

What’s wrong with it
- It’s a random crate no one uses.
- You’re not even really “using” it. You are just importing a re-export of
reqwest, which is what I expected you to immediately notice after I brought it into attention. You can obviously just remove it and usereqwestdirectly. - Still, trusting a re-export is not a trivial matter. The random author of the no-name crate could replace the original
reqwestwith something malicious, or bad in some other way, in a v0.1.1 release. That (theoretical) release will be picked up after acargo updatecall, or whenCargo.lockis not checked, which is the case by default with libraries.

Only looked at the
Cargo.tomlfiles.Cargo.lockfiles, and using=dependency versions forPhoenix_Desktop, is a bit odd!