chore(deps): update rust crate ureq to v3 - #30
Conversation
|
|
PR author is in the excluded authors list. |
🟢 WAVE BugBot — clearNo confident findings on the changed lines. Local review · $0 inference · wave-dispatch |
fefdd4b to
b58b5c5
Compare
b58b5c5 to
3cfab04
Compare
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
|
|
||
| [dependencies] | ||
| ureq = "2" | ||
| ureq = "3" |
There was a problem hiding this comment.
🔴 Rust client library stops working after HTTP library upgrade
The Rust client's HTTP dependency is upgraded to a new major version (ureq = "3" at sdk/rust/Cargo.toml:13) without updating any of the calling code, so the Rust SDK no longer builds or works at all.
Impact: Anyone using or publishing the Rust client gets a broken package; payment-retry behavior would also be lost even after a mechanical fix.
ureq 3 removed the v2 request/response API used throughout sdk/rust/src/lib.rs
All call sites still use the ureq 2 API:
ureq::Request/ureq::Responsetypes and.set(k, v)header builder (sdk/rust/src/lib.rs:148-152,157,166,174-186,237-241,253-256) — in ureq 3 these types moved (http::Request/http::Response<Body>) and.set()became.header()..send_string(..)/.into_string()(sdk/rust/src/lib.rs:158-159,176,186,242,257) — replaced by.send(..)andbody_mut().read_to_string().Err(ureq::Error::Status(402, r))(sdk/rust/src/lib.rs:160,169) — ureq 3's variant isError::StatusCode(u16)and carries no response, so the x402 challenge body needed byretry_with_hook(sdk/rust/src/lib.rs:174-177) is unavailable unless the config is switched tohttp_status_as_error(false)and the 402 handled on theOkpath.
The upgrade must be accompanied by a full migration of these call sites.
Prompt for agents
The dependency bump to ureq 3 in sdk/rust/Cargo.toml is a breaking major upgrade, but sdk/rust/src/lib.rs still uses the entire ureq 2 API surface: ureq::Request/ureq::Response types, builder .set(name, value) for headers, .send_string(body), .call(), and .into_string() on responses, plus pattern matching on ureq::Error::Status(402, response) in Dispatch::post/get to capture the x402 challenge body and feed it to retry_with_hook. In ureq 3 requests/responses are the http crate types, headers are set with .header(), bodies are sent with .send()/.send_empty(), response bodies are read via response.body_mut().read_to_string(), and the error variant is Error::StatusCode(u16) which does NOT carry the response body. Migrating the 402 path requires configuring the agent with http_status_as_error(false) (e.g. a shared ureq::Agent built from ureq::Agent::config_builder()) so a 402 arrives as Ok(response) and the challenge JSON can still be read before retrying with the payment hook headers. Either complete this migration across all call sites (Dispatch::auth/post/get/retry_with_hook and the privy/bridge wallet_sign HTTP calls) or revert the dependency to ureq 2.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
|
||
| [dependencies] | ||
| ureq = "2" | ||
| ureq = "3" |
There was a problem hiding this comment.
🟡 Changelog not updated for the dependency upgrade
The repository requires the Unreleased section of CHANGELOG.md to be updated for user-facing changes, but this major dependency upgrade of the published Rust client adds no entry.
Impact: Consumers of the Rust package get no record of a breaking dependency change.
AGENTS.md rule
AGENTS.md states: "Conventional Commit titles; update CHANGELOG.md (Unreleased) for user-facing changes." The ## [Unreleased] section in CHANGELOG.md remains empty in this PR while sdk/rust/Cargo.toml:13 bumps the published crate's HTTP dependency to a new major version.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
|
||
| [dependencies] | ||
| ureq = "2" | ||
| ureq = "3" |
There was a problem hiding this comment.
🔍 Automated dependency bump lacks accompanying source migration and MSRV check
This is a bot-style dependency bump (ureq = "3") with no source changes in sdk/rust/src/lib.rs. Besides the API migration required, ureq 3 raises the minimum supported Rust version and changes TLS/feature defaults (e.g. rustls-based defaults, native-tls behind a feature), which can affect downstream consumers of the published wave-dispatch crate. Verify MSRV/CI toolchain and TLS backend expectations before merging.
Was this helpful? React with 👍 or 👎 to provide feedback.
ApprovabilityVerdict: Needs human review Unable to check for correctness in 3cfab04. Major version bump (ureq 2 → 3) can introduce breaking API changes. The SDK uses multiple ureq APIs that may have changed. The file is owned by wave-av/streaming-team who should verify compatibility. No code changes detected at You can customize Macroscope's approvability policy. Learn more. |
3cfab04 to
c511c5d
Compare
|
|
||
| [dependencies] | ||
| ureq = "2" | ||
| ureq = "3" |
There was a problem hiding this comment.
🔍 ureq 3 default TLS backend and feature set differ from v2
ureq 2 with default features used rustls+webpki-roots; ureq 3's default features (rustls with platform verifier / different root store handling) can change TLS trust behaviour for the outbound calls to api.privy.io and api.bridge.xyz (sdk/rust/src/lib.rs:237-258). Since no features are specified here, the resulting TLS stack should be verified against the deployment environment before merging.
Was this helpful? React with 👍 or 👎 to provide feedback.
c511c5d to
29287d6
Compare
This PR contains the following updates:
2→3Release Notes
algesten/ureq (ureq)
v3.4.0Compare Source
v3.3.0Compare Source
v3.2.1Compare Source
v3.2.0Compare Source
v3.1.4Compare Source
v3.1.3Compare Source
v3.1.2Compare Source
v3.1.1Compare Source
v3.1.0Compare Source
DECISION: webpki-roots and webpki-root-certs goes from pre-release (0.26)
to stable release (1.0.0). This is potentially a big change
for ureq users. We release this as semver minor.
v3.0.12Compare Source
public_suffixfor CookieStore #1063v3.0.11Compare Source
v3.0.10Compare Source
v3.0.9Compare Source
v3.0.8Compare Source
v3.0.7Compare Source
v3.0.6Compare Source
v3.0.5Compare Source
v3.0.4Compare Source
rustls-no-providerwhen disabling ring #973v3.0.3Compare Source
v3.0.2Compare Source
v3.0.1Compare Source
public_suffixfor CookieStore #1063v3.0.0Compare Source
urlcrate #943Config::save_redirect_history#939Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.