Reqwest does not have default-features set to false

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe the bug

Renovate did a cargo update to our dependencies. We pin all reqwest usage to use rustls instead of native-tls. Spent a few hours this morning trying to understand why our workspace now tries to compile openssl-sys, and found the culprit:

ory-client update from 1.9.0 to 1.17.2: the reqwest dependency lost its default-features = false setting. Now it pulls hyper-tls with native-tls and openssl, and fails in our CI that checks we do not have dynamic linking to any dependencies.

Could we get this setting back to the reqwest dependency? Or does ory's rust-client now depend on native-tls features?

Reproducing the bug

Update ory-client from 1.9.0 to 1.17.2. Compile without openssl installed and observe a build failure.

Relevant log output

error: failed to run custom build command for `openssl-sys v0.9.106`
note: To improve backtraces for build dependencies, set the CARGO_PROFILE_DEV_BUILD_OVERRIDE_DEBUG=true environment variable to enable debug information generation.

Caused by:
  process didn't exit successfully: `/home/runner/work/grafbase/grafbase/target/debug/build/openssl-sys-90bf1def39477aa3/build-script-main` (exit status: 101)
  --- stdout
  cargo:rustc-check-cfg=cfg(osslconf, values("OPENSSL_NO_OCB", "OPENSSL_NO_SM4", "OPENSSL_NO_SEED", "OPENSSL_NO_CHACHA", "OPENSSL_NO_CAST", "OPENSSL_NO_IDEA", "OPENSSL_NO_CAMELLIA", "OPENSSL_NO_RC4", "OPENSSL_NO_BF", "OPENSSL_NO_PSK", "OPENSSL_NO_DEPRECATED_3_0", "OPENSSL_NO_SCRYPT", "OPENSSL_NO_SM3", "OPENSSL_NO_RMD160", "OPENSSL_NO_EC2M", "OPENSSL_NO_OCSP", "OPENSSL_NO_CMS", "OPENSSL_NO_COMP", "OPENSSL_NO_SOCK", "OPENSSL_NO_STDIO", "OPENSSL_NO_EC", "OPENSSL_NO_SSL3_METHOD", "OPENSSL_NO_KRB5", "OPENSSL_NO_TLSEXT", "OPENSSL_NO_SRP", "OPENSSL_NO_RFC3779", "OPENSSL_NO_SHA", "OPENSSL_NO_NEXTPROTONEG", "OPENSSL_NO_ENGINE", "OPENSSL_NO_BUF_FREELISTS", "OPENSSL_NO_RC2"))
  cargo:rustc-check-cfg=cfg(openssl)
  cargo:rustc-check-cfg=cfg(libressl)
  cargo:rustc-check-cfg=cfg(boringssl)
  cargo:rustc-check-cfg=cfg(libressl250)

Relevant configuration

Version

1.17.2

On which operating system are you observing this issue?

Linux

In which environment are you deploying?

None

Additional Context

No response

Start by inspecting the reqwest dependency declaration and compare the 1.9.0 and 1.17.2 dependency configuration. Reproduce the update on Linux without OpenSSL installed, then verify that the dependency no longer pulls native-tls, hyper-tls, or openssl-sys while the client still builds.