Skip to content

[Maintenance] Replace unmaintained backoff crate with backon (RUSTSEC-2025-0012) #1292

@pranc1ngpegasus

Description

@pranc1ngpegasus

What are you really trying to do?

Keep the Rust SDK's dependency tree free of unmaintained crates reported by cargo audit / RustSec.

Describe the issue

The SDK currently depends on the backoff crate for exponential retry delays. RUSTSEC-2025-0012 (RustSec advisory) reports that backoff is unmaintained and recommends migrating to backon for exponential backoff/retry.

backoff is used in:

  • temporalio-client — gRPC call retry (TonicErrorHandler in crates/client/src/retry.rs)
  • temporalio-sdk-core — poller autoscaling error backoff (crates/sdk-core/src/pollers/poll_buffer.rs)

Proposed change

Replace backoff with backon in both crates, using backon::ExponentialBuilder / ExponentialBackoff (Iterator::next() for delays). Each crate should depend on backon directly so sdk-core does not need to route retry utilities through client.

Additional context

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions