fix: remove reqwest-rustls-webpki-roots (#3524)

Co-authored-by: Cijo Thomas <cijo.thomas@gmail.com>

Author: scottgerring

opentelemetry-http/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## vNext
 
+- **Breaking** Removed `reqwest-rustls-webpki-roots` feature. The `webpki-roots` cargo feature was
+  removed from `reqwest` in v0.13.0. Use `reqwest-rustls` instead, which now correctly enables
+  `reqwest/rustls` (platform native trust roots). To use Mozilla's embedded CA bundle, construct a
+  custom `reqwest::Client` with a `rustls::ClientConfig` containing
+  `rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned())`, then supply it
+  to the exporter with `with_http_client()`.
+
 ## 0.32.0
 
 Released 2026-May-08

opentelemetry-http/Cargo.toml

@@ -15,8 +15,7 @@ default = ["internal-logs"]
 hyper = ["dep:http-body-util", "dep:hyper", "dep:hyper-util", "dep:tokio"]
 reqwest = ["dep:reqwest"]
 reqwest-blocking = ["dep:reqwest", "reqwest/blocking"]
-reqwest-rustls = ["dep:reqwest", "reqwest/default-tls"]
-reqwest-rustls-webpki-roots = ["dep:reqwest", "reqwest/default-tls", "reqwest/webpki-roots"]
+reqwest-rustls = ["dep:reqwest", "reqwest/rustls"]
 internal-logs = ["opentelemetry/internal-logs"]
 
 [dependencies]

opentelemetry-otlp/CHANGELOG.md

@@ -12,6 +12,22 @@
   Endpoints with an explicit scheme (e.g., `http://`, `https://`, `unix://`) are unaffected.
   [#774](https://github.com/open-telemetry/opentelemetry-rust/issues/774)
   [#984](https://github.com/open-telemetry/opentelemetry-rust/issues/984)
+- **Breaking** Removed `reqwest-rustls-webpki-roots` feature. The `webpki-roots` cargo feature was
+  removed from `reqwest` in v0.13.0, making this feature broken for anyone resolving `reqwest >= 0.13.0`.
+  **Migration**: Use `reqwest-rustls` instead (now correctly uses `reqwest/rustls` with platform native
+  trust roots). If you specifically need Mozilla's embedded CA bundle, construct a custom client:
+  ```rust
+  let root_store = rustls::RootCertStore::from_iter(
+      webpki_roots::TLS_SERVER_ROOTS.iter().cloned(),
+  );
+  let tls_config = rustls::ClientConfig::builder()
+      .with_root_certificates(root_store)
+      .with_no_client_auth();
+  let client = reqwest::Client::builder()
+      .tls_backend_preconfigured(tls_config)
+      .build()?;
+  exporter_builder.with_http_client(client)
+  ```
 
 ## 0.32.0
 

opentelemetry-otlp/Cargo.toml

@@ -115,7 +115,6 @@ hyper-client = ["opentelemetry-http/hyper"]
 # TLS options for reqwest-based HTTP clients, both blocking and async. Combine
 # these with either reqwest-blocking-client or reqwest-client.
 reqwest-rustls = ["reqwest", "opentelemetry-http/reqwest-rustls"]
-reqwest-rustls-webpki-roots = ["reqwest", "opentelemetry-http/reqwest-rustls-webpki-roots"]
 
 # test
 integration-testing = ["tonic", "prost", "tokio/full", "trace", "logs"]

opentelemetry-otlp/src/lib.rs

@@ -293,8 +293,11 @@
 //! * `reqwest-blocking-client`: Use reqwest blocking http client. This feature is enabled by default.
 //! * `reqwest-client`: Use reqwest async http client.
 //! * `hyper-client`: Use hyper async http client.
-//! * `reqwest-rustls`: Use reqwest with TLS with system trust roots via `rustls-native-certs` crate.
-//! * `reqwest-rustls-webpki-roots`: Use reqwest with TLS with Mozilla's trust roots via `webpki-roots` crate.
+//! * `reqwest-rustls`: Use reqwest with TLS. Uses `rustls` with the platform's native trust roots by default.
+//!   If you need Mozilla's embedded CA bundle (webpki-roots), build a custom `reqwest::Client` with
+//!   a `rustls::ClientConfig` containing
+//!   `rustls::RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned())`, then pass it
+//!   via `with_http_client()`.
 //!
 //! The following feature flags enable experimental retry support:
 //!