[dependabot]

Bumps the all-dependencies group in /backend with 15 updates:

Package	From	To
@stellar/stellar-sdk	17.2.0	17.3.0
dotenv	18.0.4	18.0.9
express	5.2.1	5.3.0
express-rate-limit	8.7.0	8.7.1
pg	8.23.0	8.23.1
pino	10.3.1	10.4.0
zod	4.6.5	4.6.7
@types/node	26.6.3	26.6.5
@types/ws	8.18.1	8.18.2
@vitest/coverage-v8	5.0.2	5.0.5
supertest	7.3.0	7.3.1
typescript	6.0.3	7.0.2
typescript-eslint	8.71.0	8.72.0
vite	6.4.3	8.3.5
vitest	5.0.2	5.0.5

Updates @stellar/stellar-sdk from 17.2.0 to 17.3.0

Release notes

Sourced from @​stellar/stellar-sdk's releases.

v17.3.0

v17.3.0: Protocol 30

Added

• CAP-84 muxed contract (W…) addresses. StrKey adds encodeMuxedContract(), decodeMuxedContract() and isValidMuxedContract(). Address adds the muxedContract type and Address.muxedContract(). The new encodeMuxedContractAddress() builds a W… address from a C… address and an ID. extractBaseAddress() also accepts a C… address, which it returns unchanged, and a W… address, for which it returns the base C… address. TransactionBuilder.addSacTransferOperation() accepts a W… destination (#1811).
• Horizon contract_credited effects (ContractCredited) have optional contract_muxed and contract_muxed_id fields. Horizon sets them when a Stellar Asset Contract transfer or mint sends to a muxed contract (W…) address. contract_muxed_id is a decimal string (#1836, stellar-horizon#237).
• The XDR types are regenerated from stellar-xdr with CAP-84, CAP-87 and CAP-88 enabled. xdr.ScAddress adds the scAddressTypeMuxedContract arm and xdr.MuxedContract. xdr.ContractCostType adds the ML-DSA cost types, from mlDsa44DecodeVerifyingKey to verifyMlDsa87Sig. xdr.StellarValueType adds stellarValueSignedMs and stellarValueEmptyTxSetMs, with xdr.StellarValueSignedMsValue and xdr.StellarValueProposedMsValue. The new SC_SPEC_TYPE_NAME_LIMIT constant (1024) raises the limit on contract spec type names from 60. Code that switches over these unions with an exhaustive check must handle the new arms (#1795, #1796, #1797).

Changed

• inSuccessfulContractCall on rpc.Api.EventResponse and rpc.Api.RawEventResponse is optional and deprecated, because newer RPC servers no longer return it from getEvents (#1836, stellar-rpc#1050). With such a server it is undefined. Code that uses it as a boolean can fail to compile under strict. The field will be removed in the next major release.
• The rpc.Server constructor throws when timeout is not 0 or a whole number of milliseconds up to 2147483647. Examples are NaN, a negative number or a fraction. Before, it accepted any value and ignored it. The CLI's --timeout flag has the same upper limit (#1802).
• StellarToml.Resolver.resolve() rejects before the request when allowedRedirects is not 0 or a whole number up to Number.MAX_SAFE_INTEGER. Before, it passed the value to the HTTP client. In Node, the Fetch build followed redirects without limit for NaN, and both builds did so for Infinity (#1809).
• TransactionBuilder.setTimeout() now throws "timeout ends before min_time" when a positive timeout ends before an existing minTime. Before, it built a transaction with minTime after maxTime, which is never valid (#1781).
• When you set maxRedirects or maxContentLength, the Fetch client rejects a successful response whose body is not valid UTF-8, with "Response body is not valid UTF-8". Before, it replaced the invalid bytes with U+FFFD and returned the result. The client still ignores the charset of Content-Type, because a stellar.toml file and a federation response must be UTF-8. A non-2xx response still rejects with its HTTP error (#1804).
• Federation.Server.createForDomain() and Federation.Server.resolve() reject a FEDERATION_SERVER URL from stellar.toml that has a user name or password, or a scheme other than http: or https:, even when allowHttp is set. The SDK does not check the host, so a URL can point to a private or local address, such as https://10.0.0.5. A server-side application that resolves untrusted addresses must filter the hosts it connects to. When allowedRedirects is set, redirect targets are not checked. The Federation.Server constructor does not check the URL that you pass to it (#1809).
• Contract clients reject a muxed (M… or W…) address for an Address parameter; pass it to a MuxedAddress parameter instead. authorizeEntry(), authorizeInvocation() and buildWithDelegatesEntry() reject a muxed signer or delegate address. rpc.Server.getContractData() rejects a muxed owner and a key that contains a muxed address. rpc.Server.getAssetBalance() and getSACBalance() reject a muxed address, since balances are held by the base address. Before, each of these built a request that the network rejects or can never match (#1811, #1835).
• nativeToScVal() and Spec.nativeToScVal() throw a TypeError for a function value. Before, they called the function and converted its result. To keep the old result, call the function and pass its return value. Spec also treats a struct field named like an inherited Object.prototype function as missing when the value does not set it. Examples are toString and constructor. Before, contract clients encoded that field from the inherited function, for example toString as "[object Undefined]" (#1834).

Fixed

• toJson() on a MuxedEd25519Account, or on an ScAddress that holds one, throws when the ID is outside the uint64 range. Before, it wrapped the ID, so -1n gave an M… address with ID 2^64 - 1 and 2n ** 64n gave one with ID 0. toXdr() already threw for these IDs (#1811).
• CallBuilder.stream() passes an event that it cannot parse to onerror and keeps the stream open. onerror gets a MessageEvent of type "error" whose data is the parse error. The stream moves its cursor to the event's SSE id, so a reconnect does not get the event again. An onerror handler that closes the stream now also closes it on such an event. Before, the event listener threw the error as an uncaught exception, which stops a Node.js process that has no handler for it (#1806).
• Horizon records no longer get a link method whose name is then, toJSON, paging_token, _links or the name of an Object.prototype property, such as __proto__ or constructor. The link stays in _links. Before, a then link made call() hang while it sent requests in a loop. A toJSON link made JSON.stringify() return {} and send a request. A __proto__ link changed the record's prototype. A paging_token link made stream() reconnect with the link function's source code as its cursor. A _links link replaced _links with a function, so each link method after it threw (#1806).
• scValToNative() throws a TypeError when two keys of an scvMap convert to the same object property, such as u32 1 and symbol "1". It previously kept only the last entry. Maps whose keys all convert to distinct properties decode as before. Because any contract can emit such a map, humanizeEvents() and contract-client decoding of Val-typed values can now throw on data read from the network (#1778).
• Templated Horizon _links functions now resolve a relative href the same way non-templated links do. They previously threw TypeError: Invalid URL (#1771).
• MuxedAccount, encodeMuxedAccount() and Keypair.xdrMuxedAccount() accept an ID only as decimal digits. MuxedAccount returns the ID in canonical form from id(). Before, any string that BigInt() accepts passed, such as "0x10", " 16 " or "". id() returned that string as typed, so two objects for the same M-address could report different IDs, and an empty string silently became ID 0. An ID string longer than 22 characters is now rejected before it is parsed, so a very long string no longer costs CPU time and memory (#1780).
• Operation.manageSellOffer() and Operation.manageBuyOffer() accept offerId only as a non-negative safe integer, a non-negative bigint, or a string of decimal digits, up to the int64 maximum. Operation.revokeOfferSponsorship() applies the same rule, and now also accepts a number or a bigint offerId, such as the offerId of a decoded LedgerKeyOffer. Before, a number above 2^53 - 1 was rounded and could name a different offer. An empty string meant offer 0, and a negative ID built an operation that the network rejects. An offerId string longer than 22 characters is now rejected before it is parsed (#1780).
• TransactionBuilder.setTimeout(TimeoutInfinite) keeps an existing minTime. Before, it reset both time bounds to 0, so a transaction meant to become valid later was valid at once (#1781).
• new Asset(code, issuer) keeps an issued asset's code as given. It previously changed every spelling of xlm to XLM, even when an issuer was present. As a result, Asset.fromOperation() and transaction.operations showed XLM:G… for an operation on xlm:G…. Encoding the decoded asset again also changed its bytes. An asset built as new Asset("xlm", issuer) now encodes xlm, so its contract ID changes. To keep the old asset, pass XLM (#1784).
• Transaction and FeeBumpTransaction now decode their own copy of a TransactionEnvelope object passed to the constructor, to TransactionBuilder.fromXdr() or from TransactionBuilder.build(). Before, they kept the caller's object. A later change to that object altered what hash(), sign() and toXdr() used, but not always what operations showed. An envelope that cannot be encoded, such as one with more than 100 operations, now fails in the constructor and in TransactionBuilder.build(), not later in toXdr() or sign() (#1784).
• WebAuth.readChallengeTx(), verifyChallengeTxSigners() and verifyChallengeTxThreshold() throw an InvalidChallengeError when a challenge's client_domain operation has no source account. SEP-10 requires that source to be the client domain's signing key. The verifiers previously skipped the client domain signature check for such a challenge. (#1788)
• WebAuth.buildChallengeTx() throws when clientSigningKey is the server's public key. WebAuth.readChallengeTx(), verifyChallengeTxSigners() and verifyChallengeTxThreshold() throw InvalidChallengeError when the client_domain operation's source account is the server account. The server signature previously also counted as the client domain signature, and verifyChallengeTxSigners() could leave a valid client signer out of its result. (#1791)
• In Node, when maxRedirects is set, the Fetch client rejects a redirect to a URL that is not http: or https:. It also rejects a redirect from https: to http:. Before, it followed both. For example, StellarToml.Resolver.resolve() with allowedRedirects returned the content of a data: URL. When a redirect changes the method to GET, the client now also removes the Content-Encoding, Content-Language, Content-Location and Content-Range headers. (#1799)
• rpc.Server now applies its timeout option to each request. Before, the option was ignored, so a request to a server that did not answer stayed pending. This also fixes the --timeout flag of the bindings CLI, which had no effect (#1802).
• The Fetch client sends params when the URL has a # fragment. Before, it added them after the fragment, so the server did not receive them. When there are params, the fragment is now left out of the request URL, as in the Axios build (#1804).
• In Node, when maxRedirects is set, the Fetch client keeps only a safe set of headers on a redirect to another origin: Accept, Accept-Encoding, Accept-Language, Content-Type, Content-Length, Content-Encoding, Content-Language, Content-Location, Content-Range, User-Agent, Range, Cache-Control, Pragma, the If-* conditional headers, X-Client-Name, X-Client-Version, X-App-Name and X-App-Version. Other custom headers, such as traceparent, are dropped too. An http: to https: redirect on the same host counts as another origin. Before, the client removed only Authorization, Proxy-Authorization and Cookie. Other credential headers, such as the Horizon authToken (X-Auth-Token) or an API key in headers, reached the new origin. A redirect to the same origin keeps all headers (#1814).
• AssembledTransaction.sign() and signAndSend() keep the fee from simulation. Before, they added the Soroban resource fee to the fee a second time, which raised the inclusion fee bid. The automatic footprint restore now uses the fee option (or BASE_FEE) as the inclusion fee. Before, it used the restore's resource fee as the inclusion fee and ignored fee. Set fee to bid more during surge pricing. restoreFootprint() still accepts minResourceFee but does not use it (#1808).
• Contract client MuxedAddress parameters accept an Address object, as their string | Address type says. Before, they threw "was not address, but value was Address" (#1811).
• TransactionBuilder.build() throws for a Soroban transaction that has a muxed M… source account, on the transaction or on an operation, or that has a memo. addSacTransferOperation() throws as soon as it is called on a builder with a muxed source. The network rejects all of these, so the transaction could never succeed (#1811, #1835).
• In Node, and in the Fetch build in a browser, Federation.Server no longer follows redirects. Before, it followed up to 21 redirects in the Axios build and up to 20 in the Fetch build, although the v15.1.0 entry for #1390 listed a redirect guard for it. The Axios build in a browser, and both builds in React Native, still follow redirects, because XHR follows them itself. To follow redirects, set the new allowedRedirects option, as for StellarToml.Resolver.resolve(). createForDomain() and resolve() also apply it to the stellar.toml request. The constructor, createForDomain() and resolve() throw when allowedRedirects is not 0 or a whole number up to Number.MAX_SAFE_INTEGER, such as NaN, Infinity, -1, 1.5 or 2 ** 54 (#1809).
• Spec.parseEvent() matches a map event declaration only when the event data is an scvMap, and a vec declaration only when the data is an scvVec. Otherwise it tries the next declaration. Before, it treated other data as an empty map or vec. A map declaration then matched without its data params, so a single-value event declared later never matched. For example, a mint event with i128 data was returned as the map-format Mint without its amount, in place of MintWithAmountOnly. The generated bindings' event parsing method calls Spec.parseEvent(), so it has the same fix (#1817).
• TransactionBuilder.build(), TransactionBuilder.cloneFrom(), TransactionBuilder.buildFeeBumpTransaction() and rpc.assembleTransaction() throw when a Soroban resourceFee is below 0 or above 2^50. Before, a negative value raised the fee in cloneFrom() and assembleTransaction(), and build() made a transaction that the network rejects. When the resourceFee equals the fee, cloneFrom() and assembleTransaction() now use an inclusion fee of 0. Before, they counted the resource fee twice, so AssembledTransaction.sign() with fee: "0" signed 2 × the resource fee (#1832).
• authorizeEntry() replaces the other signatures of a SOROBAN_CREDENTIALS_ADDRESS_WITH_DELEGATES entry with scvVoid when validUntilLedgerSeq differs from a non-zero stored expiration. The top-level account and all delegates sign one payload that includes the expiration. Before, the call changed the stored expiration and kept the other signatures, which then did not verify. checkAuthEntryReadiness() now lists those signers in unsignedBy. When the stored expiration is 0, as simulation returns, authorizeEntry() keeps an ed25519 signature on another node only when it verifies at validUntilLedgerSeq. It keeps a custom signature as it is. AssembledTransaction.signAuthEntries() keeps the stored expiration of a SOROBAN_CREDENTIALS_ADDRESS_WITH_DELEGATES entry by default while it lies within the next 100 ledgers. So delegates that signed first keep their signatures. Every other entry gets the latest ledger + 100, as before. An explicit expiration still applies to every entry (#1830).
• The docs of the generated .value getter on string<N> union arms (xdr.Memo memoText, and xdr.ScVal scvString, scvSymbol and scvExecutableTag) now say that it decodes leniently: bytes that are not valid UTF-8 become U+FFFD, so a value rebuilt from .value can have different bytes. The arm field (.text, .str, .sym, .executableTag) keeps the bytes. The docs of XdrString and Memo.text() now say that a lone surrogate in a JS string encodes as U+FFFD with no error. The XdrString header comment also said that toString() renders the SEP-0051 escape form. That form comes from toJson() (#1824).
• The SDK throws "Expected at most one 'contractspecv0' section in wasm, found " when a Wasm has more than one contractspecv0 custom section. Empty sections count. This applies to contract.Spec.fromWasm(), to contract.Client.fromWasm(), fromWasmHash(), from() and deploy(), to BindingGenerator.fromWasm(), fromWasmHash() and fromContractId(), and to the bindings CLI. Before, the SDK used the first non-empty section and ignored the others. Other tools can read a different section, so they could show a different contract interface. SEP-48 stores the interface in one section. A section name with a leading byte-order mark no longer counts as contractspecv0, which matches wasmparser-based tools (#1827).

Full Changelog: stellar/js-stellar-sdk@v17.2.1...v17.3.0

v17.2.1

v17.2.1

... (truncated)

Changelog

Sourced from @​stellar/stellar-sdk's changelog.

v17.3.0

Added

• CAP-84 muxed contract (W…) addresses. StrKey adds encodeMuxedContract(), decodeMuxedContract() and isValidMuxedContract(). Address adds the muxedContract type and Address.muxedContract(). The new encodeMuxedContractAddress() builds a W… address from a C… address and an ID. extractBaseAddress() also accepts a C… address, which it returns unchanged, and a W… address, for which it returns the base C… address. TransactionBuilder.addSacTransferOperation() accepts a W… destination (#1811).
• Horizon contract_credited effects (ContractCredited) have optional contract_muxed and contract_muxed_id fields. Horizon sets them when a Stellar Asset Contract transfer or mint sends to a muxed contract (W…) address. contract_muxed_id is a decimal string (#1836, stellar-horizon#237).
• The XDR types are regenerated from stellar-xdr with CAP-84, CAP-87 and CAP-88 enabled. xdr.ScAddress adds the scAddressTypeMuxedContract arm and xdr.MuxedContract. xdr.ContractCostType adds the ML-DSA cost types, from mlDsa44DecodeVerifyingKey to verifyMlDsa87Sig. xdr.StellarValueType adds stellarValueSignedMs and stellarValueEmptyTxSetMs, with xdr.StellarValueSignedMsValue and xdr.StellarValueProposedMsValue. The new SC_SPEC_TYPE_NAME_LIMIT constant (1024) raises the limit on contract spec type names from 60. Code that switches over these unions with an exhaustive check must handle the new arms (#1795, #1796, #1797).

Changed

• inSuccessfulContractCall on rpc.Api.EventResponse and rpc.Api.RawEventResponse is optional and deprecated, because newer RPC servers no longer return it from getEvents (#1836, stellar-rpc#1050). With such a server it is undefined. Code that uses it as a boolean can fail to compile under strict. The field will be removed in the next major release.
• The rpc.Server constructor throws when timeout is not 0 or a whole number of milliseconds up to 2147483647. Examples are NaN, a negative number or a fraction. Before, it accepted any value and ignored it. The CLI's --timeout flag has the same upper limit (#1802).
• StellarToml.Resolver.resolve() rejects before the request when allowedRedirects is not 0 or a whole number up to Number.MAX_SAFE_INTEGER. Before, it passed the value to the HTTP client. In Node, the Fetch build followed redirects without limit for NaN, and both builds did so for Infinity (#1809).
• TransactionBuilder.setTimeout() now throws "timeout ends before min_time" when a positive timeout ends before an existing minTime. Before, it built a transaction with minTime after maxTime, which is never valid (#1781).
• When you set maxRedirects or maxContentLength, the Fetch client rejects a successful response whose body is not valid UTF-8, with "Response body is not valid UTF-8". Before, it replaced the invalid bytes with U+FFFD and returned the result. The client still ignores the charset of Content-Type, because a stellar.toml file and a federation response must be UTF-8. A non-2xx response still rejects with its HTTP error (#1804).
• Federation.Server.createForDomain() and Federation.Server.resolve() reject a FEDERATION_SERVER URL from stellar.toml that has a user name or password, or a scheme other than http: or https:, even when allowHttp is set. The SDK does not check the host, so a URL can point to a private or local address, such as https://10.0.0.5. A server-side application that resolves untrusted addresses must filter the hosts it connects to. When allowedRedirects is set, redirect targets are not checked. The Federation.Server constructor does not check the URL that you pass to it (#1809).
• Contract clients reject a muxed (M… or W…) address for an Address parameter; pass it to a MuxedAddress parameter instead. authorizeEntry(), authorizeInvocation() and buildWithDelegatesEntry() reject a muxed signer or delegate address. rpc.Server.getContractData() rejects a muxed owner and a key that contains a muxed address. rpc.Server.getAssetBalance() and getSACBalance() reject a muxed address, since balances are held by the base address. Before, each of these built a request that the network rejects or can never match (#1811, #1835).
• nativeToScVal() and Spec.nativeToScVal() throw a TypeError for a function value. Before, they called the function and converted its result. To keep the old result, call the function and pass its return value. Spec also treats a struct field named like an inherited Object.prototype function as missing when the value does not set it. Examples are toString and constructor. Before, contract clients encoded that field from the inherited function, for example toString as "[object Undefined]" (#1834).

Fixed

• toJson() on a MuxedEd25519Account, or on an ScAddress that holds one, throws when the ID is outside the uint64 range. Before, it wrapped the ID, so -1n gave an M… address with ID 2^64 - 1 and 2n ** 64n gave one with ID 0. toXdr() already threw for these IDs (#1811).
• CallBuilder.stream() passes an event that it cannot parse to onerror and keeps the stream open. onerror gets a MessageEvent of type "error" whose data is the parse error. The stream moves its cursor to the event's SSE id, so a reconnect does not get the event again. An onerror handler that closes the stream now also closes it on such an event. Before, the event listener threw the error as an uncaught exception, which stops a Node.js process that has no handler for it (#1806).
• Horizon records no longer get a link method whose name is then, toJSON, paging_token, _links or the name of an Object.prototype property, such as __proto__ or constructor. The link stays in _links. Before, a then link made call() hang while it sent requests in a loop. A toJSON link made JSON.stringify() return {} and send a request. A __proto__ link changed the record's prototype. A paging_token link made stream() reconnect with the link function's source code as its cursor. A _links link replaced _links with a function, so each link method after it threw (#1806).
• scValToNative() throws a TypeError when two keys of an scvMap convert to the same object property, such as u32 1 and symbol "1". It previously kept only the last entry. Maps whose keys all convert to distinct properties decode as before. Because any contract can emit such a map, humanizeEvents() and contract-client decoding of Val-typed values can now throw on data read from the network (#1778).
• Templated Horizon _links functions now resolve a relative href the same way non-templated links do. They previously threw TypeError: Invalid URL (#1771).
• MuxedAccount, encodeMuxedAccount() and Keypair.xdrMuxedAccount() accept an ID only as decimal digits. MuxedAccount returns the ID in canonical form from id(). Before, any string that BigInt() accepts passed, such as "0x10", " 16 " or "". id() returned that string as typed, so two objects for the same M-address could report different IDs, and an empty string silently became ID 0. An ID string longer than 22 characters is now rejected before it is parsed, so a very long string no longer costs CPU time and memory (#1780).
• Operation.manageSellOffer() and Operation.manageBuyOffer() accept offerId only as a non-negative safe integer, a non-negative bigint, or a string of decimal digits, up to the int64 maximum. Operation.revokeOfferSponsorship() applies the same rule, and now also accepts a number or a bigint offerId, such as the offerId of a decoded LedgerKeyOffer. Before, a number above 2^53 - 1 was rounded and could name a different offer. An empty string meant offer 0, and a negative ID built an operation that the network rejects. An offerId string longer than 22 characters is now rejected before it is parsed (#1780).
• TransactionBuilder.setTimeout(TimeoutInfinite) keeps an existing minTime. Before, it reset both time bounds to 0, so a transaction meant to become valid later was valid at once (#1781).
• new Asset(code, issuer) keeps an issued asset's code as given. It previously changed every spelling of xlm to XLM, even when an issuer was present. As a result, Asset.fromOperation() and transaction.operations showed XLM:G… for an operation on xlm:G…. Encoding the decoded asset again also changed its bytes. An asset built as new Asset("xlm", issuer) now encodes xlm, so its contract ID changes. To keep the old asset, pass XLM (#1784).
• Transaction and FeeBumpTransaction now decode their own copy of a TransactionEnvelope object passed to the constructor, to TransactionBuilder.fromXdr() or from TransactionBuilder.build(). Before, they kept the caller's object. A later change to that object altered what hash(), sign() and toXdr() used, but not always what operations showed. An envelope that cannot be encoded, such as one with more than 100 operations, now fails in the constructor and in TransactionBuilder.build(), not later in toXdr() or sign() (#1784).
• WebAuth.readChallengeTx(), verifyChallengeTxSigners() and verifyChallengeTxThreshold() throw an InvalidChallengeError when a challenge's client_domain operation has no source account. SEP-10 requires that source to be the client domain's signing key. The verifiers previously skipped the client domain signature check for such a challenge. (#1788)
• WebAuth.buildChallengeTx() throws when clientSigningKey is the server's public key. WebAuth.readChallengeTx(), verifyChallengeTxSigners() and verifyChallengeTxThreshold() throw InvalidChallengeError when the client_domain operation's source account is the server account. The server signature previously also counted as the client domain signature, and verifyChallengeTxSigners() could leave a valid client signer out of its result. (#1791)
• In Node, when maxRedirects is set, the Fetch client rejects a redirect to a URL that is not http: or https:. It also rejects a redirect from https: to http:. Before, it followed both. For example, StellarToml.Resolver.resolve() with allowedRedirects returned the content of a data: URL. When a redirect changes the method to GET, the client now also removes the Content-Encoding, Content-Language, Content-Location and Content-Range headers. (#1799)
• rpc.Server now applies its timeout option to each request. Before, the option was ignored, so a request to a server that did not answer stayed pending. This also fixes the --timeout flag of the bindings CLI, which had no effect (#1802).
• The Fetch client sends params when the URL has a # fragment. Before, it added them after the fragment, so the server did not receive them. When there are params, the fragment is now left out of the request URL, as in the Axios build (#1804).
• In Node, when maxRedirects is set, the Fetch client keeps only a safe set of headers on a redirect to another origin: Accept, Accept-Encoding, Accept-Language, Content-Type, Content-Length, Content-Encoding, Content-Language, Content-Location, Content-Range, User-Agent, Range, Cache-Control, Pragma, the If-* conditional headers, X-Client-Name, X-Client-Version, X-App-Name and X-App-Version. Other custom headers, such as traceparent, are dropped too. An http: to https: redirect on the same host counts as another origin. Before, the client removed only Authorization, Proxy-Authorization and Cookie. Other credential headers, such as the Horizon authToken (X-Auth-Token) or an API key in headers, reached the new origin. A redirect to the same origin keeps all headers (#1814).
• AssembledTransaction.sign() and signAndSend() keep the fee from simulation. Before, they added the Soroban resource fee to the fee a second time, which raised the inclusion fee bid. The automatic footprint restore now uses the fee option (or BASE_FEE) as the inclusion fee. Before, it used the restore's resource fee as the inclusion fee and ignored fee. Set fee to bid more during surge pricing. restoreFootprint() still accepts minResourceFee but does not use it (#1808).
• Contract client MuxedAddress parameters accept an Address object, as their string | Address type says. Before, they threw "was not address, but value was Address" (#1811).
• TransactionBuilder.build() throws for a Soroban transaction that has a muxed M… source account, on the transaction or on an operation, or that has a memo. addSacTransferOperation() throws as soon as it is called on a builder with a muxed source. The network rejects all of these, so the transaction could never succeed (#1811, #1835).
• In Node, and in the Fetch build in a browser, Federation.Server no longer follows redirects. Before, it followed up to 21 redirects in the Axios build and up to 20 in the Fetch build, although the v15.1.0 entry for #1390 listed a redirect guard for it. The Axios build in a browser, and both builds in React Native, still follow redirects, because XHR follows them itself. To follow redirects, set the new allowedRedirects option, as for StellarToml.Resolver.resolve(). createForDomain() and resolve() also apply it to the stellar.toml request. The constructor, createForDomain() and resolve() throw when allowedRedirects is not 0 or a whole number up to Number.MAX_SAFE_INTEGER, such as NaN, Infinity, -1, 1.5 or 2 ** 54 (#1809).
• Spec.parseEvent() matches a map event declaration only when the event data is an scvMap, and a vec declaration only when the data is an scvVec. Otherwise it tries the next declaration. Before, it treated other data as an empty map or vec. A map declaration then matched without its data params, so a single-value event declared later never matched. For example, a mint event with i128 data was returned as the map-format Mint without its amount, in place of MintWithAmountOnly. The generated bindings' event parsing method calls Spec.parseEvent(), so it has the same fix (#1817).
• TransactionBuilder.build(), TransactionBuilder.cloneFrom(), TransactionBuilder.buildFeeBumpTransaction() and rpc.assembleTransaction() throw when a Soroban resourceFee is below 0 or above 2^50. Before, a negative value raised the fee in cloneFrom() and assembleTransaction(), and build() made a transaction that the network rejects. When the resourceFee equals the fee, cloneFrom() and assembleTransaction() now use an inclusion fee of 0. Before, they counted the resource fee twice, so AssembledTransaction.sign() with fee: "0" signed 2 × the resource fee (#1832).
• authorizeEntry() replaces the other signatures of a SOROBAN_CREDENTIALS_ADDRESS_WITH_DELEGATES entry with scvVoid when validUntilLedgerSeq differs from a non-zero stored expiration. The top-level account and all delegates sign one payload that includes the expiration. Before, the call changed the stored expiration and kept the other signatures, which then did not verify. checkAuthEntryReadiness() now lists those signers in unsignedBy. When the stored expiration is 0, as simulation returns, authorizeEntry() keeps an ed25519 signature on another node only when it verifies at validUntilLedgerSeq. It keeps a custom signature as it is. AssembledTransaction.signAuthEntries() keeps the stored expiration of a SOROBAN_CREDENTIALS_ADDRESS_WITH_DELEGATES entry by default while it lies within the next 100 ledgers. So delegates that signed first keep their signatures. Every other entry gets the latest ledger + 100, as before. An explicit expiration still applies to every entry (#1830).
• The docs of the generated .value getter on string<N> union arms (xdr.Memo memoText, and xdr.ScVal scvString, scvSymbol and scvExecutableTag) now say that it decodes leniently: bytes that are not valid UTF-8 become U+FFFD, so a value rebuilt from .value can have different bytes. The arm field (.text, .str, .sym, .executableTag) keeps the bytes. The docs of XdrString and Memo.text() now say that a lone surrogate in a JS string encodes as U+FFFD with no error. The XdrString header comment also said that toString() renders the SEP-0051 escape form. That form comes from toJson() (#1824).
• The SDK throws "Expected at most one 'contractspecv0' section in wasm, found " when a Wasm has more than one contractspecv0 custom section. Empty sections count. This applies to contract.Spec.fromWasm(), to contract.Client.fromWasm(), fromWasmHash(), from() and deploy(), to BindingGenerator.fromWasm(), fromWasmHash() and fromContractId(), and to the bindings CLI. Before, the SDK used the first non-empty section and ignored the others. Other tools can read a different section, so they could show a different contract interface. SEP-48 stores the interface in one section. A section name with a leading byte-order mark no longer counts as contractspecv0, which matches wasmparser-based tools (#1827).

v17.2.1

Fixed

• Asset.compare() orders two assets with the same code by their issuers' key bytes, as stellar-core does, instead of by the G… strkey text. The two orders can differ, so getLiquidityPoolId() and new LiquidityPoolAsset() rejected some valid asset pairs as out of order (#1766).
• scvSortedMap() and nativeToScVal() now sort map keys in the order the Soroban host requires: by ScVal type, then by value. They previously compared the keys' native string forms, so address, bytes, and mixed-type keys could come out in an order the host rejects. A plain object's keys are now sorted after conversion, so { 10: …, 9: … } with u32 keys becomes [9, 10]. Maps that mix key types change order: scvString keys now come before scvSymbol keys, whatever their names (#1766).

Commits

• 0f2fd40 chore(release): prepare v17.3.0 (#1837)
• 6d7521a fix: close muxed-address gaps from #1811 (#1835)
• 981ded5 fix(contract): reject function values when encoding ScVals (#1834)
• 5371a5c Update RPC and Horizon types for Protocol 30 server releases (#1836)
• fc67639 fix(base): clear delegate signatures a new expiration invalidates (#1830)
• 3a701d8 fix(base): bound the resource fee and stop double-counting it (#1832)
• 325e10c fix(contract): reject duplicate contractspecv0 wasm sections (#1827)
• c997839 docs(xdr): document where XDR strings can change bytes (#1824)
• 935279e feat: support CAP-84 muxed contract (W...) addresses (#1811)
• 6bb7127 fix(contract): match events on their declared data format (#1817)
• Additional commits viewable in compare view

Updates dotenv from 18.0.4 to 18.0.9

Changelog

Sourced from dotenv's changelog.

18.0.9 (2026-10-14)

Changed

• Permit DOTENV_PATH being empty string with the CLI (#1076)

18.0.8 (2026-10-14)

Changed

• Fast parser should strip appended extra quotes (#1073)
• Type detail improvement (#1074)

18.0.7 (2026-10-09)

Changed

• Treat undefined settings like quiet: true as null rather than falsey (#1070)
• CLI should honor DOTENV_QUIET setting in .env file (#1071)

18.0.6 (2026-10-06)

Changed

• Use smarter parseBoolean not Boolean() to fix override (#1069)

18.0.5 (2026-09-30)

Changed

• Fix missing typescript module declaration (#1068)
• Improve performance for large .env files (#1066)

Commits

• 8d1ab85 18.0.9
• 59a40ce changelog
• 88228bd Merge pull request #1076 from Enesuygurs/fix/cli-empty-dotenv-path
• bc6ef94 fix(cli): load the default .env when DOTENV_PATH is empty
• 6d6e6c5 Merge pull request #1075 from kory-kaai/test/fast-parser-branch-coverage
• 10218f1 test(parse-fast): cover the size-dependent and export-prefix branches
• e2fe95e 18.0.8
• 7aa712a type detail improvement
• 53405b0 Merge pull request #1074 from himanshu748/codex/fix-dotenv-populate-undefined...
• 0b4843a changelog
• Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting...

  Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
stellar-stream	Error		Oct 26, 2026 7:27am UTC

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9992a0bc-2513-4269-a9b1-b146cf3ee319

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}