Support TLS v1.3 on all platforms

Cargo.toml

@@ -46,7 +46,7 @@ eyeball-im-util = "0.10.0"
 futures-core = "0.3.31"
 futures-executor = "0.3.31"
 futures-util = "0.3.31"
-getrandom = { version = "0.2.15", default-features = false }
+getrandom = { version = "0.3.4", default-features = false }
 gloo-timers = "0.3.0"
 growable-bloom-filter = "2.1.1"
 hkdf = "0.12.4"
@@ -59,14 +59,15 @@ insta = { version = "1.44.1", features = ["json", "redactions"] }
 itertools = "0.14.0"
 js-sys = "0.3.82"
 mime = "0.3.17"
-oauth2 = { version = "5.0.0", default-features = false, features = ["reqwest", "timing-resistant-secret-traits"] }
+oauth2 = { version = "5.0.0", default-features = false, features = ["timing-resistant-secret-traits"] }
+oauth2-reqwest = { version = "0.1.0-alpha.1" }
 once_cell = "1.21.3"
 pbkdf2 = { version = "0.12.2" }
 pin-project-lite = "0.2.16"
-proptest = { version = "1.6.0", default-features = false, features = ["std"] }
+proptest = { version = "1.9.0", default-features = false, features = ["std"] }
 rand = "0.8.5"
 regex = "1.12.2"
-reqwest = { version = "0.12.24", default-features = false }
+reqwest = { version = "0.13.1", default-features = false }
 rmp-serde = "1.3.0"
 ruma = { git = "https://github.com/ruma/ruma", rev = "a5e8208d76d5fd7f82b04b7c86f877651d228b9a", features = [
     "client-api-c",

crates/matrix-sdk-common/Cargo.toml

@@ -65,7 +65,7 @@ wasm-bindgen-test.workspace = true
 
 [target.'cfg(target_family = "wasm")'.dev-dependencies]
 # Enable the JS feature for getrandom.
-getrandom = { workspace = true, default-features = false, features = ["js"] }
+getrandom = { workspace = true, default-features = false, features = ["wasm_js"] }
 js-sys.workspace = true
 
 [lints]

crates/matrix-sdk-indexeddb/Cargo.toml

@@ -60,7 +60,7 @@ zeroize.workspace = true
 
 [target.'cfg(target_family = "wasm")'.dependencies]
 # for wasm32 we need to activate this
-getrandom = { workspace = true, features = ["js"] }
+getrandom = { workspace = true, features = ["wasm_js"] }
 
 [dev-dependencies]
 assert_matches.workspace = true

crates/matrix-sdk-store-encryption/Cargo.toml

@@ -14,7 +14,7 @@ rustdoc-args = ["--cfg", "docsrs", "--generate-link-to-definition"]
 ignored = ["getrandom"] # We do manually enable a feature for it.
 
 [features]
-js = ["dep:getrandom", "getrandom?/js"]
+js = ["dep:getrandom", "getrandom?/wasm_js"]
 
 [dependencies]
 base64.workspace = true

crates/matrix-sdk/Cargo.toml

@@ -61,7 +61,7 @@ experimental-encrypted-state-events = [
 
 markdown = ["ruma/markdown"]
 native-tls = ["reqwest/native-tls"]
-rustls-tls = ["reqwest/rustls-tls"]
+rustls-tls = ["reqwest/rustls"]
 socks = ["reqwest/socks"]
 local-server = ["dep:axum", "dep:rand", "dep:tower"]
 sso-login = ["local-server"]
@@ -117,6 +117,7 @@ matrix-sdk-test = { workspace = true, optional = true }
 mime.workspace = true
 mime2ext = "0.1.54"
 oauth2.workspace = true
+oauth2-reqwest.workspace = true
 once_cell.workspace = true
 percent-encoding = "2.3.2"
 pin-project-lite.workspace = true

crates/matrix-sdk/src/authentication/oauth/http_client.rs

@@ -18,6 +18,7 @@ use matrix_sdk_base::BoxFuture;
 use oauth2::{
     AsyncHttpClient, ErrorResponse, HttpClientError, HttpRequest, HttpResponse, RequestTokenError,
 };
+use oauth2_reqwest::ReqwestClient;
 
 /// An HTTP client for making OAuth 2.0 requests.
 #[derive(Debug, Clone)]
@@ -54,7 +55,7 @@ impl<'c> AsyncHttpClient<'c> for OAuthHttpClient {
                 request
             };
 
-            let response = self.inner.call(request).await?;
+            let response = ReqwestClient::from(&self.inner).call(request).await?;
 
             Ok(response)
         })

crates/matrix-sdk/src/http_client/native.rs

@@ -195,15 +195,13 @@ impl HttpSettings {
                 "Adding {} additional root certificates to the HTTP client",
                 self.additional_root_certificates.len()
             );
-
-            for cert in &self.additional_root_certificates {
-                http_client = http_client.add_root_certificate(cert.clone());
-            }
         }
 
         if self.disable_built_in_root_certificates {
             info!("Built-in root certificates disabled in the HTTP client.");
-            http_client = http_client.tls_built_in_root_certs(false);
+            http_client = http_client.tls_certs_only(self.additional_root_certificates.clone());
+        } else {
+            http_client = http_client.tls_certs_merge(self.additional_root_certificates.clone());
         }
 
         if let Some(p) = &self.proxy {