chore(deps): bump soroban-sdk from 26.1.0 to 29.0.1 in /contracts by dependabot[bot] · Pull Request #1066 · FlowwStar/FlowStar

dependabot · 2026-10-22T05:14:01Z

Bumps soroban-sdk from 26.1.0 to 29.0.1.

Release notes

29.0.1

What's Changed

Update soroban-env to 29.0.1 stellar/rs-soroban-sdk#2129

Contains a fix to the wasmi runtime that was included, v29.0.0 erroneously contained the wasmi runtime from v28.

Full Changelog: stellar/rs-soroban-sdk@v29.0.0...v29.0.1

29.0.0

What Changed

Update soroban-env crates to 29.0.0 stellar/rs-soroban-sdk@cca906d

Full Changelog: stellar/rs-soroban-sdk@v28.0.0...v29.0.0

28.0.0

This is a release supporting Protocol 28. Upgrading requires changes to some contracts. See the migration guide for the full detail on each breaking change below.

Breaking changes

Build contracts with stellar-cli v25.2.0 or newer. Spec shaking v2 is now always on, so the SDK emits a spec entry for every type and relies on the build system to strip the unreachable ones. Remove the experimental_spec_shaking_v2 feature from the soroban-sdk dependency, and remove any export = ... argument from contracttype, contracterror, and contractevent, which is now a compile error. Native builds and unit tests are unaffected. #1968

Remove any lib = ... argument from contracttype, contracterror, and contractevent. It is now a compile error, and contractimport! always generates the full type definition instead of aliasing into another crate. #1951 #2000

A contracttype struct can be read from stored data with extra or missing fields (CAP-86). A field missing from the map reads as None if it is an Option, and errors otherwise, and a map key that is not a field of the struct is ignored and dropped, where both used to panic. An Option field can now be added or removed without migrating everything already stored. Writing is unchanged and still writes every field. #2006

Events no longer publish fields that are unset (CAP-86). In a contractevent with data_format = "map", a field whose value is void, or Option::None, is left out of the published map rather than written as a key with a void value. Any off-chain system consuming the events must tolerate the absent key. Keep publishing every field with #[contractevent(sparse = false)]. #2008

Deploying and upgrading take a ContractExecutable (CAP-85). deploy_contract replaces deploy_v2, and update_current_contract replaces update_current_contract_wasm; the old ones still work but are deprecated. Wrap the Wasm hash in ContractExecutable::Wasm(...) to migrate. #2020

Test snapshots change for tests that register contracts natively. Every natively registered contract now gets its own contract code entry rather than sharing one empty entry, so snapshot JSON files are regenerated on upgrade. For a test that depended on contracts sharing a code entry, upload the contract once with Env::upload and deploy it repeatedly instead. #2014

The Approve event field expiration_ledger is renamed live_until_ledger, matching the name SEP-41 uses. Rename it wherever the event is constructed or matched on. #1985

#[contractimpl(contracttrait)] on an impl block that does not implement a trait is now a compile error. It was accepted and silently did nothing. #1992

Some test utilities now panic when called inside a contract function. Call them from the test, outside the contract. #2010

New features

Protocol 28 support, with soroban-env-* at 28.0.2 and stellar-xdr at 28.0.0. #1986

Manage contract executable references from a contract (CAP-85) with Env::executable_refs(), and deploy from one by passing ContractExecutable::ExternalRef. #2020

Upload a natively defined contract in tests with Env::upload and Env::upload_at, making it possible to test a factory, or any other contract that deploys from an existing code entry, without needing to build the contract to Wasm. #2007

Fuzz and property test with account addresses using the new ArbitraryAddressAccount prototype, which generates G... addresses so the account path of a contract gets exercised. ArbitraryAddress still generates contract addresses and is also named ArbitraryAddressContract. #2024

Use SorobanArbitrary prototypes with proptest, now documented in testutils::proptest. #2011

Fixes

MuxedAddress values from different Envs can be compared in tests. #2047

BytesN<N> rejects an N larger than u32::MAX when converting from Bytes. #2050

Generated and internal spec XDR statics are now private and hidden from docs. #2054 #2032

Full Changelog: stellar/rs-soroban-sdk@v27.0.6...v28.0.0

28.0.0-rc.2

This is a pre-release supporting Protocol 28, and follows v28.0.0-rc.1. Upgrading requires changes to some contracts. See the migration guide for the full detail on each breaking change, including those released in rc.1.

Note that any changes including breaking changes may be made until the stable release.

... (truncated)

Commits

e1671a0 fix afl fuzz lock
f3ef25f update env to 29.0.1
7a3cf65 Update fuzz Cargo.lock for 29.0.1
b492cef Bump version to 29.0.1
73ea6c0 add extend_ttl overflow tests and docs
cca906d update soroban-env crates to 29.0.0
253c534 Update fuzz Cargo.lock for 29.0.0
621a172 Bump version to 29.0.0
48d5067 Bump version to 28.0.0 (#2067)
3bb283c Fix contractimport! doc example and generated-client name in docs (#2056)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [soroban-sdk](https://github.com/stellar/rs-soroban-sdk) from 26.1.0 to 29.0.1. - [Release notes](https://github.com/stellar/rs-soroban-sdk/releases) - [Commits](stellar/rs-soroban-sdk@v26.1.0...v29.0.1) --- updated-dependencies: - dependency-name: soroban-sdk dependency-version: 29.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-22T05:14:04Z

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-10-22T05:14:45Z

🛡️ Frontend Security Scan

npm audit

# npm audit report

fflate  0.7.0 - 0.7.4
Severity: moderate
fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives - https://github.com/advisories/GHSA-px8p-9vwx-vf98
fix available via `npm audit fix --force`
Will install @vercel/og@1.0.1, which is a breaking change
node_modules/fflate
  satori  >=0.33.0
  Depends on vulnerable versions of fflate
  node_modules/satori
    @vercel/og  >=1.0.2
    Depends on vulnerable versions of satori
    node_modules/@vercel/og

3 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force
# npm audit report

@vitest/mocker  <=4.1.11
Severity: moderate
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock - https://github.com/advisories/GHSA-82fw-gwwq-j7x9
Vitest: Code injection via unauthenticated manual mock registration - https://github.com/advisories/GHSA-qxg6-89mg-rqv8
Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix - https://github.com/advisories/GHSA-xp26-3454-mjgp
fix available via `npm audit fix`
node_modules/@vitest/mocker
node_modules/vitest/node_modules/@vitest/mocker
  storybook  9.0.0 - 10.1.0-beta.6
  Depends on vulnerable versions of @vitest/mocker
  node_modules/storybook
  vitest  2.1.0-beta.1 - 4.1.11
  Depends on vulnerable versions of @vitest/coverage-v8
  Depends on vulnerable versions of @vitest/mocker
  node_modules/vitest
    @vitest/coverage-v8  2.1.0-beta.1 - 4.1.11
    Depends on vulnerable versions of vitest
    node_modules/@vitest/coverage-v8

braces  *
Severity: high
braces vulnerable to stack-exhaustion denial of service through deeply nested patterns - https://github.com/advisories/GHSA-vfj7-8cjw-p6xm
No fix available
node_modules/braces
  chokidar  2.0.0 - 3.6.0
  Depends on vulnerable versions of braces
  node_modules/chokidar
    fork-ts-checker-webpack-plugin  0.4.7 - 4.0.0-beta.5 || 6.0.0-alpha.1 - 9.0.3
    Depends on vulnerable versions of chokidar
    node_modules/fork-ts-checker-webpack-plugin
      @storybook/builder-webpack5  <=11.0.0-alpha.4
      Depends on vulnerable versions of fork-ts-checker-webpack-plugin
      Depends on vulnerable versions of webpack-dev-middleware
      node_modules/@storybook/builder-webpack5
        @storybook/nextjs  *
        Depends on vulnerable versions of @storybook/builder-webpack5
        Depends on vulnerable versions of @storybook/preset-react-webpack
        Depends on vulnerable versions of node-polyfill-webpack-plugin
        node_modules/@storybook/nextjs
  micromatch  >=0.2.0
  Depends on vulnerable versions of braces
  node_modules/micromatch
    @storybook/react-docgen-typescript-plugin  *
    Depends on vulnerable versions of micromatch
    node_modules/@storybook/react-docgen-typescript-plugin
      @storybook/preset-react-webpack  *
      Depends on vulnerable versions of @storybook/react-docgen-typescript-plugin
      node_modules/@storybook/preset-react-webpack
    fast-glob  *
    Depends on vulnerable versions of micromatch
    node_modules/@shadcn/registry/node_modules/fast-glob
    node_modules/@ts-morph/common/node_modules/fast-glob
    node_modules/fast-glob
    node_modules/shadcn/node_modules/fast-glob
      @next/eslint-plugin-next  >=14.3.0-canary.0
      Depends on vulnerable versions of fast-glob
      node_modules/@next/eslint-plugin-next
      @shadcn/registry  <=0.0.0-rc-20261007105214 || >=0.1.0
      Depends on vulnerable versions of fast-glob
      Depends on vulnerable versions of ts-morph
      node_modules/@shadcn/registry
        shadcn  <=0.0.0-rc-20261007105214 || >=2.0.0
        Depends on vulnerable versions of @shadcn/registry
        Depends on vulnerable versions of fast-glob
        Depends on vulnerable versions of ts-morph
        node_modules/shadcn
      @ts-morph/common  0.2.0 - 0.24.0 || 0.26.0 - 0.27.0
      Depends on vulnerable versions of fast-glob
      node_modules/@ts-morph/common
        ts-morph  6.0.1 - 23.0.0 || 25.0.0 - 26.0.0
        Depends on vulnerable versions of @ts-morph/common
        node_modules/ts-morph

elliptic  *
Elliptic Uses a Cryptographic Primitive with a Risky Implementation - https://github.com/advisories/GHSA-848j-6mx2-7j84
No fix available
node_modules/elliptic
  browserify-sign  >=2.4.0
  Depends on vulnerable versions of elliptic
  node_modules/browserify-sign
    crypto-browserify  >=3.4.0
    Depends on vulnerable versions of browserify-sign
    Depends on vulnerable versions of create-ecdh
    node_modules/crypto-browserify
      node-polyfill-webpack-plugin  <=4.0.0
      Depends on vulnerable versions of crypto-browserify
      node_modules/node-polyfill-webpack-plugin
  create-ecdh  *
  Depends on vulnerable versions of elliptic
  node_modules/create-ecdh

fflate  0.7.0 - 0.7.4
Severity: moderate
fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives - https://github.com/advisories/GHSA-px8p-9vwx-vf98
fix available via `npm audit fix --force`
Will install @vercel/og@1.0.1, which is a breaking change
node_modules/fflate
  satori  >=0.33.0
  Depends on vulnerable versions of fflate
  node_modules/satori
    @vercel/og  >=1.0.2
    Depends on vulnerable versions of satori
    node_modules/@vercel/og


vite  7.0.0 - 7.3.6
Severity: high
launch-editor: escapeCmdArgs() omits % escaping on Windows - https://github.com/advisories/GHSA-698v-4r3x-3vcv
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors - https://github.com/advisories/GHSA-r825-w8mm-5pxw
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows - https://github.com/advisories/GHSA-587h-7wmj-h5pm
Vite: Cross origin script execution through Vite custom middleware - https://github.com/advisories/GHSA-9jrq-w75r-8gcw
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine - https://github.com/advisories/GHSA-rq7h-c2jc-7f22
fix available via `npm audit fix`
node_modules/vite

webpack-dev-middleware  <7.4.5
Severity: high
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath - https://github.com/advisories/GHSA-g84c-rxfj-3j2c
No fix available
node_modules/webpack-dev-middleware

28 vulnerabilities (5 low, 6 moderate, 16 high, 1 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

ESLint

(no output)

Hardcoded secrets check

(no output)

github-actions · 2026-10-22T05:15:06Z

🔐 Contract Security Scan

cargo audit

(no output)

Soroban pattern check

(no output)

dependabot Bot mentioned this pull request Oct 22, 2026

chore(deps): bump soroban-sdk from 26.1.0 to 28.0.0 in /contracts #851

Closed

dependabot Bot had a problem deploying to staging October 22, 2026 05:14 Failure

Navigation Menu

Repository navigation

chore(deps): bump soroban-sdk from 26.1.0 to 29.0.1 in /contracts - #1066

chore(deps): bump soroban-sdk from 26.1.0 to 29.0.1 in /contracts#1066
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/contracts/soroban-sdk-29.0.1

dependabot Bot commented on behalf of github Oct 22, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

This branch had an error being deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 22, 2026

29.0.1

What's Changed

29.0.0

What Changed

28.0.0

Breaking changes

New features

Fixes

28.0.0-rc.2

Uh oh!

dependabot Bot commented on behalf of github Oct 22, 2026

Labels

Uh oh!

github-actions Bot commented Oct 22, 2026

🛡️ Frontend Security Scan

Uh oh!

github-actions Bot commented Oct 22, 2026

🔐 Contract Security Scan

Uh oh!

This branch had an error being deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants