Update stellar dependencies to protocol 27

[mootz12]

What

Updates protocol dependencies to protocol 27, cleans up clippy warnings, and adds the ability to sign AddressV2 auth entries.

Known limitations

Support for signing with delegated signers does not exist at this time

TODO

• Update rs-soroban-sdk packages once an RC release is available

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​tokio@​1.47.1 ⏵ 1.52.3	-5
	cargo/​soroban-sdk@​26.0.1 ⏵ 27.0.0-rc.1
	cargo/​serde_json@​1.0.143 ⏵ 1.0.150
	cargo/​serde_with@​3.14.0 ⏵ 3.21.0	-12		+11
	cargo/​stellar-xdr@​26.0.1 ⏵ 27.0.0
	cargo/​soroban-spec@​26.0.1 ⏵ 27.0.0-rc.1
	cargo/​soroban-spec-rust@​26.0.1 ⏵ 27.0.0-rc.1
	cargo/​clap@​4.5.47 ⏵ 4.6.1
	cargo/​soroban-ledger-snapshot@​26.0.1 ⏵ 27.0.0-rc.1
	cargo/​soroban-token-sdk@​26.0.1 ⏵ 27.0.0-rc.1
	cargo/​stellar-asset-spec@​26.0.1 ⏵ 27.0.0-rc.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo libc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/bollard@0.20.2 → cargo/testcontainers@0.27.2 → cargo/sep5@0.1.0 → cargo/tokio@1.52.3 → cargo/stellar-xdr@27.0.0 → cargo/soroban-sdk@27.0.0-rc.1 → cargo/soroban-ledger-snapshot@27.0.0-rc.1 → cargo/sha2@0.10.9 → cargo/sha2@0.9.9 → cargo/which@4.4.2 → cargo/ulid@1.2.1 → cargo/directories@5.0.1 → cargo/mockito@1.7.0 → cargo/whoami@1.6.1 → cargo/reqwest@0.12.23 → cargo/httpmock@0.7.0 → cargo/ledger-transport-hid@0.10.0 → cargo/wasm-opt@0.116.1 → cargo/tempfile@3.21.0 → cargo/open@5.3.2 → cargo/rpassword@7.4.0 → cargo/keyring@3.6.3 → cargo/serial_test@3.2.0 → cargo/assert_cmd@2.0.17 → cargo/libc@0.2.186 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/libc@0.2.186. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo tokio is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: Cargo.lock → cargo/tokio@1.52.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/tokio@1.52.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[Copilot]

Pull request overview

Updates stellar-cli’s Rust workspace to Protocol 27-compatible dependencies (notably stellar-xdr / Soroban crates), adjusts code to the new stellar_xdr API surface (removing curr usage), and extends the signer to support signing AddressV2 Soroban auth entries using the correct CAP-0071-02 payload preimage.

Changes:

• Bump workspace protocol dependencies to v27 (including stellar-xdr = 27.0.0, soroban-env-host = 27.0.0, and soroban-* = 27.0.0-rc.1) and update the lockfile accordingly.
• Replace stellar_xdr::curr::* imports/usages with top-level stellar_xdr::* and update CLI encode/decode helpers to the new stellar_xdr::cli API.
• Add AddressV2 signing support by hashing the SorobanAuthorizationWithAddress preimage, plus unit tests ensuring the AddressV2 variant is preserved and produces distinct signatures from V1.

Reviewed changes

Copilot reviewed 41 out of 42 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
cmd/soroban-cli/src/wasm.rs	Switch XDR imports from curr to top-level stellar_xdr.
cmd/soroban-cli/src/utils.rs	Update XDR imports and tests to use top-level stellar_xdr types.
cmd/soroban-cli/src/signer/validation.rs	Update contract ID construction for non-curr XDR types in tests.
cmd/soroban-cli/src/signer/mod.rs	Add AddressV2 auth signing using SorobanAuthorizationWithAddress preimage + new tests; update contract ID pattern matching.
cmd/soroban-cli/src/log/auth.rs	Format auth entries for AddressV2 and AddressWithDelegates; minor iterator/clippy cleanups; update contract ID formatting match.
cmd/soroban-cli/src/lib.rs	Re-export stellar_xdr directly as xdr (removing curr re-export).
cmd/soroban-cli/src/key.rs	Update contract address construction to non-curr XDR types.
cmd/soroban-cli/src/config/sc_address.rs	Update ScAddress::Contract construction to non-curr XDR types.
cmd/soroban-cli/src/commands/version.rs	Update displayed XDR version field naming (from xdr_curr to xdr).
cmd/soroban-cli/src/commands/tx/xdr.rs	Update Limited/error types to non-curr XDR.
cmd/soroban-cli/src/commands/tx/update/sequence_number/next.rs	Update MuxedAccount import to top-level stellar_xdr.
cmd/soroban-cli/src/commands/tx/send.rs	Update XDR error type to stellar_xdr::Error and remove curr import.
cmd/soroban-cli/src/commands/tx/encode.rs	Update stellar_xdr::cli::encode invocation to new API (cmd.run() without Channel::Curr).
cmd/soroban-cli/src/commands/tx/edit.rs	Update XDR read/write trait bounds and envelope types to top-level stellar_xdr.
cmd/soroban-cli/src/commands/tx/decode.rs	Update stellar_xdr::cli::decode invocation to new API (cmd.run() without Channel::Curr).
cmd/soroban-cli/src/commands/snapshot/merge.rs	Update snapshot merge key/value types to non-curr XDR types.
cmd/soroban-cli/src/commands/snapshot/create.rs	Switch broad XDR imports and contract address creation off curr.
cmd/soroban-cli/src/commands/network/settings.rs	Update XDR imports and error types to non-curr.
cmd/soroban-cli/src/commands/ledger/entry/fetch/contract_data.rs	Update XDR error type to stellar_xdr::Error.
cmd/soroban-cli/src/commands/doctor.rs	Update displayed XDR version field naming (from xdr_curr to xdr).
cmd/soroban-cli/src/commands/contract/info/shared.rs	Update ContractId import to top-level stellar_xdr.
cmd/soroban-cli/src/commands/contract/info/meta.rs	Update meta XDR imports to top-level stellar_xdr.
cmd/soroban-cli/src/commands/contract/info/build.rs	Update meta XDR imports to top-level stellar_xdr.
cmd/soroban-cli/src/commands/contract/deploy/asset.rs	Update contract address creation to non-curr XDR types.
cmd/soroban-cli/src/commands/contract/build.rs	Update XDR imports/error types and spec entry typing to non-curr.
cmd/soroban-cli/src/commands/contract/arg_parsing.rs	Update many spec/XDR type imports/usages to non-curr and clean up iterator style.
cmd/soroban-cli/src/assembled.rs	Update broad XDR imports and contract ID construction to non-curr.
cmd/crates/stellar-ledger/tests/test/emulator_tests.rs	Update test XDR imports to non-curr.
cmd/crates/stellar-ledger/src/lib.rs	Update crate XDR imports to non-curr.
cmd/crates/stellar-ledger/src/emulator_test_support/util.rs	Update Hash import to non-curr.
cmd/crates/stellar-ledger/Cargo.toml	Drop stellar-xdr feature curr from this crate.
cmd/crates/soroban-spec-typescript/src/types.rs	Update spec/XDR imports to non-curr.
cmd/crates/soroban-spec-typescript/src/lib.rs	Update spec/XDR imports and error typing to non-curr.
cmd/crates/soroban-spec-typescript/src/boilerplate.rs	Improve ignored-test messages and adjust directory-compare helper logic.
cmd/crates/soroban-spec-typescript/Cargo.toml	Drop stellar-xdr feature curr from this crate.
cmd/crates/soroban-spec-tools/src/verify.rs	Update spec/XDR imports to non-curr and clean up iterator style.
cmd/crates/soroban-spec-tools/src/lib.rs	Update broad XDR imports to non-curr and adjust remaining curr-scoped enums.
cmd/crates/soroban-spec-tools/src/event.rs	Update XDR imports to non-curr.
cmd/crates/soroban-spec-tools/src/contract.rs	Update XDR imports to non-curr and clean up iterator style.
cmd/crates/soroban-spec-tools/Cargo.toml	Drop stellar-xdr feature curr from this crate.
Cargo.toml	Bump workspace protocol dependency versions to v27 / v27 RCs and add soroban-env-host v27.
Cargo.lock	Refresh lockfile for the new dependency set.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8a70c15cc7

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 46e035db10

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".