Deprecate async-std-rt and document reqwless upgrade blocker by e-desouza · Pull Request #130 · XRPLF/xrpl-rust

e-desouza · 2026-02-20T23:04:30Z

High Level Overview of Change

Deprecate the async-std-rt feature with a compile_error! directing users to smol-rt
Document that reqwless 0.13.0 pins embedded-tls 0.17.0 which still depends on atomic-polyfill, and that this is blocked upstream

Closes #126
Partially addresses #111

Context of Change

async-std (#126): The async-std crate has been officially discontinued (RUSTSEC-2025-0052). Rather than silently removing the feature (which would be a breaking change for anyone who has it in their Cargo.toml), this replaces the runtime implementation with a compile_error! that tells users to switch to smol-rt. The async-std dependency is retained in Cargo.toml so the feature gate still resolves -- it just immediately errors at compile time with a clear message.

atomic-polyfill (#111): The advisory (RUSTSEC-2023-0089) comes from embedded-tls 0.17.0, which is pulled in by reqwless 0.13.0. Newer versions of embedded-tls have migrated to portable-atomic, but reqwless 0.13.0 pins the old version. There is no compatible reqwless release that fixes this yet. Added a comment in Cargo.toml documenting the situation so it's tracked in-tree rather than only in the issue tracker.

Type of Change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Refactor (non-breaking change that only restructures code)
Tests (You added tests for code that already exists, or your new feature included in this PR)
Documentation Updates
Release

Before / After

Before:

async-std-rt feature compiles and runs using a discontinued runtime
cargo audit reports RUSTSEC-2025-0052 (async-std) and RUSTSEC-2023-0089 (atomic-polyfill)

After:

Enabling async-std-rt produces a clear compile-time error: "The async-std-rt feature is deprecated. async-std has been discontinued (RUSTSEC-2025-0052). Use smol-rt instead."
atomic-polyfill situation documented in Cargo.toml (upstream-blocked on reqwless update)
cargo audit advisory count reduced

Test Plan

# Verify the compile_error fires:
cargo build --no-default-features --features async-std-rt,helpers,json-rpc,models,core,wallet
# Expected: compile error with deprecation message

# Verify normal builds still work:
cargo build --release
cargo test --all-features

pdp2121 · 2026-03-26T18:19:13Z

Can you document this change in CHANGELOG.md? This is somewhat still a breaking change imo since previously working code will not work anymore before switching

…cker Replace async-std sleep implementation with a deprecation warning and runtime panic. Using compile_error! would break --all-features builds (including CI clippy checks), so instead we emit a deprecation warning at compile time and panic at runtime if the feature is actually exercised. Also document in Cargo.toml that the atomic-polyfill advisory (RUSTSEC-2023-0089) is blocked upstream on a reqwless update. Closes #126 Partially addresses #111

… and reqwless blocker

…t deprecation async-std has been discontinued (RUSTSEC-2025-0052). Using panic!() inside a #[cfg(feature = "async-std-rt")] block caused clippy to report an unreachable statement on the subsequent futures-rt block when --all-features was used, because panic!() is a diverging expression. Replace the runtime panic with a module-level compile_error!() so: - Users get a clear compile-time message instead of a runtime panic - No unreachable-code lint is triggered (compile_error! is at module level) - The CI clippy step now uses an explicit feature list excluding async-std-rt (--all-features would always fail since compile_error! fires unconditionally)

alloc::boxed::Box is only used by XRPLWebSocketError which is gated on feature = "websocket". Without the websocket gate, building with only json-rpc produces an unused import warning.

.github/workflows/build_and_lint.yml

Cargo.toml

xrplf-ai-reviewer

A few issues flagged inline: narrowed cfg guard on Box import risks no_std breakage, a misleading comment calls a compile-time error a runtime panic, two supply-chain advisories (RUSTSEC-2023-0089, RUSTSEC-2025-0052) lack CI suppression/tracking entries, and the hardcoded Clippy feature list needs a sync reminder.

Review by Claude Opus 4.6 · Prompt: V13

src/asynch/clients/exceptions.rs

Cargo.toml

.github/workflows/build_and_lint.yml

- Cargo.toml: correct comment to say "compile_error" not "runtime panic" - build_and_lint.yml: add note for contributors to manually add new features

xrplf-ai-reviewer

Four follow-up issues flagged inline: two related to the async-std dep still being resolved by Cargo despite the compile_error! guard, one for the unresolved atomic-polyfill advisory (RUSTSEC-2023-0089), and one for the hardcoded Clippy feature list requiring manual upkeep.

Review by Claude Opus 4.6 · Prompt: V13

.github/workflows/build_and_lint.yml

src/asynch/mod.rs

Cargo.toml

e-desouza · 2026-04-03T17:47:37Z

Done in 60fea581. Added under "Breaking Changes" with a separate "Known Blockers" section for the reqwless/atomic-polyfill upstream dependency.

…ty-advisories

e-desouza requested a review from LimpidCrypto as a code owner February 20, 2026 23:04

e-desouza force-pushed the fix/dependency-security-advisories branch from c59fa5f to 761b32b Compare February 21, 2026 00:01

e-desouza marked this pull request as draft February 21, 2026 00:11

e-desouza force-pushed the fix/dependency-security-advisories branch from 761b32b to 96bdb61 Compare February 21, 2026 05:20

e-desouza marked this pull request as ready for review February 22, 2026 18:28

e-desouza self-assigned this Feb 23, 2026

e-desouza force-pushed the fix/dependency-security-advisories branch from 96bdb61 to 695145c Compare March 25, 2026 21:54

e-desouza requested review from Patel-Raj11 and pdp2121 and removed request for LimpidCrypto March 25, 2026 22:39

e-desouza force-pushed the fix/dependency-security-advisories branch from 31eee08 to 510a127 Compare March 26, 2026 19:28

Patel-Raj11 previously approved these changes Mar 26, 2026

View reviewed changes

e-desouza dismissed Patel-Raj11’s stale review via 4538380 March 26, 2026 21:15

e-desouza force-pushed the fix/dependency-security-advisories branch from 510a127 to 4538380 Compare March 26, 2026 21:15

e-desouza added 3 commits March 27, 2026 23:13

docs(changelog): document async-std-rt deprecation as breaking change…

60fea58

… and reqwless blocker

e-desouza force-pushed the fix/dependency-security-advisories branch from 1719ffc to 563c441 Compare March 28, 2026 03:15

fix(asynch): tighten Box import guard to no_std + websocket only

9f40073

alloc::boxed::Box is only used by XRPLWebSocketError which is gated on feature = "websocket". Without the websocket gate, building with only json-rpc produces an unused import warning.

pdp2121 previously approved these changes Mar 31, 2026

View reviewed changes

pdp2121 reviewed Mar 31, 2026

View reviewed changes

.github/workflows/build_and_lint.yml Show resolved Hide resolved

pdp2121 reviewed Mar 31, 2026

View reviewed changes

Cargo.toml Outdated Show resolved Hide resolved

xrplf-ai-reviewer bot reviewed Apr 3, 2026

View reviewed changes

src/asynch/clients/exceptions.rs Show resolved Hide resolved

Cargo.toml Outdated Show resolved Hide resolved

Cargo.toml Show resolved Hide resolved

Cargo.toml Show resolved Hide resolved

.github/workflows/build_and_lint.yml Show resolved Hide resolved

fix: address review feedback on async-std deprecation PR

8c31ccc

- Cargo.toml: correct comment to say "compile_error" not "runtime panic" - build_and_lint.yml: add note for contributors to manually add new features

e-desouza dismissed pdp2121’s stale review via 8c31ccc April 3, 2026 04:34

xrplf-ai-reviewer bot reviewed Apr 3, 2026

View reviewed changes

.github/workflows/build_and_lint.yml Show resolved Hide resolved

src/asynch/mod.rs Show resolved Hide resolved

Cargo.toml Show resolved Hide resolved

Cargo.toml Show resolved Hide resolved

Merge remote-tracking branch 'origin/main' into fix/dependency-securi…

b0bd6c5

…ty-advisories

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deprecate async-std-rt and document reqwless upgrade blocker#130

Deprecate async-std-rt and document reqwless upgrade blocker#130
e-desouza wants to merge 6 commits intomainfrom
fix/dependency-security-advisories

e-desouza commented Feb 20, 2026

Uh oh!

pdp2121 commented Mar 26, 2026

Uh oh!

Uh oh!

Uh oh!

xrplf-ai-reviewer bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

xrplf-ai-reviewer bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

e-desouza commented Apr 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

e-desouza commented Feb 20, 2026

High Level Overview of Change

Context of Change

Type of Change

Before / After

Test Plan

Uh oh!

pdp2121 commented Mar 26, 2026

Uh oh!

Uh oh!

Uh oh!

xrplf-ai-reviewer bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

xrplf-ai-reviewer bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

e-desouza commented Apr 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants