2026-05-01 22:36:41 +0000 - chore(deps): update compatible (rust-lang/cargo#16952) - feat(lints): Add deny-by-default text_direction_codepoint lints (rust-lang/cargo#16950) - chore(deps): update embarkstudios/cargo-deny-action action to v2.0.17 (rust-lang/cargo#16953) - docs(guide): Switch from third-party to first-party unused deps detection (rust-lang/cargo#16946) - Remove curl dependency from crates-io crate (rust-lang/cargo#16936) - chore(deps): update gix to 0.83 (rust-lang/cargo#16945) - fix(compile): Where possible, hint about misplaced deps (rust-lang/cargo#16940) - Remove `windows-sys` from `home` (rust-lang/cargo#16918) - docs(resolver): `--precise <yanked>` is on stable (rust-lang/cargo#16944) - Update `gix` to 0.82 (with security fixes and hardened parsers) (rust-lang/cargo#16941)

rustbot assigned weihanglo Apr 23, 2026

rustbot added A-interacts-with-crates.io Area: interaction with registries A-networking Area: networking issues, curl, etc. Command-publish S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Apr 23, 2026

arlosi changed the title ~~Async/easy~~ Remove curl dependency from crates-io crate Apr 23, 2026

arlosi mentioned this pull request Apr 23, 2026

Tracking Issue for async http #16845

Open

6 tasks

weihanglo reviewed Apr 23, 2026

View reviewed changes

Comment thread crates/crates-io/lib.rs

arlosi force-pushed the async/easy branch 2 times, most recently from 9c0e0d7 to 54ea404 Compare April 23, 2026 19:54

This comment was marked as outdated.

Sign in to view

weihanglo added the T-cargo Team: Cargo label Apr 24, 2026

rust-rfcbot added proposed-final-comment-period An FCP proposal has started, but not yet signed off. disposition-merge FCP with intent to merge labels Apr 24, 2026

weihanglo reviewed Apr 24, 2026

View reviewed changes

0xPoe reviewed Apr 27, 2026

View reviewed changes

Comment thread crates/crates-io/lib.rs Outdated

arlosi force-pushed the async/easy branch from 54ea404 to 522bc69 Compare April 28, 2026 00:47

This comment has been minimized.

Sign in to view

weihanglo approved these changes Apr 28, 2026

View reviewed changes

ehuss added this to Cargo status tracker Apr 28, 2026

ehuss moved this to FCP merge in Cargo status tracker Apr 28, 2026

rust-rfcbot added final-comment-period FCP — a period for last comments before action is taken and removed proposed-final-comment-period An FCP proposal has started, but not yet signed off. labels Apr 28, 2026

arlosi added 4 commits April 28, 2026 10:51

Add enum for crates.io token errors

62fe7be

Add non_exhaustive to Error enum

dc90527

Convert crates-io crate to use http_async

9efb2be

This is a breaking change in the crates-io crate. It removes the dependency on curl. Users using this crate will need to provide their own implementation of the HttpClient trait using curl or another http request library.

arlosi force-pushed the async/easy branch from 522bc69 to 9efb2be Compare April 28, 2026 15:53

weihanglo added this pull request to the merge queue Apr 28, 2026

Merged via the queue into rust-lang:master with commit bbc9162 Apr 28, 2026
31 checks passed

rustbot removed the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Apr 28, 2026

rustbot mentioned this pull request Apr 28, 2026

fix(search): follow http redirects #15593

Draft

weihanglo mentioned this pull request May 2, 2026

Update cargo submodule rust-lang/rust#156069

Merged

rustbot added this to the 1.97.0 milestone May 2, 2026

Conversation

arlosi commented Apr 23, 2026

What does this PR try to resolve?

How to test and review this PR?

Uh oh!

rustbot commented Apr 23, 2026

Uh oh!

Uh oh!

arlosi commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

weihanglo commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rust-rfcbot commented Apr 24, 2026 • edited by Eh2406 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

weihanglo Apr 24, 2026 • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arlosi Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

0xPoe left a comment • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment has been minimized.

weihanglo left a comment • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rust-rfcbot commented Apr 28, 2026

Uh oh!

rustbot commented Apr 28, 2026

Uh oh!

weihanglo commented Apr 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

arlosi commented Apr 23, 2026 •

edited

Loading

weihanglo commented Apr 24, 2026 •

edited

Loading

rust-rfcbot commented Apr 24, 2026 •

edited by Eh2406

Loading

weihanglo Apr 24, 2026 •

edited by rustbot

Loading

0xPoe left a comment •

edited by rustbot

Loading

weihanglo left a comment •

edited by rustbot

Loading