[dependabot]

Bumps soroban-sdk from 22.0.11 to 29.0.1.

Release notes

Sourced from soroban-sdk's releases.

29.0.1

What's Changed

• Update soroban-env to 29.0.1 stellar/rs-soroban-sdk#2129
  • Contains a fix to the wasmi runtime that was included, v29.0.0 erroneously contained the wasmi runtime from v28.

Full Changelog: stellar/rs-soroban-sdk@v29.0.0...v29.0.1

29.0.0

What Changed

• Update soroban-env crates to 29.0.0 stellar/rs-soroban-sdk@cca906d

Full Changelog: stellar/rs-soroban-sdk@v28.0.0...v29.0.0

28.0.0

This is a release supporting Protocol 28. Upgrading requires changes to some contracts. See the migration guide for the full detail on each breaking change below.

Breaking changes

• Build contracts with stellar-cli v25.2.0 or newer. Spec shaking v2 is now always on, so the SDK emits a spec entry for every type and relies on the build system to strip the unreachable ones. Remove the experimental_spec_shaking_v2 feature from the soroban-sdk dependency, and remove any export = ... argument from contracttype, contracterror, and contractevent, which is now a compile error. Native builds and unit tests are unaffected. #1968
• Remove any lib = ... argument from contracttype, contracterror, and contractevent. It is now a compile error, and contractimport! always generates the full type definition instead of aliasing into another crate. #1951 #2000
• A contracttype struct can be read from stored data with extra or missing fields (CAP-86). A field missing from the map reads as None if it is an Option, and errors otherwise, and a map key that is not a field of the struct is ignored and dropped, where both used to panic. An Option field can now be added or removed without migrating everything already stored. Writing is unchanged and still writes every field. #2006
• Events no longer publish fields that are unset (CAP-86). In a contractevent with data_format = "map", a field whose value is void, or Option::None, is left out of the published map rather than written as a key with a void value. Any off-chain system consuming the events must tolerate the absent key. Keep publishing every field with #[contractevent(sparse = false)]. #2008
• Deploying and upgrading take a ContractExecutable (CAP-85). deploy_contract replaces deploy_v2, and update_current_contract replaces update_current_contract_wasm; the old ones still work but are deprecated. Wrap the Wasm hash in ContractExecutable::Wasm(...) to migrate. #2020
• Test snapshots change for tests that register contracts natively. Every natively registered contract now gets its own contract code entry rather than sharing one empty entry, so snapshot JSON files are regenerated on upgrade. For a test that depended on contracts sharing a code entry, upload the contract once with Env::upload and deploy it repeatedly instead. #2014
• The Approve event field expiration_ledger is renamed live_until_ledger, matching the name SEP-41 uses. Rename it wherever the event is constructed or matched on. #1985
• #[contractimpl(contracttrait)] on an impl block that does not implement a trait is now a compile error. It was accepted and silently did nothing. #1992
• Some test utilities now panic when called inside a contract function. Call them from the test, outside the contract. #2010

New features

• Protocol 28 support, with soroban-env-* at 28.0.2 and stellar-xdr at 28.0.0. #1986
• Manage contract executable references from a contract (CAP-85) with Env::executable_refs(), and deploy from one by passing ContractExecutable::ExternalRef. #2020
• Upload a natively defined contract in tests with Env::upload and Env::upload_at, making it possible to test a factory, or any other contract that deploys from an existing code entry, without needing to build the contract to Wasm. #2007
• Fuzz and property test with account addresses using the new ArbitraryAddressAccount prototype, which generates G... addresses so the account path of a contract gets exercised. ArbitraryAddress still generates contract addresses and is also named ArbitraryAddressContract. #2024
• Use SorobanArbitrary prototypes with proptest, now documented in testutils::proptest. #2011

Fixes

• MuxedAddress values from different Envs can be compared in tests. #2047
• BytesN<N> rejects an N larger than u32::MAX when converting from Bytes. #2050
• Generated and internal spec XDR statics are now private and hidden from docs. #2054 #2032

Full Changelog: stellar/rs-soroban-sdk@v27.0.6...v28.0.0

28.0.0-rc.2

This is a pre-release supporting Protocol 28, and follows v28.0.0-rc.1. Upgrading requires changes to some contracts. See the migration guide for the full detail on each breaking change, including those released in rc.1.

Note that any changes including breaking changes may be made until the stable release.

... (truncated)

Commits

• e1671a0 fix afl fuzz lock
• f3ef25f update env to 29.0.1
• 7a3cf65 Update fuzz Cargo.lock for 29.0.1
• b492cef Bump version to 29.0.1
• 73ea6c0 add extend_ttl overflow tests and docs
• cca906d update soroban-env crates to 29.0.0
• 253c534 Update fuzz Cargo.lock for 29.0.0
• 621a172 Bump version to 29.0.0
• 48d5067 Bump version to 28.0.0 (#2067)
• 3bb283c Fix contractimport! doc example and generated-client name in docs (#2056)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
trustlend-stellar	Ready	Preview	Oct 22, 2026 5:55pm UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2eec5d8b-5839-42a6-90e7-e1b879f93e30

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thisisouvik]

Closing: soroban-sdk 29.0.1 targets Protocol 28/29 which introduces breaking API and event/spec changes incompatible with the current Stellar testnet/Protocol 22 contracts.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.