Skip to content

Update dependencies.#1644

Closed
fnando wants to merge 23 commits intostellar:release/v25-previewfrom
fnando:stellar-xdr-v25
Closed

Update dependencies.#1644
fnando wants to merge 23 commits intostellar:release/v25-previewfrom
fnando:stellar-xdr-v25

Conversation

@fnando
Copy link
Copy Markdown
Member

@fnando fnando commented Dec 15, 2025

What

Update dependencies to p25.

Why

N/A

Known limitations

N/A

leighmcculloch and others added 11 commits November 14, 2025 17:27
### What
Extract hardcoded LedgerInfo initialization in Env::default() into a new
testutils::default_ledger_info() function.

  ### Why
I'm writing more code that needs to set a default ledger info and it's
helpful if this is outside of the Env code and I can call it in the new
places too.

For stellar#1448
### What
Store test name and environment number directly in EnvTestState instead
of tracking them at the point where test snapshots are written.

  ### Why
Snapshot file numbering is confusing and difficult to follow when
multiple Env instances existed per test. It's because the order of the
env numbers is based on the order of the drops, not the order of the
envs being defined. This is difficult to reason about, and doesn't work
with new features I want to add where we'll write and read from other
types of files for each Env in a test.

This is technically a breaking change, but multiple env's in tests is
super rare and is supported as an edge case to ensure things still keep
working. I think it's okay to "fix this" with a break given the rareness
of its use. Anyone using it who does see a break will see there test
files flip. 1 -> 2, 2 -> 1.

This change is a bit of a clean up, but it is also required for the work
on improving fork testing (stellar#1448). The improved fork testing will start
sourcing network data from a variety of sources but will need to cache
that data for subsequent test runs to ensure tests stay fast and
deterministic. The logic used to assign test names and numbers to envs
will be used to separate the caches for envs in tests. Even if we don't
end up using this in the fork testing flows I think this change stands
alone and is worth it for the other reasons above.

For stellar#1448
### What
Bump version to 23.1.1, creating release branch.

### Why
Triggered by @leighmcculloch in
https://github.com/stellar/rs-soroban-sdk/actions/runs/19484439564.

### What is next

See the release instructions for a full rundown on the release process:
https://github.com/stellar/actions/blob/main/README-rust-release.md

Commit any changes to the `release/v23.1.1` branch that are needed in
this release.

If this is a regular release releasing from `main`, merge this PR when
ready, and after merging, create a release for this version by going to
this link:
https://github.com/stellar/rs-soroban-sdk/releases/new?tag=v23.1.1&title=23.1.1

If this is a backport or patch release of a past version, see the
release instructions. When ready to release this branch create a release
by going to this link:

https://github.com/stellar/rs-soroban-sdk/releases/new?tag=v23.1.1&title=23.1.1&target=release/v23.1.1

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Leigh <351529+leighmcculloch@users.noreply.github.com>
### What
Bump version to 23.2.1, creating release branch.

### Why
Triggered by @leighmcculloch in
https://github.com/stellar/rs-soroban-sdk/actions/runs/19515525384.

### What is next

See the release instructions for a full rundown on the release process:
https://github.com/stellar/actions/blob/main/README-rust-release.md

Commit any changes to the `release/v23.2.1` branch that are needed in
this release.

If this is a regular release releasing from `main`, merge this PR when
ready, and after merging, create a release for this version by going to
this link:
https://github.com/stellar/rs-soroban-sdk/releases/new?tag=v23.2.1&title=23.2.1

If this is a backport or patch release of a past version, see the
release instructions. When ready to release this branch create a release
by going to this link:

https://github.com/stellar/rs-soroban-sdk/releases/new?tag=v23.2.1&title=23.2.1&target=release/v23.2.1

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Leigh <351529+leighmcculloch@users.noreply.github.com>
### What
  Deprecate the protocol_version method.

  ### Why
Protocol version will probably not be available in future releases of
the runtime. It is not used by any contract deployed to mainnet today.
### What
Skip test_alloc from expand-tests target in Makefile and remove its test
snapshot files. Configure test_alloc to disable snapshot capture at
environment drop by setting capture_snapshot_at_drop to false in
EnvTestConfig.

  ### Why
The alloc test isn't reproducible that results in diffs in the expands
and the snapshots, even on extremely similar systems. We know that test
reproducibility has some issues in Rust and that there are changes
proposed (rust-lang/cargo#15477) that may
improve this. So rather than devote effort to trying to make this test
vector reproducible removing it from the tests that require
reproducibility seems like a better cost tradeoff for right now.
### What
Add granular hazmat feature (`hazmat-crypto`) for cryptographic hazmat
functions. The umbrella `hazmat` feature remains and enables all hazmat
sub-features.

### Why
Developers needing hazmat crypto functions previously had to enable all
hazmat functionality, risking accidental use of other hazardous APIs.
Granular features let developers enable only what they need, reducing
exposure to unintended risks.

As we expand the types of hazardous functionality in the SDK we make it
easier to treat some functionality as hazardous even though it doesn't
fit the traditional super-hazardous threshold of crypto functions. For
example: stellar#1636

Close stellar#1637
### What
Add `to_payload` and `from_payload` methods on `Address` to extract and
construct raw 32-byte payloads (Ed25519 public keys or contract hashes).
Add a new `address_payload` module with the `AddressPayload` enum. Gate
behind a `hazmat-address` feature flag to discourage use outside careful
intentional situations that absolutely require them.

### Why
Cross-chain interoperability protocols need to pass raw address payloads
between systems. Previously this required manual XDR serialization which
was verbose and error-prone. Feature flags prevent accidental misuse by
developers who might incorrectly use extracted Ed25519 keys for
signature verification, as account master keys may not be active
signers.

### API

```rust
// With feature = "hazmat-address" or feature = "hazmat"
use soroban_sdk::address_payload::AddressPayload;

// Extract payload from address
let payload: Option<AddressPayload> = address.to_payload();

// Construct address from payload
let address = Address::from_payload(&env, payload);

// AddressPayload methods
let address = payload.to_address(&env);
let payload = AddressPayload::from_address(&address);
```

Close stellar#1636

### Merging

Intended to be merged to `main` after:
- stellar#1639
### What
Bump version to 23.3.0, creating release branch.

### Why
Triggered by @leighmcculloch in
https://github.com/stellar/rs-soroban-sdk/actions/runs/20219946680.

### What is next

See the release instructions for a full rundown on the release process:
https://github.com/stellar/actions/blob/main/README-rust-release.md

Commit any changes to the `release/v23.3.0` branch that are needed in
this release.

If this is a regular release releasing from `main`, merge this PR when
ready, and after merging, create a release for this version by going to
this link:
https://github.com/stellar/rs-soroban-sdk/releases/new?tag=v23.3.0&title=23.3.0

If this is a backport or patch release of a past version, see the
release instructions. When ready to release this branch create a release
by going to this link:

https://github.com/stellar/rs-soroban-sdk/releases/new?tag=v23.3.0&title=23.3.0&target=release/v23.3.0

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Leigh <351529+leighmcculloch@users.noreply.github.com>
### What
Remove `hazmat` feature from doc cfg attributes, keeping only the
specific `hazmat-address` and `hazmat-crypto` features in documentation.

#### Before
<img width="461" height="214" alt="Screenshot 2025-12-15 at 4 05 12 pm"
src="https://github.com/user-attachments/assets/3e00c4da-cf53-4b34-924f-b8f913bfc1c5"
/>

#### After
<img width="461" height="214" alt="Screenshot 2025-12-15 at 4 05 58 pm"
src="https://github.com/user-attachments/assets/8229806b-22ab-4e76-bd93-aa1f3a57654c"
/>

### Why
The generic `hazmat` feature is used for compilation gating, but really
only exists historically for backwards compatibility and as something
used for testing during development of the SDK. Generally folks should
use the narrower scoped hazmat features, so showing it in documentation
guides folks to do the not best practice, which results in enabling more
hazmat APIs than are necessary.
@fnando fnando requested a review from sisuresh December 15, 2025 23:18
@socket-security
Copy link
Copy Markdown

socket-security bot commented Dec 15, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedsoroban-env-host@​25.0.086100100100100
Addedsoroban-env-common@​25.0.091100100100100
Addedstellar-xdr@​25.0.093100100100100
Addedvisibility@​0.1.110010093100100
Addedsoroban-env-guest@​25.0.010010093100100

View full report

),
));
VecM::<_, MAX>::default()
VecM::<_, { u32::MAX }>::default()
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe this is due to stellar/stellar-xdr@0a621ec. There's no longer a limit of 10, so the logic above this needs to be cleaned up. @leighmcculloch is my understanding correct?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's right, more changes need to be made here, the lines above that define a max need removing.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated

sisuresh and others added 8 commits December 15, 2025 17:57
### What
Update the soroban examples test workflow to patch both local Cargo.toml
files and the workspace root Cargo.toml.

### Why
The previous logic only patched local Cargo.toml files found by find,
missing the workspace root Cargo.toml which may be located outside the
search path.

Related:
- stellar/soroban-examples#391

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
This reverts commit ee64581.

Revert "Check for examples toml patch at top level directory"

This reverts commit 7698fc0.

Revert "Check for examples toml patch at top level directory"

This reverts commit 858f5bb.
@sisuresh sisuresh marked this pull request as draft December 16, 2025 22:51
@sisuresh sisuresh mentioned this pull request Dec 16, 2025
sisuresh added a commit that referenced this pull request Dec 17, 2025
### What

This is just #1644 with
cleaner history.

---------

Co-authored-by: Nando Vieira <me@fnando.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@sisuresh
Copy link
Copy Markdown
Contributor

Merged in #1649

@sisuresh sisuresh closed this Dec 17, 2025
jayz22 pushed a commit to jayz22/rs-soroban-sdk that referenced this pull request Dec 22, 2025
### What

This is just stellar#1644 with
cleaner history.

---------

Co-authored-by: Nando Vieira <me@fnando.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants