chore: replace unmaintained backoff with backon (release 0.49.1) (#738)

* chore: replace unmaintained backoff with backon

`backoff` is flagged as unmaintained. Replace it with `backon` for the
`request_status` polling backoff in ic-agent.

- Wrap `backon::ExponentialBackoff` in a small `RetryPolicy` that tracks
  wall-clock elapsed time (via `web-time`, so it works on wasm32) and
  bounds polling by `max_polling_time`. Delay schedule is unchanged:
  500ms initial, x1.4 growth capped at 1s, jittered.
- `backoff/wasm-bindgen` previously enabled `getrandom` 0.2's `js`
  backend for the transitive crypto crates on wasm. Restore that
  explicitly via a renamed `getrandom_0_2` dependency gated on
  ic-agent's `wasm-bindgen` feature.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: release 0.49.1 — replace unmaintained backoff with backon

Bump all workspace crates 0.49.0 -> 0.49.1. This is a patch release: the
backoff -> backon swap is an internal dependency change with no public API
or behavior change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor: use backon ExponentialBackoff directly, drop RetryPolicy

The RetryPolicy wrapper was a 1:1 re-implementation of the old
`backoff::Backoff` trait (next_backoff / reset / get_elapsed_time). The
polling schedule is an internal detail, so lean on backon's building
blocks instead:

- Drive `backon::ExponentialBackoff` (an Iterator<Item = Duration>)
  directly in the poll loops.
- Bound the polling budget with backon's `with_total_delay(max_polling_time)`
  so the iterator yields None once the cumulative sleep is spent — no
  manual elapsed-time bookkeeping.
- Track a small `slept` accumulator only for the existing 5-minute
  "Unknown => ingress message lost" guard.

This also drops the `web-time` dependency added earlier (it was only
needed for the wrapper's wall-clock Instant). `max_polling_time` now
bounds cumulative backoff sleep rather than wall-clock elapsed; in
practice they differ only by per-poll request latency.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* review: clarify slept-based timeout comment; align getrandom_0_2 enablement

Address Copilot review feedback on PR #738:

- Clarify the `Unknown => ingress message lost` comments in both poll
  loops: the 5-minute threshold is now cumulative backoff sleep
  (`slept`), not wall-clock, so it excludes per-poll request latency.
- Enable `getrandom_0_2` via `dep:getrandom_0_2` + `features = ["js"]`
  on the dependency, mirroring the sibling `getrandom` (0.4) entry
  exactly. This is unambiguous and suppresses the implicit
  `getrandom_0_2` feature that `getrandom_0_2/js` would otherwise leak
  on ic-agent's public feature set.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: lwshang

CHANGELOG.md

@@ -8,6 +8,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+## [0.49.1] - 2026-07-20
+
+* `ic-agent`: Replaced the unmaintained `backoff` dependency with `backon` for the `request_status` polling backoff, using `backon`'s `ExponentialBackoff` iterator directly. The schedule is unchanged (500ms initial delay, growing by 1.4x up to 1s, jittered). `max_polling_time` now bounds the cumulative backoff sleep (via `backon`'s `with_total_delay`) rather than wall-clock elapsed time; in practice they differ only by per-poll request latency.
+
 ## [0.49.0] - 2026-07-13
 
 * `ic-utils`: Bump `ic-management-canister-types` to 0.8.0.

Cargo.lock

@@ -13,7 +13,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.49.0"
+version = "0.49.1"
 authors = ["DFINITY Stiftung <sdk@dfinity.org>"]
 edition = "2021"
 repository = "https://github.com/dfinity/agent-rs"
@@ -30,10 +30,10 @@ license = "Apache-2.0"
 #   a comment listing those crates). Otherwise, features are declared in the individual crate Cargo.toml.
 #
 # The path dependencies below ensure all workspace members use the same version of internal crates.
-ic-agent = { path = "ic-agent", version = "0.49.0", default-features = false }
-ic-identity-hsm = { path = "ic-identity-hsm", version = "0.49.0" }
-ic-transport-types = { path = "ic-transport-types", version = "0.49.0" }
-ic-utils = { path = "ic-utils", version = "0.49.0" }
+ic-agent = { path = "ic-agent", version = "0.49.1", default-features = false }
+ic-identity-hsm = { path = "ic-identity-hsm", version = "0.49.1" }
+ic-transport-types = { path = "ic-transport-types", version = "0.49.1" }
+ic-utils = { path = "ic-utils", version = "0.49.1" }
 ic-utils-bindgen = { path = "ic-utils-bindgen" }
 ref-tests = { path = "ref-tests" }
 
@@ -44,7 +44,7 @@ async-channel = "2.5"
 async-lock = "3.4"
 async-trait = "0.1"
 async-watch = "0.3"
-backoff = "0.4.0"
+backon = { version = "1", default-features = false }
 base64 = "0.22"
 bytes = "1.11"
 cached = { version = "0.56", default-features = false }
@@ -57,6 +57,11 @@ ed25519-consensus = "2.1.0"
 elliptic-curve = "0.13"
 futures-util = "0.3.31"
 getrandom = "0.4"
+# getrandom 0.2 is pulled in only transitively (via rand_core 0.6, used by the
+# crypto crates). On wasm it needs its `js` backend enabled; ic-agent turns that
+# on through this renamed entry under its `wasm-bindgen` feature. This activation
+# was previously provided by `backoff/wasm-bindgen`.
+getrandom_0_2 = { package = "getrandom", version = "0.2" }
 hex = "0.4.3"
 http = "1.0.0"
 http-body = "1.0.0"

Cargo.toml

@@ -28,9 +28,9 @@ wasm-bindgen = [
     "dep:wasm-bindgen",
     "dep:wasm-bindgen-futures",
     "dep:getrandom",
+    "dep:getrandom_0_2",
     "dep:web-sys",
     "time/wasm-bindgen",
-    "backoff/wasm-bindgen",
     "cached/wasm",
 ]
 _internal_dynamic-routing = []
@@ -41,7 +41,7 @@ arc-swap = { workspace = true }
 async-channel = { workspace = true }
 async-lock = { workspace = true }
 async-trait = { workspace = true }
-backoff = { workspace = true }
+backon = { workspace = true, features = ["std"] }
 bytes = { workspace = true }
 cached = { workspace = true, features = ["ahash"], default-features = false }
 candid = { workspace = true }
@@ -89,7 +89,16 @@ tokio = { workspace = true, default-features = false, features = ["time", "sync"
 
 [target.'cfg(target_family = "wasm")'.dependencies]
 async-watch = { workspace = true }
+# getrandom 0.4 is required (on all targets) by `rand` 0.10, which ic-agent uses
+# directly (e.g. nonce generation). On native it selects a backend automatically;
+# on wasm the `wasm_js` backend must be turned on explicitly, which is the only
+# reason for this direct, wasm-only entry. Enabled via the `wasm-bindgen` feature.
 getrandom = { workspace = true, optional = true, features = ["wasm_js"] }
+# Likewise, getrandom 0.2 is pulled in (on all targets) only transitively, by the
+# crypto crates via rand_core 0.6; on wasm its `js` backend must be turned on. This
+# renamed entry does that (see the workspace manifest), and was previously provided
+# by `backoff/wasm-bindgen`. Enabled via the `wasm-bindgen` feature.
+getrandom_0_2 = { workspace = true, optional = true, features = ["js"] }
 js-sys = { workspace = true, optional = true }
 wasm-bindgen = { workspace = true, optional = true }
 wasm-bindgen-futures = { workspace = true, optional = true }

ic-agent/Cargo.toml

@@ -53,8 +53,7 @@ use crate::{
     identity::Identity,
     to_request_id, RequestId,
 };
-use backoff::{backoff::Backoff, ExponentialBackoffBuilder};
-use backoff::{exponential::ExponentialBackoff, SystemClock};
+use backon::{BackoffBuilder, ExponentialBackoff, ExponentialBuilder};
 use ic_certification::{Certificate, Delegation, Label};
 use ic_transport_types::{
     signed::{SignedQuery, SignedRequestStatus, SignedUpdate},
@@ -838,12 +837,17 @@ impl Agent {
         })
     }
 
-    fn get_retry_policy(&self) -> ExponentialBackoff<SystemClock> {
-        ExponentialBackoffBuilder::new()
-            .with_initial_interval(Duration::from_millis(500))
-            .with_max_interval(Duration::from_secs(1))
-            .with_multiplier(1.4)
-            .with_max_elapsed_time(Some(self.max_polling_time))
+    /// Backoff schedule for polling `request_status`: 500ms initial delay, growing by 1.4x up to
+    /// 1s, jittered. `with_total_delay` bounds the cumulative sleep by `max_polling_time`, so the
+    /// iterator yields `None` (i.e. "give up") once the budget is spent.
+    fn poll_backoff(&self) -> ExponentialBackoff {
+        ExponentialBuilder::default()
+            .with_min_delay(Duration::from_millis(500))
+            .with_max_delay(Duration::from_secs(1))
+            .with_factor(1.4)
+            .with_jitter()
+            .without_max_times()
+            .with_total_delay(Some(self.max_polling_time))
             .build()
     }
 
@@ -859,7 +863,8 @@ impl Agent {
         signed_request_status: Vec<u8>,
     ) -> Result<(Vec<u8>, Certificate), AgentError> {
         let effective_id = effective_id.into();
-        let mut retry_policy = self.get_retry_policy();
+        let mut backoff = self.poll_backoff();
+        let mut slept = Duration::ZERO;
 
         let mut request_accepted = false;
         loop {
@@ -868,15 +873,18 @@ impl Agent {
                 .await?;
             match resp {
                 RequestStatusResponse::Unknown => {
-                    // If status is still `Unknown` after 5 minutes, the ingress message is lost.
-                    if retry_policy.get_elapsed_time() > Duration::from_secs(5 * 60) {
+                    // If the status is still `Unknown` after 5 minutes of cumulative polling
+                    // backoff, the ingress message is presumed lost. `slept` counts backoff
+                    // sleep, not wall-clock, so this excludes per-poll request latency.
+                    if slept > Duration::from_secs(5 * 60) {
                         return Err(AgentError::TimeoutWaitingForResponse());
                     }
                 }
 
                 RequestStatusResponse::Received | RequestStatusResponse::Processing => {
                     if !request_accepted {
-                        retry_policy.reset();
+                        backoff = self.poll_backoff();
+                        slept = Duration::ZERO;
                         request_accepted = true;
                     }
                 }
@@ -899,9 +907,11 @@ impl Agent {
                 }
             };
 
-            match retry_policy.next_backoff() {
-                Some(duration) => crate::util::sleep(duration).await,
-
+            match backoff.next() {
+                Some(duration) => {
+                    slept += duration;
+                    crate::util::sleep(duration).await;
+                }
                 None => return Err(AgentError::TimeoutWaitingForResponse()),
             }
         }
@@ -926,15 +936,18 @@ impl Agent {
         effective_id: EffectiveId,
         operation: Option<Operation>,
     ) -> Result<(Vec<u8>, Certificate), AgentError> {
-        let mut retry_policy = self.get_retry_policy();
+        let mut backoff = self.poll_backoff();
+        let mut slept = Duration::ZERO;
 
         let mut request_accepted = false;
         loop {
             let (resp, cert) = self.request_status_raw(request_id, effective_id).await?;
             match resp {
                 RequestStatusResponse::Unknown => {
-                    // If status is still `Unknown` after 5 minutes, the ingress message is lost.
-                    if retry_policy.get_elapsed_time() > Duration::from_secs(5 * 60) {
+                    // If the status is still `Unknown` after 5 minutes of cumulative polling
+                    // backoff, the ingress message is presumed lost. `slept` counts backoff
+                    // sleep, not wall-clock, so this excludes per-poll request latency.
+                    if slept > Duration::from_secs(5 * 60) {
                         return Err(AgentError::TimeoutWaitingForResponse());
                     }
                 }
@@ -948,7 +961,8 @@ impl Agent {
                         // instantaneous. Therefore, once we know the request is accepted,
                         // we should restart the backoff so the request does not time out.
 
-                        retry_policy.reset();
+                        backoff = self.poll_backoff();
+                        slept = Duration::ZERO;
                         request_accepted = true;
                     }
                 }
@@ -971,9 +985,11 @@ impl Agent {
                 }
             };
 
-            match retry_policy.next_backoff() {
-                Some(duration) => crate::util::sleep(duration).await,
-
+            match backoff.next() {
+                Some(duration) => {
+                    slept += duration;
+                    crate::util::sleep(duration).await;
+                }
                 None => return Err(AgentError::TimeoutWaitingForResponse()),
             }
         }