Tighten comments added in the reqwest 0.13 bump

Each reqwest_0_12 site was repeating the same reqsign 0.16 / iceberg
fork story. Keep the full explanation once at the workspace declaration
and leave one-line pointers at the consuming sites (deny.toml, the
storage-types Cargo.toml, and the AwsCredentialLoad impl). Also trim
the feature-flag comment on reqwest and the TransportOptions note in
azure.rs to the essentials.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jasonhernandez

Cargo.toml

@@ -443,18 +443,12 @@ rdkafka = { version = "0.29.0", features = ["cmake-build", "libz-static", "ssl-v
 rdkafka-sys = { version = "4.3.0", features = ["cmake-build", "libz-static", "ssl-vendored", "zstd"] }
 regex = "1.12.3"
 regex-syntax = "0.8.10"
-# Starting in reqwest 0.13, default features changed: `default-tls` now
-# activates rustls (which pulls in banned rustls/hyper-rustls), and
-# `system-proxy` became an opt-in feature that was implicit before. We
-# disable default features and list everything explicitly so the TLS
-# backend stays on native-tls. Switching to rustls is tracked separately
-# in the crypto migration plan. `query` became opt-in in 0.13 and is
-# used by the cloud-api and frontegg-client crates.
+# reqwest 0.13 changed defaults: `default-tls` now pulls in rustls
+# (banned) and `query`/`system-proxy` are opt-in. List features
+# explicitly to stay on native-tls.
 reqwest = { version = "0.13.2", default-features = false, features = ["blocking", "charset", "cookies", "http2", "json", "native-tls", "native-tls-vendored", "query", "stream", "system-proxy"] }
-# Used by mz-storage-types to satisfy the `reqsign::AwsCredentialLoad`
-# trait signature (reqsign 0.16, via our iceberg fork, is pinned to
-# reqwest 0.12). Remove once iceberg bumps to a reqsign that supports
-# reqwest 0.13.
+# Satisfies reqsign 0.16's `AwsCredentialLoad` trait, pulled in via our
+# iceberg fork and pinned to reqwest 0.12. Remove once iceberg bumps.
 reqwest_0_12 = { package = "reqwest", version = "0.12", default-features = false }
 reqwest-middleware = { version = "0.5.1", features = ["json"] }
 reqwest-retry = "0.9.1"

deny.toml

@@ -128,9 +128,7 @@ skip = [
     { name = "fallible-iterator", version = "0.3.0" },
     # arrow
     { name = "hashbrown", version = "0.16.1" },
-    # Used via `reqwest_0_12` workspace alias to satisfy reqsign 0.16's
-    # `AwsCredentialLoad` trait (dragged in by our iceberg fork).
-    # Remove once iceberg bumps to a reqsign that supports reqwest 0.13.
+    # reqwest_0_12 workspace alias; see Cargo.toml.
     { name = "reqwest", version = "0.12" },
 ]
 

src/persist/src/azure.rs

@@ -70,13 +70,11 @@ impl AzureBlobConfig {
     ) -> Result<Self, Error> {
         let client = if account == EMULATOR_ACCOUNT {
             info!("Connecting to Azure emulator");
-            // `TransportOptions::new(Arc::new(reqwest::Client))` used to plumb
-            // `knobs.operation_attempt_timeout/read_timeout/connect_timeout`
-            // here. After the reqwest 0.13 bump, azure_core 0.21 pins reqwest
-            // 0.12 internally, so our 0.13 client no longer implements its
-            // `HttpClient` trait. The azure_sdk migration (separate PR)
-            // restores this plumbing against the new SDK; the outer
-            // `operation_timeout` still applies via the retry policy.
+            // Per-attempt/read/connect-timeout plumbing via `TransportOptions`
+            // was dropped: azure_core 0.21 pins reqwest 0.12 internally, so our
+            // 0.13 client no longer satisfies its `HttpClient` trait. Restored
+            // on the new SDK in the azure_sdk migration PR; `operation_timeout`
+            // still applies via the retry policy.
             ClientBuilder::with_location(
                 CloudLocation::Emulator {
                     address: url.domain().expect("domain for Azure emulator").to_string(),

src/storage-types/Cargo.toml

@@ -61,10 +61,7 @@ prost.workspace = true
 rdkafka.workspace = true
 regex.workspace = true
 reqwest.workspace = true
-# The `iceberg::io::AwsCredentialLoad` trait (re-exported from reqsign 0.16)
-# is defined against reqwest 0.12, so impls must use that version's
-# `reqwest::Client`. Remove once the iceberg fork bumps to a reqsign that
-# supports reqwest 0.13.
+# For impls of `iceberg::io::AwsCredentialLoad` (reqsign 0.16); see workspace Cargo.toml.
 reqwest_0_12 = { workspace = true }
 serde.workspace = true
 serde_json = { workspace = true, features = ["preserve_order"] }

src/storage-types/src/connections.rs

@@ -100,9 +100,7 @@ impl AwsSdkCredentialLoader {
 impl AwsCredentialLoad for AwsSdkCredentialLoader {
     async fn load_credential(
         &self,
-        // reqsign 0.16 (via the iceberg fork) is pinned to reqwest 0.12, so
-        // this impl must match that version's `Client` type rather than the
-        // workspace reqwest 0.13.
+        // reqsign 0.16 trait signature; see `reqwest_0_12` in workspace Cargo.toml.
         _client: reqwest_0_12::Client,
     ) -> anyhow::Result<Option<AwsCredential>> {
         let creds = self