# Network Dependency Audit
Audit date: 2026-07-20 UTC.
`reqwest` 0.13 is used without default features and intentionally follows
Cargo's compatible-release range rather than an exact pin. It handles only
unauthenticated public-web requests and receives no credentials or highly
sensitive data, so compatible security and performance updates are preferred.
`Cargo.lock` records the dependency revision used for validation.
The enabled Rustls and content-decoding features provide HTTP transport only.
The client disables proxy discovery, automatic redirects, retries, and
referrers; it never receives credentials. `html2text` converts
already-downloaded HTML locally. `tokio` performs DNS lookup. Dependencies that
receive API keys or otherwise handle highly sensitive data require an audit
before updates and may be exact-pinned; this `reqwest` use does not cross that
boundary.