Skip to content

chore(deps): update rust crate ureq to v3 #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update rust crate ureq to v3 #30

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion sdk/rust/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ keywords = ["llm", "routing", "local-first", "dispatch"]
categories = ["api-bindings"]

[dependencies]
ureq = "2"
ureq = "3"

@devin-ai-integration devin-ai-integration Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Rust client library stops working after HTTP library upgrade

The Rust client's HTTP dependency is upgraded to a new major version (ureq = "3" at sdk/rust/Cargo.toml:13) without updating any of the calling code, so the Rust SDK no longer builds or works at all.
Impact: Anyone using or publishing the Rust client gets a broken package; payment-retry behavior would also be lost even after a mechanical fix.

ureq 3 removed the v2 request/response API used throughout sdk/rust/src/lib.rs

All call sites still use the ureq 2 API:

  • ureq::Request / ureq::Response types and .set(k, v) header builder (sdk/rust/src/lib.rs:148-152, 157, 166, 174-186, 237-241, 253-256) — in ureq 3 these types moved (http::Request/http::Response<Body>) and .set() became .header().
  • .send_string(..) / .into_string() (sdk/rust/src/lib.rs:158-159, 176, 186, 242, 257) — replaced by .send(..) and body_mut().read_to_string().
  • Err(ureq::Error::Status(402, r)) (sdk/rust/src/lib.rs:160, 169) — ureq 3's variant is Error::StatusCode(u16) and carries no response, so the x402 challenge body needed by retry_with_hook (sdk/rust/src/lib.rs:174-177) is unavailable unless the config is switched to http_status_as_error(false) and the 402 handled on the Ok path.

The upgrade must be accompanied by a full migration of these call sites.

Prompt for agents 
The dependency bump to ureq 3 in sdk/rust/Cargo.toml is a breaking major upgrade, but sdk/rust/src/lib.rs still uses the entire ureq 2 API surface: ureq::Request/ureq::Response types, builder .set(name, value) for headers, .send_string(body), .call(), and .into_string() on responses, plus pattern matching on ureq::Error::Status(402, response) in Dispatch::post/get to capture the x402 challenge body and feed it to retry_with_hook. In ureq 3 requests/responses are the http crate types, headers are set with .header(), bodies are sent with .send()/.send_empty(), response bodies are read via response.body_mut().read_to_string(), and the error variant is Error::StatusCode(u16) which does NOT carry the response body. Migrating the 402 path requires configuring the agent with http_status_as_error(false) (e.g. a shared ureq::Agent built from ureq::Agent::config_builder()) so a 402 arrives as Ok(response) and the challenge JSON can still be read before retrying with the payment hook headers. Either complete this migration across all call sites (Dispatch::auth/post/get/retry_with_hook and the privy/bridge wallet_sign HTTP calls) or revert the dependency to ureq 2.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@devin-ai-integration devin-ai-integration Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changelog not updated for the dependency upgrade

The repository requires the Unreleased section of CHANGELOG.md to be updated for user-facing changes, but this major dependency upgrade of the published Rust client adds no entry.
Impact: Consumers of the Rust package get no record of a breaking dependency change.

AGENTS.md rule

AGENTS.md states: "Conventional Commit titles; update CHANGELOG.md (Unreleased) for user-facing changes." The ## [Unreleased] section in CHANGELOG.md remains empty in this PR while sdk/rust/Cargo.toml:13 bumps the published crate's HTTP dependency to a new major version.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@devin-ai-integration devin-ai-integration Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Automated dependency bump lacks accompanying source migration and MSRV check

This is a bot-style dependency bump (ureq = "3") with no source changes in sdk/rust/src/lib.rs. Besides the API migration required, ureq 3 raises the minimum supported Rust version and changes TLS/feature defaults (e.g. rustls-based defaults, native-tls behind a feature), which can affect downstream consumers of the published wave-dispatch crate. Verify MSRV/CI toolchain and TLS backend expectations before merging.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@devin-ai-integration devin-ai-integration Bot Aug 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 ureq 3 default TLS backend and feature set differ from v2

ureq 2 with default features used rustls+webpki-roots; ureq 3's default features (rustls with platform verifier / different root store handling) can change TLS trust behaviour for the outbound calls to api.privy.io and api.bridge.xyz (sdk/rust/src/lib.rs:237-258). Since no features are specified here, the resulting TLS stack should be verified against the deployment environment before merging.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

serde_json = "1"
base64 = "0.22" # 0.5.1 — wallet_hook(privy) needs Basic auth encoding
urlencoding = "2" # 0.5.1 — wallet_hook(privy) URL-encodes the wallet_id path segment
Expand Down
Loading