Deprecate async-std-rt and document reqwless upgrade blocker by e-desouza · Pull Request #130 · XRPLF/xrpl-rust

e-desouza · 2026-02-20T23:04:30Z

High Level Overview of Change

Deprecate the async-std-rt feature with a compile_error! directing users to smol-rt
Document that reqwless 0.13.0 pins embedded-tls 0.17.0 which still depends on atomic-polyfill, and that this is blocked upstream

Closes #126
Partially addresses #111

Context of Change

async-std (#126): The async-std crate has been officially discontinued (RUSTSEC-2025-0052). Rather than silently removing the feature (which would be a breaking change for anyone who has it in their Cargo.toml), this replaces the runtime implementation with a compile_error! that tells users to switch to smol-rt. The async-std dependency is retained in Cargo.toml so the feature gate still resolves -- it just immediately errors at compile time with a clear message.

atomic-polyfill (#111): The advisory (RUSTSEC-2023-0089) comes from embedded-tls 0.17.0, which is pulled in by reqwless 0.13.0. Newer versions of embedded-tls have migrated to portable-atomic, but reqwless 0.13.0 pins the old version. There is no compatible reqwless release that fixes this yet. Added a comment in Cargo.toml documenting the situation so it's tracked in-tree rather than only in the issue tracker.

Type of Change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Refactor (non-breaking change that only restructures code)
Tests (You added tests for code that already exists, or your new feature included in this PR)
Documentation Updates
Release

Before / After

Before:

async-std-rt feature compiles and runs using a discontinued runtime
cargo audit reports RUSTSEC-2025-0052 (async-std) and RUSTSEC-2023-0089 (atomic-polyfill)

After:

Enabling async-std-rt produces a clear compile-time error: "The async-std-rt feature is deprecated. async-std has been discontinued (RUSTSEC-2025-0052). Use smol-rt instead."
atomic-polyfill situation documented in Cargo.toml (upstream-blocked on reqwless update)
cargo audit advisory count reduced

Test Plan

# Verify the compile_error fires:
cargo build --no-default-features --features async-std-rt,helpers,json-rpc,models,core,wallet
# Expected: compile error with deprecation message

# Verify normal builds still work:
cargo build --release
cargo test --all-features

pdp2121 · 2026-03-26T18:19:13Z

Can you document this change in CHANGELOG.md? This is somewhat still a breaking change imo since previously working code will not work anymore before switching

…cker Replace async-std sleep implementation with a deprecation warning and runtime panic. Using compile_error! would break --all-features builds (including CI clippy checks), so instead we emit a deprecation warning at compile time and panic at runtime if the feature is actually exercised. Also document in Cargo.toml that the atomic-polyfill advisory (RUSTSEC-2023-0089) is blocked upstream on a reqwless update. Closes #126 Partially addresses #111

… and reqwless blocker

…t deprecation async-std has been discontinued (RUSTSEC-2025-0052). Using panic!() inside a #[cfg(feature = "async-std-rt")] block caused clippy to report an unreachable statement on the subsequent futures-rt block when --all-features was used, because panic!() is a diverging expression. Replace the runtime panic with a module-level compile_error!() so: - Users get a clear compile-time message instead of a runtime panic - No unreachable-code lint is triggered (compile_error! is at module level) - The CI clippy step now uses an explicit feature list excluding async-std-rt (--all-features would always fail since compile_error! fires unconditionally)

alloc::boxed::Box is only used by XRPLWebSocketError which is gated on feature = "websocket". Without the websocket gate, building with only json-rpc produces an unused import warning.

xrplf-ai-reviewer

A few issues flagged inline: narrowed cfg guard on Box import risks no_std breakage, a misleading comment calls a compile-time error a runtime panic, two supply-chain advisories (RUSTSEC-2023-0089, RUSTSEC-2025-0052) lack CI suppression/tracking entries, and the hardcoded Clippy feature list needs a sync reminder.

Review by Claude Opus 4.6 · Prompt: V13

- Cargo.toml: correct comment to say "compile_error" not "runtime panic" - build_and_lint.yml: add note for contributors to manually add new features

xrplf-ai-reviewer

Four follow-up issues flagged inline: two related to the async-std dep still being resolved by Cargo despite the compile_error! guard, one for the unresolved atomic-polyfill advisory (RUSTSEC-2023-0089), and one for the hardcoded Clippy feature list requiring manual upkeep.

Review by Claude Opus 4.6 · Prompt: V13

e-desouza · 2026-04-03T17:47:37Z

Done in 60fea581. Added under "Breaking Changes" with a separate "Known Blockers" section for the reqwless/atomic-polyfill upstream dependency.

…ty-advisories

The runtime list in src/lib.rs guarded helpers against missing a runtime, but still accepted async-std-rt even though it is deprecated and always trips the compile_error! in src/asynch/mod.rs; dropping it makes the missing-runtime message fire first and keeps the two checks consistent.

The rippleci/rippled:develop image updated after 2026-04-01 and broke integration tests across all PRs (container exits before becoming healthy, causing Connection refused on localhost:5005). Pin to the last known-good digest and replace the simple until loop with a bounded retry that checks container liveness, prints status per attempt, and dumps container logs on failure.

@ckeshava

… #3270) (#291) ## Summary The `rippled` binary was renamed to `xrpld` upstream, and the `rippleci/rippled` image stopped receiving updates. Our integration tests across every open PR started failing because the published `develop` image exited before becoming healthy (`Connection refused` on `localhost:5005`, **0 passed / 41 failed**). This PR mirrors the upstream fix in xrpl.js: [XRPLF/xrpl.js#3270](XRPLF/xrpl.js#3270). Switching to `rippleci/xrpld:develop` is the **actual root-cause fix** rather than pinning an old digest of the deprecated image. ## Changes `.github/workflows/integration_test.yml`: - `RIPPLED_DOCKER_IMAGE` -> `XRPLD_DOCKER_IMAGE: rippleci/xrpld:develop`. - `docker run` simplified to `${IMAGE} --standalone` (the `xrpld` image handles `mkdir` + launch internally; no more `bash -c "mkdir -p /var/lib/rippled/db/ && rippled -a"` wrapper). - Volume mount changed from `/etc/opt/ripple/` to `/etc/opt/xrpld/`. - Container name: `rippled-service` -> `xrpld-service`. - Removed the docker `--health-cmd` (which shelled out to the renamed `rippled` CLI and always failed) in favour of a direct JSON-RPC poll against `http://localhost:5005/`. - Always dump container logs on the stop step for post-mortem visibility. `.ci-config/rippled.cfg` -> `.ci-config/xrpld.cfg`: - `path=/var/lib/rippled/db/nudb` -> `path=/var/lib/xrpld/db/nudb`. - `[database_path] /var/lib/rippled/db` -> `/var/lib/xrpld/db`. - `[debug_logfile] /var/log/rippled/debug.log` -> `/var/log/xrpld/debug.log`. ## Verification Validated on throwaway PR #292 (now closed): **Integration Test green in 2m53s** on this exact workflow. Unit tests, Build & Lint, Quality Check also pass. ## Related follow-up The 7 in-flight PRs (#130, #131, #151, #153, #156, #157, #158) currently carry a stopgap commit pinning `rippleci/rippled:develop` to a specific digest. After this PR merges to `main`, those branches should: 1. Rebase on `main` to pick up the xrpld switch, or 2. Cherry-pick this commit and drop the stopgap digest pin. ## Test plan - [x] Validated end-to-end on PR #292 - [x] Build & Lint, Unit Test, Integration Test, Quality Check all pass - [ ] Merge and confirm subsequent PRs inherit the fix without manual cherry-pick ## Credit Approach lifted from @ckeshava's [xrpl.js#3270](XRPLF/xrpl.js#3270).

e-desouza requested a review from LimpidCrypto as a code owner February 20, 2026 23:04

e-desouza force-pushed the fix/dependency-security-advisories branch from c59fa5f to 761b32b Compare February 21, 2026 00:01

e-desouza marked this pull request as draft February 21, 2026 00:11

e-desouza force-pushed the fix/dependency-security-advisories branch from 761b32b to 96bdb61 Compare February 21, 2026 05:20

e-desouza marked this pull request as ready for review February 22, 2026 18:28

e-desouza self-assigned this Feb 23, 2026

e-desouza force-pushed the fix/dependency-security-advisories branch from 96bdb61 to 695145c Compare March 25, 2026 21:54

e-desouza requested review from Patel-Raj11 and pdp2121 and removed request for LimpidCrypto March 25, 2026 22:39

e-desouza force-pushed the fix/dependency-security-advisories branch from 31eee08 to 510a127 Compare March 26, 2026 19:28

Patel-Raj11 previously approved these changes Mar 26, 2026

View reviewed changes

e-desouza dismissed Patel-Raj11’s stale review via 4538380 March 26, 2026 21:15

e-desouza force-pushed the fix/dependency-security-advisories branch from 510a127 to 4538380 Compare March 26, 2026 21:15

e-desouza added 3 commits March 27, 2026 23:13

docs(changelog): document async-std-rt deprecation as breaking change…

60fea58

… and reqwless blocker

e-desouza force-pushed the fix/dependency-security-advisories branch from 1719ffc to 563c441 Compare March 28, 2026 03:15

fix(asynch): tighten Box import guard to no_std + websocket only

9f40073

alloc::boxed::Box is only used by XRPLWebSocketError which is gated on feature = "websocket". Without the websocket gate, building with only json-rpc produces an unused import warning.

pdp2121 previously approved these changes Mar 31, 2026

View reviewed changes

pdp2121 reviewed Mar 31, 2026

View reviewed changes

Comment thread .github/workflows/build_and_lint.yml

pdp2121 reviewed Mar 31, 2026

View reviewed changes

Comment thread Cargo.toml Outdated

xrplf-ai-reviewer Bot reviewed Apr 3, 2026

View reviewed changes

Comment thread src/asynch/clients/exceptions.rs

Comment thread Cargo.toml Outdated

Comment thread Cargo.toml

Comment thread Cargo.toml

Comment thread .github/workflows/build_and_lint.yml

fix: address review feedback on async-std deprecation PR

8c31ccc

- Cargo.toml: correct comment to say "compile_error" not "runtime panic" - build_and_lint.yml: add note for contributors to manually add new features

e-desouza dismissed pdp2121’s stale review via 8c31ccc April 3, 2026 04:34

xrplf-ai-reviewer Bot reviewed Apr 3, 2026

View reviewed changes

Comment thread .github/workflows/build_and_lint.yml

Comment thread src/asynch/mod.rs

Comment thread Cargo.toml

Comment thread Cargo.toml

e-desouza added 2 commits April 3, 2026 17:52

Merge remote-tracking branch 'origin/main' into fix/dependency-securi…

b0bd6c5

…ty-advisories

e-desouza mentioned this pull request Apr 20, 2026

ci: switch integration tests to rippleci/xrpld image (follows xrpl.js #3270) #291

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deprecate async-std-rt and document reqwless upgrade blocker#130

Deprecate async-std-rt and document reqwless upgrade blocker#130
e-desouza wants to merge 8 commits intomainfrom
fix/dependency-security-advisories

e-desouza commented Feb 20, 2026

Uh oh!

pdp2121 commented Mar 26, 2026

Uh oh!

Uh oh!

Uh oh!

xrplf-ai-reviewer Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

xrplf-ai-reviewer Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

e-desouza commented Apr 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

e-desouza commented Feb 20, 2026

High Level Overview of Change

Context of Change

Type of Change

Before / After

Test Plan

Uh oh!

pdp2121 commented Mar 26, 2026

Uh oh!

Uh oh!

Uh oh!

xrplf-ai-reviewer Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

xrplf-ai-reviewer Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

e-desouza commented Apr 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants