A massive week across the XRPL ecosystem: in rippled, 37 PRs merged including MPT support for the DEX (XLS-82) — a 35,000-line feature change — plus the ripple(d) to xrpl(d) rename, AMM helper consolidation, and multiple Attackathon-branch merges for Sponsored Fees (XLS-68), Confidential Transfers, and Batch. The XRPL-Standards repo landed three new specs: XLS-82 (MPT DEX), XLS-98 (Vault Metadata), and an XLS-68 update. On the developer portal, a new fungible token escrows tutorial and a Claude Code release notes skill merged. In xrpl-py, the default signing algorithm was updated to ED25519 (breaking change). On opensource.ripple.com, XLS-68 Sponsored Fees documentation and an XLS-82 MPT DEX landing page shipped.
This was one of the most active weeks in recent memory for XRP Ledger development, with major progress on several fronts. The headline change is that Multi-Purpose Tokens (a way to create custom tokens on the XRPL) can now be traded on the built-in decentralized exchange — previously, MPTs could only be sent directly between accounts. This change, known as XLS-82, touched over 200 files and is one of the largest single feature additions to rippled. It's merged to the development branch but won't go live until it's included in a release and validators vote to enable it. Once live, it would mean any MPT issuer's tokens could be freely traded against XRP or other tokens using the same orderbook and AMM infrastructure that already exists for traditional XRPL tokens.
The Attackathon security audit program saw intensive activity, with Sponsored Fees and Reserves (a feature that lets one account pay transaction fees and reserve requirements on behalf of another), Confidential Transfers (privacy-preserving token sends), and Batch transactions all being merged to the dedicated testing branch. Three formal specifications were also finalized: the MPT DEX integration, a standard format for vault metadata (useful for apps that need to identify and categorize vaults), and updates to the Sponsored Fees spec. On the documentation side, the developer portal added a new tutorial teaching developers how to create escrows using custom tokens (not just XRP), and comprehensive reference documentation for Sponsored Fees was published on opensource.ripple.com. In the Python SDK (xrpl-py), a breaking change updated the default cryptographic signing algorithm to ED25519, which is more modern and consistent across the library. A massive triage effort also produced 49 new bug reports covering input validation issues in nearly every RPC handler — 12 of these are tagged as good first issues for new contributors.
For ongoing updates, follow @XRPLF and @RippleXDev on X. Check the XRPLF GitHub organization for the latest activity, and explore the new fungible token escrows tutorial and XLS-68 Sponsored Fees documentation.
Note: All rippled changes below were merged to the develop branch and are not yet live on the network. A tagged release is required for any change to reach production.
FlowCross feature. Labeled "Amendment" and "Breaking change". Approved by reviewer @vlntb. rippled#5285 (+34,948/−4,279, 223 files)assetsAvailable, allowing more assets to be recovered than available when there was an outstanding loan. Now shares the same clamping logic. Old behavior retained behind an amendment gate. Labeled "Amendment". Approved by @pratikmankawde. rippled#6646 (+693/−25)MPTokenIssuanceDestroy when escrows are still associated with the token. rippled#6635 (+105/−2)mpt-crypto SDK for smaller proof sizes in Confidential MPT transactions (e.g., ConfidentialMPTSend down to 946 bytes). Approved by @PeterChen13579. rippled#6861 (+166/−410)break in the ping handler's PROXY case (causing fallthrough) and corrected a gRPC GetLedgerDiff error message. Closes rippled#6792. rippled#6730 (+7/−2)canTrade → canTransfer in CheckCreate/Cash), changed tecFROZEN to tecLOCKED for locked MPT, fixed double adjustOwnerCount in AMMWithdraw. rippled#6840 (+523/−237)ContractCall tx. rippled#6724 (+470/−444)bookOffers minimum limit to 1 — Updates Tuning::bookOffers minimum from 0 to 1, consistent with readLimitField rejecting limit == 0. rippled#6812 (+1/−1)terLOCKED error description — Adds a missing description string. rippled#6811 (+1/−0)account_tx limit validation, array size checks, book_offers CLI index fix, nullptr resolution without DB config, and more. Approved by @ximinez. rippled#6739 (+1,138/−410, 63 files)ripple(d) to xrpl(d) in non-functional uses — Per XLS-95, updates documentation, comments, and internal function names across 144 files. No binary/functionality changes. rippled#6676 (+544/−511)AMMHelpers and AMMUtils — Pure refactor merging two confusingly separate AMM helper files into one. Approved by @gregtatcam. rippled#6733 (+637/−668)libxrpl/ledger/helpers — Continues the helper file reorganization from prior PRs. Pure refactor. rippled#6731 (+102/−105, 63 files)core.autocrlf. Approved by @a1q123456. rippled#6833 (+1/−1), also rippled#6832mpt_holder_api rippled#6810 (+168/−162)MPTVersion2 enabling MPT support on the DEX. XRPL-Standards#451 (+843 lines)docker/login-action 4.0.0 → 4.1.0 in two locations. clio#3024, clio#3025. Nightly build nightly-20260409 published (development only, not for production).Wallet.from_secret_numbers now defaults to ED25519, consistent with the rest of the Wallet class. xrpl-py#942 (+12/−8)'connected' emissions that grew with each reconnect cycle. xrpl.js#3211 (+31/−3)handlebars to 4.7.9 xrpl.js#3235, plus 24 Dependabot dependency bumps including TypeScript 5.2→6.0 xrpl.js#3244, ESLint 9→10 xrpl.js#3249, bignumber.js 9→10 xrpl.js#3252, jest 30.2→30.3, prettier 3.7→3.8, ws 8.19→8.20, and more.Clio: libxrpl compatibility update (clio#3030, +4,759/−4,945, 221 files) — Large refactor to make Clio compatible with the newest version of libxrpl. No reviews yet.
rippled: Sponsored Fees and Reserves (XLS-68) on develop (rippled#5887, +11,533/−437, 140 files) — The main develop-branch PR for XLS-68. Labeled "Amendment" and "Blocked: Needs Final XLS". 165 review rounds. AI reviewer flagged correctness issues including read-after-erase bugs and signed/unsigned comparisons. A critical vulnerability in SponsorshipTransfer was identified in review: it allows forcing sponsorship transfers without the new sponsor's agreement. Active discussion on fixes.
rippled: Confidential Transfer for MPT (rippled#5860, +17,473/−305, 60 files) — The main develop-branch PR for Confidential Transfers. Labeled "Amendment" and "Blocked: Needs Final XLS". 160 review rounds. AI reviewer flagged issues including a blinding factor on-chain that could break confidentiality.
rippled: Online delete pause on ledger gaps (rippled#5531, +328/−20, 9 files) — Adds a check to pause online deletion when gaps exist in recent ledger history, preventing gap persistence after sync loss. Multiple Copilot review rounds. AI reviewer flagged a potential liveness deadlock.
rippled: Linux DEB + RPM package builds (rippled#6639, +1,072/−9, 27 files) — Adds DEB and RPM package builds to CI. 84 review rounds. Partial review from @bthomee; deferred to @mathbunnyru for packaging expertise.
rippled: Exception handling improvement (rippled#6735, +97/−115, 15 files) — Replaces LogicError with Throw and adds const to exception handlers. Approved by AI reviewer, reviewed by @mvadari. Awaiting final merge.
xrpl.js: Quarterly batch dependency upgrade Q2 2026 (xrpl.js#3271, +4,346/−2,952) — Consolidates 28 Dependabot PRs into a single upgrade. Under active review.
xrpl.js: Assorted fixes (xrpl.js#3270, +147/−5, 13 files) — Improved validations and bug fixes including URL scheme validation. Approved by AI reviewer.
xrpl.js: Non-UTF-8 input handling (xrpl.js#3268, +147/−16) — Prevents crashes when rippled sends malformed UTF-8 in WebSocket text frames. Under review.
xrpl.js: Sponsorship (XLS-68) (xrpl.js#3238, +3,851/−34, 36 files) — Adds SponsorshipSet, SponsorshipTransfer types, and sponsor signing utilities.
xrpl4j: Sponsored Fees and Reserves (XLS-68) (xrpl4j#720, +4,095/−32, 50 files) — AI reviewer flagged missing cryptographic domain separation in sponsorSign.
xrpl4j: Lending Protocol (XLS-66) (xrpl4j#719, +10,655/−3, 88 files) — All lending transactions and ledger objects. 13 review rounds.
xrpl4j: Permission Delegation (XLS-75) (xrpl4j#689, +5,271/−9, 46 files) — 76 review rounds, nearing completion.
Developer portal: MPT DEX Integration docs (XLS-82) (xrpl-dev-portal#3537, +560/−110, 30 files) — Updates concept and reference docs. JSON examples still need real transaction data.
Developer portal: Tutorials landing page v2 (xrpl-dev-portal#3572, +1,182/−392, 8 files) — Auto-populated sections and "What's New" feature. Has review feedback.
xrpl-py: Multiple open PRs from community — websockets minimum version bump to ≥14 xrpl-py#945, hex string signature handling fix xrpl-py#944, and Directory model fix making dir_root/owner optional xrpl-py#943 (closes #885).
Massive bug triage effort — @mvadari filed 49 new issues this week on rippled, all labeled "Bug" and "AI Triage", covering input validation gaps across nearly every RPC handler. These range from missing isString() checks before asString() calls, to unsigned integer overflow in asUInt(), to non-standard error formats. 12 are labeled "Good First Issue", making them excellent entry points for new contributors. Examples: rippled#6804 (vault_id type check), rippled#6793 (counters param validation), rippled#6764 (zero-drop amount acceptance).
Community RPC fix PRs — Community member @shortthefomo responded to the triage by opening PRs for many of these issues: channel_authorize/channel_verify zero-drop rejection rippled#6846, path_find session preservation rippled#6838, destination_tag boolean fix rippled#6837, simulate fee burden correction rippled#6841, and more. Community member @michalgolda also contributed type validation PRs for manifest rippled#6821, nft_id rippled#6820, amm_account rippled#6822, and transaction_entry error standardization rippled#6819.
Default peering port — Community member @shortthefomo proposed defaulting the peering port to 2459 (the IANA-assigned port for XRPL) rippled#6848. Core team member @legleux noted this is "long overdue". The backwards-compatible default (51235) was named back in 2019.
Clio self-healing cache — Community member @interc0der filed clio#3027 requesting more verbose corruption detection and a self-healing procedure instead of requiring full keyspace wipes.
Oracle deduplication in Clio — clio#3028 filed for RPC parity with rippled's in-progress get_aggregate_price deduplication fix rippled#6586.
xrpl.js community contributions — @slurpyone contributed currency name/code conversion utilities xrpl.js#3223, enhanced parseTransactionFlags xrpl.js#3224, and deprecated function replacements xrpl.js#3221. @Platonenkov fixed ticket ledger_entry property names xrpl.js#3237.
xrpl-py community contributions — @m1lestones contributed three PRs: websockets version bump xrpl-py#945, hex signature handling xrpl-py#944, and Directory model fix xrpl-py#943.
Compared to last week (March 30 – April 5, 2026):
| Metric | This Week | Last Week | Change |
| Repos with activity | 8 | 8 | flat |
| rippled PRs merged | 37 | 28 | ↑9 |
| rippled PRs opened | 25 | 17 | ↑8 |
| rippled commits | 13 | 23 | ↓10 |
| rippled new issues filed | 49 | 5 | ↑44 |
| xrpl-dev-portal PRs merged | 13 | 3 | ↑10 |
| xrpl-dev-portal PRs opened | 10 | 9 | ↑1 |
| xrpl-dev-portal commits | 12 | 6 | ↑6 |
| xrpl.js PRs merged | 26 | 10 | ↑16 |
| xrpl.js PRs opened | 14 | 25 | ↓11 |
| xrpl.js commits | 2 | 3 | ↓1 |
| xrpl-py PRs merged | 1 | 2 | ↓1 |
| xrpl-py PRs opened | 4 | 15 | ↓11 |
| xrpl-py commits | 1 | 2 | ↓1 |
| XRPL-Standards PRs merged | 3 | 4 | ↓1 |
| XRPL-Standards PRs opened | 2 | 2 | flat |
| XRPL-Standards commits | 3 | 4 | ↓1 |
| clio PRs merged | 2 | 4 | ↓2 |
| clio PRs opened | 2 | 2 | flat |
| clio commits | 2 | 4 | ↓2 |
| xrpl4j PRs merged | 0 | 0 | flat |
| xrpl4j PRs opened | 3 | 3 | flat |
| xrpl4j commits | 0 | 0 | flat |
| opensource.ripple.com PRs merged | 4 | 2 | ↑2 |
| opensource.ripple.com PRs opened | 0 | 2 | ↓2 |
| opensource.ripple.com commits | 5 | 4 | ↑1 |
| Releases | 1 | 0 | ↑1 |
Notable carryovers: The VaultClawback zero-amount clamping fix (rippled#6646) and MPTokens escrow deletion prevention (rippled#6635) were "In Progress" last week and merged this week. The xrpl-py default algorithm change (xrpl-py#942) also carried over and landed. The developer portal saw a strong recovery from last week's 3 merges to 13 this week. rippled saw its highest merge count in these two weeks at 37 PRs, driven largely by Attackathon branch activity. The massive spike in rippled issues (49, up from 5) reflects the systematic RPC triage effort by @mvadari.