Add support for Protocol 28

[fnando]

What

Upgrades the soroban dependencies to Protocol 28 (28.0.0-rc.1) and adds first-class CAP-85 support: the CLI now resolves an externally managed executable (ExternalRef) to its wasm hash, so invoke, fetch, and info interface work against beacon-proxied contracts. Includes an end-to-end integration test.

Why

Protocol 28 introduces new XDR types and SDK changes the CLI must handle to keep building, and without ExternalRef resolution beacon-proxied contracts can't be used through the CLI.

Known limitations

Delegated auth signers (AddressWithDelegates) remain unsupported and the useUpgradedAuth flag isn't plumbed through yet (#2701).

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​soroban-sdk@​27.0.2 ⏵ 28.0.0-rc.1	+1
	cargo/​stellar-strkey@​0.0.18
	cargo/​stellar-xdr@​27.0.0 ⏵ 28.0.0	+1
	cargo/​soroban-spec@​27.0.2 ⏵ 28.0.0-rc.1
	cargo/​soroban-spec-rust@​27.0.2 ⏵ 28.0.0-rc.1
	cargo/​soroban-ledger-snapshot@​27.0.2 ⏵ 28.0.0-rc.1
	cargo/​soroban-token-sdk@​27.0.2 ⏵ 28.0.0-rc.1
	cargo/​stellar-asset-spec@​27.0.2 ⏵ 28.0.0-rc.1

View full report

[Copilot]

Pull request overview

Upgrades Stellar CLI to Protocol 28 and adds CAP-85 ExternalRef resolution for contract operations.

Changes:

• Upgrades Protocol 28 dependencies and CI environments.
• Resolves ExternalRef executables for invoke, fetch, and info commands.
• Adds end-to-end CAP-85 integration coverage and fixture support.

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Makefile	Enables spec shaking v2 for test Wasm builds.
cmd/soroban-cli/src/wasm.rs	Resolves ExternalRefs when fetching Wasm.
cmd/soroban-cli/src/utils.rs	Adds ExternalRef ledger-entry resolution.
cmd/soroban-cli/src/log/auth.rs	Formats ExternalRefs in authorization output.
cmd/soroban-cli/src/get_spec.rs	Fetches specifications through ExternalRefs.
cmd/soroban-cli/src/config/data.rs	Adapts to the updated RPC response.
cmd/crates/soroban-test/tests/it/integration/contract/mod.rs	Registers CAP-85 tests.
cmd/crates/soroban-test/tests/it/integration/contract/external_ref.rs	Tests ExternalRef invocation, fetch, and interface lookup.
cmd/crates/soroban-test/tests/fixtures/test-wasms/token/src/contract.rs	Adopts the renamed token event field.
cmd/crates/soroban-test/tests/fixtures/test-wasms/hello_world/src/lib.rs	Adds CAP-85 fixture operations.
cmd/crates/soroban-spec-tools/src/lib.rs	Serializes new Protocol 28 XDR variants.
Cargo.toml	Upgrades Protocol 28 dependencies.
Cargo.lock	Locks upgraded dependency versions.
.github/workflows/rpc-tests.yml	Runs RPC tests with Protocol 28.
.github/workflows/ledger-emulator.yml	Updates emulator testing to Protocol 28.
.github/workflows/bindings-ts.yml	Updates TypeScript binding tests to Protocol 28.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 19 out of 20 changed files in this pull request and generated 1 comment.

[leighmcculloch]

It looks like this code doesn't offer any new functionality for for deploying from executable references. Here's the plan to add that in a follow up?

Otherwise lgtm.

[fnando]

Yeah, given how close we're from the testnet release, I'm focusing on making the CLI runnable with p28, rather than adding features. We can follow up with that later on!