krystv's picture
fix: restore production-safe cross-platform reqwest backend after impersonation API audit
e24324c verified
[package]
name = "bex-core"
version = "2.1.1"
edition = "2021"
[dependencies]
bex-types = { workspace = true }
bex-pkg = { workspace = true }
bex-db = { workspace = true }
bex-js = { workspace = true }
anyhow = { workspace = true }
tokio = { workspace = true }
serde = { workspace = true }
serde_json = { workspace = true }
serde_yaml = { workspace = true }
tracing = { workspace = true }
# Production-safe default HTTP backend.
#
# IMPORTANT:
# - This is the portable/cross-platform default for Linux/macOS/Windows and most app embedding.
# - It does browser-like HTTP headers, cookies, HTTP/2, compression, and session persistence.
# - It does NOT provide byte-identical Chrome TLS JA3/JA4. For advanced CF/DataDome-level
# bypass you need a BoringSSL/curl-impersonate backend, which must be validated per target.
#
# The previous experimental rquest dependency was intentionally removed because the exact
# crate version/API was not verified in this environment and could make the repo fail to build.
reqwest = { version = "0.12", default-features = false, features = [
"rustls-tls",
"json",
"gzip",
"brotli",
"deflate",
"cookies",
"http2",
] }
wasmtime = { version = "30", features = ["component-model", "cranelift", "parallel-compilation"] }
wasmtime-wasi = "30"
wasmtime-wasi-io = "30"
rand = "0.8"
parking_lot = "0.12"
indexmap = "2"
bytes = "1"
sha2 = "0.10"
hmac = "0.12"
hex = "0.4"
fs4 = "0.12"
url = "2"