From 4d55ba323afecc18a320b60206a2d3f4e8a1aacd Mon Sep 17 00:00:00 2001
From: Wenbin Fang <wenbin@listennotes.com>
Date: Thu, 22 Oct 2026 10:15:12 -0700
Subject: [PATCH] fix: require patched bundled certificate roots

---
 Cargo.lock | 1 +
 Cargo.toml | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/Cargo.lock b/Cargo.lock
index 92c3887..cda7450 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -599,6 +599,7 @@ dependencies = [
  "reqwest",
  "serde_json",
  "tokio",
+ "webpki-root-certs",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 7803508..bfe37f8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -17,6 +17,8 @@ include = ["src/**", "tests/**", "examples/sample.rs", "Cargo.toml", "Cargo.lock
 [dependencies]
 reqwest = { version = "0.13.5", default-features = false, features = ["json", "query", "form", "rustls"] }
 serde_json = "1.0.150"
+# Enforce patched bundled roots even when consumers reuse an existing lockfile.
+webpki-root-certs = "1.0.10"
 
 [dev-dependencies]
 tokio = { version = "1.53.0", features = ["macros", "rt-multi-thread", "net", "io-util", "time"] }