A massive week across the ecosystem with 68 PRs merged across 8 repos. In rippled, 36 PRs merged to develop — highlighted by a performance fix for extreme-exponent Number addition, Rust-C++ CMake/CI integration, multiple vault and MPT bug fixes under fixCleanup3_4_0, and a major packaging overhaul for signed RPMs and the new packages.xrplf.org repository. Clio 2.8.0 was released with support for amendments introduced since 2.7.1. xrpl-py v5.1.0 shipped with Batch (XLS-56) V1_1 signing and Dynamic MPT (XLS-94) support. The developer portal merged 19 PRs including accessibility fixes, refreshed diagrams, the XRPL Manifest Flood disclosure report, and first-loss capital documentation updates. In xrpl.js, Confidential MPT (XLS-96) and Sponsored Fees (XLS-68) support merged to main — pending release.
This week saw a heavy push across the XRP Ledger ecosystem, with 68 changes merged across eight repositories. The core server software (rippled) continued its focus on hardening the vault and Multi-Purpose Token (MPT) systems — think of these as building blocks for more sophisticated financial products on the ledger. Several fixes addressed edge cases where tiny rounding differences could cause transactions to fail unexpectedly or, in one case, allow auction slots to be acquired for free. A notable performance fix, four weeks in the making, was finally merged: it prevents a scenario where someone could send a specially crafted number (like "1 followed by two billion zeros") and cause a server to hang for a couple of seconds while trying to process it. On the infrastructure side, the team completely overhauled how rippled packages are built and distributed — RPM packages are now digitally signed, compressed to a fraction of their previous size, and served from a new package repository. This makes it easier and more secure for node operators to install and update their servers.
For developers building applications, the Python SDK released version 5.1.0, which is now available on PyPI with support for bundling multiple transactions together (Batch) and working with tokens that issuers can update after creation (Dynamic MPT). The JavaScript and Python libraries also both merged support for two major upcoming features — Confidential MPT (which lets validators verify token transfers without learning the amounts, using zero-knowledge proofs) and Sponsored Fees (which lets one account pay transaction costs on behalf of another). These features are merged into the main branches but aren't installable yet — developers will get access once the next versions are published. The Clio API server shipped its 2.8.0 release, bringing it up to date with all the protocol changes in rippled 3.3.0. And the developer documentation site had its busiest week in a while with 19 changes merged, including accessibility improvements, refreshed technical diagrams, and the publication of a retrospective disclosure report about a peer-connectivity event in July that was already fixed in earlier releases.
For the latest updates, follow @XRPLF and @RippleXDev on X, and explore the repos directly at github.com/XRPLF. The Clio 2.8.0 release notes are available here, the xrpl-py v5.1.0 release here, and the Manifest Flood disclosure report here.
Note: All rippled changes below were merged to the develop branch and are not yet live on the network. A tagged release is required for any change to reach production.
Note: SDK PRs below were merged to each library's main branch. They become available to application developers only after a tagged release is published (npm for xrpl.js, Maven Central for xrpl4j, PyPI for xrpl-py). If no corresponding SDK release appears in the data, treat the feature as merged-but-pending-release and phrase availability accordingly.
lsfMPTCanTransfer, LPToken transfers between holders are now blocked, mirroring existing freeze behavior.ProposalCreate transaction.lsfDepositAuth can now succeed when the sender presents valid sfCredentialIDs.1e2000000000 could previously tie up a node for 1–2 seconds. In progress for four consecutive weeks; now merged.ValidMPTBalanceChanges and ValidMPTTransfer were previously advisory-only (log-only); this makes them active protections that also enforce on failed transactions.tecPRECISION_LOSS instead of tripping a VaultInvariant check when rounding causes zero actual transfer. Gated behind fixCleanup3_4_0.tfLoanDefault now bypasses freeze invariants so brokers can default late loans regardless of freeze state.tfMPTUnauthorize on individually-locked MPTokens. Also allows cleanup of dangling locked MPTokens after issuance destruction.AccountRoot balance instead of reserve-clamped xrpLiquid for XRP fund conservation.fixCleanup3_4_0.malformedRequest token with distinct error codes for invalid hex, invalid owner, invalid seq, and mismatched fields. Closes rippled#6738.AccountRoot flags cannot be silently omitted from account_info output.TxSettings designated-initializer; transactions now only state values that differ from defaults.isFrozen() overloads to avoid redundant state reads on mixed MPT/IOU payment paths.src/test/app/vault/.rpm-sign availability (rippled#8045), and published to a signed hosted RPM repo with debian any distribution (rippled#8053). Packages are now published from GitHub directly (rippled#8031, +343/−97).Clio 2.8.0 released (release notes) — built with libxrpl 3.3.0, supporting amendments introduced since 2.7.1. Last-minute fixes merged to the release branch: better issuer validator (clio#3184), credentialTypeValidator fix (clio#3185), and a revert of the mptoken_issuance_history RPC (clio#3183) which hadn't been tested in rc5 — it will return in a future release.
The mptoken_issuance_history RPC was briefly merged to develop (clio#3141, +2,876 lines) before being reverted from the release branch.
19 PRs merged this week covering accessibility, design, documentation, and disclosure:
SponsorshipSet/SponsorshipTransfer transaction types and sponsor signing utilities.Both Confidential MPT and Sponsored Fees are merged to main but not yet available to application developers — they will ship in upcoming npm releases.
rippled — Vault clawback/withdraw overrun prevention (rippled#8075, +353/−57, draft) — Truncates shares in the asset-denominated branch of both VaultClawback and VaultWithdraw so the delivered amount never exceeds the request. Approved by reviewer.
rippled — Clamp Vault operations to assetsTotal grid (rippled#8057, +1,453/−56) — Forces deposit/withdraw/clawback amounts onto sfAssetsTotal's own rounding grid before applying, preventing one-unit divergence. Approved by 3 reviewers but has conflicts.
rippled — Absorb Vault invariant rounding noise (rippled#8055, +990/−22) — Widens ValidVault's strict-equality checks to a one-unit tolerance for IOU assets. Approved by 2 reviewers.
rippled — Disable open-ended vaults (rippled#8076, +317/−209) — Rejects new open-ended VaultCreate when featureLendingProtocolV1_1 is enabled. Approved but has conflicts.
rippled — Add batch transactions to TxQ (rippled#8052, +2,146/−683) — Allows Batch (XLS-56) transactions to be queued with some limitations (inner transactions cannot be replaced).
rippled — Tighten vault withdrawal destination checks (rippled#7977, +418/−20) — Requires both submitter and destination to be permissioned domain members for private vault withdrawals. Approved by 3 reviewers, labeled "Ready to merge," awaiting re-approval after conflict resolution.
rippled — MPT/DEX audit fixes (Phase 1) (rippled#7334, +1,746/−173, 23 files) — Fixes multiple audit/attackathon findings: inflated MPT liquidity in book_offers, missing type tags in book hashing, flawed pathfinding constraints, and arithmetic overflow handling. Approved by 2 reviewers.
rippled — Pause online delete during ledger gaps (rippled#5531, +734/−87) — Long-running PR with a circuit-breaker mechanism. Approved by 3 reviewers, labeled "Ready to merge."
rippled — SLE wrapper classes (rippled#7886, +3,757 lines, 65 files) — Adds typed wrapper classes for all ledger entry types, intended to replace raw SLE usage. Approved by 2 reviewers.
rippled — Vault invariants (rippled#7732, +5,580/−44) — Has outstanding change requests.
rippled — Prevent early loan impairment and due-date manipulation (rippled#6557, +544/−34) — Approved by 2 reviewers.
xrpl4j — Confidential MPT (XLS-96) (xrpl4j#810, +14,868/−34, 162 files) — In active review with 122 comments.
xrpl4j — Make ValidatedLedger#age() optional (xrpl4j#825, +127/−3) — Fixes deserialization failure when rippled omits age during sync. Approved.
Clio — Re-add mptoken_issuance_history RPC (clio#3188) — Restoring the feature reverted from the 2.8.0 release.
Clio — Fix fiber suspension segfault (clio#3187) — Fixes a regression from retry logic introduced in #3167.
fixCleanup3_4_0.Community contributor @Krypto-Whitehat opened a discussion questioning whether rippled#7691 should be treated as a DelegateSet-specific bug or as a broader systemic question about unconsented destination ownerDir entries and AccountDelete. The discussion outlines constraints any future design would need to satisfy.
Community contributor @Krypto-Whitehat also has an open PR XRPL-Standards#601 aligning XLS-0085 (Token Escrow) spec language with rippled's implementation — the spec says tecFROZEN for locked MPTs but rippled returns tecLOCKED.
XRPL-Standards discussion #605 — A new amendment proposal, "DriftVault," proposing a slippage rebate mechanism for XRP settlement, was posted for community feedback.
Community member @ChrisCarini has an open PR in xrpl-py (xrpl-py#1018) removing the httpx upper bound and moving types-Deprecated to dev dependencies — this is blocking progress on a Home Assistant integration.
Contributor @ckeshava filed two rippled issues identifying test harness inaccuracies: incorrect Vault object ID creation in invariant tests (rippled#8056) and inconsistent invariant enforcement across unsuccessful transactions (rippled#8054).
Compared to last week (August 10–16, 2026):
| Metric | This Week | Last Week | Change |
| Repos with activity | 8 | 8 | flat |
| rippled PRs merged | 36 | 37 | ↓1 |
| rippled PRs opened | 18 | 27 | ↓9 |
| rippled new issues | 4 | 7 | ↓3 |
| rippled closed issues | 2 | 4 | ↓2 |
| rippled releases | 0 | 0 | flat |
| rippled commits | 35 | 35 | flat |
| xrpl.js PRs merged | 3 | 3 | flat |
| xrpl.js PRs opened | 30 | 7 | ↑23 |
| xrpl.js new issues | 2 | 9 | ↓7 |
| xrpl.js releases | 0 | 3 | ↓3 |
| xrpl-py PRs merged | 3 | 2 | ↑1 |
| xrpl-py PRs opened | 3 | 5 | ↓2 |
| xrpl-py new issues | 1 | 6 | ↓5 |
| xrpl-py releases | 1 | 0 | ↑1 |
| xrpl4j PRs merged | 0 | 4 | ↓4 |
| xrpl4j PRs opened | 3 | 1 | ↑2 |
| xrpl4j new issues | 3 | 0 | ↑3 |
| xrpl-dev-portal PRs merged | 19 | 1 | ↑18 |
| xrpl-dev-portal PRs opened | 14 | 16 | ↓2 |
| xrpl-dev-portal commits | 26 | 1 | ↑25 |
| Clio PRs merged | 5 | 3 | ↑2 |
| Clio PRs opened | 10 | 8 | ↑2 |
| Clio releases | 2 | 2 | flat |
| XRPL-Standards PRs merged | 1 | 2 | ↓1 |
| XRPL-Standards PRs opened | 6 | 6 | flat |
| opensource.ripple.com PRs merged | 1 | 1 | flat |
| Total PRs merged (all repos) | 68 | 53 | ↑15 |
| Total releases | 3 | 5 | ↓2 |
The headline shift this week is the developer portal surge — from 1 merge last week to 19 this week — as the accessibility/design refresh and documentation improvements landed together. rippled maintained its high merge velocity (36 vs 37), continuing the vault and MPT stabilization push under fixCleanup3_4_0. The extreme-exponent performance fix (rippled#7825), in progress for four consecutive weeks, finally merged. xrpl.js saw a spike in opened PRs (30, mostly Dependabot) while xrpl4j had no merges but gained 3 new issues. Clio 2.8.0 shipped as a production release, graduating from the rc5 candidate tracked last week. xrpl-py v5.1.0 was released to PyPI with Batch V1_1 signing and Dynamic MPT support.