From 4ddeef8c8bb168a7c50ec4e1e6e0b04947d68511 Mon Sep 17 00:00:00 2001
From: Aumetra Weisman <aumetra@cryptolab.net>
Date: Mon, 11 Nov 2024 16:05:11 +0000
Subject: [PATCH 1/2] Build Docker images directly with Nix (#607)

* Build Docker images directly with Nix

* Compile for dist target

* fix typo

* up

* update cargo-dist
---
 .dockerignore                      |   4 -
 .github/workflows/release.yml      |  48 +++++------
 Cargo.lock                         | 127 ++++++++++++++---------------
 Cargo.toml                         |   4 +-
 crates/kitsune-oidc/Cargo.toml     |   2 +-
 crates/kitsune-service/Cargo.toml  |   2 +-
 crates/kitsune-storage/Cargo.toml  |   2 +-
 crates/kitsune-wasm-mrf/Cargo.toml |   2 +-
 dist-workspace.toml                |   6 +-
 docker-compose.yml                 |  50 ------------
 flake.nix                          |  42 +++++++++-
 kitsune/Cargo.toml                 |   2 +-
 kitsune/Dockerfile.dev             |  26 ------
 kitsune/Dockerfile.prod            |  26 ------
 lib/athena/Cargo.toml              |   2 +-
 lib/blowocking/Cargo.toml          |   2 +-
 lib/geomjeungja/Cargo.toml         |   4 +-
 lib/http-signatures/Cargo.toml     |   2 +-
 lib/mrf-manifest/Cargo.toml        |   2 +-
 lib/schaber/Cargo.toml             |   2 +-
 lib/speedy-uuid/Cargo.toml         |   2 +-
 21 files changed, 145 insertions(+), 214 deletions(-)
 delete mode 100644 .dockerignore
 delete mode 100644 docker-compose.yml
 delete mode 100644 kitsune/Dockerfile.dev
 delete mode 100644 kitsune/Dockerfile.prod

diff --git a/.dockerignore b/.dockerignore
deleted file mode 100644
index cda47b7b0..000000000
--- a/.dockerignore
+++ /dev/null
@@ -1,4 +0,0 @@
-**/node_modules
-target/
-Dockerfile.dev
-Dockerfile.prod
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 42b4067e2..0e9bca831 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,4 @@
-# This file was autogenerated by cargo-dist: https://opensource.axo.dev/cargo-dist/
+# This file was autogenerated by dist: https://opensource.axo.dev/cargo-dist/
 #
 # Copyright 2022-2024, axodotdev
 # SPDX-License-Identifier: MIT or Apache-2.0
@@ -6,7 +6,7 @@
 # CI that:
 #
 # * checks for a Git Tag that looks like a release
-# * builds artifacts with cargo-dist (archives, installers, hashes)
+# * builds artifacts with dist (archives, installers, hashes)
 # * uploads those artifacts to temporary workflow zip
 # * on success, uploads the artifacts to a GitHub Release
 #
@@ -24,10 +24,10 @@ permissions:
 # must be a Cargo-style SemVer Version (must have at least major.minor.patch).
 #
 # If PACKAGE_NAME is specified, then the announcement will be for that
-# package (erroring out if it doesn't have the given version or isn't cargo-dist-able).
+# package (erroring out if it doesn't have the given version or isn't dist-able).
 #
 # If PACKAGE_NAME isn't specified, then the announcement will be for all
-# (cargo-dist-able) packages in the workspace with that version (this mode is
+# (dist-able) packages in the workspace with that version (this mode is
 # intended for workspaces with only one dist-able package, or with all dist-able
 # packages versioned/released in lockstep).
 #
@@ -45,7 +45,7 @@ on:
       - '**[0-9]+.[0-9]+.[0-9]+*'
 
 jobs:
-  # Run 'cargo dist plan' (or host) to determine what tasks we need to do
+  # Run 'dist plan' (or host) to determine what tasks we need to do
   plan:
     runs-on: "ubuntu-20.04"
     outputs:
@@ -59,16 +59,16 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - name: Install cargo-dist
+      - name: Install dist
         # we specify bash to get pipefail; it guards against the `curl` command
         # failing. otherwise `sh` won't catch that `curl` returned non-0
         shell: bash
-        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.23.0/cargo-dist-installer.sh | sh"
-      - name: Cache cargo-dist
+        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.25.1/cargo-dist-installer.sh | sh"
+      - name: Cache dist
         uses: actions/upload-artifact@v4
         with:
           name: cargo-dist-cache
-          path: ~/.cargo/bin/cargo-dist
+          path: ~/.cargo/bin/dist
       # sure would be cool if github gave us proper conditionals...
       # so here's a doubly-nested ternary-via-truthiness to try to provide the best possible
       # functionality based on whether this is a pull_request, and whether it's from a fork.
@@ -76,8 +76,8 @@ jobs:
       # but also really annoying to build CI around when it needs secrets to work right.)
       - id: plan
         run: |
-          cargo dist ${{ (!github.event.pull_request && format('host --steps=create --tag={0}', github.ref_name)) || 'plan' }} --output-format=json > plan-dist-manifest.json
-          echo "cargo dist ran successfully"
+          dist ${{ (!github.event.pull_request && format('host --steps=create --tag={0}', github.ref_name)) || 'plan' }} --output-format=json > plan-dist-manifest.json
+          echo "dist ran successfully"
           cat plan-dist-manifest.json
           echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
       - name: "Upload dist-manifest.json"
@@ -95,12 +95,12 @@ jobs:
     if: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix.include != null && (needs.plan.outputs.publishing == 'true' || fromJson(needs.plan.outputs.val).ci.github.pr_run_mode == 'upload') }}
     strategy:
       fail-fast: false
-      # Target platforms/runners are computed by cargo-dist in create-release.
+      # Target platforms/runners are computed by dist in create-release.
       # Each member of the matrix has the following arguments:
       #
       # - runner: the github runner
-      # - dist-args: cli flags to pass to cargo dist
-      # - install-dist: expression to run to install cargo-dist on the runner
+      # - dist-args: cli flags to pass to dist
+      # - install-dist: expression to run to install dist on the runner
       #
       # Typically there will be:
       # - 1 "global" task that builds universal installers
@@ -117,7 +117,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - name: Install cargo-dist
+      - name: Install dist
         run: ${{ matrix.install_dist }}
       # Get the dist-manifest
       - name: Fetch local artifacts
@@ -132,8 +132,8 @@ jobs:
       - name: Build artifacts
         run: |
           # Actually do builds and make zips and whatnot
-          cargo dist build ${{ needs.plan.outputs.tag-flag }} --print=linkage --output-format=json ${{ matrix.dist_args }} > dist-manifest.json
-          echo "cargo dist ran successfully"
+          dist build ${{ needs.plan.outputs.tag-flag }} --print=linkage --output-format=json ${{ matrix.dist_args }} > dist-manifest.json
+          echo "dist ran successfully"
       - id: cargo-dist
         name: Post-build
         # We force bash here just because github makes it really hard to get values up
@@ -168,12 +168,12 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - name: Install cached cargo-dist
+      - name: Install cached dist
         uses: actions/download-artifact@v4
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/
-      - run: chmod +x ~/.cargo/bin/cargo-dist
+      - run: chmod +x ~/.cargo/bin/dist
       # Get all the local artifacts for the global tasks to use (for e.g. checksums)
       - name: Fetch local artifacts
         uses: actions/download-artifact@v4
@@ -184,8 +184,8 @@ jobs:
       - id: cargo-dist
         shell: bash
         run: |
-          cargo dist build ${{ needs.plan.outputs.tag-flag }} --output-format=json "--artifacts=global" > dist-manifest.json
-          echo "cargo dist ran successfully"
+          dist build ${{ needs.plan.outputs.tag-flag }} --output-format=json "--artifacts=global" > dist-manifest.json
+          echo "dist ran successfully"
 
           # Parse out what we just built and upload it to scratch storage
           echo "paths<<EOF" >> "$GITHUB_OUTPUT"
@@ -217,12 +217,12 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - name: Install cached cargo-dist
+      - name: Install cached dist
         uses: actions/download-artifact@v4
         with:
           name: cargo-dist-cache
           path: ~/.cargo/bin/
-      - run: chmod +x ~/.cargo/bin/cargo-dist
+      - run: chmod +x ~/.cargo/bin/dist
       # Fetch artifacts from scratch-storage
       - name: Fetch artifacts
         uses: actions/download-artifact@v4
@@ -233,7 +233,7 @@ jobs:
       - id: host
         shell: bash
         run: |
-          cargo dist host ${{ needs.plan.outputs.tag-flag }} --steps=upload --steps=release --output-format=json > dist-manifest.json
+          dist host ${{ needs.plan.outputs.tag-flag }} --steps=upload --steps=release --output-format=json > dist-manifest.json
           echo "artifacts uploaded and released successfully"
           cat dist-manifest.json
           echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
diff --git a/Cargo.lock b/Cargo.lock
index bdd391f68..08b663a57 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -101,9 +101,9 @@ dependencies = [
 
 [[package]]
 name = "allocator-api2"
-version = "0.2.18"
+version = "0.2.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c6cb57a04249c6480766f7f7cef5467412af1490f8d1e243141daddada3264f"
+checksum = "45862d1c77f2228b9e10bc609d5bc203d86ebc9b87ad8d5d5167a6c9abf739d9"
 
 [[package]]
 name = "ambient-authority"
@@ -350,7 +350,7 @@ dependencies = [
  "serde_urlencoded",
  "static_assertions_next",
  "tempfile",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
  "time",
  "tracing",
  "tracing-futures",
@@ -389,7 +389,7 @@ dependencies = [
  "quote",
  "strum",
  "syn 2.0.87",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -488,7 +488,7 @@ dependencies = [
  "smol_str",
  "sonic-rs",
  "speedy-uuid",
- "thiserror 2.0.0",
+ "thiserror 2.0.3",
  "tokio",
  "tokio-util",
  "tracing",
@@ -799,16 +799,16 @@ name = "blowocking"
 version = "0.0.1-pre.6"
 dependencies = [
  "rayon",
- "thiserror 2.0.0",
+ "thiserror 2.0.3",
  "tokio",
  "tracing",
 ]
 
 [[package]]
 name = "borsh"
-version = "1.5.1"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6362ed55def622cddc70a4746a68554d7b687713770de539e59a739b249f8ed"
+checksum = "f5327f6c99920069d1fe374aa743be1af0031dea9f250852cdf1ae6a0861ee24"
 dependencies = [
  "cfg_aliases",
 ]
@@ -855,7 +855,7 @@ dependencies = [
  "lol_html",
  "once_cell",
  "slab",
- "thiserror 2.0.0",
+ "thiserror 2.0.3",
 ]
 
 [[package]]
@@ -989,9 +989,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.1.36"
+version = "1.1.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baee610e9452a8f6f0a1b6194ec09ff9e2d85dea54432acdae41aa0761c95d70"
+checksum = "40545c26d092346d8a8dab71ee48e7685a7a9cba76e634790c215b41a4a7b4cf"
 dependencies = [
  "shlex",
 ]
@@ -2113,9 +2113,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8c02a5121d4ea3eb16a80748c74f5549a5665e4c21333c6098f283870fbdea6"
+checksum = "486f806e73c5707928240ddc295403b1b93c96a02038563881c4a2fd84b81ac4"
 
 [[package]]
 name = "faststr"
@@ -2441,7 +2441,7 @@ dependencies = [
  "serde",
  "simdutf8",
  "sonic-rs",
- "thiserror 2.0.0",
+ "thiserror 2.0.3",
  "tokio",
  "tracing",
  "triomphe",
@@ -2584,7 +2584,7 @@ dependencies = [
  "pest_derive",
  "serde",
  "serde_json",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -2682,9 +2682,9 @@ dependencies = [
 
 [[package]]
 name = "hickory-proto"
-version = "0.25.0-alpha.2"
+version = "0.25.0-alpha.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8270a1857fb962b9914aafd46a89a187a4e63d0eb4190c327e7c7b8256a2d055"
+checksum = "993f9d675890080b3bab88e475e6a0db4fe96b39b2fbd42a72eb315dc9009798"
 dependencies = [
  "async-recursion",
  "async-trait",
@@ -2698,8 +2698,7 @@ dependencies = [
  "ipnet",
  "once_cell",
  "rand 0.8.5",
- "thiserror 1.0.68",
- "time",
+ "thiserror 1.0.69",
  "tinyvec",
  "tokio",
  "tracing",
@@ -2708,9 +2707,9 @@ dependencies = [
 
 [[package]]
 name = "hickory-resolver"
-version = "0.25.0-alpha.2"
+version = "0.25.0-alpha.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c110355b5703070d9e29c344d79818a7cde3de9c27fc35750defea6074b0ad"
+checksum = "0eec9ac701a9b34a77c8ccbe39d589db876290f6bdc6e05ac118fd114cb1ad26"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -2722,7 +2721,7 @@ dependencies = [
  "rand 0.8.5",
  "resolv-conf",
  "smallvec",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
  "tokio",
  "tracing",
 ]
@@ -2825,7 +2824,7 @@ dependencies = [
  "pkcs8",
  "ring",
  "scoped-futures",
- "thiserror 2.0.0",
+ "thiserror 2.0.3",
  "tick-tock-mock",
  "tokio",
  "tracing",
@@ -4169,9 +4168,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.161"
+version = "0.2.162"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9489c2807c139ffd9c1794f4af0ebe86a828db53ecdc7fea2111d0fed085d1"
+checksum = "18d287de67fe55fd7e1581fe933d965a5a9477b38e949cfa9f8574ef01506398"
 
 [[package]]
 name = "libm"
@@ -4272,7 +4271,7 @@ dependencies = [
  "memchr",
  "mime",
  "selectors",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -4367,7 +4366,7 @@ dependencies = [
  "meilisearch-index-setting-macro",
  "serde",
  "serde_json",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
  "time",
  "uuid",
  "wasm-bindgen-futures",
@@ -4406,7 +4405,7 @@ dependencies = [
  "supports-unicode",
  "terminal_size 0.3.0",
  "textwrap",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
  "unicode-width",
 ]
 
@@ -4518,7 +4517,7 @@ dependencies = [
  "rustc_version",
  "smallvec",
  "tagptr",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
  "triomphe",
  "uuid",
 ]
@@ -4534,7 +4533,7 @@ dependencies = [
  "semver",
  "serde",
  "sonic-rs",
- "thiserror 2.0.0",
+ "thiserror 2.0.3",
  "wasm-encoder 0.219.1",
  "wasmparser 0.219.1",
  "wat",
@@ -4563,7 +4562,7 @@ dependencies = [
  "indexmap 2.6.0",
  "itertools 0.13.0",
  "rustc-hash",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
  "xmlparser",
 ]
 
@@ -4695,7 +4694,7 @@ dependencies = [
  "serde_json",
  "serde_path_to_error",
  "sha2",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
  "url",
 ]
 
@@ -4764,7 +4763,7 @@ dependencies = [
  "serde_with",
  "sha2",
  "subtle",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
  "url",
 ]
 
@@ -4785,7 +4784,7 @@ dependencies = [
  "js-sys",
  "once_cell",
  "pin-project-lite",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -4815,7 +4814,7 @@ dependencies = [
  "opentelemetry_sdk",
  "prost",
  "serde_json",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
  "tokio",
  "tonic",
 ]
@@ -4849,7 +4848,7 @@ dependencies = [
  "opentelemetry",
  "percent-encoding",
  "rand 0.8.5",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
  "tokio",
  "tokio-stream",
 ]
@@ -5021,7 +5020,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879952a81a83930934cbf1786752d6dedc3b1f29e8f8fb2ad1d0a36f377cf442"
 dependencies = [
  "memchr",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
  "ucd-trie",
 ]
 
@@ -5657,9 +5656,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.8"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "368758f23274712b504848e9d5a6f010445cc8b87a7cdb4d7cbee666c1288da3"
+checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -5866,9 +5865,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.39"
+version = "0.38.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "375116bee2be9ed569afe2154ea6a99dfdffd257f533f187498c2a8f5feaf4ee"
+checksum = "99e4ea3e1cdc4b559b8e5650f9c8e5998e3e5c1343b4eaf034565f32318d63c0"
 dependencies = [
  "bitflags 2.6.0",
  "errno",
@@ -5991,7 +5990,7 @@ name = "schaber"
 version = "0.0.1-pre.6"
 dependencies = [
  "lol_html",
- "thiserror 2.0.0",
+ "thiserror 2.0.3",
 ]
 
 [[package]]
@@ -6072,9 +6071,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.12.0"
+version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea4a292869320c0272d7bc55a5a6aafaff59b4f63404a003887b679a2e05b4b6"
+checksum = "fa39c7303dc58b5543c94d22c1766b0d31f2ee58306363ea622b10bbc075eaa2"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -6446,7 +6445,7 @@ dependencies = [
  "serde",
  "simdutf8",
  "smallvec",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -6467,7 +6466,7 @@ dependencies = [
  "fred",
  "serde",
  "serde_test",
- "thiserror 2.0.0",
+ "thiserror 2.0.3",
  "uuid",
  "uuid-simd",
 ]
@@ -6699,9 +6698,9 @@ checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
 
 [[package]]
 name = "tempfile"
-version = "3.13.0"
+version = "3.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0f2c9fc62d0beef6951ccffd757e241266a2c833136efbe35af6cd2567dca5b"
+checksum = "28cce251fcbc87fac86a866eeb0d6c2d536fc16d06f184bb61aeae11aa4cee0c"
 dependencies = [
  "cfg-if",
  "fastrand",
@@ -6767,27 +6766,27 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.68"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02dd99dc800bbb97186339685293e1cc5d9df1f8fae2d0aecd9ff1c77efea892"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
 dependencies = [
- "thiserror-impl 1.0.68",
+ "thiserror-impl 1.0.69",
 ]
 
 [[package]]
 name = "thiserror"
-version = "2.0.0"
+version = "2.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15291287e9bff1bc6f9ff3409ed9af665bec7a5fc8ac079ea96be07bca0e2668"
+checksum = "c006c85c7651b3cf2ada4584faa36773bd07bac24acfb39f3c431b36d7e667aa"
 dependencies = [
- "thiserror-impl 2.0.0",
+ "thiserror-impl 2.0.3",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.68"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7c61ec9a6f64d2793d8a45faba21efbe3ced62a886d44c36a009b2b519b4c7e"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6796,9 +6795,9 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.0"
+version = "2.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22efd00f33f93fa62848a7cab956c3d38c8d43095efda1decfc2b3a5dc0b8972"
+checksum = "f077553d607adc1caf65430528a576c757a71ed73944b66ebb58ef2bbd243568"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6910,9 +6909,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.41.0"
+version = "1.41.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "145f3413504347a2be84393cc8a7d2fb4d863b375909ea59f2158261aa258bbb"
+checksum = "22cfb5bee7a6a52939ca9224d6ac897bb669134078daa8735560897f69de4d33"
 dependencies = [
  "backtrace",
  "bytes",
@@ -7355,7 +7354,7 @@ dependencies = [
  "log",
  "rand 0.8.5",
  "sha1",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
  "utf-8",
 ]
 
@@ -7875,7 +7874,7 @@ dependencies = [
  "object 0.36.5",
  "smallvec",
  "target-lexicon",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
  "wasmparser 0.218.0",
  "wasmtime-environ",
  "wasmtime-versioned-export-macros",
@@ -7972,7 +7971,7 @@ dependencies = [
  "once_cell",
  "rustix",
  "system-interface",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
  "tokio",
  "tracing",
  "url",
@@ -8509,7 +8508,7 @@ checksum = "b0144f1a16a199846cb21024da74edd930b43443463292f536b7110b4855b5c6"
 dependencies = [
  "form_urlencoded",
  "serde",
- "thiserror 1.0.68",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 9a960526f..fa63fd659 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -113,8 +113,8 @@ iso8601-timestamp = "0.3.0"
 itertools = { version = "0.13.0", default-features = false }
 moka = { version = "=0.12.7", features = ["sync"] }
 simdutf8 = { version = "0.1.5", features = ["aarch64_neon"] }
-sonic-rs = "0.3.14"
-tokio = "1.41.0"
+sonic-rs = "=0.3.14"
+tokio = "1.41.1"
 triomphe = { version = "0.1.14", default-features = false, features = [
     "unsize",
 ] }
diff --git a/crates/kitsune-oidc/Cargo.toml b/crates/kitsune-oidc/Cargo.toml
index d63dff963..87f64b964 100644
--- a/crates/kitsune-oidc/Cargo.toml
+++ b/crates/kitsune-oidc/Cargo.toml
@@ -27,7 +27,7 @@ speedy-uuid = { workspace = true }
 url = "2.5.3"
 
 [dev-dependencies]
-tokio = { version = "1.41.0", features = ["macros", "rt"] }
+tokio = { version = "1.41.1", features = ["macros", "rt"] }
 
 [lints]
 workspace = true
diff --git a/crates/kitsune-service/Cargo.toml b/crates/kitsune-service/Cargo.toml
index 15b40d113..d7491e490 100644
--- a/crates/kitsune-service/Cargo.toml
+++ b/crates/kitsune-service/Cargo.toml
@@ -66,7 +66,7 @@ kitsune-jobs = { workspace = true }
 kitsune-test = { workspace = true }
 kitsune-webfinger = { workspace = true }
 pretty_assertions = "1.4.1"
-tempfile = "3.13.0"
+tempfile = "3.14.0"
 tower = { version = "0.5.1", default-features = false, features = ["util"] }
 
 [lints]
diff --git a/crates/kitsune-storage/Cargo.toml b/crates/kitsune-storage/Cargo.toml
index 6c0e16e80..7ed0fc0a4 100644
--- a/crates/kitsune-storage/Cargo.toml
+++ b/crates/kitsune-storage/Cargo.toml
@@ -17,7 +17,7 @@ tokio-util = { version = "0.7.12", features = ["io"] }
 triomphe = { workspace = true }
 
 [dev-dependencies]
-tempfile = "3.13.0"
+tempfile = "3.14.0"
 tokio = { workspace = true, features = ["macros", "rt"] }
 
 [lints]
diff --git a/crates/kitsune-wasm-mrf/Cargo.toml b/crates/kitsune-wasm-mrf/Cargo.toml
index 446707056..f489dfb28 100644
--- a/crates/kitsune-wasm-mrf/Cargo.toml
+++ b/crates/kitsune-wasm-mrf/Cargo.toml
@@ -41,7 +41,7 @@ wasmtime = { version = "26.0.1", default-features = false, features = [
 wasmtime-wasi = { version = "26.0.1", default-features = false }
 
 [dev-dependencies]
-tempfile = "3.13.0"
+tempfile = "3.14.0"
 tokio = { workspace = true, features = ["macros", "rt"] }
 tracing-subscriber = "0.3.18"
 wat = "1.219.1"
diff --git a/dist-workspace.toml b/dist-workspace.toml
index f3aafce6f..87474574c 100644
--- a/dist-workspace.toml
+++ b/dist-workspace.toml
@@ -1,12 +1,12 @@
 [workspace]
 members = ["cargo:."]
 
-# Config for 'cargo dist'
+# Config for 'dist'
 [dist]
 # Whether to pass --all-features to cargo build
 all-features = true
-# The preferred cargo-dist version to use in CI (Cargo.toml SemVer syntax)
-cargo-dist-version = "0.23.0"
+# The preferred dist version to use in CI (Cargo.toml SemVer syntax)
+cargo-dist-version = "0.25.1"
 # CI backends to support
 ci = "github"
 # The installers to generate for each app
diff --git a/docker-compose.yml b/docker-compose.yml
deleted file mode 100644
index fedda3417..000000000
--- a/docker-compose.yml
+++ /dev/null
@@ -1,50 +0,0 @@
-version: "3.1"
-
-services:
-  backend:
-    image: kitsune
-    command: --config config.toml
-    ports:
-      - "5000:5000"
-    networks:
-      - backend
-    environment:
-      DATABASE_URL: postgres://kitsune:password@db/kitsune
-      DOMAIN: example.com
-      PORT: 5000
-      JOB_WORKERS: 1
-      REDIS_URL: redis://redis:6379
-      RUST_LOG: debug
-    volumes:
-      - upload-data:/app/uploads
-      - type: bind
-        source: ${KITSUNE_CONFIG}
-        target: /app/config.toml
-        read_only: true
-    depends_on:
-      - db
-      - redis
-
-  db:
-    image: postgres:15-alpine
-    environment:
-      POSTGRES_DB: kitsune
-      POSTGRES_USER: kitsune
-      POSTGRES_PASSWORD: password
-    networks:
-      - backend
-    volumes:
-      - db-data:/var/lib/postgresql/data
-
-  redis:
-    image: redis:alpine
-    networks:
-      - backend
-
-networks:
-  backend: {}
-
-volumes:
-  db-data:
-  search-index:
-  upload-data:
diff --git a/flake.nix b/flake.nix
index 27d9e9915..738670f4b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -85,8 +85,8 @@
                   homepage = "https://joinkitsune.org";
                 };
 
-                OPENSSL_NO_VENDOR = 1;
                 NIX_OUTPATH_USED_AS_RANDOM_SEED = "aaaaaaaaaa";
+                CARGO_PROFILE = "dist";
                 cargoExtraArgs = "--locked ${features}";
               }
               // (pkgs.lib.optionalAttrs inputs.debugBuild.value {
@@ -122,6 +122,30 @@
                 }
               );
 
+              cli-docker = pkgs.dockerTools.buildImage {
+                name = "kitsune-cli";
+                tag = "latest";
+                copyToRoot = [ cli ];
+                config.Cmd = [ "${cli}/bin/kitsune-cli" ];
+              };
+
+              job-runner = craneLib.buildPackage (
+                commonArgs
+                // {
+                  pname = "kitsune-job-runner";
+                  cargoExtraArgs = commonArgs.cargoExtraArgs + " --bin kitsune-job-runner";
+                  inherit cargoArtifacts;
+                  doCheck = false;
+                }
+              );
+
+              job-runner-docker = pkgs.dockerTools.buildImage {
+                name = "kitsune-job-runner";
+                tag = "latest";
+                copyToRoot = [ job-runner ];
+                config.Cmd = [ "${job-runner}/bin/kitsune-job-runner" ];
+              };
+
               mrf-tool = craneLib.buildPackage (
                 commonArgs
                 // {
@@ -132,16 +156,30 @@
                 }
               );
 
+              mrf-tool-docker = pkgs.dockerTools.buildImage {
+                name = "mrf-tool";
+                tag = "latest";
+                copyToRoot = [ mrf-tool ];
+                config.Cmd = [ "${mrf-tool}/bin/mrf-tool" ];
+              };
+
               main = craneLib.buildPackage (
                 commonArgs
                 // {
                   pname = "kitsune";
-                  cargoExtraArgs = commonArgs.cargoExtraArgs + " --bin kitsune --bin kitsune-job-runner";
+                  cargoExtraArgs = commonArgs.cargoExtraArgs + " --bin kitsune";
                   inherit cargoArtifacts;
                   doCheck = false;
                 }
               );
 
+              main-docker = pkgs.dockerTools.buildImage {
+                name = "kitsune";
+                tag = "latest";
+                copyToRoot = [ main ];
+                config.Cmd = [ "${main}/bin/kitsune" ];
+              };
+
               frontend = pnpm2nix.packages.${system}.mkPnpmPackage {
                 src = "${src}/kitsune-fe";
                 distDir = "build";
diff --git a/kitsune/Cargo.toml b/kitsune/Cargo.toml
index a4261f237..58088483f 100644
--- a/kitsune/Cargo.toml
+++ b/kitsune/Cargo.toml
@@ -81,7 +81,7 @@ sonic-rs = { workspace = true }
 simdutf8 = { workspace = true }
 speedy-uuid = { workspace = true }
 strum = { version = "0.26.3", features = ["derive"] }
-tempfile = "3.13.0"
+tempfile = "3.14.0"
 time = "0.3.36"
 tokio = { workspace = true, features = ["full"] }
 tokio-util = { version = "0.7.12", features = ["io"] }
diff --git a/kitsune/Dockerfile.dev b/kitsune/Dockerfile.dev
deleted file mode 100644
index e45a41d11..000000000
--- a/kitsune/Dockerfile.dev
+++ /dev/null
@@ -1,26 +0,0 @@
-FROM rust:1-alpine AS base
-RUN apk add --no-cache musl-dev make protobuf-dev
-RUN cargo install cargo-chef
-WORKDIR app
-
-FROM base AS planner 
-COPY . .
-RUN cargo chef prepare --recipe-path recipe.json
-
-FROM base AS build
-COPY --from=planner /app/recipe.json recipe.json
-RUN cargo chef cook --recipe-path recipe.json
-COPY . .
-RUN cargo build --bin kitsune
-
-FROM base AS frontend
-COPY kitsune-fe .
-WORKDIR kitsune-fe
-RUN npm i && npm run build
-
-FROM alpine:latest
-WORKDIR app
-COPY --from=build /app/target/debug/kitsune .
-COPY --from=build /app/public public
-COPY --from=frontend /app kitsune-fe
-ENTRYPOINT ["./kitsune"]
diff --git a/kitsune/Dockerfile.prod b/kitsune/Dockerfile.prod
deleted file mode 100644
index 0e505997d..000000000
--- a/kitsune/Dockerfile.prod
+++ /dev/null
@@ -1,26 +0,0 @@
-FROM rust:1-alpine AS base
-RUN apk add --no-cache musl-dev make protobuf-dev
-RUN cargo install cargo-chef
-WORKDIR app
-
-FROM base AS planner 
-COPY . .
-RUN cargo chef prepare --recipe-path recipe.json
-
-FROM base AS build
-COPY --from=planner /app/recipe.json recipe.json
-RUN cargo chef cook --release --recipe-path recipe.json
-COPY . .
-RUN cargo build --release --bin kitsune
-
-FROM base AS frontend
-COPY kitsune-fe .
-WORKDIR kitsune-fe
-RUN npm i && npm run build
-
-FROM alpine:latest
-WORKDIR app
-COPY --from=build /app/target/release/kitsune .
-COPY --from=build /app/public public
-COPY --from=frontend /app kitsune-fe
-ENTRYPOINT ["./kitsune"]
diff --git a/lib/athena/Cargo.toml b/lib/athena/Cargo.toml
index 885ad37b1..b47f82a7b 100644
--- a/lib/athena/Cargo.toml
+++ b/lib/athena/Cargo.toml
@@ -22,7 +22,7 @@ serde = { version = "1.0.214", features = ["derive"] }
 smol_str = "0.3.2"
 sonic-rs = { workspace = true, optional = true }
 speedy-uuid = { workspace = true, features = ["redis"] }
-thiserror = "2.0.0"
+thiserror = "2.0.3"
 tokio = { workspace = true, features = ["macros", "rt", "sync"] }
 tokio-util = { version = "0.7.12", features = ["rt"] }
 tracing = "0.1.40"
diff --git a/lib/blowocking/Cargo.toml b/lib/blowocking/Cargo.toml
index 51023548f..3fd5ae12c 100644
--- a/lib/blowocking/Cargo.toml
+++ b/lib/blowocking/Cargo.toml
@@ -7,7 +7,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 rayon = "1.10.0"
-thiserror = "2.0.0"
+thiserror = "2.0.3"
 tokio = { workspace = true, features = ["sync"] }
 tracing = "0.1.40"
 
diff --git a/lib/geomjeungja/Cargo.toml b/lib/geomjeungja/Cargo.toml
index 00269ea31..368c5ca2a 100644
--- a/lib/geomjeungja/Cargo.toml
+++ b/lib/geomjeungja/Cargo.toml
@@ -7,11 +7,11 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 async-trait = "0.1.83"
-hickory-resolver = "0.25.0-alpha.2"
+hickory-resolver = "0.25.0-alpha.3"
 rand = "0.8.5"
 serde = { version = "1.0.214", features = ["derive"] }
 simdutf8 = { workspace = true }
-thiserror = "2.0.0"
+thiserror = "2.0.3"
 tracing = "0.1.40"
 triomphe = { workspace = true }
 typed-builder = "0.20.0"
diff --git a/lib/http-signatures/Cargo.toml b/lib/http-signatures/Cargo.toml
index 5f44e5170..878d42a4d 100644
--- a/lib/http-signatures/Cargo.toml
+++ b/lib/http-signatures/Cargo.toml
@@ -27,7 +27,7 @@ miette = "7.2.0"
 pkcs8 = { version = "0.10.2", features = ["pem", "std"] }
 ring = { version = "0.17.8", features = ["std"] }
 scoped-futures = { version = "0.1.4", default-features = false }
-thiserror = "2.0.0"
+thiserror = "2.0.3"
 tick-tock-mock = { workspace = true }
 tracing = { version = "0.1.40", default-features = false, optional = true }
 
diff --git a/lib/mrf-manifest/Cargo.toml b/lib/mrf-manifest/Cargo.toml
index 605f28b96..c80876225 100644
--- a/lib/mrf-manifest/Cargo.toml
+++ b/lib/mrf-manifest/Cargo.toml
@@ -12,7 +12,7 @@ schemars = { version = "0.8.21", features = ["impl_json_schema", "semver"] }
 semver = { version = "1.0.23", features = ["serde"] }
 serde = { version = "1.0.214", features = ["derive"] }
 sonic-rs = { workspace = true, optional = true }
-thiserror = { version = "2.0.0", optional = true }
+thiserror = { version = "2.0.3", optional = true }
 wasm-encoder = { version = "0.219.1", optional = true }
 wasmparser = { version = "0.219.1", optional = true }
 
diff --git a/lib/schaber/Cargo.toml b/lib/schaber/Cargo.toml
index 496401109..cfb47d9d1 100644
--- a/lib/schaber/Cargo.toml
+++ b/lib/schaber/Cargo.toml
@@ -7,7 +7,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 lol_html = "2.0.0"
-thiserror = "2.0.0"
+thiserror = "2.0.3"
 
 [lints]
 workspace = true
diff --git a/lib/speedy-uuid/Cargo.toml b/lib/speedy-uuid/Cargo.toml
index 500063a8a..0fb985d2c 100644
--- a/lib/speedy-uuid/Cargo.toml
+++ b/lib/speedy-uuid/Cargo.toml
@@ -13,7 +13,7 @@ diesel = { version = "2.2.4", default-features = false, features = [
 ], optional = true }
 fred = { version = "9.4.0", default-features = false, optional = true }
 serde = { version = "1.0.214", optional = true }
-thiserror = "2.0.0"
+thiserror = "2.0.3"
 uuid = { version = "1.11.0", features = ["fast-rng", "v7"] }
 uuid-simd = { version = "0.8.0", features = ["uuid"] }
 

From fe44a5df7a3f47c157e130c0fb230f37234f6c8c Mon Sep 17 00:00:00 2001
From: Aumetra Weisman <aumetra@cryptolab.net>
Date: Wed, 13 Nov 2024 01:13:25 +0000
Subject: [PATCH 2/2] Use user-space DNS resolver (#608)

* use minimal features

* use hickory for http

* remove public error constructor

* get rid of future wrapper

* share http client throughout kitsune (where possible and useful) to maximize pooling effectiveness

* fix feature flags

* up
---
 Cargo.lock                                    | 166 ++++++++----------
 Cargo.toml                                    |   8 +
 crates/kitsune-activitypub/Cargo.toml         |   2 +-
 .../kitsune-activitypub/src/deliverer/core.rs |   6 +-
 crates/kitsune-activitypub/src/fetcher/mod.rs |  39 ++--
 .../tests/fetcher/basic.rs                    |  12 +-
 .../tests/fetcher/filter.rs                   |  12 +-
 .../tests/fetcher/infinite.rs                 |   4 +-
 .../tests/fetcher/origin.rs                   |  12 +-
 .../tests/fetcher/webfinger.rs                |   8 +-
 crates/kitsune-cache/Cargo.toml               |   2 +-
 crates/kitsune-captcha/Cargo.toml             |   2 +-
 crates/kitsune-captcha/src/hcaptcha.rs        |   5 +-
 crates/kitsune-captcha/src/mcaptcha.rs        |   5 +-
 crates/kitsune-config/Cargo.toml              |   2 +-
 crates/kitsune-core/Cargo.toml                |   2 +-
 crates/kitsune-db/Cargo.toml                  |   2 +-
 crates/kitsune-federation/Cargo.toml          |   1 +
 crates/kitsune-federation/src/activitypub.rs  |   6 +-
 crates/kitsune-http-client/Cargo.toml         |   4 +-
 crates/kitsune-http-client/src/lib.rs         |  39 +++-
 crates/kitsune-http-client/src/resolver.rs    |  55 ++++++
 crates/kitsune-jobs/Cargo.toml                |   2 +-
 crates/kitsune-mastodon/Cargo.toml            |   2 +-
 crates/kitsune-observability/Cargo.toml       |   8 +-
 crates/kitsune-observability/src/lib.rs       |  44 ++---
 crates/kitsune-oidc/Cargo.toml                |   3 +-
 crates/kitsune-oidc/src/error.rs              |   7 +
 crates/kitsune-oidc/src/http.rs               |  14 +-
 crates/kitsune-oidc/src/lib.rs                |   1 +
 crates/kitsune-s3/Cargo.toml                  |   2 +-
 crates/kitsune-search/Cargo.toml              |   2 +-
 crates/kitsune-service/Cargo.toml             |   2 +-
 crates/kitsune-service/src/attachment.rs      |   6 +-
 crates/kitsune-service/src/post/resolver.rs   |   4 +-
 crates/kitsune-service/src/prepare.rs         |   4 +-
 crates/kitsune-type/Cargo.toml                |   2 +-
 crates/kitsune-wasm-mrf/Cargo.toml            |   2 +-
 crates/kitsune-webfinger/src/lib.rs           |  46 +++--
 crates/kitsune-webfinger/tests/basic.rs       |   2 +-
 crates/kitsune-webfinger/tests/redirects.rs   |   6 +-
 kitsune-cli/Cargo.toml                        |   2 +-
 kitsune-job-runner/Cargo.toml                 |   1 +
 kitsune-job-runner/src/lib.rs                 |   4 +-
 kitsune-job-runner/src/main.rs                |   9 +-
 kitsune/Cargo.toml                            |   3 +-
 .../src/http/handler/well_known/webfinger.rs  |  10 +-
 kitsune/src/lib.rs                            |   9 +-
 kitsune/src/main.rs                           |   6 +-
 lib/athena/Cargo.toml                         |   2 +-
 lib/fast-cjson/Cargo.toml                     |   4 +-
 lib/geomjeungja/Cargo.toml                    |   4 +-
 lib/geomjeungja/src/lib.rs                    |  12 +-
 lib/mrf-manifest/Cargo.toml                   |   8 +-
 lib/mrf-tool/Cargo.toml                       |   4 +-
 lib/speedy-uuid/Cargo.toml                    |   2 +-
 56 files changed, 356 insertions(+), 277 deletions(-)
 create mode 100644 crates/kitsune-http-client/src/resolver.rs
 create mode 100644 crates/kitsune-oidc/src/error.rs

diff --git a/Cargo.lock b/Cargo.lock
index 08b663a57..e119a646e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -989,9 +989,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.1.37"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40545c26d092346d8a8dab71ee48e7685a7a9cba76e634790c215b41a4a7b4cf"
+checksum = "1aeb932158bd710538c73702db6945cb68a8fb08c519e6e12706b94263b36db8"
 dependencies = [
  "shlex",
 ]
@@ -1296,9 +1296,9 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "cpufeatures"
-version = "0.2.14"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "608697df725056feaccfa42cffdaeeec3fccc4ffc38358ecd19b243e716a78e0"
+checksum = "0ca741a962e1b0bff6d724a1a0958b686406e853bb14061f218562e1896f95e6"
 dependencies = [
  "libc",
 ]
@@ -2698,9 +2698,12 @@ dependencies = [
  "ipnet",
  "once_cell",
  "rand 0.8.5",
+ "rustls",
+ "rustls-native-certs 0.7.3",
  "thiserror 1.0.69",
  "tinyvec",
  "tokio",
+ "tokio-rustls",
  "tracing",
  "url",
 ]
@@ -2714,15 +2717,16 @@ dependencies = [
  "cfg-if",
  "futures-util",
  "hickory-proto",
- "ipconfig",
  "lru-cache",
  "once_cell",
  "parking_lot",
  "rand 0.8.5",
- "resolv-conf",
+ "rustls",
+ "rustls-native-certs 0.7.3",
  "smallvec",
  "thiserror 1.0.69",
  "tokio",
+ "tokio-rustls",
  "tracing",
 ]
 
@@ -2744,17 +2748,6 @@ dependencies = [
  "digest",
 ]
 
-[[package]]
-name = "hostname"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c731c3e10504cc8ed35cfe2f1db4c9274c3d35fa486e3b31df46f068ef3e867"
-dependencies = [
- "libc",
- "match_cfg",
- "winapi",
-]
-
 [[package]]
 name = "hostname"
 version = "0.4.0"
@@ -3202,18 +3195,6 @@ version = "2.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5a611371471e98973dbcab4e0ec66c31a10bc356eeb4d54a0e05eac8158fe38c"
 
-[[package]]
-name = "ipconfig"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b58db92f96b720de98181bbbe63c831e87005ab460c1bf306eb2622b4707997f"
-dependencies = [
- "socket2",
- "widestring",
- "windows-sys 0.48.0",
- "winreg",
-]
-
 [[package]]
 name = "ipnet"
 version = "2.10.1"
@@ -3681,6 +3662,7 @@ dependencies = [
  "kitsune-db",
  "kitsune-embed",
  "kitsune-federation-filter",
+ "kitsune-http-client",
  "kitsune-search",
  "kitsune-service",
  "kitsune-url",
@@ -3709,12 +3691,14 @@ dependencies = [
  "asynk-strim",
  "bytes",
  "futures-util",
+ "hickory-resolver",
  "http-body",
  "http-body-util",
  "http-signatures",
  "hyper",
  "hyper-rustls",
  "hyper-util",
+ "kitsune-core",
  "kitsune-type",
  "pin-project",
  "serde",
@@ -3741,6 +3725,7 @@ dependencies = [
  "kitsune-error",
  "kitsune-federation",
  "kitsune-federation-filter",
+ "kitsune-http-client",
  "kitsune-jobs",
  "kitsune-observability",
  "kitsune-service",
@@ -3848,6 +3833,7 @@ dependencies = [
  "serde",
  "sonic-rs",
  "speedy-uuid",
+ "thiserror 2.0.3",
  "tokio",
  "url",
 ]
@@ -4148,7 +4134,7 @@ dependencies = [
  "fastrand",
  "futures-io",
  "futures-util",
- "hostname 0.4.0",
+ "hostname",
  "httpdate",
  "idna 1.0.3",
  "mime",
@@ -4303,12 +4289,6 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "match_cfg"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffbee8634e0d45d258acb448e7eaab3fce7a0a467395d4d9f228e3c1f01fb2e4"
-
 [[package]]
 name = "matches"
 version = "0.1.10"
@@ -4406,7 +4386,7 @@ dependencies = [
  "terminal_size 0.3.0",
  "textwrap",
  "thiserror 1.0.69",
- "unicode-width",
+ "unicode-width 0.1.14",
 ]
 
 [[package]]
@@ -4534,8 +4514,8 @@ dependencies = [
  "serde",
  "sonic-rs",
  "thiserror 2.0.3",
- "wasm-encoder 0.219.1",
- "wasmparser 0.219.1",
+ "wasm-encoder 0.220.0",
+ "wasmparser 0.220.0",
  "wat",
 ]
 
@@ -4548,7 +4528,7 @@ dependencies = [
  "colored_json",
  "mrf-manifest",
  "sonic-rs",
- "wasmparser 0.219.1",
+ "wasmparser 0.220.0",
  "wat",
 ]
 
@@ -4775,9 +4755,9 @@ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
 [[package]]
 name = "opentelemetry"
-version = "0.26.0"
+version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "570074cc999d1a58184080966e5bd3bf3a9a4af650c3b05047c2621e7405cd17"
+checksum = "0f3cebff57f7dbd1255b44d8bddc2cebeb0ea677dbaa2e25a3070a91b318f660"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -4789,9 +4769,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-http"
-version = "0.26.0"
+version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6351496aeaa49d7c267fb480678d85d1cd30c5edb20b497c48c56f62a8c14b99"
+checksum = "10a8a7f5f6ba7c1b286c2fbca0454eaba116f63bbe69ed250b642d36fbb04d80"
 dependencies = [
  "async-trait",
  "bytes",
@@ -4801,9 +4781,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-otlp"
-version = "0.26.0"
+version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29e1f9c8b032d4f635c730c0efcf731d5e2530ea13fa8bef7939ddc8420696bd"
+checksum = "91cf61a1868dacc576bf2b2a1c3e9ab150af7272909e80085c3173384fe11f76"
 dependencies = [
  "async-trait",
  "futures-core",
@@ -4821,9 +4801,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-proto"
-version = "0.26.1"
+version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9d3968ce3aefdcca5c27e3c4ea4391b37547726a70893aab52d3de95d5f8b34"
+checksum = "a6e05acbfada5ec79023c85368af14abd0b307c015e9064d249b2a950ef459a6"
 dependencies = [
  "hex",
  "opentelemetry",
@@ -4835,9 +4815,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry_sdk"
-version = "0.26.0"
+version = "0.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2c627d9f4c9cdc1f21a29ee4bfbd6028fcb8bcf2a857b43f3abdf72c9c862f3"
+checksum = "27b742c1cae4693792cc564e58d75a2a0ba29421a34a85b50da92efa89ecb2bc"
 dependencies = [
  "async-trait",
  "futures-channel",
@@ -5436,12 +5416,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "quick-error"
-version = "1.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
-
 [[package]]
 name = "quick-xml"
 version = "0.30.0"
@@ -5683,16 +5657,6 @@ version = "1.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba39f3699c378cd8970968dcbff9c43159ea4cfbd88d43c00b22f2ef10a435d2"
 
-[[package]]
-name = "resolv-conf"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52e44394d2086d010551b14b53b1f24e31647570cd1deb0379e2c21b329aba00"
-dependencies = [
- "hostname 0.3.1",
- "quick-error",
-]
-
 [[package]]
 name = "retry-policies"
 version = "0.4.0"
@@ -6110,9 +6074,9 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.214"
+version = "1.0.215"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f55c3193aca71c12ad7890f1785d2b73e1b9f63a0bbc353c08ef26fe03fc56b5"
+checksum = "6513c1ad0b11a9376da888e3e0baa0077f1aed55c17f50e7b2397136129fb88f"
 dependencies = [
  "serde_derive",
 ]
@@ -6129,9 +6093,9 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.214"
+version = "1.0.215"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de523f781f095e28fa605cdce0f8307e451cc0fd14e2eb4cd2e98a355b147766"
+checksum = "ad1e866f866923f252f05c889987993144fb74e722403468a4ebd70c3cd756c0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6746,7 +6710,7 @@ checksum = "23d434d3f8967a09480fb04132ebe0a3e088c173e6d0ee7897abbdf4eab0f8b9"
 dependencies = [
  "smawk",
  "unicode-linebreak",
- "unicode-width",
+ "unicode-width 0.1.14",
 ]
 
 [[package]]
@@ -7289,8 +7253,7 @@ dependencies = [
 [[package]]
 name = "tracing-opentelemetry"
 version = "0.27.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc58af5d3f6c5811462cabb3289aec0093f7338e367e5a33d28c0433b3c7360b"
+source = "git+https://github.com/tokio-rs/tracing-opentelemetry.git?rev=d18214596c97b1243ee955a63bed3875a4f8f5f9#d18214596c97b1243ee955a63bed3875a4f8f5f9"
 dependencies = [
  "js-sys",
  "once_cell",
@@ -7477,6 +7440,12 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
 
+[[package]]
+name = "unicode-width"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fc81956842c57dac11422a97c3b8195a1ff727f06e85c84ed2e8aa277c9a0fd"
+
 [[package]]
 name = "unicode-xid"
 version = "0.2.6"
@@ -7720,6 +7689,16 @@ dependencies = [
  "wasmparser 0.219.1",
 ]
 
+[[package]]
+name = "wasm-encoder"
+version = "0.220.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebf48234b389415b226a4daef6562933d38c7b28a8b8f64c5c4130dad1561ab7"
+dependencies = [
+ "leb128",
+ "wasmparser 0.220.0",
+]
+
 [[package]]
 name = "wasm-metadata"
 version = "0.219.1"
@@ -7755,6 +7734,19 @@ name = "wasmparser"
 version = "0.219.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5c771866898879073c53b565a6c7b49953795159836714ac56a5befb581227c5"
+dependencies = [
+ "ahash",
+ "bitflags 2.6.0",
+ "hashbrown 0.14.5",
+ "indexmap 2.6.0",
+ "semver",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.220.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e246c2772ce3ebc83f89a2d4487ac5794cad6c309b2071818a88c7db7c36d87b"
 dependencies = [
  "ahash",
  "bitflags 2.6.0",
@@ -8010,22 +8002,22 @@ dependencies = [
 
 [[package]]
 name = "wast"
-version = "219.0.1"
+version = "220.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f79a9d9df79986a68689a6b40bcc8d5d40d807487b235bebc2ac69a242b54a1"
+checksum = "4e708c8de08751fd66e70961a32bae9d71901f14a70871e181cb8461a3bb3165"
 dependencies = [
  "bumpalo",
  "leb128",
  "memchr",
- "unicode-width",
- "wasm-encoder 0.219.1",
+ "unicode-width 0.2.0",
+ "wasm-encoder 0.220.0",
 ]
 
 [[package]]
 name = "wat"
-version = "1.219.1"
+version = "1.220.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bc3cf014fb336883a411cd662f987abf6a1d2a27f2f0008616a0070bbf6bd0d"
+checksum = "de4f1d7d59614ba690541360102b995c4eb1b9ed373701d5102cc1a968b1c5a3"
 dependencies = [
  "wast",
 ]
@@ -8086,12 +8078,6 @@ dependencies = [
  "web-sys",
 ]
 
-[[package]]
-name = "widestring"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7219d36b6eac893fa81e84ebe06485e7dcbb616177469b142df14f1f4deb1311"
-
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -8316,16 +8302,6 @@ dependencies = [
  "memchr",
 ]
 
-[[package]]
-name = "winreg"
-version = "0.50.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
-dependencies = [
- "cfg-if",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "winx"
 version = "0.36.3"
diff --git a/Cargo.toml b/Cargo.toml
index fa63fd659..691025a24 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -109,6 +109,11 @@ garde = { version = "0.20.0", features = [
     "regex",
     "serde",
 ] }
+hickory-resolver = { version = "0.25.0-alpha.3", default-features = false, features = [
+    "dns-over-rustls",
+    "native-certs",
+    "tokio-runtime",
+] }
 iso8601-timestamp = "0.3.0"
 itertools = { version = "0.13.0", default-features = false }
 moka = { version = "=0.12.7", features = ["sync"] }
@@ -199,3 +204,6 @@ license = "AGPL-3.0-or-later"
 [patch.crates-io]
 # SIMD runtime detection and generic I/O wrapper
 sonic-rs = { git = "https://github.com/aumetra/sonic-rs.git", rev = "12df930a57ff9f07eb16111a3da1feff3dc8e5ad" }
+
+# Compatibility with latest opentelemetry crates
+tracing-opentelemetry = { git = "https://github.com/tokio-rs/tracing-opentelemetry.git", rev = "d18214596c97b1243ee955a63bed3875a4f8f5f9" }
diff --git a/crates/kitsune-activitypub/Cargo.toml b/crates/kitsune-activitypub/Cargo.toml
index 2d8e79822..98e961cbb 100644
--- a/crates/kitsune-activitypub/Cargo.toml
+++ b/crates/kitsune-activitypub/Cargo.toml
@@ -31,7 +31,7 @@ kitsune-util = { workspace = true }
 kitsune-wasm-mrf = { workspace = true }
 mime = "0.3.17"
 mime_guess = { version = "2.0.5", default-features = false }
-serde = "1.0.214"
+serde = "1.0.215"
 sha2 = "0.10.8"
 sonic-rs = { workspace = true }
 speedy-uuid = { workspace = true }
diff --git a/crates/kitsune-activitypub/src/deliverer/core.rs b/crates/kitsune-activitypub/src/deliverer/core.rs
index 56f753813..034f7bb57 100644
--- a/crates/kitsune-activitypub/src/deliverer/core.rs
+++ b/crates/kitsune-activitypub/src/deliverer/core.rs
@@ -1,6 +1,5 @@
 use futures_util::{stream::FuturesUnordered, Stream, StreamExt};
 use http::{Method, Request};
-use kitsune_core::consts::USER_AGENT;
 use kitsune_db::model::{account::Account, user::User};
 use kitsune_error::{Error, Result};
 use kitsune_federation_filter::FederationFilter;
@@ -17,8 +16,7 @@ use url::Url;
 /// Does not need to be Arc wrapped for cheap cloning. It's inherently cheap to clone.
 #[derive(Clone, TypedBuilder)]
 pub struct Deliverer {
-    #[builder(default = Client::builder().user_agent(USER_AGENT).unwrap().build())]
-    client: Client,
+    http_client: Client,
     federation_filter: FederationFilter,
     mrf_service: MrfService,
 }
@@ -55,7 +53,7 @@ impl Deliverer {
             .body(body.into())?;
 
         let response = self
-            .client
+            .http_client
             .execute_signed(request, &account.public_key_id, &user.private_key)
             .await?;
 
diff --git a/crates/kitsune-activitypub/src/fetcher/mod.rs b/crates/kitsune-activitypub/src/fetcher/mod.rs
index 4be794838..380afc9b6 100644
--- a/crates/kitsune-activitypub/src/fetcher/mod.rs
+++ b/crates/kitsune-activitypub/src/fetcher/mod.rs
@@ -1,15 +1,12 @@
 use async_trait::async_trait;
 use headers::{ContentType, HeaderMapExt};
-use http::HeaderValue;
+use http::{header::ACCEPT, HeaderValue, Request};
 use kitsune_cache::ArcCache;
 use kitsune_config::language_detection::Configuration as LanguageDetectionConfig;
-use kitsune_core::{
-    consts::USER_AGENT,
-    traits::{
-        coerce::CoerceResolver,
-        fetcher::{AccountFetchOptions, PostFetchOptions},
-        Fetcher as FetcherTrait, Resolver,
-    },
+use kitsune_core::traits::{
+    coerce::CoerceResolver,
+    fetcher::{AccountFetchOptions, PostFetchOptions},
+    Fetcher as FetcherTrait, Resolver,
 };
 use kitsune_db::{
     model::{account::Account, custom_emoji::CustomEmoji, post::Post},
@@ -32,23 +29,14 @@ mod actor;
 mod emoji;
 mod object;
 
+static ACCEPT_VALUE: HeaderValue = HeaderValue::from_static(
+    "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\", application/activity+json",
+);
+
 #[derive(TypedBuilder)]
 #[builder(build_method(into = Arc<Fetcher>))]
 pub struct Fetcher {
-    #[builder(default =
-        Client::builder()
-            .default_header(
-                "accept",
-                HeaderValue::from_static(
-                    "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\", application/activity+json",
-                ),
-            )
-            .unwrap()
-            .user_agent(USER_AGENT)
-            .unwrap()
-            .build()
-    )]
-    client: Client,
+    http_client: Client,
     db_pool: PgPool,
     embed_client: Option<EmbedClient>,
     federation_filter: FederationFilter,
@@ -74,8 +62,13 @@ impl Fetcher {
             bail!("instance is blocked");
         }
 
-        let response = self.client.get(url.as_str()).await?;
+        let request = Request::builder()
+            .method(http::Method::GET)
+            .uri(url.as_str())
+            .header(ACCEPT, &ACCEPT_VALUE)
+            .body(kitsune_http_client::Body::empty())?;
 
+        let response = self.http_client.execute(request).await?;
         if !response.status().is_success() {
             return Ok(None);
         }
diff --git a/crates/kitsune-activitypub/tests/fetcher/basic.rs b/crates/kitsune-activitypub/tests/fetcher/basic.rs
index 8d9601671..6569bd2f2 100644
--- a/crates/kitsune-activitypub/tests/fetcher/basic.rs
+++ b/crates/kitsune-activitypub/tests/fetcher/basic.rs
@@ -25,7 +25,7 @@ async fn fetch_actor() {
         let client = Client::builder().service(service_fn(handle));
 
         let fetcher = Fetcher::builder()
-            .client(client.clone())
+            .http_client(client.clone())
             .db_pool(db_pool)
             .embed_client(None)
             .federation_filter(
@@ -36,7 +36,7 @@ async fn fetch_actor() {
             )
             .language_detection_config(language_detection_config())
             .search_backend(NoopSearchService)
-            .resolver(Arc::new(Webfinger::with_client(client, Arc::new(NoopCache.into()))).coerce())
+            .resolver(Arc::new(Webfinger::new(client, Arc::new(NoopCache.into()))).coerce())
             .account_cache(Arc::new(NoopCache.into()))
             .post_cache(Arc::new(NoopCache.into()))
             .build();
@@ -64,7 +64,7 @@ async fn fetch_emoji() {
         let client = Client::builder().service(service_fn(handle));
 
         let fetcher = Fetcher::builder()
-            .client(client.clone())
+            .http_client(client.clone())
             .db_pool(db_pool.clone())
             .embed_client(None)
             .federation_filter(
@@ -75,7 +75,7 @@ async fn fetch_emoji() {
             )
             .language_detection_config(language_detection_config())
             .search_backend(NoopSearchService)
-            .resolver(Arc::new(Webfinger::with_client(client, Arc::new(NoopCache.into()))).coerce())
+            .resolver(Arc::new(Webfinger::new(client, Arc::new(NoopCache.into()))).coerce())
             .account_cache(Arc::new(NoopCache.into()))
             .post_cache(Arc::new(NoopCache.into()))
             .build();
@@ -115,7 +115,7 @@ async fn fetch_note() {
         let client = Client::builder().service(service_fn(handle));
 
         let fetcher = Fetcher::builder()
-            .client(client.clone())
+            .http_client(client.clone())
             .db_pool(db_pool.clone())
             .embed_client(None)
             .federation_filter(
@@ -126,7 +126,7 @@ async fn fetch_note() {
             )
             .language_detection_config(language_detection_config())
             .search_backend(NoopSearchService)
-            .resolver(Arc::new(Webfinger::with_client(client, Arc::new(NoopCache.into()))).coerce())
+            .resolver(Arc::new(Webfinger::new(client, Arc::new(NoopCache.into()))).coerce())
             .account_cache(Arc::new(NoopCache.into()))
             .post_cache(Arc::new(NoopCache.into()))
             .build();
diff --git a/crates/kitsune-activitypub/tests/fetcher/filter.rs b/crates/kitsune-activitypub/tests/fetcher/filter.rs
index bb3484700..d82068f6b 100644
--- a/crates/kitsune-activitypub/tests/fetcher/filter.rs
+++ b/crates/kitsune-activitypub/tests/fetcher/filter.rs
@@ -45,9 +45,9 @@ async fn federation_allow() {
         let client = Client::builder().service(client);
         let fetcher = builder
             .clone()
-            .client(client.clone())
+            .http_client(client.clone())
             .language_detection_config(language_detection_config())
-            .resolver(Arc::new(Webfinger::with_client(client, Arc::new(NoopCache.into()))).coerce())
+            .resolver(Arc::new(Webfinger::new(client, Arc::new(NoopCache.into()))).coerce())
             .build();
 
         assert_blocked!(fetcher
@@ -63,9 +63,9 @@ async fn federation_allow() {
         let client = Client::builder().service(service_fn(handle));
         let fetcher = builder
             .clone()
-            .client(client.clone())
+            .http_client(client.clone())
             .language_detection_config(language_detection_config())
-            .resolver(Arc::new(Webfinger::with_client(client, Arc::new(NoopCache.into()))).coerce())
+            .resolver(Arc::new(Webfinger::new(client, Arc::new(NoopCache.into()))).coerce())
             .build();
 
         assert!(matches!(
@@ -90,7 +90,7 @@ async fn federation_deny() {
         let client = Client::builder().service(client);
 
         let fetcher = Fetcher::builder()
-            .client(client.clone())
+            .http_client(client.clone())
             .db_pool(db_pool)
             .embed_client(None)
             .federation_filter(
@@ -101,7 +101,7 @@ async fn federation_deny() {
             )
             .language_detection_config(language_detection_config())
             .search_backend(NoopSearchService)
-            .resolver(Arc::new(Webfinger::with_client(client, Arc::new(NoopCache.into()))).coerce())
+            .resolver(Arc::new(Webfinger::new(client, Arc::new(NoopCache.into()))).coerce())
             .account_cache(Arc::new(NoopCache.into()))
             .post_cache(Arc::new(NoopCache.into()))
             .build();
diff --git a/crates/kitsune-activitypub/tests/fetcher/infinite.rs b/crates/kitsune-activitypub/tests/fetcher/infinite.rs
index aa03eba99..e0264da2b 100644
--- a/crates/kitsune-activitypub/tests/fetcher/infinite.rs
+++ b/crates/kitsune-activitypub/tests/fetcher/infinite.rs
@@ -91,7 +91,7 @@ async fn fetch_infinitely_long_reply_chain() {
             let client = Client::builder().service(client);
 
             let fetcher = Fetcher::builder()
-                .client(client.clone())
+                .http_client(client.clone())
                 .db_pool(db_pool)
                 .embed_client(None)
                 .federation_filter(
@@ -102,7 +102,7 @@ async fn fetch_infinitely_long_reply_chain() {
                 )
                 .language_detection_config(language_detection_config())
                 .search_backend(NoopSearchService)
-                .resolver(Arc::new(Webfinger::with_client(client, Arc::new(NoopCache.into()))).coerce())
+                .resolver(Arc::new(Webfinger::new(client, Arc::new(NoopCache.into()))).coerce())
                 .account_cache(Arc::new(NoopCache.into()))
                 .post_cache(Arc::new(NoopCache.into()))
                 .build();
diff --git a/crates/kitsune-activitypub/tests/fetcher/origin.rs b/crates/kitsune-activitypub/tests/fetcher/origin.rs
index 3181fe5cd..54baed964 100644
--- a/crates/kitsune-activitypub/tests/fetcher/origin.rs
+++ b/crates/kitsune-activitypub/tests/fetcher/origin.rs
@@ -37,9 +37,9 @@ async fn check_ap_id_authority() {
         let client = Client::builder().service(client);
         let fetcher = builder
             .clone()
-            .client(client.clone())
+            .http_client(client.clone())
             .language_detection_config(language_detection_config())
-            .resolver(Arc::new(Webfinger::with_client(client, Arc::new(NoopCache.into()))).coerce())
+            .resolver(Arc::new(Webfinger::new(client, Arc::new(NoopCache.into()))).coerce())
             .build();
 
         // The mock HTTP client ensures that the fetcher doesn't access the correct server
@@ -60,9 +60,9 @@ async fn check_ap_id_authority() {
         let client = Client::builder().service(client);
         let fetcher = builder
             .clone()
-            .client(client.clone())
+            .http_client(client.clone())
             .language_detection_config(language_detection_config())
-            .resolver(Arc::new(Webfinger::with_client(client, Arc::new(NoopCache.into()))).coerce())
+            .resolver(Arc::new(Webfinger::new(client, Arc::new(NoopCache.into()))).coerce())
             .build();
 
         let _ = fetcher
@@ -84,7 +84,7 @@ async fn check_ap_content_type() {
         let client = Client::builder().service(client);
 
         let fetcher = Fetcher::builder()
-            .client(client.clone())
+            .http_client(client.clone())
             .db_pool(db_pool)
             .embed_client(None)
             .federation_filter(
@@ -95,7 +95,7 @@ async fn check_ap_content_type() {
             )
             .language_detection_config(language_detection_config())
             .search_backend(NoopSearchService)
-            .resolver(Arc::new(Webfinger::with_client(client, Arc::new(NoopCache.into()))).coerce())
+            .resolver(Arc::new(Webfinger::new(client, Arc::new(NoopCache.into()))).coerce())
             .account_cache(Arc::new(NoopCache.into()))
             .post_cache(Arc::new(NoopCache.into()))
             .build();
diff --git a/crates/kitsune-activitypub/tests/fetcher/webfinger.rs b/crates/kitsune-activitypub/tests/fetcher/webfinger.rs
index a332e5a96..7c4cac600 100644
--- a/crates/kitsune-activitypub/tests/fetcher/webfinger.rs
+++ b/crates/kitsune-activitypub/tests/fetcher/webfinger.rs
@@ -47,7 +47,7 @@ async fn fetch_actor_with_custom_acct() {
         let client = Client::builder().service(client);
 
         let fetcher = Fetcher::builder()
-            .client(client.clone())
+            .http_client(client.clone())
             .db_pool(db_pool)
             .embed_client(None)
             .federation_filter(
@@ -58,7 +58,7 @@ async fn fetch_actor_with_custom_acct() {
             )
             .language_detection_config(language_detection_config())
             .search_backend(NoopSearchService)
-            .resolver(Arc::new(Webfinger::with_client(client, Arc::new(NoopCache.into()))).coerce())
+            .resolver(Arc::new(Webfinger::new(client, Arc::new(NoopCache.into()))).coerce())
             .account_cache(Arc::new(NoopCache.into()))
             .post_cache(Arc::new(NoopCache.into()))
             .build();
@@ -125,7 +125,7 @@ async fn ignore_fake_webfinger_acct() {
         let client = Client::builder().service(client);
 
         let fetcher = Fetcher::builder()
-            .client(client.clone())
+            .http_client(client.clone())
             .db_pool(db_pool)
             .embed_client(None)
             .federation_filter(
@@ -136,7 +136,7 @@ async fn ignore_fake_webfinger_acct() {
             )
             .language_detection_config(language_detection_config())
             .search_backend(NoopSearchService)
-            .resolver(Arc::new(Webfinger::with_client(client, Arc::new(NoopCache.into()))).coerce())
+            .resolver(Arc::new(Webfinger::new(client, Arc::new(NoopCache.into()))).coerce())
             .account_cache(Arc::new(NoopCache.into()))
             .post_cache(Arc::new(NoopCache.into()))
             .build();
diff --git a/crates/kitsune-cache/Cargo.toml b/crates/kitsune-cache/Cargo.toml
index d3a6a4712..75389e8c0 100644
--- a/crates/kitsune-cache/Cargo.toml
+++ b/crates/kitsune-cache/Cargo.toml
@@ -10,7 +10,7 @@ enum_dispatch = "0.3.13"
 fred = { workspace = true }
 kitsune-error = { workspace = true }
 moka = { workspace = true }
-serde = "1.0.214"
+serde = "1.0.215"
 sonic-rs = { workspace = true }
 tracing = "0.1.40"
 triomphe = { workspace = true }
diff --git a/crates/kitsune-captcha/Cargo.toml b/crates/kitsune-captcha/Cargo.toml
index f16560ba1..1f17ffef6 100644
--- a/crates/kitsune-captcha/Cargo.toml
+++ b/crates/kitsune-captcha/Cargo.toml
@@ -10,7 +10,7 @@ enum_dispatch = "0.3.13"
 http = "1.1.0"
 kitsune-error = { workspace = true }
 kitsune-http-client = { workspace = true }
-serde = { version = "1.0.214", features = ["derive"] }
+serde = { version = "1.0.215", features = ["derive"] }
 serde_urlencoded = "0.7.1"
 sonic-rs = { workspace = true }
 strum = { version = "0.26.3", features = ["derive"] }
diff --git a/crates/kitsune-captcha/src/hcaptcha.rs b/crates/kitsune-captcha/src/hcaptcha.rs
index 30905a490..a07430a0f 100644
--- a/crates/kitsune-captcha/src/hcaptcha.rs
+++ b/crates/kitsune-captcha/src/hcaptcha.rs
@@ -10,8 +10,7 @@ pub struct Captcha {
     pub site_key: String,
     pub secret_key: String,
 
-    #[builder(default)]
-    client: Client,
+    http_client: Client,
 }
 
 #[derive(Serialize, Deserialize, TypedBuilder)]
@@ -46,7 +45,7 @@ impl CaptchaBackend for Captcha {
             .header("Accept", "application/json")
             .body(body.into())?;
 
-        let response = self.client.execute(request).await?;
+        let response = self.http_client.execute(request).await?;
 
         let verification_result = response.json::<HCaptchaResponse>().await?;
         if !verification_result.success {
diff --git a/crates/kitsune-captcha/src/mcaptcha.rs b/crates/kitsune-captcha/src/mcaptcha.rs
index 53c20b542..ab8a33912 100644
--- a/crates/kitsune-captcha/src/mcaptcha.rs
+++ b/crates/kitsune-captcha/src/mcaptcha.rs
@@ -11,8 +11,7 @@ pub struct Captcha {
     pub secret_key: String,
     pub site_key: String,
 
-    #[builder(default)]
-    client: Client,
+    http_client: Client,
 }
 
 #[derive(Debug, Serialize, Deserialize)]
@@ -41,7 +40,7 @@ impl CaptchaBackend for Captcha {
             .header("Accept", "application/json")
             .body(body.into())?;
 
-        let response = self.client.execute(request).await?;
+        let response = self.http_client.execute(request).await?;
 
         let verification_result = response.json::<MCaptchaResponse>().await?;
         if !verification_result.valid {
diff --git a/crates/kitsune-config/Cargo.toml b/crates/kitsune-config/Cargo.toml
index f9ade3a3f..c4c02fd22 100644
--- a/crates/kitsune-config/Cargo.toml
+++ b/crates/kitsune-config/Cargo.toml
@@ -9,7 +9,7 @@ license.workspace = true
 eyre = "0.6.12"
 human-size = { version = "0.4.3", features = ["serde"] }
 isolang = { version = "2.4.0", features = ["serde"] }
-serde = { version = "1.0.214", features = ["derive"] }
+serde = { version = "1.0.215", features = ["derive"] }
 smol_str = { version = "0.3.2", features = ["serde"] }
 tokio = { workspace = true, features = ["fs"] }
 toml = { version = "0.8.19", default-features = false, features = ["parse"] }
diff --git a/crates/kitsune-core/Cargo.toml b/crates/kitsune-core/Cargo.toml
index 19a5f38f1..c6a283b91 100644
--- a/crates/kitsune-core/Cargo.toml
+++ b/crates/kitsune-core/Cargo.toml
@@ -12,7 +12,7 @@ git-version = "0.3.9"
 kitsune-db = { workspace = true }
 kitsune-error = { workspace = true }
 paste = "1.0.15"
-serde = { version = "1.0.214", features = ["derive"] }
+serde = { version = "1.0.215", features = ["derive"] }
 triomphe = { workspace = true }
 typed-builder = "0.20.0"
 unsize = "1.1.0"
diff --git a/crates/kitsune-db/Cargo.toml b/crates/kitsune-db/Cargo.toml
index 680e6231c..72dbea8a0 100644
--- a/crates/kitsune-db/Cargo.toml
+++ b/crates/kitsune-db/Cargo.toml
@@ -29,7 +29,7 @@ rustls = { version = "0.23.16", default-features = false, features = [
     "tls12",
 ] }
 rustls-native-certs = "0.8.0"
-serde = { version = "1.0.214", features = ["derive"] }
+serde = { version = "1.0.215", features = ["derive"] }
 sonic-rs = { workspace = true }
 speedy-uuid = { workspace = true, features = ["diesel"] }
 tokio = { workspace = true, features = ["rt"] }
diff --git a/crates/kitsune-federation/Cargo.toml b/crates/kitsune-federation/Cargo.toml
index 12441fe70..5ff563b8b 100644
--- a/crates/kitsune-federation/Cargo.toml
+++ b/crates/kitsune-federation/Cargo.toml
@@ -13,6 +13,7 @@ kitsune-core = { workspace = true }
 kitsune-db = { workspace = true }
 kitsune-embed = { workspace = true }
 kitsune-federation-filter = { workspace = true }
+kitsune-http-client.workspace = true
 kitsune-search = { workspace = true }
 kitsune-service = { workspace = true }
 kitsune-url = { workspace = true }
diff --git a/crates/kitsune-federation/src/activitypub.rs b/crates/kitsune-federation/src/activitypub.rs
index 348f0af8f..5e447e15a 100644
--- a/crates/kitsune-federation/src/activitypub.rs
+++ b/crates/kitsune-federation/src/activitypub.rs
@@ -27,6 +27,7 @@ pub struct PrepareDeliverer {
     attachment_service: AttachmentService,
     db_pool: PgPool,
     federation_filter: FederationFilter,
+    http_client: kitsune_http_client::Client,
     mrf_service: MrfService,
     url_service: UrlService,
 }
@@ -38,6 +39,7 @@ pub struct PrepareFetcher {
     db_pool: PgPool,
     embed_client: Option<kitsune_embed::Client>,
     federation_filter: FederationFilter,
+    http_client: kitsune_http_client::Client,
     language_detection_config: LanguageDetectionConfig,
     post_cache: ArcCache<str, Post>,
     search_backend: AnySearchBackend,
@@ -47,6 +49,7 @@ pub struct PrepareFetcher {
 pub(crate) fn prepare_deliverer(prepare: PrepareDeliverer) -> Arc<dyn Deliverer> {
     let core_deliverer = kitsune_activitypub::CoreDeliverer::builder()
         .federation_filter(prepare.federation_filter)
+        .http_client(prepare.http_client)
         .mrf_service(prepare.mrf_service)
         .build();
 
@@ -67,13 +70,14 @@ pub(crate) fn prepare_deliverer(prepare: PrepareDeliverer) -> Arc<dyn Deliverer>
 
 #[inline]
 pub(crate) fn prepare_fetcher(prepare: PrepareFetcher) -> Arc<dyn Fetcher> {
-    let webfinger = Webfinger::new(prepare.account_resource_cache);
+    let webfinger = Webfinger::new(prepare.http_client.clone(), prepare.account_resource_cache);
 
     ActivityPubFetcher::builder()
         .account_cache(prepare.account_cache)
         .db_pool(prepare.db_pool.clone())
         .embed_client(prepare.embed_client)
         .federation_filter(prepare.federation_filter.clone())
+        .http_client(prepare.http_client)
         .language_detection_config(prepare.language_detection_config)
         .post_cache(prepare.post_cache)
         .resolver(Arc::new(webfinger).coerce())
diff --git a/crates/kitsune-http-client/Cargo.toml b/crates/kitsune-http-client/Cargo.toml
index dd83fe5ef..540476435 100644
--- a/crates/kitsune-http-client/Cargo.toml
+++ b/crates/kitsune-http-client/Cargo.toml
@@ -11,6 +11,7 @@ bytes = "1.8.0"
 futures-util = { version = "0.3.31", default-features = false, features = [
     "alloc",
 ] }
+hickory-resolver = { workspace = true }
 http-body = "1.0.1"
 http-body-util = "0.1.2"
 http-signatures = { workspace = true }
@@ -29,9 +30,10 @@ hyper-rustls = { version = "0.27.3", default-features = false, features = [
     "ring",
     "tls12",
 ] }
+kitsune-core = { workspace = true }
 kitsune-type = { workspace = true }
 pin-project = "1.1.7"
-serde = "1.0.214"
+serde = "1.0.215"
 simdutf8 = { workspace = true }
 sonic-rs = { workspace = true }
 tower = { version = "0.5.1", features = ["util"] }
diff --git a/crates/kitsune-http-client/src/lib.rs b/crates/kitsune-http-client/src/lib.rs
index 8b35d86bd..e364ebd54 100644
--- a/crates/kitsune-http-client/src/lib.rs
+++ b/crates/kitsune-http-client/src/lib.rs
@@ -1,9 +1,10 @@
 #![doc = include_str!("../README.md")]
 #![deny(missing_docs)]
 
-use self::util::BoxCloneService;
+use self::{resolver::Resolver, util::BoxCloneService};
 use bytes::Buf;
 use futures_util::{Stream, StreamExt};
+use hickory_resolver::config::{ResolverConfig, ResolverOpts};
 use http_body::Body as HttpBody;
 use http_body_util::{BodyExt, BodyStream, Limited};
 use hyper::{
@@ -13,7 +14,10 @@ use hyper::{
     HeaderMap, Request, Response as HyperResponse, StatusCode, Uri, Version,
 };
 use hyper_rustls::HttpsConnectorBuilder;
-use hyper_util::{client::legacy::Client as HyperClient, rt::TokioExecutor};
+use hyper_util::{
+    client::legacy::{connect::HttpConnector, Client as HyperClient},
+    rt::TokioExecutor,
+};
 use kitsune_type::jsonld::RdfNode;
 use serde::de::DeserializeOwned;
 use std::{error::Error as StdError, fmt, time::Duration};
@@ -26,6 +30,7 @@ use tower_http::{
 };
 
 mod body;
+mod resolver;
 mod util;
 
 type BoxBody<E = BoxError> = http_body_util::combinators::BoxBody<Bytes, E>;
@@ -44,8 +49,7 @@ pub struct Error {
 
 impl Error {
     #[inline]
-    #[doc(hidden)]
-    pub fn new<E>(inner: E) -> Self
+    fn new<E>(inner: E) -> Self
     where
         E: Into<BoxError>,
     {
@@ -73,6 +77,7 @@ impl StdError for Error {}
 pub struct ClientBuilder {
     content_length_limit: Option<usize>,
     default_headers: HeaderMap,
+    dns_resolver: Option<Resolver>,
     timeout: Option<Duration>,
 }
 
@@ -113,6 +118,15 @@ impl ClientBuilder {
         Ok(self)
     }
 
+    /// Set a hickory DNS resolver you want this client to use
+    ///
+    /// Otherwise it creates a new one which connects to Quad9 via DNS-over-TLS
+    #[must_use]
+    pub fn dns_resolver(mut self, resolver: impl Into<Resolver>) -> Self {
+        self.dns_resolver = Some(resolver.into());
+        self
+    }
+
     /// Set the User-Agent header
     ///
     /// Defaults to `kitsune-http-client`
@@ -143,14 +157,22 @@ impl ClientBuilder {
     ///
     /// Yes, this operation is infallible
     #[must_use]
-    pub fn build(self) -> Client {
+    pub fn build(mut self) -> Client {
+        let resolver = self.dns_resolver.take().unwrap_or_else(|| {
+            let resolver = hickory_resolver::TokioResolver::tokio(
+                ResolverConfig::quad9_tls(),
+                ResolverOpts::default(),
+            );
+            resolver.into()
+        });
+
         let connector = HttpsConnectorBuilder::new()
             .with_native_roots()
             .expect("Failed to fetch native certificates")
             .https_or_http()
             .enable_http1()
             .enable_http2()
-            .build();
+            .wrap_connector(HttpConnector::new_with_resolver(resolver));
 
         let client = HyperClient::builder(TokioExecutor::new())
             .build(connector)
@@ -207,10 +229,13 @@ impl Default for ClientBuilder {
         let builder = ClientBuilder {
             content_length_limit: Some(DEFAULT_BODY_LIMIT),
             default_headers: HeaderMap::default(),
+            dns_resolver: None,
             timeout: Option::default(),
         };
 
-        builder.user_agent("kitsune-http-client").unwrap()
+        builder
+            .user_agent(kitsune_core::consts::USER_AGENT)
+            .unwrap()
     }
 }
 
diff --git a/crates/kitsune-http-client/src/resolver.rs b/crates/kitsune-http-client/src/resolver.rs
new file mode 100644
index 000000000..2b390fe7e
--- /dev/null
+++ b/crates/kitsune-http-client/src/resolver.rs
@@ -0,0 +1,55 @@
+use futures_util::{future::BoxFuture, FutureExt};
+use hickory_resolver::{lookup_ip::LookupIpIntoIter, TokioResolver};
+use hyper_util::client::legacy::connect::dns::Name;
+use std::{
+    net::SocketAddr,
+    task::{self, Poll},
+};
+use tower::{BoxError, Service};
+
+pub struct ResolveIter {
+    inner: LookupIpIntoIter,
+}
+
+impl Iterator for ResolveIter {
+    type Item = SocketAddr;
+
+    #[inline]
+    fn next(&mut self) -> Option<Self::Item> {
+        let item = self.inner.next()?;
+        Some(SocketAddr::new(item, 80))
+    }
+}
+
+#[derive(Clone)]
+pub struct Resolver {
+    inner: TokioResolver,
+}
+
+impl From<TokioResolver> for Resolver {
+    fn from(value: TokioResolver) -> Self {
+        Self { inner: value }
+    }
+}
+
+impl Service<Name> for Resolver {
+    type Error = BoxError;
+    type Response = ResolveIter;
+    type Future = BoxFuture<'static, Result<ResolveIter, BoxError>>;
+
+    fn poll_ready(&mut self, _cx: &mut task::Context<'_>) -> Poll<Result<(), Self::Error>> {
+        Poll::Ready(Ok(()))
+    }
+
+    fn call(&mut self, req: Name) -> Self::Future {
+        let dns_client = self.inner.clone();
+
+        async move {
+            let lookup_ips = dns_client.lookup_ip(req.as_str()).await?;
+            Ok(ResolveIter {
+                inner: lookup_ips.into_iter(),
+            })
+        }
+        .boxed()
+    }
+}
diff --git a/crates/kitsune-jobs/Cargo.toml b/crates/kitsune-jobs/Cargo.toml
index 9150b9214..76b6e8ca4 100644
--- a/crates/kitsune-jobs/Cargo.toml
+++ b/crates/kitsune-jobs/Cargo.toml
@@ -15,7 +15,7 @@ kitsune-core = { workspace = true }
 kitsune-db = { workspace = true }
 kitsune-email = { workspace = true }
 kitsune-error = { workspace = true }
-serde = { version = "1.0.214", features = ["derive"] }
+serde = { version = "1.0.215", features = ["derive"] }
 speedy-uuid = { workspace = true }
 tracing = "0.1.40"
 typed-builder = "0.20.0"
diff --git a/crates/kitsune-mastodon/Cargo.toml b/crates/kitsune-mastodon/Cargo.toml
index ef946b3f3..9bc22f5ce 100644
--- a/crates/kitsune-mastodon/Cargo.toml
+++ b/crates/kitsune-mastodon/Cargo.toml
@@ -19,7 +19,7 @@ kitsune-type = { workspace = true }
 kitsune-url = { workspace = true }
 kitsune-util = { workspace = true }
 mime = "0.3.17"
-serde = "1.0.214"
+serde = "1.0.215"
 smol_str = "0.3.2"
 sonic-rs = { workspace = true }
 speedy-uuid = { workspace = true }
diff --git a/crates/kitsune-observability/Cargo.toml b/crates/kitsune-observability/Cargo.toml
index d9b9063c6..eb997a279 100644
--- a/crates/kitsune-observability/Cargo.toml
+++ b/crates/kitsune-observability/Cargo.toml
@@ -13,11 +13,11 @@ hyper = { version = "1.5.0", default-features = false }
 kitsune-config = { workspace = true }
 kitsune-core = { workspace = true }
 kitsune-http-client = { workspace = true }
-opentelemetry = { version = "0.26.0", default-features = false, features = [
+opentelemetry = { version = "0.27.0", default-features = false, features = [
     "trace",
 ] }
-opentelemetry-http = "0.26.0"
-opentelemetry-otlp = { version = "0.26.0", default-features = false, features = [
+opentelemetry-http = "0.27.0"
+opentelemetry-otlp = { version = "0.27.0", default-features = false, features = [
     "grpc-tonic",
     "http-json",
     "http-proto",
@@ -25,7 +25,7 @@ opentelemetry-otlp = { version = "0.26.0", default-features = false, features =
     "tls-roots",
     "trace",
 ] }
-opentelemetry_sdk = { version = "0.26.0", default-features = false, features = [
+opentelemetry_sdk = { version = "0.27.0", default-features = false, features = [
     "rt-tokio",
 ] }
 tracing = "0.1.40"
diff --git a/crates/kitsune-observability/src/lib.rs b/crates/kitsune-observability/src/lib.rs
index 517dbd854..98fa55952 100644
--- a/crates/kitsune-observability/src/lib.rs
+++ b/crates/kitsune-observability/src/lib.rs
@@ -5,7 +5,7 @@ use kitsune_config::{open_telemetry::Transport, Configuration};
 use kitsune_core::consts::PROJECT_IDENTIFIER;
 use opentelemetry::trace::{noop::NoopTracer, Tracer, TracerProvider};
 use opentelemetry_http::{Bytes, HttpClient, HttpError, Request, Response};
-use opentelemetry_otlp::{SpanExporterBuilder, WithExportConfig};
+use opentelemetry_otlp::{WithExportConfig, WithHttpConfig};
 use opentelemetry_sdk::runtime::Tokio;
 use std::{env, fmt};
 use tracing_error::ErrorLayer;
@@ -43,24 +43,6 @@ impl HttpClient for HttpClientAdapter {
     }
 }
 
-macro_rules! build_exporter {
-    ($exporter_type:ty : $transport:expr, $http_client:expr, $endpoint:expr $(,)?) => {{
-        let exporter: $exporter_type = match $transport {
-            Transport::Grpc => opentelemetry_otlp::new_exporter()
-                .tonic()
-                .with_endpoint($endpoint)
-                .into(),
-            Transport::Http => opentelemetry_otlp::new_exporter()
-                .http()
-                .with_endpoint($endpoint)
-                .with_http_client($http_client.clone())
-                .into(),
-        };
-
-        exporter
-    }};
-}
-
 fn initialise_logging<T>(tracer: T) -> eyre::Result<()>
 where
     T: Tracer + PreSampledTracer + Send + Sync + 'static,
@@ -87,17 +69,21 @@ pub fn initialise(config: &Configuration) -> eyre::Result<()> {
             inner: kitsune_http_client::Client::default(),
         };
 
-        let trace_exporter = build_exporter!(
-            SpanExporterBuilder:
-            opentelemetry_config.tracing_transport,
-            &http_client,
-            opentelemetry_config.tracing_endpoint.as_str(),
-        );
+        let trace_exporter = match opentelemetry_config.tracing_transport {
+            Transport::Grpc => opentelemetry_otlp::SpanExporter::builder()
+                .with_tonic()
+                .with_endpoint(opentelemetry_config.tracing_endpoint.as_str())
+                .build()?,
+            Transport::Http => opentelemetry_otlp::SpanExporter::builder()
+                .with_http()
+                .with_endpoint(opentelemetry_config.tracing_endpoint.as_str())
+                .with_http_client(http_client.clone())
+                .build()?,
+        };
 
-        let tracer = opentelemetry_otlp::new_pipeline()
-            .tracing()
-            .with_exporter(trace_exporter)
-            .install_batch(Tokio)?
+        let tracer = opentelemetry_sdk::trace::TracerProvider::builder()
+            .with_batch_exporter(trace_exporter, Tokio)
+            .build()
             .tracer(PROJECT_IDENTIFIER);
 
         initialise_logging(tracer)?;
diff --git a/crates/kitsune-oidc/Cargo.toml b/crates/kitsune-oidc/Cargo.toml
index 87f64b964..cd0892609 100644
--- a/crates/kitsune-oidc/Cargo.toml
+++ b/crates/kitsune-oidc/Cargo.toml
@@ -21,9 +21,10 @@ openidconnect = { version = "4.0.0-rc.1", default-features = false, features = [
     "accept-string-booleans",
     "timing-resistant-secret-traits",
 ] }
-serde = { version = "1.0.214", features = ["derive"] }
+serde = { version = "1.0.215", features = ["derive"] }
 sonic-rs = { workspace = true }
 speedy-uuid = { workspace = true }
+thiserror = "2.0.3"
 url = "2.5.3"
 
 [dev-dependencies]
diff --git a/crates/kitsune-oidc/src/error.rs b/crates/kitsune-oidc/src/error.rs
new file mode 100644
index 000000000..28882f7d9
--- /dev/null
+++ b/crates/kitsune-oidc/src/error.rs
@@ -0,0 +1,7 @@
+use thiserror::Error;
+
+/// Don't ask me why we need this wrapper, I really don't know.
+/// I would have preferred to just use a boxed error but here we are.
+#[derive(Debug, Error)]
+#[error(transparent)]
+pub struct ErrorWrapper(pub kitsune_error::BoxError);
diff --git a/crates/kitsune-oidc/src/http.rs b/crates/kitsune-oidc/src/http.rs
index 25666bd09..bffbfb784 100644
--- a/crates/kitsune-oidc/src/http.rs
+++ b/crates/kitsune-oidc/src/http.rs
@@ -1,3 +1,4 @@
+use crate::error::ErrorWrapper;
 use http_body_util::BodyExt;
 use kitsune_http_client::Client as HttpClient;
 use openidconnect::{HttpRequest, HttpResponse};
@@ -6,15 +7,14 @@ use std::sync::LazyLock;
 static HTTP_CLIENT: LazyLock<HttpClient> = LazyLock::new(HttpClient::default);
 
 #[inline]
-pub async fn async_client(req: HttpRequest) -> Result<HttpResponse, kitsune_http_client::Error> {
-    let response = HTTP_CLIENT.execute(req.map(Into::into)).await?;
+pub async fn async_client(req: HttpRequest) -> Result<HttpResponse, ErrorWrapper> {
+    let response = HTTP_CLIENT
+        .execute(req.map(Into::into))
+        .await
+        .map_err(|err| ErrorWrapper(err.into()))?;
 
     let (parts, body) = response.into_inner().into_parts();
-    let body = body
-        .collect()
-        .await
-        .map_err(kitsune_http_client::Error::new)?
-        .to_bytes();
+    let body = body.collect().await.map_err(ErrorWrapper)?.to_bytes();
 
     Ok(HttpResponse::from_parts(parts, body.to_vec()))
 }
diff --git a/crates/kitsune-oidc/src/lib.rs b/crates/kitsune-oidc/src/lib.rs
index edf60e96b..91416e7d8 100644
--- a/crates/kitsune-oidc/src/lib.rs
+++ b/crates/kitsune-oidc/src/lib.rs
@@ -46,6 +46,7 @@ type OidcClient = openidconnect::Client<
     openidconnect::EndpointMaybeSet,
 >;
 
+mod error;
 mod state;
 
 pub mod http;
diff --git a/crates/kitsune-s3/Cargo.toml b/crates/kitsune-s3/Cargo.toml
index bb238d6f6..7f852348f 100644
--- a/crates/kitsune-s3/Cargo.toml
+++ b/crates/kitsune-s3/Cargo.toml
@@ -13,7 +13,7 @@ kitsune-error = { workspace = true }
 kitsune-http-client = { workspace = true }
 quick-xml = { version = "0.37.0", features = ["serialize"] }
 rusty-s3 = "0.5.0"
-serde = { version = "1.0.214", features = ["derive"] }
+serde = { version = "1.0.215", features = ["derive"] }
 typed-builder = "0.20.0"
 
 [dev-dependencies]
diff --git a/crates/kitsune-search/Cargo.toml b/crates/kitsune-search/Cargo.toml
index df6e8792a..e56f0932a 100644
--- a/crates/kitsune-search/Cargo.toml
+++ b/crates/kitsune-search/Cargo.toml
@@ -23,7 +23,7 @@ kitsune-http-client = { workspace = true }
 kitsune-language = { workspace = true }
 meilisearch-sdk = { version = "0.27.1", default-features = false }
 pin-project-lite = "0.2.15"
-serde = { version = "1.0.214", features = ["derive"] }
+serde = { version = "1.0.215", features = ["derive"] }
 serde_urlencoded = "0.7.1"
 speedy-uuid = { workspace = true }
 strum = { version = "0.26.3", features = ["derive"] }
diff --git a/crates/kitsune-service/Cargo.toml b/crates/kitsune-service/Cargo.toml
index d7491e490..deb50c831 100644
--- a/crates/kitsune-service/Cargo.toml
+++ b/crates/kitsune-service/Cargo.toml
@@ -45,7 +45,7 @@ post-process = { workspace = true }
 rand = "0.8.5"
 rsa = "0.9.6"
 rusty-s3 = { version = "0.5.0", default-features = false }
-serde = "1.0.214"
+serde = "1.0.215"
 smol_str = "0.3.2"
 speedy-uuid = { workspace = true }
 tokio = { workspace = true, features = ["macros", "sync"] }
diff --git a/crates/kitsune-service/src/attachment.rs b/crates/kitsune-service/src/attachment.rs
index 296dde8c5..ce9409914 100644
--- a/crates/kitsune-service/src/attachment.rs
+++ b/crates/kitsune-service/src/attachment.rs
@@ -84,7 +84,7 @@ pub struct AttachmentService {
             .unwrap()
             .build()
     )]
-    client: Client,
+    http_client: Client,
     db_pool: PgPool,
     media_proxy_enabled: bool,
     #[builder(setter(into))]
@@ -132,7 +132,7 @@ impl AttachmentService {
             Ok(stream.map_err(Error::from).boxed())
         } else if self.media_proxy_enabled {
             Ok(self
-                .client
+                .http_client
                 .get(media_attachment.remote_url.as_ref().unwrap())
                 .await?
                 .stream()
@@ -267,7 +267,7 @@ mod test {
                 .build();
 
             let attachment_service = AttachmentService::builder()
-                .client(client)
+                .http_client(client)
                 .db_pool(db_pool)
                 .url_service(url_service)
                 .storage_backend(storage)
diff --git a/crates/kitsune-service/src/post/resolver.rs b/crates/kitsune-service/src/post/resolver.rs
index 56d241749..4d430bb3d 100644
--- a/crates/kitsune-service/src/post/resolver.rs
+++ b/crates/kitsune-service/src/post/resolver.rs
@@ -165,10 +165,10 @@ mod test {
                 });
                 let client = Client::builder().service(client);
 
-                let webfinger = Arc::new(Webfinger::with_client(client.clone(), Arc::new(NoopCache.into()))).coerce();
+                let webfinger = Arc::new(Webfinger::new(client.clone(), Arc::new(NoopCache.into()))).coerce();
 
                 let fetcher = Fetcher::builder()
-                    .client(client)
+                    .http_client(client)
                     .db_pool(db_pool.clone())
                     .embed_client(None)
                     .federation_filter(
diff --git a/crates/kitsune-service/src/prepare.rs b/crates/kitsune-service/src/prepare.rs
index 0ffef713d..550696c10 100644
--- a/crates/kitsune-service/src/prepare.rs
+++ b/crates/kitsune-service/src/prepare.rs
@@ -55,12 +55,13 @@ where
 }
 
 #[must_use]
-pub fn captcha(config: &captcha::Configuration) -> AnyCaptcha {
+pub fn captcha(client: kitsune_http_client::Client, config: &captcha::Configuration) -> AnyCaptcha {
     match config {
         captcha::Configuration::HCaptcha(config) => HCaptcha::builder()
             .verify_url(config.verify_url.to_string())
             .site_key(config.site_key.to_string())
             .secret_key(config.secret_key.to_string())
+            .http_client(client)
             .build()
             .into(),
         captcha::Configuration::MCaptcha(config) => MCaptcha::builder()
@@ -68,6 +69,7 @@ pub fn captcha(config: &captcha::Configuration) -> AnyCaptcha {
             .verify_url(config.verify_url.to_string())
             .site_key(config.site_key.to_string())
             .secret_key(config.secret_key.to_string())
+            .http_client(client)
             .build()
             .into(),
     }
diff --git a/crates/kitsune-type/Cargo.toml b/crates/kitsune-type/Cargo.toml
index 83e8d6b89..8f14bd41d 100644
--- a/crates/kitsune-type/Cargo.toml
+++ b/crates/kitsune-type/Cargo.toml
@@ -7,7 +7,7 @@ license.workspace = true
 
 [dependencies]
 iso8601-timestamp = { workspace = true }
-serde = { version = "1.0.214", features = ["derive"] }
+serde = { version = "1.0.215", features = ["derive"] }
 serde_with = { version = "3.11.0", default-features = false, features = [
     "alloc",
     "macros",
diff --git a/crates/kitsune-wasm-mrf/Cargo.toml b/crates/kitsune-wasm-mrf/Cargo.toml
index f489dfb28..edab5e44c 100644
--- a/crates/kitsune-wasm-mrf/Cargo.toml
+++ b/crates/kitsune-wasm-mrf/Cargo.toml
@@ -44,7 +44,7 @@ wasmtime-wasi = { version = "26.0.1", default-features = false }
 tempfile = "3.14.0"
 tokio = { workspace = true, features = ["macros", "rt"] }
 tracing-subscriber = "0.3.18"
-wat = "1.219.1"
+wat = "1.220.0"
 
 [lints]
 workspace = true
diff --git a/crates/kitsune-webfinger/src/lib.rs b/crates/kitsune-webfinger/src/lib.rs
index 9d55fe080..97be41ae8 100644
--- a/crates/kitsune-webfinger/src/lib.rs
+++ b/crates/kitsune-webfinger/src/lib.rs
@@ -4,12 +4,9 @@ extern crate tracing;
 use async_trait::async_trait;
 use fred::clients::RedisPool;
 use futures_util::future::{FutureExt, OptionFuture};
-use http::{HeaderValue, StatusCode};
+use http::{header::ACCEPT, HeaderValue, Request, StatusCode};
 use kitsune_cache::{ArcCache, CacheBackend, RedisCache};
-use kitsune_core::{
-    consts::USER_AGENT,
-    traits::{resolver::AccountResource, Resolver},
-};
+use kitsune_core::traits::{resolver::AccountResource, Resolver};
 use kitsune_error::Result;
 use kitsune_http_client::Client;
 use kitsune_type::webfinger::Resource;
@@ -18,6 +15,7 @@ use std::{ptr, time::Duration};
 use triomphe::Arc;
 
 const CACHE_DURATION: Duration = Duration::from_secs(10 * 60); // 10 minutes
+static ACCEPT_VALUE: HeaderValue = HeaderValue::from_static("application/jrd+json");
 
 /// Intended to allow up to one canonicalisation on the originating server, one cross-origin
 /// canonicalisation and one more canonicalisation on the destination server,
@@ -28,35 +26,26 @@ pub const MAX_JRD_REDIRECTS: u32 = 3;
 #[derive(Clone)]
 pub struct Webfinger {
     cache: ArcCache<str, AccountResource>,
-    client: Client,
+    http_client: Client,
 }
 
 impl Webfinger {
     #[must_use]
-    pub fn with_defaults(redis_pool: RedisPool) -> Self {
-        Self::new(Arc::new(
-            RedisCache::new(redis_pool, "webfinger", CACHE_DURATION).into(),
-        ))
+    pub fn with_defaults(client: Client, redis_pool: RedisPool) -> Self {
+        Self::new(
+            client,
+            Arc::new(RedisCache::new(redis_pool, "webfinger", CACHE_DURATION).into()),
+        )
     }
 }
 
 impl Webfinger {
-    #[allow(clippy::missing_panics_doc)] // The invariants are covered. It won't panic.
     #[must_use]
-    pub fn new(cache: ArcCache<str, AccountResource>) -> Self {
-        let client = Client::builder()
-            .default_header("Accept", HeaderValue::from_static("application/jrd+json"))
-            .unwrap()
-            .user_agent(USER_AGENT)
-            .unwrap()
-            .build();
-
-        Self::with_client(client, cache)
-    }
-
-    #[must_use]
-    pub fn with_client(client: Client, cache: ArcCache<str, AccountResource>) -> Self {
-        Self { cache, client }
+    pub fn new(client: Client, cache: ArcCache<str, AccountResource>) -> Self {
+        Self {
+            cache,
+            http_client: client,
+        }
     }
 }
 
@@ -95,8 +84,13 @@ impl Resolver for Webfinger {
             }
 
             let webfinger_url = format!("https://{domain}/.well-known/webfinger?resource={acct}");
-            let response = self.client.get(webfinger_url).await?;
+            let request = Request::builder()
+                .header(ACCEPT, &ACCEPT_VALUE)
+                .uri(webfinger_url)
+                .body(kitsune_http_client::Body::empty())
+                .unwrap();
 
+            let response = self.http_client.execute(request).await?;
             if matches!(response.status(), StatusCode::NOT_FOUND | StatusCode::GONE) {
                 // Either the actor couldn't be found or the server doesn't support WebFinger
                 return Ok(None);
diff --git a/crates/kitsune-webfinger/tests/basic.rs b/crates/kitsune-webfinger/tests/basic.rs
index f2d76e789..be480ecb3 100644
--- a/crates/kitsune-webfinger/tests/basic.rs
+++ b/crates/kitsune-webfinger/tests/basic.rs
@@ -21,7 +21,7 @@ async fn basic() {
     });
     let client = Client::builder().service(client);
 
-    let webfinger = Webfinger::with_client(client, Arc::new(NoopCache.into()));
+    let webfinger = Webfinger::new(client, Arc::new(NoopCache.into()));
     let resource = webfinger
         .resolve_account("0x0", "corteximplant.com")
         .await
diff --git a/crates/kitsune-webfinger/tests/redirects.rs b/crates/kitsune-webfinger/tests/redirects.rs
index 3f3adcfb5..8792e51c2 100644
--- a/crates/kitsune-webfinger/tests/redirects.rs
+++ b/crates/kitsune-webfinger/tests/redirects.rs
@@ -40,7 +40,7 @@ async fn follow_jrd_redirect() {
 
     let client = Client::builder().service(client);
 
-    let webfinger = Webfinger::with_client(client, Arc::new(NoopCache.into()));
+    let webfinger = Webfinger::new(client, Arc::new(NoopCache.into()));
     let resource = webfinger
         .resolve_account("0x0", "corteximplant.com")
         .await
@@ -79,7 +79,7 @@ async fn reject_fake_jrd_redirect() {
     });
     let client = Client::builder().service(client);
 
-    let webfinger = Webfinger::with_client(client, Arc::new(NoopCache.into()));
+    let webfinger = Webfinger::new(client, Arc::new(NoopCache.into()));
     let resource = webfinger
         .resolve_account("0x0", "corteximplant.com")
         .await
@@ -116,7 +116,7 @@ async fn reject_unbounded_number_of_jrd_redirects() {
     });
     let client = Client::builder().service(client);
 
-    let webfinger = Webfinger::with_client(client, Arc::new(NoopCache.into()));
+    let webfinger = Webfinger::new(client, Arc::new(NoopCache.into()));
     let resource = webfinger
         .resolve_account("0x0", "corteximplant.com")
         .await
diff --git a/kitsune-cli/Cargo.toml b/kitsune-cli/Cargo.toml
index 19bc4e514..3123d1c88 100644
--- a/kitsune-cli/Cargo.toml
+++ b/kitsune-cli/Cargo.toml
@@ -22,7 +22,7 @@ kitsune-config = { workspace = true }
 kitsune-core = { workspace = true }
 kitsune-db = { workspace = true }
 kitsune-error = { workspace = true }
-serde = { version = "1.0.214", features = ["derive"] }
+serde = { version = "1.0.215", features = ["derive"] }
 speedy-uuid = { workspace = true }
 tokio = { workspace = true, features = ["full"] }
 tracing-subscriber = "0.3.18"
diff --git a/kitsune-job-runner/Cargo.toml b/kitsune-job-runner/Cargo.toml
index 2de5dd17e..a74026526 100644
--- a/kitsune-job-runner/Cargo.toml
+++ b/kitsune-job-runner/Cargo.toml
@@ -24,6 +24,7 @@ kitsune-email = { workspace = true }
 kitsune-error = { workspace = true }
 kitsune-federation = { workspace = true }
 kitsune-federation-filter = { workspace = true }
+kitsune-http-client.workspace = true
 kitsune-jobs = { workspace = true }
 kitsune-observability = { workspace = true }
 kitsune-service = { workspace = true }
diff --git a/kitsune-job-runner/src/lib.rs b/kitsune-job-runner/src/lib.rs
index 6d12a4c7d..8c2476c7a 100644
--- a/kitsune-job-runner/src/lib.rs
+++ b/kitsune-job-runner/src/lib.rs
@@ -58,8 +58,9 @@ pub async fn prepare_job_queue(
     Ok(Arc::new(queue).coerce())
 }
 
-#[instrument(skip(job_queue, state))]
+#[instrument(skip(http_client, job_queue, state))]
 pub async fn run_dispatcher(
+    http_client: kitsune_http_client::Client,
     job_queue: Arc<dyn JobQueue<ContextRepository = KitsuneContextRepo> + '_>,
     state: JobDispatcherState,
     num_job_workers: usize,
@@ -68,6 +69,7 @@ pub async fn run_dispatcher(
         .attachment_service(state.attachment_service)
         .db_pool(state.db_pool.clone())
         .federation_filter(state.federation_filter)
+        .http_client(http_client)
         .mrf_service(state.mrf_service)
         .url_service(state.url_service.clone())
         .build();
diff --git a/kitsune-job-runner/src/main.rs b/kitsune-job-runner/src/main.rs
index 3a11d7160..340841ba7 100644
--- a/kitsune-job-runner/src/main.rs
+++ b/kitsune-job-runner/src/main.rs
@@ -30,6 +30,7 @@ async fn main() -> eyre::Result<()> {
 
     kitsune_observability::initialise(&config)?;
 
+    let http_client = kitsune_http_client::Client::default();
     let db_pool = kitsune_db::connect(&config.database)
         .await
         .map_err(kitsune_error::Error::into_error)?;
@@ -67,7 +68,13 @@ async fn main() -> eyre::Result<()> {
         .url_service(url_service)
         .build();
 
-    kitsune_job_runner::run_dispatcher(job_queue, state, config.job_queue.num_workers.into()).await;
+    kitsune_job_runner::run_dispatcher(
+        http_client,
+        job_queue,
+        state,
+        config.job_queue.num_workers.into(),
+    )
+    .await;
 
     Ok(())
 }
diff --git a/kitsune/Cargo.toml b/kitsune/Cargo.toml
index 58088483f..1a29b1414 100644
--- a/kitsune/Cargo.toml
+++ b/kitsune/Cargo.toml
@@ -55,6 +55,7 @@ kitsune-embed = { workspace = true }
 kitsune-error = { workspace = true }
 kitsune-federation = { workspace = true }
 kitsune-federation-filter = { workspace = true }
+kitsune-http-client = { workspace = true }
 kitsune-job-runner = { workspace = true }
 kitsune-jobs = { workspace = true }
 kitsune-language = { workspace = true }
@@ -75,7 +76,7 @@ oxide-auth-async = "0.2.1"
 oxide-auth-axum = "0.5.0"
 rust-embed = { version = "8.5.0", features = ["include-exclude"] }
 scoped-futures = "0.1.4"
-serde = { version = "1.0.214", features = ["derive"] }
+serde = { version = "1.0.215", features = ["derive"] }
 serde_urlencoded = "0.7.1"
 sonic-rs = { workspace = true }
 simdutf8 = { workspace = true }
diff --git a/kitsune/src/http/handler/well_known/webfinger.rs b/kitsune/src/http/handler/well_known/webfinger.rs
index 8591d4546..e8622c295 100644
--- a/kitsune/src/http/handler/well_known/webfinger.rs
+++ b/kitsune/src/http/handler/well_known/webfinger.rs
@@ -108,17 +108,21 @@ mod tests {
         let client = Client::builder().service(service_fn(handle));
 
         let attachment_service = AttachmentService::builder()
-            .client(client.clone())
+            .http_client(client.clone())
             .db_pool(db_pool.clone())
             .url_service(url_service.clone())
             .storage_backend(storage)
             .media_proxy_enabled(false)
             .build();
 
-        let resolver = Arc::new(Webfinger::new(Arc::new(NoopCache.into()))).coerce();
+        let resolver = Arc::new(Webfinger::new(
+            Client::default(),
+            Arc::new(NoopCache.into()),
+        ))
+        .coerce();
 
         let fetcher = Fetcher::builder()
-            .client(client)
+            .http_client(client)
             .db_pool(db_pool.clone())
             .embed_client(None)
             .federation_filter(
diff --git a/kitsune/src/lib.rs b/kitsune/src/lib.rs
index fe534a321..623dc92d6 100644
--- a/kitsune/src/lib.rs
+++ b/kitsune/src/lib.rs
@@ -47,6 +47,7 @@ use {futures_util::future::OptionFuture, kitsune_oidc::OidcService};
 pub async fn initialise_state(
     config: &Configuration,
     db_pool: PgPool,
+    http_client: kitsune_http_client::Client,
     job_queue: Arc<dyn JobQueue<ContextRepository = KitsuneContextRepo>>,
 ) -> eyre::Result<Zustand> {
     let url_service = UrlService::builder()
@@ -83,6 +84,7 @@ pub async fn initialise_state(
         .db_pool(db_pool.clone())
         .embed_client(embed_client.clone())
         .federation_filter(federation_filter.clone())
+        .http_client(http_client.clone())
         .language_detection_config(config.language_detection)
         .post_cache(prepare::cache(&config.cache, "POST-CACHE").await?)
         .search_backend(search_backend.clone())
@@ -104,7 +106,12 @@ pub async fn initialise_state(
         .build();
 
     let captcha_service = CaptchaService::builder()
-        .backend(config.captcha.as_ref().map(prepare::captcha))
+        .backend(
+            config
+                .captcha
+                .as_ref()
+                .map(|captcha_config| prepare::captcha(http_client.clone(), captcha_config)),
+        )
         .build();
 
     let custom_emoji_service = CustomEmojiService::builder()
diff --git a/kitsune/src/main.rs b/kitsune/src/main.rs
index 904f8f383..b5a6407d5 100644
--- a/kitsune/src/main.rs
+++ b/kitsune/src/main.rs
@@ -22,6 +22,7 @@ async fn boot() -> eyre::Result<()> {
     let config = Configuration::load(args.config).await?;
     kitsune_observability::initialise(&config)?;
 
+    let http_client = kitsune_http_client::Client::default();
     let conn = kitsune_db::connect(&config.database)
         .await
         .map_err(kitsune_error::Error::into_error)
@@ -31,7 +32,9 @@ async fn boot() -> eyre::Result<()> {
         .await
         .wrap_err("Failed to connect to the Redis instance for the job scheduler")?;
 
-    let state = kitsune::initialise_state(&config, conn, job_queue.clone()).await?;
+    let state =
+        kitsune::initialise_state(&config, conn, http_client.clone(), job_queue.clone()).await?;
+
     let dispatcher_state = JobDispatcherState::builder()
         .attachment_service(state.service.attachment.clone())
         .db_pool(state.db_pool.clone())
@@ -49,6 +52,7 @@ async fn boot() -> eyre::Result<()> {
         shutdown_signal.clone(),
     ));
     let job_runner_fut = tokio::spawn(kitsune_job_runner::run_dispatcher(
+        http_client,
         job_queue,
         dispatcher_state,
         config.job_queue.num_workers.get(),
diff --git a/lib/athena/Cargo.toml b/lib/athena/Cargo.toml
index b47f82a7b..b8c5e69f2 100644
--- a/lib/athena/Cargo.toml
+++ b/lib/athena/Cargo.toml
@@ -18,7 +18,7 @@ iso8601-timestamp = { workspace = true }
 fred = { workspace = true, optional = true }
 just-retry = { workspace = true }
 rand = { version = "0.8.5", optional = true }
-serde = { version = "1.0.214", features = ["derive"] }
+serde = { version = "1.0.215", features = ["derive"] }
 smol_str = "0.3.2"
 sonic-rs = { workspace = true, optional = true }
 speedy-uuid = { workspace = true, features = ["redis"] }
diff --git a/lib/fast-cjson/Cargo.toml b/lib/fast-cjson/Cargo.toml
index 29ae70ee7..24e099e60 100644
--- a/lib/fast-cjson/Cargo.toml
+++ b/lib/fast-cjson/Cargo.toml
@@ -12,7 +12,7 @@ harness = false
 [dependencies]
 icu_normalizer = "1.5.0"
 memchr = "2.7.4"
-serde = "1.0.214"
+serde = "1.0.215"
 sonic-rs = { workspace = true }
 
 [dev-dependencies]
@@ -21,7 +21,7 @@ mimalloc = "0.1.43"
 olpc-cjson = "0.1.4"
 proptest = { version = "1.5.0", default-features = false, features = ["std"] }
 proptest-derive = "0.5.0"
-serde = { version = "1.0.214", features = ["derive"] }
+serde = { version = "1.0.215", features = ["derive"] }
 serde_json = "1.0.132"
 
 [lints]
diff --git a/lib/geomjeungja/Cargo.toml b/lib/geomjeungja/Cargo.toml
index 368c5ca2a..1f6b58088 100644
--- a/lib/geomjeungja/Cargo.toml
+++ b/lib/geomjeungja/Cargo.toml
@@ -7,9 +7,9 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 async-trait = "0.1.83"
-hickory-resolver = "0.25.0-alpha.3"
+hickory-resolver = { workspace = true }
 rand = "0.8.5"
-serde = { version = "1.0.214", features = ["derive"] }
+serde = { version = "1.0.215", features = ["derive"] }
 simdutf8 = { workspace = true }
 thiserror = "2.0.3"
 tracing = "0.1.40"
diff --git a/lib/geomjeungja/src/lib.rs b/lib/geomjeungja/src/lib.rs
index 409982cd6..f5e87bbd4 100644
--- a/lib/geomjeungja/src/lib.rs
+++ b/lib/geomjeungja/src/lib.rs
@@ -8,7 +8,7 @@ use crate::util::OpaqueDebug;
 use async_trait::async_trait;
 use hickory_resolver::{
     config::{ResolverConfig, ResolverOpts},
-    TokioAsyncResolver,
+    TokioResolver,
 };
 use rand::{
     distributions::{Alphanumeric, DistString},
@@ -71,7 +71,7 @@ pub trait DnsResolver: Send + Sync {
 }
 
 #[async_trait]
-impl DnsResolver for TokioAsyncResolver {
+impl DnsResolver for TokioResolver {
     async fn lookup_txt(&self, fqdn: &str) -> Result<Vec<String>, BoxError> {
         let records =
             self.txt_lookup(fqdn)
@@ -160,8 +160,10 @@ impl VerificationStrategy for KeyValueStrategy {
 /// Construct the default resolver used by this library
 #[must_use]
 pub fn default_resolver() -> Arc<dyn DnsResolver> {
-    Arc::new(TokioAsyncResolver::tokio(
-        ResolverConfig::default(),
+    Arc::new(TokioResolver::tokio(
+        // Per-default hickory-resolver would use Google's DNS servers.
+        // Since Google is kinda disgusting, we use Quad9 instead.
+        ResolverConfig::quad9_tls(),
         ResolverOpts::default(),
     ))
     .unsize(Coercion!(to dyn DnsResolver))
@@ -266,7 +268,7 @@ mod test {
             .strategy(dummy)
             .build();
 
-        assert!(verifier.verify().await.is_ok());
+        verifier.verify().await.unwrap();
     }
 
     #[tokio::test]
diff --git a/lib/mrf-manifest/Cargo.toml b/lib/mrf-manifest/Cargo.toml
index c80876225..2d6a0e536 100644
--- a/lib/mrf-manifest/Cargo.toml
+++ b/lib/mrf-manifest/Cargo.toml
@@ -10,16 +10,16 @@ fast-cjson = { workspace = true, optional = true }
 leb128 = { version = "0.2.5", optional = true }
 schemars = { version = "0.8.21", features = ["impl_json_schema", "semver"] }
 semver = { version = "1.0.23", features = ["serde"] }
-serde = { version = "1.0.214", features = ["derive"] }
+serde = { version = "1.0.215", features = ["derive"] }
 sonic-rs = { workspace = true, optional = true }
 thiserror = { version = "2.0.3", optional = true }
-wasm-encoder = { version = "0.219.1", optional = true }
-wasmparser = { version = "0.219.1", optional = true }
+wasm-encoder = { version = "0.220.0", optional = true }
+wasmparser = { version = "0.220.0", optional = true }
 
 [dev-dependencies]
 insta = { version = "1.41.1", default-features = false, features = ["json"] }
 sonic-rs = { workspace = true }
-wat = "1.219.1"
+wat = "1.220.0"
 
 [features]
 decode = ["dep:leb128", "dep:sonic-rs", "dep:thiserror", "dep:wasmparser"]
diff --git a/lib/mrf-tool/Cargo.toml b/lib/mrf-tool/Cargo.toml
index bd307150a..2471f2939 100644
--- a/lib/mrf-tool/Cargo.toml
+++ b/lib/mrf-tool/Cargo.toml
@@ -16,11 +16,11 @@ mrf-manifest = { workspace = true, features = [
     "serialise",
 ] }
 sonic-rs = { workspace = true }
-wasmparser = "0.219.1"
+wasmparser = "0.220.0"
 
 [lints]
 workspace = true
 
 [dev-dependencies]
 sonic-rs = { workspace = true }
-wat = "1.219.1"
+wat = "1.220.0"
diff --git a/lib/speedy-uuid/Cargo.toml b/lib/speedy-uuid/Cargo.toml
index 0fb985d2c..2f9912f9d 100644
--- a/lib/speedy-uuid/Cargo.toml
+++ b/lib/speedy-uuid/Cargo.toml
@@ -12,7 +12,7 @@ diesel = { version = "2.2.4", default-features = false, features = [
     "uuid",
 ], optional = true }
 fred = { version = "9.4.0", default-features = false, optional = true }
-serde = { version = "1.0.214", optional = true }
+serde = { version = "1.0.215", optional = true }
 thiserror = "2.0.3"
 uuid = { version = "1.11.0", features = ["fast-rng", "v7"] }
 uuid-simd = { version = "0.8.0", features = ["uuid"] }