Skip to content

chore(deps): replace unmaintained backoff crate with backon#1291

Open
pranc1ngpegasus wants to merge 1 commit into
temporalio:mainfrom
pranc1ngpegasus:chore/replace-backoff-with-backon
Open

chore(deps): replace unmaintained backoff crate with backon#1291
pranc1ngpegasus wants to merge 1 commit into
temporalio:mainfrom
pranc1ngpegasus:chore/replace-backoff-with-backon

Conversation

@pranc1ngpegasus
Copy link
Copy Markdown
Contributor

@pranc1ngpegasus pranc1ngpegasus commented May 24, 2026

What was changed

The SDK depended on the unmaintained backoff crate (see RUSTSEC-2025-0012 / RustSec advisory) for exponential retry delays in:

  • temporalio-client — gRPC call retry (TonicErrorHandler in retry.rs)
  • temporalio-sdk-core — poller autoscaling error backoff (poll_buffer.rs)

This PR replaces backoff with backon in both crates:

  1. temporalio-client: RetryOptions builds a backon::ExponentialBuilder; TonicErrorHandler drives retry delays via Iterator::next() on backon::ExponentialBackoff. Jitter is enabled when randomization_factor > 0 (with_jitter()). Long-poll fatal-error grace still uses wall-clock elapsed time via retry_started_at.
  2. temporalio-sdk-core: Poll scaler backoff uses shared ExponentialBuilder constants aligned with RetryOptions::task_poll_retry_policy() and throttle_retry_policy(); state resets with builder.build() after successful polls.

Why?

Fixes #1292. RUSTSEC-2025-0012 reports that backoff is unmaintained and recommends migrating to backon for exponential backoff/retry. Each crate now depends on backon directly so sdk-core does not pull retry utilities through client.

Checklist

  1. Closes [Maintenance] Replace unmaintained backoff crate with backon (RUSTSEC-2025-0012) #1292

  2. How was this tested:

    • cargo test -p temporalio-client retry::
    • cargo test -p temporalio-sdk-core autoscaler_applies_backoff
  3. Any docs updates needed?
    N/A — internal dependency and retry implementation change only; public RetryOptions fields are unchanged.

The backoff crate is unmaintained per RUSTSEC-2025-0012. Migrate gRPC
retry and poll-buffer backoff to backon's ExponentialBuilder API in
temporalio-client and temporalio-sdk-core respectively.

Co-authored-by: Cursor <cursoragent@cursor.com>
@pranc1ngpegasus pranc1ngpegasus requested a review from a team as a code owner May 24, 2026 10:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Maintenance] Replace unmaintained backoff crate with backon (RUSTSEC-2025-0012)

1 participant