From c2682f780ec89d095a46480526c57da97cf9dba5 Mon Sep 17 00:00:00 2001
From: Stanislav Panferov <stanislav@panferov.dev>
Date: Sat, 4 Jul 2026 13:06:18 -0700
Subject: [PATCH] build: allow overriding the reqwest TLS backend

rustls with the aws-lc-rs provider stays the default (via the default
feature => reqwest?/rustls). To use a different backend, disable default
features and add your own reqwest dependency selecting the TLS features
you want; previously the rustls/aws-lc-rs provider was hardcoded and
impossible to opt out of because Cargo features are additive.
---
 CHANGELOG.md |  4 ++++
 Cargo.toml   | 11 ++++++++++-
 README.md    | 22 ++++++++++++++++++++++
 3 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a80df03c..b775ea42 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## Unreleased
+
+* build: allow overriding the `reqwest` TLS backend. rustls with the `aws-lc-rs` provider stays the default; to use another backend, disable default features and add your own `reqwest` dependency selecting the TLS features you want (previously the `rustls`/`aws-lc-rs` provider was hardcoded and impossible to opt out of)
+
 ## 0.50.1 (2026-06-20)
 
 * feat: Bot API 10.1 - [#325](https://github.com/ayrat555/frankenstein/pull/325)
diff --git a/Cargo.toml b/Cargo.toml
index 73fd9fbb..0b936090 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -18,7 +18,12 @@ categories = ["web-programming::http-client"]
 [package.metadata.docs.rs]
 all-features = true
 
+# `default` enables rustls (with the `aws-lc-rs` provider) as the TLS backend for the
+# reqwest client, keeping the previous behaviour. `reqwest?/rustls` is a no-op unless
+# the reqwest client is enabled. To use a different backend, disable default features
+# and add your own `reqwest` dependency selecting the TLS features you want (see README).
 [features]
+default = ["reqwest?/rustls"]
 client-reqwest = ["trait-async", "dep:reqwest", "dep:tokio", "dep:serde_json"]
 client-ureq = ["trait-sync", "dep:ureq", "dep:multipart", "dep:mime_guess", "dep:serde_json"]
 trait-async = ["dep:async-trait"]
@@ -47,10 +52,14 @@ serde_with = { version = "3.0.0", default-features = false, features = ["macros"
 thiserror = "2"
 ureq = { version = "3.0.0", optional = true, default-features = false, features = ["rustls"] }
 
+# The TLS backend is selected via the `default` feature (`reqwest?/rustls`) rather
+# than hardcoded here, so downstreams can override it by disabling default features
+# and bringing their own `reqwest` dependency (additive Cargo features otherwise make
+# a hardcoded `rustls`/`aws-lc-rs` provider impossible to opt out of).
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies.reqwest]
 version = "0.13"
 default-features = false
-features = ["multipart", "stream", "rustls"]
+features = ["multipart", "stream"]
 optional = true
 
 [target.'cfg(target_arch = "wasm32")'.dependencies.reqwest]
diff --git a/README.md b/README.md
index ab7ec9c5..88ff5039 100644
--- a/README.md
+++ b/README.md
@@ -36,6 +36,28 @@ For example for the async client add the following line to your `Cargo.toml` fil
 frankenstein = { version = "0.50", features = ["client-reqwest"] }
 ```
 
+### TLS backend for the `reqwest` client
+
+By default (`default` feature) the `reqwest` client uses rustls with the `aws-lc-rs`
+provider, keeping the previous behaviour. To pick a different backend, disable default
+features and add your own `reqwest` dependency selecting the TLS features you want.
+`reqwest`'s features are additive, so you only need to add the TLS feature —
+`frankenstein` already enables `multipart`/`stream`. For example, to use rustls without
+the `aws-lc-rs` provider (avoids pulling in `aws-lc-sys` and its C build; install your
+own `rustls::crypto::CryptoProvider` before making requests):
+
+```toml
+frankenstein = { version = "0.50", default-features = false, features = ["client-reqwest"] }
+reqwest = { version = "0.13", default-features = false, features = ["rustls-no-provider"] }
+```
+
+Or, to use native-tls:
+
+```toml
+frankenstein = { version = "0.50", default-features = false, features = ["client-reqwest"] }
+reqwest = { version = "0.13", default-features = false, features = ["native-tls"] }
+```
+
 ## Usage
 
 Examples in this section use the blocking client (`frankenstein::Api`), but async examples would look the same (just replace `frankenstein::Api` with `frankenstein::AsyncApi`)