chore(deps): drop the unused async esplora client

[Jolah1]

Why

RUSTSEC-2026-0258 (h2 unbounded empty DATA frames) was published 2026-08-17 and started failing cargo audit on main the next morning. Main's scheduled rust run at 04:52 on 2026-08-19 failed; the run 24 hours earlier passed. It blocks every PR.

The vulnerable h2 0.3.27 reached us through exactly one chain:

ghostkey-{server,cli}
  └── bdk_esplora 0.20  (async-https-rustls)
        └── esplora-client 0.11
              └── reqwest 0.11 -> hyper 0.14 -> h2 0.3.27

h2 0.3 has no patched release. The advisory says upgrade to >= 0.4.16, which needs reqwest 0.12, which needs esplora-client past 0.11, which is the semver-incompatible BDK bump .cargo/audit.toml already describes as unplanned.

The actual fix

We never use the async client. grep -rn "build_async\|AsyncClient\|EsploraAsyncExt" --include=*.rs . returns nothing. The only Esplora client the workspace builds is build_blocking() at crates/ghostkey-server/src/psbt_routes.rs:151, which goes through minreq, not reqwest.

So async-https-rustls was linking a second HTTP stack purely so it could sit there unused, and dragging its advisories in with it. This drops the feature.

Removed from the lockfile: 21 crates including reqwest 0.11, hyper 0.14, h2, rustls-pemfile 1.x, tokio-socks, winreg. Cargo.lock shrinks by 275 lines and no h2 entry remains at all. Our own reqwest 0.12 is untouched (it runs with default-features = false, so it has no h2 either).

Advisories cleared

ID	What	How
RUSTSEC-2026-0258	h2 0.3.27 empty DATA frames	crate gone
RUSTSEC-2025-0134	rustls-pemfile 1.x unmaintained	crate gone, stale ignore removed from .cargo/audit.toml

RUSTSEC-2026-0098/0099/0104 (rustls-webpki) stay ignored. Those come through minreq on the blocking path, which we do use, and the reasoning in .cargo/audit.toml still holds.

No new ignores. This fixes the advisory rather than silencing it.

Testing

• cargo audit --deny warnings exit 0
• cargo check --workspace --all-targets clean
• RUSTFLAGS=-D warnings cargo clippy --workspace --all-targets clean
• cargo fmt --all --check clean
• cargo test --workspace 323 passed, 0 failed

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ghost-key	Ready	Preview	Aug 19, 2026 2:24pm