{"record":{"id":"f5a52a839d885ba9","repo":"seanmonstar/reqwest","slug":"client-new","errorCode":null,"errorMessage":"Client::new()","messagePattern":"Client::new\\(\\)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/async_impl/client.rs","lineNumber":2524,"sourceCode":"        See https://docs.rs/rustls/latest/rustls/#cryptography-providers for details.\"\n    );\n\n    #[cfg(feature = \"__rustls-aws-lc-rs\")]\n    Arc::new(rustls::crypto::aws_lc_rs::default_provider())\n}\n\nimpl Client {\n    /// Constructs a new `Client`.\n    ///\n    /// # Panics\n    ///\n    /// This method panics if a TLS backend cannot be initialized, or the resolver\n    /// cannot load the system configuration.\n    ///\n    /// Use `Client::builder()` if you wish to handle the failure as an `Error`\n    /// instead of panicking.\n    pub fn new() -> Client {\n        ClientBuilder::new().build().expect(\"Client::new()\")\n    }\n\n    /// Creates a `ClientBuilder` to configure a `Client`.\n    ///\n    /// This is the same as `ClientBuilder::new()`.\n    pub fn builder() -> ClientBuilder {\n        ClientBuilder::new()\n    }\n\n    /// Convenience method to make a `GET` request to a URL.\n    ///\n    /// # Errors\n    ///\n    /// This method fails whenever the supplied `Url` cannot be parsed.\n    pub fn get<U: IntoUrl>(&self, url: U) -> RequestBuilder {\n        self.request(Method::GET, url)\n    }\n","sourceCodeStart":2506,"sourceCodeEnd":2542,"githubUrl":"https://github.com/seanmonstar/reqwest/blob/9f06fd28abe53e5ff84a091825ea5ce8984b51e0/src/async_impl/client.rs#L2506-L2542","documentation":"Client::new() (src/async_impl/client.rs:2523-2525) calls ClientBuilder::new().build().expect(\"Client::new()\"). ClientBuilder::build() returns crate::Result<Client> and fails if a TLS backend cannot be initialized, the DNS resolver cannot load system configuration, a config error was recorded on the builder, or (with rustls-no-provider) no crypto provider was installed (see the panic at client.rs:2500-2507 for context). Because new() uses .expect(), any such failure aborts the process with the panic message 'Client::new()'. The doc comment on new() explicitly warns of this and points to Client::builder() for fallible construction.","triggerScenarios":"Calling Client::new() on a system with missing/broken root certificate stores (e.g. minimal containers without ca-certificates). Building with the 'rustls-no-provider' feature and forgetting to install a CryptoProvider before Client::new(). A GaiResolver failing to load /etc/resolv.conf or a hickory-dns resolver failing its config. Setting an invalid TLS config on the builder that surfaces as config.error inside build() (client.rs:412-414).","commonSituations":"Alpine / distroless / scratch Docker images without ca-certificates installed. Switching from default native-tls to rustls with the no-provider feature to reduce binary size and forgetting the install_default() call. Sandboxed environments where /etc/resolv.conf is absent. CI runners with restricted system config.","solutions":["Replace Client::new() with Client::builder().build()? so failures return a Result instead of panicking, and handle the error.","Install ca-certificates in the container (apt-get install ca-certificates / apk add ca-certificates) or bundle roots via .add_root_certificate().","If using rustls-no-provider, install a provider before building: rustls::crypto::aws_lc_rs::default_provider().install_default().unwrap();","For missing resolv.conf, mount /etc/resolv.conf in the container or supply a custom resolver via .dns_resolver()."],"exampleFix":"// before\nlet client = reqwest::Client::new();\n\n// after\nlet client = match reqwest::Client::builder().build() {\n    Ok(c) => c,\n    Err(e) => {\n        eprintln!(\"failed to build reqwest client: {e}\");\n        std::process::exit(1);\n    }\n};","handlingStrategy":"try-catch","validationCode":"// There is no fallible validation before build(); the fix is to use the fallible builder.\n// Pre-flight: ensure a crypto provider is installed when rustls-no-provider is on.\n#[cfg(feature = \"rustls-no-provider\")]\nfn ensure_crypto_provider() {\n    let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();\n}","typeGuard":null,"tryCatchPattern":"// never use Client::new(); always:\nlet client = match reqwest::Client::builder().build() {\n    Ok(c) => c,\n    Err(e) => {\n        eprintln!(\"reqwest client build failed: {e}\");\n        // degrade gracefully or exit\n        std::process::exit(1);\n    }\n};","preventionTips":["Never call Client::new() in production paths; prefer Client::builder().build()? so TLS/resolver failures are Result-returned, not panics.","In Docker, install ca-certificates and ensure /etc/resolv.conf is present before the binary starts.","With rustls-no-provider, call CryptoProvider::install_default() once at process startup.","Add a startup smoke test that builds the client and logs a clear error instead of letting the panic surface mid-request."],"tags":["panic","tls","builder","crypto-provider","dns","initialization"],"backgroundTag":null,"analyzedSha":"9f06fd28abe53e5ff84a091825ea5ce8984b51e0","analyzedAt":"2026-08-10T17:01:13.368Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}