rippled 3.4.0 shipped with two new amendments (LendingProtocolV1_1 and fixCleanup3_4_0) and a retired one (fixAMMOverflowOffer) — validators should upgrade. All three SDK libraries released with Lending Protocol V1_1 support: xrpl.js 5.3.0 (npm), xrpl-py v5.2.0 (PyPI), and xrpl4j v7.0.0-rc.2 (Maven Central). The developer portal merged 25 PRs — a massive documentation push covering the entire 3.4.0 release. Clio merged 9 PRs completing most of its rpc-spec handler migration, and XRPL-Standards merged the new Onchain Cosigner spec (XLS-103) and the Closed-ended Vault spec.
This was a release week for the XRP Ledger. The core server software, rippled, published version 3.4.0 — the first production release in a while. It introduces two new protocol features that validators will vote on: "LendingProtocolV1_1," which adds closed-ended vaults (vaults with fixed start and end dates, like a term deposit) and changes how interest is tracked on vault books, and "fixCleanup3_4_0," which bundles assorted correctness fixes. One older fix, "fixAMMOverflowOffer," is retired, meaning it's now a permanent part of the protocol. If you run an XRP Ledger server, you should upgrade. The software packages are now hosted at a new location (packages.xrplf.org) with the XRPL Foundation's signing key, and the developer portal's installation instructions have been updated accordingly.
All three official SDK libraries shipped matching releases this week so application developers can immediately start building with the new features. JavaScript developers can install xrpl.js 5.3.0 from npm, Python developers can get xrpl-py v5.2.0 from PyPI, and Java developers can use xrpl4j v7.0.0-rc.2 from Maven Central. The Java SDK release also includes a complete rewrite of how transaction fees are calculated, now mirroring the server's own fee engine for all 81 transaction types, plus a fix for a key derivation bug that could produce incorrect signing keys in rare cases. The developer portal at xrpl.org merged 25 documentation changes this week — essentially rewriting the docs for every feature area touched by 3.4.0, from AMM trading to lending to signing. The Clio API server (used by many applications to query the ledger) nearly finished migrating its RPC handling to a shared specification system, removing thousands of lines of hand-maintained code in the process. It also gained the ability to filter token holder queries by specific accounts. On the specification side, a new proposal called "Onchain Cosigner" was accepted as XLS-103 — it defines a way for multiple parties to propose, vote on, and execute transactions on-chain, similar to a governance or multi-sig workflow but with richer approval logic.
For the latest updates, follow @XRPLF and @RippleXDev on X. The rippled 3.4.0 release is available here, and the release announcement blog post is at xrpl.org/blog/2026/xrpld-3.4.0.
Note: All rippled changes below were merged to the develop branch and are not yet live on the network. A tagged release is required for any change to reach production.
Note: SDK PRs below were merged to each library's main branch. They become available to application developers only after a tagged release is published (npm for xrpl.js, Maven Central for xrpl4j, PyPI for xrpl-py). If no corresponding SDK release appears in the data, treat the feature as merged-but-pending-release and phrase availability accordingly.
featureConfidentialMPTKeyRotation. Ensures that after a key rotation, transactions correctly validate against the appropriate epoch for each participant.sponsorshipKeylet, loanBrokerKeylet, loanKeylet) enabling smart escrows to compute the keylets of Sponsorship (XLS-68), LoanBroker, and Loan ledger objects. These were the last missing keylet host functions.[peers_in_max]/[peers_out_max] instead of the legacy [peers_max], maxPeers was left at zero. Now correctly computed as the sum of inbound and outbound allowances. Operators using per-direction peer limits should note this fix.noripple_check API cleanup: rippled#6303 (+67/−50, 4 files) — Error responses from the noripple_check RPC no longer include an empty transactions array. Labeled API Change. Closes #4616.HandlerTable singleton with sorted constexpr arrays validated by static_assert. A new MethodNames.h provides a single shared constant per RPC method name, preventing the handler table and CLI parser table from drifting apart.LendingProtocolV1_1 vault interest model from "accrual" to instant_recognition, clarifying that interest is credited at origination rather than accrued over time.Cluster::isMember membership query: rippled#8221 (+47/−2, 5 files) — Adds a bool-returning membership check that avoids copying the node's comment string under the mutex, used by the two call sites that only need a boolean.MPTTester, reducing test boilerplate by ~240 lines net. Closes #7630.packages-upload.xrplf.org: rippled#8241 (+8/−5, 3 files) — Separates the upload hostname (DNS-only, bypasses Cloudflare's 100 MB body limit for large debug packages) from the read hostname (edge-cached for fast downloads).... (dry run) when not actually publishing, and passes publish: false explicitly.Clio completed the bulk of its migration from hand-written RPC validation to the shared rpc-spec system this week, merging 8 migration batches plus a new feature:
account_info, account_currencies, ledger_entry, subscribe/unsubscribe, and more) to typed rpc-spec inputs, removed the old specs system entirely (−3486 lines in batch G alone), and restored wire compatibility with rippled 2.8.0 to avoid format changes in the first rpc-spec release.accounts filter for mpt_holders: clio#3180 (+716/−88, 8 files) — Adds the ability to filter mpt_holders results by specific account addresses.The developer portal had its largest week of the period with 25 PRs merged, driven almost entirely by the 3.4.0 release:
packages.xrplf.org: xrpl-dev-portal#3951 (+160/−113, 7 files) — Ubuntu/Debian and RHEL install pages now reference the XRPLF key and packages.xrplf.org repos, since the previous repository stops at 3.3.0-1.npm dedupe and removed the htmltojsx devDependency to fix a production-only breakage in the WebSocket API tool caused by a CodeMirror version mismatch.ProposalCreate, ProposalVote, and ProposalDelete transactions, a Proposal ledger object, and a CosignerList for configuring approval thresholds.VaultKind, SubscriptionDate, and RedemptionDate fields, as part of the LendingProtocolV1_1 amendment. Community member @frytegg confirmed the spec matches wire behavior tested on Devnet.VaultInvariant.cpp, plus amendment patches XLS-65.1 and XLS-65.2.VaultKind, SubscriptionDate, RedemptionDate), VaultDelete MemoData, and CredentialIDs on VaultWithdraw/LoanBrokerCoverWithdraw. Released in xrpl.js 5.3.0 — developers can install it now via npm.fixCleanup3_4_0 signing prefixes: xrpl-py#1036 (+433/−314, 12 files) — Adds CPT/CPM (counterparty) and SPN/SPM (sponsor) hash prefixes with corresponding encode/multisign functions. Released in xrpl-py v5.2.0.XrplClient and JsonRpcClient now accept any Feign Client (e.g., feign-okhttp with connection pooling). Old constructors deprecated but preserved. Released in xrpl4j v7.0.0-rc.2.calculateBaseFee for all 81 transaction types, reached through computeFee(FeeParams). Closes #829. Released in xrpl4j v7.0.0-rc.2.FeeParams factory methods.deriveScalar fix: xrpl4j#801 (+70/−1, 4 files) — Fixed a bug where HashingUtils.addUInt32() accumulated bytes across iterations instead of starting from the original seed each time. Released in xrpl4j v7.0.0-rc.2.rippled — Batch order book registration and inner wrapper fix (rippled#8248, +228/−7, 8 files) — Two fixes for Batch (XLS-56): prevents an aborted inner OfferCreate from registering books with the process-wide OrderBookDB, and tightens validation of the sfRawTransaction wrapper field. Approved by the AI reviewer.
rippled — Lending transactions in Batch (rippled#8244, +56/−20, 3 files) — Allows Single Asset Vault and Lending Protocol transactions as Batch inner transactions when featureLendingProtocolV1_2 is enabled. Approved by the AI reviewer.
rippled — Online-delete cache lock bounded (rippled#8240, +264/−11, 7 files) — Adds TaggedCache::forEachKeyPartition to copy keys one partition at a time during the online-delete freshen, releasing the mutex between partitions. Approved after an initial round of changes requested.
rippled — TSan CI job and lock-order detection (rippled#8245, +281/−61, 10 files) — Removes TSan suppressions that were hiding real deadlock reports, adds a TSan CI job, and introduces XRPL_ASAN/XRPL_TSAN/XRPL_UBSAN defines. Approved.
rippled — Retire fixAMMv1_1 amendment (rippled#8226, +656/−1597, 11 files) — Moves fixAMMv1_1 to the retired list and deletes all conditional code, keeping only the enabled behavior. Approved.
rippled — Validator-keys tool integration (rippled#8223, +4959/−271, 35 files) — Moves validator-keys into the rippled tree with external signing and validator-list signing support. Has outstanding review comments about a symlink TOCTOU vulnerability and file permission race.
xrpl4j — ServerSecret memory safety fix (xrpl4j#839, +150/−14, 5 files) — ServerSecret.of() now defensively copies the input array so destroy() won't zero caller-owned bytes. Approved by 3 reviewers.
xrpl4j — Counterparty/Sponsor signing prefixes (xrpl4j#834, +590/−180, 13 files) — Implements fixCleanup3_4_0 role-specific signing for Java. Approved by 4 reviewers.
xrpl4j — Single Asset Vault model changes (xrpl4j#832, +1632/−25, 30 files) — Adds LendingProtocolV1_1 vault models (VaultKind, SubscriptionDate, RedemptionDate, deposit-blocking flags). Approved.
Clio — Upgrade to libxrpl 3.4.0 (clio#3217, +306/−14, 10 files) — Brings Clio to libxrpl 3.4.0 and rpc-spec 0.1.15 with all amendments supported.
XRPL-Standards — Rewrite closed-ended vault as nested patches (XRPL-Standards#636, +451/−620, 8 files) — Restructures the spec into nested patch format (XLS-65.1.4, XLS-66.1.2). Approved.
xrpl-dev-portal — Go code samples migration to xrpl-go v0.3.1 (xrpl-dev-portal#3955, +6429/−6839, 96 files) — Upgrades all Go tutorial samples to xrpl-go v0.3.1 and Go 1.25.13.
xrpl-dev-portal — Deep Freeze docs consolidation (xrpl-dev-portal#3953, +89/−207, 17 files) — Merges the separate Deep Freeze page into the existing freezes page, removing extraneous implementation details.
fixCleanup3_4_0 and LendingProtocolV1_1 support.Missing async deadlines reported: Contributor @sublimator filed rippled#8235 documenting three categories of missing deadline/timeout handling on the develop branch: HTTPClient requests without timeouts after successful setup, ConnectAttempt timer cancellation before reading the upgrade response (allowing silent TLS peers to hold attempts indefinitely), and util::spawn context/executor argument failures.
Clio parity gaps identified: Two bugs filed against Clio this week: account_objects with deletion_blockers_only: true omits Vault and LoanBroker objects that genuinely block AccountDelete (clio#3216), and ledger_entry rejects the account and state locators that rippled accepts (clio#3215). Both were filed by core team member @godexsoft during the libxrpl 3.4.0 upgrade.
XLS formalization proposals: Collaborator @sappenin opened issues proposing formal XLS specs for Transaction Common Fields and Ledger Entry Common Fields, and flagged that XLS-33 (MPTs) needs updating to match the actual implementation.
Community contributions: A community member opened xrpl.js#3480 adding getTransactionResultCode and isTesSuccess utility functions to xrpl.js. Another community member submitted xrpl.js#3482 to align integration test documentation with the current xrpld Docker configuration. In xrpl-py, a community member opened xrpl-py#1035 to reject odd-length MPT metadata hex strings that would previously cause a ValueError. In xrpl4j, a community member opened xrpl4j#833 improving test coverage for TrustLine flags.
Closed-ended vault spec confirmed on Devnet: Community member @frytegg commented that they built the closed-ended vault + lending chain on XRPL Devnet (rippled 3.4.0-rc4/rc5, LendingProtocolV1_1 enabled) and confirmed the spec's phase model matches the wire behavior.
Compared to last week (September 7–13, 2026):
| Metric | This Week | Last Week | Change |
| Repos with activity | 8 | 8 | flat |
| rippled PRs merged | 13 | 13 | flat |
| rippled PRs opened | 18 | 24 | ↓6 |
| rippled new issues | 1 | 1 | flat |
| rippled closed issues | 4 | 0 | ↑4 |
| rippled releases | 1 | 0 | ↑1 |
| rippled commits | 25 | 6 | ↑19 |
| xrpl.js PRs merged | 1 | 4 | ↓3 |
| xrpl.js PRs opened | 5 | 4 | ↑1 |
| xrpl.js new issues | 2 | 9 | ↓7 |
| xrpl.js closed issues | 24 | 0 | ↑24 |
| xrpl.js releases | 1 | 7 | ↓6 |
| xrpl.js commits | 1 | 3 | ↓2 |
| xrpl-py PRs merged | 2 | 1 | ↑1 |
| xrpl-py PRs opened | 4 | 3 | ↑1 |
| xrpl-py new issues | 1 | 1 | flat |
| xrpl-py releases | 1 | 1 | flat |
| xrpl-py commits | 2 | 2 | flat |
| xrpl-dev-portal PRs merged | 25 | 8 | ↑17 |
| xrpl-dev-portal PRs opened | 11 | 7 | ↑4 |
| xrpl-dev-portal new issues | 1 | 1 | flat |
| xrpl-dev-portal closed issues | 3 | 1 | ↑2 |
| xrpl-dev-portal commits | 106 | 19 | ↑87 |
| Clio PRs merged | 9 | 8 | ↑1 |
| Clio PRs opened | 2 | 3 | ↓1 |
| Clio new issues | 2 | 1 | ↑1 |
| Clio releases | 1 | 2 | ↓1 |
| Clio commits | 9 | 8 | ↑1 |
| XRPL-Standards PRs merged | 4 | 10 | ↓6 |
| XRPL-Standards PRs opened | 10 | 27 | ↓17 |
| XRPL-Standards new issues | 3 | 0 | ↑3 |
| XRPL-Standards commits | 4 | 10 | ↓6 |
| xrpl4j PRs merged | 4 | 1 | ↑3 |
| xrpl4j PRs opened | 13 | 3 | ↑10 |
| xrpl4j closed issues | 1 | 1 | flat |
| xrpl4j releases | 1 | 0 | ↑1 |
| xrpl4j commits | 3 | 1 | ↑2 |
| opensource.ripple.com PRs merged | 0 | 2 | ↓2 |
| opensource.ripple.com PRs opened | 1 | 0 | ↑1 |
| Total PRs merged (all repos) | 58 | 47 | ↑11 |
| Total releases | 6 | 10 | ↓4 |
Carryovers from last week: The xrpl.js LendingProtocolV1_1 PR (xrpl.js#3456), xrpl-py LendingProtocolV1_1 (xrpl-py#1034), xrpl-py signing prefixes (xrpl-py#1036), the Onchain Cosigner spec (XRPL-Standards#613), and the Clio handler migration batch A (clio#3206) — all noted as "In Progress" last week — merged this week. Trends: The developer portal surged from 8 to 25 merged PRs and 19 to 106 commits, driven by the 3.4.0 documentation push. rippled shipped its first release in weeks (3.4.0). xrpl4j activity jumped significantly (1→4 merged PRs, 1→13 opened) as the Java SDK caught up with protocol changes. The xrpl.js security vulnerability issue housekeeping resulted in 24 closed issues.