chore(deps): update rust crate ureq to v3 - #30
Conversation
|
|
PR author is in the excluded authors list. |
🟢 WAVE BugBot — clearNo confident findings on the changed lines. Local review · $0 inference · wave-dispatch |
fefdd4b to
b58b5c5
Compare
b58b5c5 to
3cfab04
Compare
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
|
|
||
| [dependencies] | ||
| ureq = "2" | ||
| ureq = "3" |
There was a problem hiding this comment.
🔴 Rust client library stops working after HTTP library upgrade
The Rust client's HTTP dependency is upgraded to a new major version (ureq = "3" at sdk/rust/Cargo.toml:13) without updating any of the calling code, so the Rust SDK no longer builds or works at all.
Impact: Anyone using or publishing the Rust client gets a broken package; payment-retry behavior would also be lost even after a mechanical fix.
ureq 3 removed the v2 request/response API used throughout sdk/rust/src/lib.rs
All call sites still use the ureq 2 API:
ureq::Request/ureq::Responsetypes and.set(k, v)header builder (sdk/rust/src/lib.rs:148-152,157,166,174-186,237-241,253-256) — in ureq 3 these types moved (http::Request/http::Response<Body>) and.set()became.header()..send_string(..)/.into_string()(sdk/rust/src/lib.rs:158-159,176,186,242,257) — replaced by.send(..)andbody_mut().read_to_string().Err(ureq::Error::Status(402, r))(sdk/rust/src/lib.rs:160,169) — ureq 3's variant isError::StatusCode(u16)and carries no response, so the x402 challenge body needed byretry_with_hook(sdk/rust/src/lib.rs:174-177) is unavailable unless the config is switched tohttp_status_as_error(false)and the 402 handled on theOkpath.
The upgrade must be accompanied by a full migration of these call sites.
Prompt for agents
The dependency bump to ureq 3 in sdk/rust/Cargo.toml is a breaking major upgrade, but sdk/rust/src/lib.rs still uses the entire ureq 2 API surface: ureq::Request/ureq::Response types, builder .set(name, value) for headers, .send_string(body), .call(), and .into_string() on responses, plus pattern matching on ureq::Error::Status(402, response) in Dispatch::post/get to capture the x402 challenge body and feed it to retry_with_hook. In ureq 3 requests/responses are the http crate types, headers are set with .header(), bodies are sent with .send()/.send_empty(), response bodies are read via response.body_mut().read_to_string(), and the error variant is Error::StatusCode(u16) which does NOT carry the response body. Migrating the 402 path requires configuring the agent with http_status_as_error(false) (e.g. a shared ureq::Agent built from ureq::Agent::config_builder()) so a 402 arrives as Ok(response) and the challenge JSON can still be read before retrying with the payment hook headers. Either complete this migration across all call sites (Dispatch::auth/post/get/retry_with_hook and the privy/bridge wallet_sign HTTP calls) or revert the dependency to ureq 2.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
|
||
| [dependencies] | ||
| ureq = "2" | ||
| ureq = "3" |
There was a problem hiding this comment.
🟡 Changelog not updated for the dependency upgrade
The repository requires the Unreleased section of CHANGELOG.md to be updated for user-facing changes, but this major dependency upgrade of the published Rust client adds no entry.
Impact: Consumers of the Rust package get no record of a breaking dependency change.
AGENTS.md rule
AGENTS.md states: "Conventional Commit titles; update CHANGELOG.md (Unreleased) for user-facing changes." The ## [Unreleased] section in CHANGELOG.md remains empty in this PR while sdk/rust/Cargo.toml:13 bumps the published crate's HTTP dependency to a new major version.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
|
||
| [dependencies] | ||
| ureq = "2" | ||
| ureq = "3" |
There was a problem hiding this comment.
🔍 Automated dependency bump lacks accompanying source migration and MSRV check
This is a bot-style dependency bump (ureq = "3") with no source changes in sdk/rust/src/lib.rs. Besides the API migration required, ureq 3 raises the minimum supported Rust version and changes TLS/feature defaults (e.g. rustls-based defaults, native-tls behind a feature), which can affect downstream consumers of the published wave-dispatch crate. Verify MSRV/CI toolchain and TLS backend expectations before merging.
Was this helpful? React with 👍 or 👎 to provide feedback.
ApprovabilityVerdict: Needs human review Unable to check for correctness in 3cfab04. Major version bump (ureq 2 → 3) can introduce breaking API changes. The SDK uses multiple ureq APIs that may have changed. The file is owned by wave-av/streaming-team who should verify compatibility. No code changes detected at You can customize Macroscope's approvability policy. Learn more. |
3cfab04 to
c511c5d
Compare
|
|
||
| [dependencies] | ||
| ureq = "2" | ||
| ureq = "3" |
There was a problem hiding this comment.
🔍 ureq 3 default TLS backend and feature set differ from v2
ureq 2 with default features used rustls+webpki-roots; ureq 3's default features (rustls with platform verifier / different root store handling) can change TLS trust behaviour for the outbound calls to api.privy.io and api.bridge.xyz (sdk/rust/src/lib.rs:237-258). Since no features are specified here, the resulting TLS stack should be verified against the deployment environment before merging.
Was this helpful? React with 👍 or 👎 to provide feedback.
This PR contains the following updates:
2→3Release Notes
algesten/ureq (ureq)
v3.3.0Compare Source
v3.2.1Compare Source
v3.2.0Compare Source
v3.1.4Compare Source
v3.1.3Compare Source
v3.1.2Compare Source
v3.1.1Compare Source
v3.1.0Compare Source
DECISION: webpki-roots and webpki-root-certs goes from pre-release (0.26)
to stable release (1.0.0). This is potentially a big change
for ureq users. We release this as semver minor.
v3.0.12Compare Source
public_suffixfor CookieStore #1063v3.0.11Compare Source
v3.0.10Compare Source
v3.0.9Compare Source
v3.0.8Compare Source
v3.0.7Compare Source
v3.0.6Compare Source
v3.0.5Compare Source
v3.0.4Compare Source
rustls-no-providerwhen disabling ring #973v3.0.3Compare Source
v3.0.2Compare Source
v3.0.1Compare Source
public_suffixfor CookieStore #1063v3.0.0Compare Source
urlcrate #943Config::save_redirect_history#939Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.
Note
Update
ureqdependency to v3 in the Rust SDKBumps the
ureqcrate version from"2"to"3"in Cargo.toml. Risk:ureqv3 includes breaking API changes that may require code updates in any callers using the library directly.Macroscope summarized c511c5d.