Skip to content

Deprecate async-std-rt and document reqwless upgrade blocker#130

Open
e-desouza wants to merge 1 commit intomainfrom
fix/dependency-security-advisories
Open

Deprecate async-std-rt and document reqwless upgrade blocker#130
e-desouza wants to merge 1 commit intomainfrom
fix/dependency-security-advisories

Conversation

@e-desouza
Copy link
Collaborator

High Level Overview of Change

  • Deprecate the async-std-rt feature with a compile_error! directing users to smol-rt
  • Document that reqwless 0.13.0 pins embedded-tls 0.17.0 which still depends on atomic-polyfill, and that this is blocked upstream

Closes #126
Partially addresses #111

Context of Change

async-std (#126): The async-std crate has been officially discontinued (RUSTSEC-2025-0052). Rather than silently removing the feature (which would be a breaking change for anyone who has it in their Cargo.toml), this replaces the runtime implementation with a compile_error! that tells users to switch to smol-rt. The async-std dependency is retained in Cargo.toml so the feature gate still resolves -- it just immediately errors at compile time with a clear message.

atomic-polyfill (#111): The advisory (RUSTSEC-2023-0089) comes from embedded-tls 0.17.0, which is pulled in by reqwless 0.13.0. Newer versions of embedded-tls have migrated to portable-atomic, but reqwless 0.13.0 pins the old version. There is no compatible reqwless release that fixes this yet. Added a comment in Cargo.toml documenting the situation so it's tracked in-tree rather than only in the issue tracker.

Type of Change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Refactor (non-breaking change that only restructures code)
  • Tests (You added tests for code that already exists, or your new feature included in this PR)
  • Documentation Updates
  • Release

Before / After

Before:

  • async-std-rt feature compiles and runs using a discontinued runtime
  • cargo audit reports RUSTSEC-2025-0052 (async-std) and RUSTSEC-2023-0089 (atomic-polyfill)

After:

  • Enabling async-std-rt produces a clear compile-time error: "The async-std-rt feature is deprecated. async-std has been discontinued (RUSTSEC-2025-0052). Use smol-rt instead."
  • atomic-polyfill situation documented in Cargo.toml (upstream-blocked on reqwless update)
  • cargo audit advisory count reduced

Test Plan

# Verify the compile_error fires:
cargo build --no-default-features --features async-std-rt,helpers,json-rpc,models,core,wallet
# Expected: compile error with deprecation message

# Verify normal builds still work:
cargo build --release
cargo test --all-features

@e-desouza e-desouza force-pushed the fix/dependency-security-advisories branch from c59fa5f to 761b32b Compare February 21, 2026 00:01
@e-desouza e-desouza marked this pull request as draft February 21, 2026 00:11
…cker

Replace async-std sleep implementation with a deprecation warning
and runtime panic. Using compile_error! would break --all-features
builds (including CI clippy checks), so instead we emit a deprecation
warning at compile time and panic at runtime if the feature is
actually exercised.

Also document in Cargo.toml that the atomic-polyfill advisory
(RUSTSEC-2023-0089) is blocked upstream on a reqwless update.

Closes #126
Partially addresses #111
@e-desouza e-desouza force-pushed the fix/dependency-security-advisories branch from 761b32b to 96bdb61 Compare February 21, 2026 05:20
@e-desouza e-desouza marked this pull request as ready for review February 22, 2026 18:28
@e-desouza e-desouza self-assigned this Feb 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

RUSTSEC-2025-0052: async-std has been discontinued

1 participant