Skip to content

Add tx-granular ledger snapshot source using meta, RPC, and archives#1657

Draft
leighmcculloch wants to merge 26 commits intomainfrom
snapshot-source-tx
Draft

Add tx-granular ledger snapshot source using meta, RPC, and archives#1657
leighmcculloch wants to merge 26 commits intomainfrom
snapshot-source-tx

Conversation

@leighmcculloch
Copy link
Copy Markdown
Member

@leighmcculloch leighmcculloch commented Dec 19, 2025

What

Add new crates for fetching ledger entries from multiple data sources to enable more seamless and built-in fork testing in the sdk. Add soroban-ledger-snapshot-source-tx for transaction-level snapshot sources.

sequenceDiagram
    autonumber
    actor App as 
    participant SelTxMeta as Query<br/>Ledger<br/>Tx Meta
    participant LedgerMeta as Query<br/>Ledger – 1..N<br/>Tx Meta
    participant Archive as History<br/>Archive
    participant RPC as RPC

    App->>SelTxMeta: Lookup with key
    Note over App,SelTxMeta: If found → use it.<br/>If not → continue.
    
    App->>SelTxMeta: Look in prior txs in same ledger
    Note over App,SelTxMeta: If found → use it.<br/>If not → continue.

    opt Optionally use RPC
        App->>RPC: getLedgerEntries([key])
        Note over App,RPC: Use if (lastModified < queryLedger)<br/>AND (rpcLatestSeen >= queryLedger).<br/>Otherwise continue.
    end

    App->>LedgerMeta: Look in prior ledger meta
    Note over App,LedgerMeta: If found → use it.<br/>If checkpoint ledger not reached → continue to next ledger meta<br/>If checkpoint ledger is reached → continue to archive.

    App->>Archive: Download checkpoint from history archive and search
    Note over App,Archive: If found → use it.<br/>If not → does not exist.
Loading

Why

The current fork testing experience utilising the stellar-cli has low granularity only at the boundaries of ledgers, and requires downloading full history archives and manually identifying footprints ahead of time, which is difficult to do well and a poor developer experience. This change enables the SDK to lazily fetch ledger entries on-demand from the most efficient source available, caching results locally for subsequent runs. Developers will be able to fork test against any ledger and transaction without pre-identifying the footprint.

The change uses a Ledger Meta Storage (SEP-54), an RPC, and a History Archive to collect ledger entries.

The change caches results in three layers. All raw files downloaded are cached in the system cache directory and reused across tests, across workspaces. All ledger entries found are cached in the system cache directory. All ledger entries found for the current workspace are cached in the tests-snapshot-source directory intended to be committed so that CI runs reproducibly without needing to collect entries. Note that the format of that cache is not a ledger snapshot json file because for many tests running concurrently one file per ledger entry is easier to manage.

Close #1448

Try it out

Add the following dependencies to your Cargo.toml:

[dev-dependencies]
soroban-sdk = { version = "25.1.0", features = ["testutils"] }
soroban-ledger-snapshot-source-tx = { git = "https://github.com/stellar/rs-soroban-sdk", branch = "snapshot-source-tx" }
bytes-lit = "0.0.6"

Note: Requires soroban-sdk v23.4.0 or later.

Example

use bytes_lit::bytes;
use soroban_ledger_snapshot_source_tx::{Network, TxSnapshotSource};
use soroban_sdk::{token::TokenClient, Address, Env};

#[test]
fn test_fork_at_tx() {
    // The address of the native asset (test XLM) on testnet.
    const NATIVE_ADDRESS: &str = "CDLZFC3SYJYDZT7K67VZ75HPJVIEUVNIXF47ZG2FB2RMQQVU2HHGCYSC";
    
    // Create a snapshot source at ledger 8655, just BEFORE the specified tx.
    let source = TxSnapshotSource::new(
        Network::testnet(),
        8655,
        Some(bytes!(0x580bad1826d02b45634a3742049a23bf652fb2d4bc0814c83f2f58a7a9810ac9)),
    );
    
    // Setup the environment with the source.
    let env = Env::from_ledger_snapshot(source);
    let contract = Address::from_str(&env, NATIVE_ADDRESS);
    let client = TokenClient::new(&env, &contract);

    // Lookup the balance of the following address.
    let addr = Address::from_str(&env, "CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2KM");
    let bal = client.balance(&addr);
    assert_eq!(bal, 47);  // Balance just before the tx executed
}

Observing State Changes

The TxSnapshotSource looks up state with transaction-level granularity when a transaction hash is provided allowing developers to debug a transaction by starting at the point just before the transaction. For example:

Before a specific tx: Pass the tx hash to get state just before that tx executed:

let source = TxSnapshotSource::new(
    Network::testnet(),
    8655,
    Some(bytes!(0x580bad1826d02b45634a3742049a23bf652fb2d4bc0814c83f2f58a7a9810ac9)),
);
// Balance will be 47 (before this tx added 10)

End of ledger (after all txs): Use None for the tx_hash to get state at the end of the ledger:

let source = TxSnapshotSource::new(Network::testnet(), 8655, None);
// Balance will be 57 (after all txs in ledger 8655)

Different ledgers/txs: Update the test to investigate the state of the balance at each of the following ledgers and transactions to see how the transactions affected the balance. Check out the links to see the operations the transactions performed and how they align with the changes in balances observed.

Ledger TX HASH Change Bal
8511 51b21c588f3b397f957d3c14685debf96224c27c5a45b81b27eb5ee0a56517bf + 1 1
8613 52e9a67fdd78105ed84f6d073f50a464e14c1c587a5e4b45842e4b3386336751 + 2 3
8622 a5dd4e98df837da3b1a7de52e9698c1a28ae15973f52651c765f1654a3033993 + 3 6
8632 7a6143351fc48aed1b34d9d0b1690bfe11404cc10cc10f5d52ec06758d0f2b5b + 6 12
8633 d5f676598fd331867f728c4f1c28ea6045c2d31a80d48bfb873d8302816a6304 + 7 19
8633 34e420d6cf03ec2ad1560545f6f98ae281bbb6ac9837d23dbc44d158b2942a65 + 8 27
8655 52ec73f485fb132fb5777c6f2be6c0358e9587c64f4a9ef1f861b56923493400 +11 38
8655 ccede7115f962f3680dc7ff45b21e52e5ea02004f6c2e5b47cf35b853a91203a + 9 47
8655 580bad1826d02b45634a3742049a23bf652fb2d4bc0814c83f2f58a7a9810ac9 +10 57

Debugging with RUST_LOG

Enable logging to see which data sources are being queried and what entries are found:

RUST_LOG=soroban_ledger_fetch=debug cargo test -- --nocapture

Example output:

2025-12-19T14:56:01.070297Z  INFO soroban_ledger_fetch: fetch, key: {"contract_data":{"contract":"CDLZFC3SYJYDZT7K67VZ75HPJVIEUVNIXF47ZG2FB2RMQQVU2HHGCYSC","durability":"persistent","key":"ledger_key_contract_instance"}}
2025-12-19T14:56:01.070932Z DEBUG soroban_ledger_fetch: fetch from meta range, count: 16, first: 8655, last: 8640
2025-12-19T14:56:01.071069Z DEBUG soroban_ledger_fetch: fetch from meta, ledger: 8655
2025-12-19T14:56:01.990395Z DEBUG soroban_ledger_fetch: fetch from rpc, ledger: 8655
2025-12-19T14:56:02.900716Z DEBUG soroban_ledger_fetch: found from rpc, last_modified: 689, usable: true
2025-12-19T14:56:02.919258Z  INFO soroban_ledger_fetch: found, entry: {"data":{"contract_data":{"contract":"CDLZFC3SYJYDZT7K67VZ75HPJVIEUVNIXF47ZG2FB2RMQQVU2HHGCYSC","durability":"persistent","ext":"v0","key":"ledger_key_contract_instance","val":{"contract_instance":{"executable":"stellar_asset","storage":[{"key":{"symbol":"METADATA"},"val":{"map":[{"key":{"symbol":"decimal"},"val":{"u32":7}},{"key":{"symbol":"name"},"val":{"string":"native"}},{"key":{"symbol":"symbol"},"val":{"string":"native"}}]}},{"key":{"vec":[{"symbol":"AssetInfo"}]},"val":{"vec":[{"symbol":"Native"}]}}]}}}},"ext":"v0","last_modified_ledger_seq":689}
2025-12-19T14:56:02.941928Z  INFO soroban_ledger_fetch: fetch, key: {"contract_data":{"contract":"CDLZFC3SYJYDZT7K67VZ75HPJVIEUVNIXF47ZG2FB2RMQQVU2HHGCYSC","durability":"persistent","key":{"vec":[{"symbol":"Balance"},{"address":"CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2KM"}]}}}
2025-12-19T14:56:02.942165Z DEBUG soroban_ledger_fetch: fetch from meta range, count: 16, first: 8655, last: 8640
2025-12-19T14:56:02.942205Z DEBUG soroban_ledger_fetch: fetch from meta, ledger: 8655
2025-12-19T14:56:02.950580Z  INFO soroban_ledger_fetch: found, entry: {"data":{"contract_data":{"contract":"CDLZFC3SYJYDZT7K67VZ75HPJVIEUVNIXF47ZG2FB2RMQQVU2HHGCYSC","durability":"persistent","ext":"v0","key":{"vec":[{"symbol":"Balance"},{"address":"CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD2KM"}]},"val":{"map":[{"key":{"symbol":"amount"},"val":{"i128":"47"}},{"key":{"symbol":"authorized"},"val":{"bool":true}},{"key":{"symbol":"clawback"},"val":{"bool":false}}]}}},"ext":"v0","last_modified_ledger_seq":8655}

TODO

Thanks

Thanks @orbitlens for sharing the idea of using transaction meta as a way to collect recent state. Thanks to all the people who provided feedback to me about how they use the existing stellar snapshot create functionality.

This comment was marked as resolved.

@leighmcculloch leighmcculloch force-pushed the snapshot-source-tx branch 2 times, most recently from 42f37c9 to 598ad4c Compare December 19, 2025 14:52
@leighmcculloch leighmcculloch changed the title Add new ledger snapshot source using meta, RPC, and archives Add tx-granular ledger snapshot source using meta, RPC, and archives Dec 19, 2025
@leighmcculloch leighmcculloch force-pushed the snapshot-source-tx branch 3 times, most recently from 0a8ae20 to 19904da Compare December 19, 2025 15:34
@earrietadev
Copy link
Copy Markdown

is it possible to set it so the timestamp is also set after the snapshot has been loaded? Currently we need to manually set it after the env is created from the snapshot with something like e.ledger().set_timestamp(1766260837);

@willemneal
Copy link
Copy Markdown
Contributor

This seems like an interesting way of handling a simulation locally. Or at least doing a read call locally.

@orbitlens
Copy link
Copy Markdown

Looks awesome. Thanks, Leigh! ❤️

Comment on lines +77 to +87
let ledger_cache_dir = self.cache_path.join(
self.tx_hash
.map(|h| {
let tx_hash_str: String = h.iter().map(|b| format!("{b:02x}")).collect();
format!("{}-{}-before", self.fetcher.ledger(), tx_hash_str)
})
.unwrap_or_else(|| format!("{}-after", self.fetcher.ledger())),
);

// Ensure cache directory exists
std::fs::create_dir_all(&ledger_cache_dir).expect("failed to create cache directory");
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This probably should be the cache crate's responsibility. If it is abstracted more than this crate will never need to use a fs. This way we could eventually use Wasm to run this in the browser.

@socket-security
Copy link
Copy Markdown

socket-security bot commented Feb 22, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
License policy violation: cargo adler2 under 0BSD AND Apache-2.0 AND MIT

Location: Package overview

From: ?cargo/flate2@1.1.9cargo/adler2@2.0.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/adler2@2.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo aho-corasick under MIT AND Unlicense

Location: Package overview

From: ?cargo/tracing-subscriber@0.3.23cargo/aho-corasick@1.1.4

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/aho-corasick@1.1.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo ed25519-dalek under BSD-3-Clause

Location: Package overview

From: soroban-sdk/Cargo.tomlcargo/ed25519-dalek@2.2.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/ed25519-dalek@2.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo encoding_rs

Location: Package overview

From: ?cargo/reqwest@0.12.28cargo/encoding_rs@0.8.35

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/encoding_rs@0.8.35. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo foldhash under Zlib

Location: Package overview

From: ?cargo/reqwest@0.12.28cargo/stellar-rpc-client@25.0.0cargo/proptest@1.10.0cargo/libfuzzer-sys@0.4.12cargo/zstd@0.13.3cargo/ark-bls12-381@0.5.0cargo/ark-bn254@0.5.0cargo/foldhash@0.1.5

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/foldhash@0.1.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo icu_collections under Unicode-3.0

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (icu_collections-2.1.1/LICENSE)

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (icu_collections-2.1.1/Cargo.toml)

From: ?cargo/url@2.5.8cargo/icu_collections@2.1.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/icu_collections@2.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo icu_locale_core under Unicode-3.0

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (icu_locale_core-2.1.1/LICENSE)

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (icu_locale_core-2.1.1/Cargo.toml)

From: ?cargo/url@2.5.8cargo/icu_locale_core@2.1.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/icu_locale_core@2.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo icu_normalizer_data under Unicode-3.0

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (icu_normalizer_data-2.1.1/LICENSE)

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (icu_normalizer_data-2.1.1/Cargo.toml)

From: ?cargo/url@2.5.8cargo/icu_normalizer_data@2.1.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/icu_normalizer_data@2.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo icu_normalizer under Unicode-3.0

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (icu_normalizer-2.1.1/LICENSE)

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (icu_normalizer-2.1.1/Cargo.toml)

From: ?cargo/url@2.5.8cargo/icu_normalizer@2.1.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/icu_normalizer@2.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo icu_properties_data under Unicode-3.0

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (icu_properties_data-2.1.2/LICENSE)

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (icu_properties_data-2.1.2/Cargo.toml)

From: ?cargo/url@2.5.8cargo/icu_properties_data@2.1.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/icu_properties_data@2.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo icu_properties under Unicode-3.0

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (icu_properties-2.1.2/LICENSE)

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (icu_properties-2.1.2/Cargo.toml)

From: ?cargo/url@2.5.8cargo/icu_properties@2.1.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/icu_properties@2.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo icu_provider under Unicode-3.0

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (icu_provider-2.1.1/LICENSE)

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (icu_provider-2.1.1/Cargo.toml)

From: ?cargo/url@2.5.8cargo/icu_provider@2.1.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/icu_provider@2.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo linux-raw-sys

License: Apache-2.0 WITH LLVM-exception - the applicable license policy does not allow this license exception (linux-raw-sys-0.12.1/LICENSE-Apache-2.0_WITH_LLVM-exception)

From: ?cargo/reqwest@0.12.28cargo/proptest@1.10.0cargo/linux-raw-sys@0.12.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/linux-raw-sys@0.12.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo litemap under Unicode-3.0

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (litemap-0.8.1/LICENSE)

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (litemap-0.8.1/Cargo.toml)

From: ?cargo/url@2.5.8cargo/litemap@0.8.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/litemap@0.8.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo lru-slab under Apache-2.0 AND MIT AND Zlib

Location: Package overview

From: ?cargo/reqwest@0.12.28cargo/lru-slab@0.1.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/lru-slab@0.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo memchr under MIT AND Unlicense

Location: Package overview

From: ?cargo/reqwest@0.12.28cargo/serde_json@1.0.149cargo/stellar-rpc-client@25.0.0cargo/tracing-subscriber@0.3.23cargo/memchr@2.8.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/memchr@2.8.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo miniz_oxide under Apache-2.0 AND MIT AND Zlib

Location: Package overview

From: ?cargo/flate2@1.1.9cargo/miniz_oxide@0.8.9

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/miniz_oxide@0.8.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo option-ext under MPL-2.0

Location: Package overview

From: ?cargo/directories@6.0.0cargo/option-ext@0.2.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/option-ext@0.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo potential_utf under Unicode-3.0

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (potential_utf-0.1.4/LICENSE)

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (potential_utf-0.1.4/Cargo.toml)

From: ?cargo/url@2.5.8cargo/potential_utf@0.1.4

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/potential_utf@0.1.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo regex-syntax

Location: Package overview

From: ?cargo/proptest@1.10.0cargo/tracing-subscriber@0.3.23cargo/regex-syntax@0.8.10

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/regex-syntax@0.8.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo ring

Location: Package overview

From: ?cargo/reqwest@0.12.28cargo/stellar-rpc-client@25.0.0cargo/ring@0.17.14

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/ring@0.17.14. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo rustix

License: Apache-2.0 WITH LLVM-exception - the applicable license policy does not allow this license exception (rustix-1.1.4/LICENSE-Apache-2.0_WITH_LLVM-exception)

From: ?cargo/reqwest@0.12.28cargo/proptest@1.10.0cargo/rustix@1.1.4

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/rustix@1.1.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo termcolor under MIT AND Unlicense

Location: Package overview

From: ?cargo/stellar-rpc-client@25.0.0cargo/termcolor@1.4.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/termcolor@1.4.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo tinystr under Unicode-3.0

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (tinystr-0.8.2/LICENSE)

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (tinystr-0.8.2/Cargo.toml)

From: ?cargo/url@2.5.8cargo/tinystr@0.8.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/tinystr@0.8.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo tinyvec under Apache-2.0 AND MIT AND Zlib

Location: Package overview

From: ?cargo/reqwest@0.12.28cargo/tinyvec@1.11.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/tinyvec@1.11.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo unicode-ident under Unicode-3.0

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (unicode-ident-1.0.24/LICENSE-UNICODE)

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (unicode-ident-1.0.24/Cargo.toml)

License: Unicode-3.0 - the applicable license policy does not allow this license (4) (unicode-ident-1.0.24/Cargo.toml)

From: ?cargo/reqwest@0.12.28cargo/stellar-rpc-client@25.0.0cargo/proc-macro2@1.0.106cargo/proptest@1.10.0cargo/libfuzzer-sys@0.4.12cargo/syn@2.0.117cargo/serde_with@3.18.0cargo/zstd@0.13.3cargo/directories@6.0.0cargo/unicode-ident@1.0.24

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/unicode-ident@1.0.24. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo wasi

License: Apache-2.0 WITH LLVM-exception - the applicable license policy does not allow this license exception (wasi-0.11.1+wasi-snapshot-preview1/LICENSE-Apache-2.0_WITH_LLVM-exception)

From: ?cargo/reqwest@0.12.28cargo/stellar-rpc-client@25.0.0cargo/tokio@1.50.0cargo/directories@6.0.0cargo/wasi@0.11.1%2Bwasi-snapshot-preview1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/wasi@0.11.1%2Bwasi-snapshot-preview1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: cargo wasm-bindgen-futures

Location: Package overview

From: ?cargo/reqwest@0.12.28cargo/wasm-bindgen-futures@0.4.64

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/wasm-bindgen-futures@0.4.64. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

See 15 more rows in the dashboard

View full report

@leighmcculloch
Copy link
Copy Markdown
Member Author

Fixed an issue that makes it much faster to run on subsequent runs.

Agent: Claude Code
Agent-Model: claude-opus-4-6
Agent-Session-Id: 09a10129-7596-430d-979d-70a4c8fed82f
Agent: Claude Code
Agent-Model: claude-opus-4-6
Agent-Session-Id: 09a10129-7596-430d-979d-70a4c8fed82f
Agent: Claude Code
Agent-Model: claude-opus-4-6
Agent-Session-Id: 09a10129-7596-430d-979d-70a4c8fed82f
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Improve the in SDK fork testing experience

5 participants