[dependabot]

Bumps the npm-dependencies group with 39 updates in the /frontend directory:

Package	From	To
@sentry/nextjs	8.28.0	11.11.0
@stellar/freighter-api	3.1.0	6.0.1
@stellar/stellar-sdk	14.6.1	17.4.0
@tanstack/react-query	5.101.0	5.106.1
framer-motion	11.18.2	14.9.1
lucide-react	0.414.0	1.69.0
next	14.2.35	16.4.5
react	18.3.1	19.3.1
@types/react	18.3.31	19.3.0
react-dom	18.3.1	19.3.1
@types/react-dom	18.3.7	19.3.0
sonner	1.7.4	2.0.8
tailwind-merge	2.6.1	3.7.0
zustand	4.5.7	5.0.16
@babel/core	7.29.7	8.1.0
@babel/preset-env	7.29.7	8.0.7
@babel/preset-react	7.29.7	8.0.1
@babel/preset-typescript	7.29.7	8.0.7
@lhci/cli	0.15.1	0.16.0
@next/bundle-analyzer	14.2.35	16.4.5
@playwright/test	1.62.1	1.65.0
@testing-library/dom	10.4.1	10.4.2
@testing-library/jest-dom	6.9.1	7.0.1
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.1	14.6.8
@types/node	20.19.43	26.6.6
@types/react	18.3.31	19.3.0
@types/react-dom	18.3.7	19.3.0
autoprefixer	10.5.0	10.6.2
babel-jest	30.4.1	30.5.2
eslint	8.57.1	10.14.0
eslint-config-next	14.2.35	16.4.5
eslint-config-prettier	9.1.0	10.1.8
jest	30.4.2	30.5.2
jest-axe	9.0.0	11.0.0
jest-environment-jsdom	30.4.1	30.5.2
postcss	8.5.15	8.5.23
prettier	3.3.3	3.9.10
tailwindcss	3.4.19	4.3.4
typescript	5.9.3	7.0.2
undici	6.28.0	8.12.4

Updates @sentry/nextjs from 8.28.0 to 11.11.0

Release notes

Sourced from @​sentry/nextjs's releases.

11.11.0

Important Changes

• ref(cloudflare): Use the shared request handler wrapper (#25588)

  Cloudflare Workers now use the same request handler wrapper as Deno.serve and Bun.serve. Changes for Cloudflare users:

  • Request spans now set client.address from the CF-Connecting-IP header (or another forwarding header), as on the other runtimes. This follows dataCollection.userInfo, which is true by default. To leave it out, set dataCollection: { userInfo: false }.
  • Request spans now have the response header attributes, and events have the response context with the status code.
  • When the source of a streamed response fails, the SDK now captures the error and marks the span as failed. With captureErrors: false, it does not capture it.
  • Request spans now list every Set-Cookie header of a response, as on Deno and Bun.
  • Without AsyncLocalStorage (for example on Shopify Oxygen), events now also get the request URL and method.

• feat(nestjs): Add an option to monitor every @​Cron method (#25471)

  Set monitorCronJobs: true on nestIntegration() to send check-ins for every @Cron() method, without adding @SentryCron to each one. It's off by default. Each monitored job creates a monitor in Sentry, and monitors are billed. Use excludeCronJobs to skip jobs by slug. Methods that also have @SentryCron check in once, with the slug and options passed to @SentryCron.

• feat(node): Add cronJobIntegration to monitor cron jobs (#25477)

  Add Sentry.cronJobIntegration() to integrations to send check-ins for every named CronJob of the cron package (4.3+), with the job name as the monitor slug. It's off by default. Each monitored job creates a monitor in Sentry, and monitors are billed. Use excludeJobs to skip jobs by name. Sentry.cron.instrumentCron is deprecated; use cronJobIntegration instead.

• fix(server-utils): Instrument @​anthropic-ai/sdk 1.x and turn off its own OTel spans (#25750)

  The Anthropic integration now instruments @anthropic-ai/sdk 1.x. Since 0.134 the SDK also records its own OpenTelemetry spans, such as anthropic.messages.create, which duplicated Sentry's gen_ai spans. Once Sentry instruments the SDK, it sets ANTHROPIC_OPEN_TELEMETRY=false to turn those spans off. To keep them, set ANTHROPIC_OPEN_TELEMETRY=true or pass the openTelemetry option to the Anthropic client.

• feat(nextjs): Mark pageloads of cached pages (#25318)

  When Next.js serves a page from its cache, for example an ISR page or a cacheComponents shell, the pageload now has the page.server_rendering.type attribute. It is static if the whole page came from the cache, and partially_static if parts of it rendered for this request. Then the pageload stays connected to this request, as before. If the request that rendered the cached page was sampled, the pageload also links to it. So in Sentry, a cached page no longer looks like missing server instrumentation.

Other Changes

• feat(astro): Add @sentry/astro/integration entry for the Astro integration (#25726)
• feat(bundler-plugins): Add sourcemaps.deleteSourcemapsAfterUpload and staged uploads (#25637)
• feat(nestjs): Derive SentryCron monitor config from @​Cron (#25013)
• feat(nextjs): Add applicationKeyExcludeDependencies option (#25818)
• feat(node): Add awsLambdaWebIntegration for Lambda Web Functions (#25355)
• feat(node): Add BullMQ integration (#21777)
• feat(node): Add nodeCronIntegration to monitor node-cron tasks (#25473)
• feat(node): Add nodeScheduleIntegration to monitor node-schedule jobs (#25474)
• feat(node): Support postgres v4 through its native tracing channels (#26076)
• feat(server-utils): Extract getSqlSpanName for SQL span names (#25929)
• feat(server-utils): Move to new getSqlQueryAttributes helper for consistency (#25927)
• feat(server-utils): Record AI SDK v7 runtime and tool context on Vercel AI spans (#25774)
• feat(server-utils): Set db.operation.name on SQL spans (#25850)
• feat(server-utils): Support @​mistralai/mistralai v3 (#25827)
• feat(solidstart): Export withSentry from @sentry/solidstart/vite (#25725)
• fix(astro): Initialize the server SDK on the first endpoint request (#25731)
• fix(browser): Attribute long animation frame spans to the longest script (#25990)
• fix(bundler-plugins): Inject debug IDs into every esbuild rebuild (#26099)
• fix(bundler-plugins): upload literal artifact paths (#25356)

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

11.11.0

Important Changes

• ref(cloudflare): Use the shared request handler wrapper (#25588)

  Cloudflare Workers now use the same request handler wrapper as Deno.serve and Bun.serve. Changes for Cloudflare users:

  • Request spans now set client.address from the CF-Connecting-IP header (or another forwarding header), as on the other runtimes. This follows dataCollection.userInfo, which is true by default. To leave it out, set dataCollection: { userInfo: false }.
  • Request spans now have the response header attributes, and events have the response context with the status code.
  • When the source of a streamed response fails, the SDK now captures the error and marks the span as failed. With captureErrors: false, it does not capture it.
  • Request spans now list every Set-Cookie header of a response, as on Deno and Bun.
  • Without AsyncLocalStorage (for example on Shopify Oxygen), events now also get the request URL and method.

• feat(nestjs): Add an option to monitor every @​Cron method (#25471)

  Set monitorCronJobs: true on nestIntegration() to send check-ins for every @Cron() method, without adding @SentryCron to each one. It's off by default. Each monitored job creates a monitor in Sentry, and monitors are billed. Use excludeCronJobs to skip jobs by slug. Methods that also have @SentryCron check in once, with the slug and options passed to @SentryCron.

• feat(node): Add cronJobIntegration to monitor cron jobs (#25477)

  Add Sentry.cronJobIntegration() to integrations to send check-ins for every named CronJob of the cron package (4.3+), with the job name as the monitor slug. It's off by default. Each monitored job creates a monitor in Sentry, and monitors are billed. Use excludeJobs to skip jobs by name. Sentry.cron.instrumentCron is deprecated; use cronJobIntegration instead.

• fix(server-utils): Instrument @​anthropic-ai/sdk 1.x and turn off its own OTel spans (#25750)

  The Anthropic integration now instruments @anthropic-ai/sdk 1.x. Since 0.134 the SDK also records its own OpenTelemetry spans, such as anthropic.messages.create, which duplicated Sentry's gen_ai spans. Once Sentry instruments the SDK, it sets ANTHROPIC_OPEN_TELEMETRY=false to turn those spans off. To keep them, set ANTHROPIC_OPEN_TELEMETRY=true or pass the openTelemetry option to the Anthropic client.

• feat(nextjs): Mark pageloads of cached pages (#25318)

  When Next.js serves a page from its cache, for example an ISR page or a cacheComponents shell, the pageload now has the page.server_rendering.type attribute. It is static if the whole page came from the cache, and partially_static if parts of it rendered for this request. Then the pageload stays connected to this request, as before. If the request that rendered the cached page was sampled, the pageload also links to it. So in Sentry, a cached page no longer looks like missing server instrumentation.

Other Changes

• feat(astro): Add @sentry/astro/integration entry for the Astro integration (#25726)
• feat(bundler-plugins): Add sourcemaps.deleteSourcemapsAfterUpload and staged uploads (#25637)
• feat(nestjs): Derive SentryCron monitor config from @​Cron (#25013)
• feat(nextjs): Add applicationKeyExcludeDependencies option (#25818)
• feat(node): Add awsLambdaWebIntegration for Lambda Web Functions (#25355)
• feat(node): Add BullMQ integration (#21777)
• feat(node): Add nodeCronIntegration to monitor node-cron tasks (#25473)
• feat(node): Add nodeScheduleIntegration to monitor node-schedule jobs (#25474)
• feat(node): Support postgres v4 through its native tracing channels (#26076)
• feat(server-utils): Extract getSqlSpanName for SQL span names (#25929)
• feat(server-utils): Move to new getSqlQueryAttributes helper for consistency (#25927)
• feat(server-utils): Record AI SDK v7 runtime and tool context on Vercel AI spans (#25774)
• feat(server-utils): Set db.operation.name on SQL spans (#25850)
• feat(server-utils): Support @​mistralai/mistralai v3 (#25827)
• feat(solidstart): Export withSentry from @sentry/solidstart/vite (#25725)
• fix(astro): Initialize the server SDK on the first endpoint request (#25731)
• fix(browser): Attribute long animation frame spans to the longest script (#25990)
• fix(bundler-plugins): Inject debug IDs into every esbuild rebuild (#26099)

... (truncated)

Commits

• eadbabb release: 11.11.0
• 7e24c6b Merge pull request #26122 from getsentry/prepare-release/11.11.0
• 3b15c56 meta(changelog): Update changelog for 11.11.0
• b765940 fix(nextjs): Drop tunnel requests under the Next.request proxy root span (#26...
• 88a5e3b chore(deps): Bump @​actions/core and @​actions/github in internal GH actions (#...
• b310704 chore(deps): Bump undici from 6.24.1 to 6.29.1 (#26108)
• 1bd5136 fix(nextjs): Don't abort Cache Components renders on Cloudflare Workers when ...
• a1162e3 feat(node): Support postgres v4 through its native tracing channels (#26076)
• e4eff2c fix(browser): Attribute long animation frame spans to the longest script (#25...
• 77f71ea fix(bundler-plugins): Inject debug IDs into every esbuild rebuild (#26099)
• Additional commits viewable in compare view

Updates @stellar/freighter-api from 3.1.0 to 6.0.1

Release notes

Sourced from @​stellar/freighter-api's releases.

@​stellar/freighter-api@​6.0.0

What's Changed

• Freighter api release/6.0.0 by @​piyalbasu in stellar/freighter#2395
• Update signAuthEntry return type to correctly reflect that it's a base64 string of the signed hash

Full Changelog: https://github.com/stellar/freighter/compare/5.36.0-beta.0...@​stellar/freighter-api@6.0.0

Commits

• See full diff in compare view

Updates @stellar/stellar-sdk from 14.6.1 to 17.4.0

Release notes

Sourced from @​stellar/stellar-sdk's releases.

v17.4.0

v17.4.0

Added

• rpc.Server.queryEvents() fetches one page of events with the new queryEvents RPC method. Only the archival RPC node serves it, and it is in beta. A request is a ledger range query or a cursor continuation, and filter topics can be ScVals. rpc.Api.isQueryEventsError() narrows its typed errors, and rpc.parseRawQueryEvents() parses a raw response from _queryEvents(). getEvents() is unchanged (#1839).

Fixed

• Operation.toXdrPrice() throws "price must be positive" for a {n, d} price whose n is 0. Before, it returned a zero price, which the network rejects as malformed. This affects manageSellOffer(), manageBuyOffer(), createPassiveSellOffer() and liquidityPoolDeposit(). A zero price in number or string form already threw (#1843).

Full Changelog: stellar/js-stellar-sdk@v17.3.0...v17.4.0

v17.3.0

v17.3.0: Protocol 30

Added

• CAP-84 muxed contract (W…) addresses. StrKey adds encodeMuxedContract(), decodeMuxedContract() and isValidMuxedContract(). Address adds the muxedContract type and Address.muxedContract(). The new encodeMuxedContractAddress() builds a W… address from a C… address and an ID. extractBaseAddress() also accepts a C… address, which it returns unchanged, and a W… address, for which it returns the base C… address. TransactionBuilder.addSacTransferOperation() accepts a W… destination (#1811).
• Horizon contract_credited effects (ContractCredited) have optional contract_muxed and contract_muxed_id fields. Horizon sets them when a Stellar Asset Contract transfer or mint sends to a muxed contract (W…) address. contract_muxed_id is a decimal string (#1836, stellar-horizon#237).
• The XDR types are regenerated from stellar-xdr with CAP-84, CAP-87 and CAP-88 enabled. xdr.ScAddress adds the scAddressTypeMuxedContract arm and xdr.MuxedContract. xdr.ContractCostType adds the ML-DSA cost types, from mlDsa44DecodeVerifyingKey to verifyMlDsa87Sig. xdr.StellarValueType adds stellarValueSignedMs and stellarValueEmptyTxSetMs, with xdr.StellarValueSignedMsValue and xdr.StellarValueProposedMsValue. The new SC_SPEC_TYPE_NAME_LIMIT constant (1024) raises the limit on contract spec type names from 60. Code that switches over these unions with an exhaustive check must handle the new arms (#1795, #1796, #1797).

Changed

• inSuccessfulContractCall on rpc.Api.EventResponse and rpc.Api.RawEventResponse is optional and deprecated, because newer RPC servers no longer return it from getEvents (#1836, stellar-rpc#1050). With such a server it is undefined. Code that uses it as a boolean can fail to compile under strict. The field will be removed in the next major release.
• The rpc.Server constructor throws when timeout is not 0 or a whole number of milliseconds up to 2147483647. Examples are NaN, a negative number or a fraction. Before, it accepted any value and ignored it. The CLI's --timeout flag has the same upper limit (#1802).
• StellarToml.Resolver.resolve() rejects before the request when allowedRedirects is not 0 or a whole number up to Number.MAX_SAFE_INTEGER. Before, it passed the value to the HTTP client. In Node, the Fetch build followed redirects without limit for NaN, and both builds did so for Infinity (#1809).
• TransactionBuilder.setTimeout() now throws "timeout ends before min_time" when a positive timeout ends before an existing minTime. Before, it built a transaction with minTime after maxTime, which is never valid (#1781).
• When you set maxRedirects or maxContentLength, the Fetch client rejects a successful response whose body is not valid UTF-8, with "Response body is not valid UTF-8". Before, it replaced the invalid bytes with U+FFFD and returned the result. The client still ignores the charset of Content-Type, because a stellar.toml file and a federation response must be UTF-8. A non-2xx response still rejects with its HTTP error (#1804).
• Federation.Server.createForDomain() and Federation.Server.resolve() reject a FEDERATION_SERVER URL from stellar.toml that has a user name or password, or a scheme other than http: or https:, even when allowHttp is set. The SDK does not check the host, so a URL can point to a private or local address, such as https://10.0.0.5. A server-side application that resolves untrusted addresses must filter the hosts it connects to. When allowedRedirects is set, redirect targets are not checked. The Federation.Server constructor does not check the URL that you pass to it (#1809).
• Contract clients reject a muxed (M… or W…) address for an Address parameter; pass it to a MuxedAddress parameter instead. authorizeEntry(), authorizeInvocation() and buildWithDelegatesEntry() reject a muxed signer or delegate address. rpc.Server.getContractData() rejects a muxed owner and a key that contains a muxed address. rpc.Server.getAssetBalance() and getSACBalance() reject a muxed address, since balances are held by the base address. Before, each of these built a request that the network rejects or can never match (#1811, #1835).
• nativeToScVal() and Spec.nativeToScVal() throw a TypeError for a function value. Before, they called the function and converted its result. To keep the old result, call the function and pass its return value. Spec also treats a struct field named like an inherited Object.prototype function as missing when the value does not set it. Examples are toString and constructor. Before, contract clients encoded that field from the inherited function, for example toString as "[object Undefined]" (#1834).

Fixed

• toJson() on a MuxedEd25519Account, or on an ScAddress that holds one, throws when the ID is outside the uint64 range. Before, it wrapped the ID, so -1n gave an M… address with ID 2^64 - 1 and 2n ** 64n gave one with ID 0. toXdr() already threw for these IDs (#1811).
• CallBuilder.stream() passes an event that it cannot parse to onerror and keeps the stream open. onerror gets a MessageEvent of type "error" whose data is the parse error. The stream moves its cursor to the event's SSE id, so a reconnect does not get the event again. An onerror handler that closes the stream now also closes it on such an event. Before, the event listener threw the error as an uncaught exception, which stops a Node.js process that has no handler for it (#1806).
• Horizon records no longer get a link method whose name is then, toJSON, paging_token, _links or the name of an Object.prototype property, such as __proto__ or constructor. The link stays in _links. Before, a then link made call() hang while it sent requests in a loop. A toJSON link made JSON.stringify() return {} and send a request. A __proto__ link changed the record's prototype. A paging_token link made stream() reconnect with the link function's source code as its cursor. A _links link replaced _links with a function, so each link method after it threw (#1806).
• scValToNative() throws a TypeError when two keys of an scvMap convert to the same object property, such as u32 1 and symbol "1". It previously kept only the last entry. Maps whose keys all convert to distinct properties decode as before. Because any contract can emit such a map, humanizeEvents() and contract-client decoding of Val-typed values can now throw on data read from the network (#1778).
• Templated Horizon _links functions now resolve a relative href the same way non-templated links do. They previously threw TypeError: Invalid URL (#1771).
• MuxedAccount, encodeMuxedAccount() and Keypair.xdrMuxedAccount() accept an ID only as decimal digits. MuxedAccount returns the ID in canonical form from id(). Before, any string that BigInt() accepts passed, such as "0x10", " 16 " or "". id() returned that string as typed, so two objects for the same M-address could report different IDs, and an empty string silently became ID 0. An ID string longer than 22 characters is now rejected before it is parsed, so a very long string no longer costs CPU time and memory (#1780).
• Operation.manageSellOffer() and Operation.manageBuyOffer() accept offerId only as a non-negative safe integer, a non-negative bigint, or a string of decimal digits, up to the int64 maximum. Operation.revokeOfferSponsorship() applies the same rule, and now also accepts a number or a bigint offerId, such as the offerId of a decoded LedgerKeyOffer. Before, a number above 2^53 - 1 was rounded and could name a different offer. An empty string meant offer 0, and a negative ID built an operation that the network rejects. An offerId string longer than 22 characters is now rejected before it is parsed (#1780).
• TransactionBuilder.setTimeout(TimeoutInfinite) keeps an existing minTime. Before, it reset both time bounds to 0, so a transaction meant to become valid later was valid at once (#1781).
• new Asset(code, issuer) keeps an issued asset's code as given. It previously changed every spelling of xlm to XLM, even when an issuer was present. As a result, Asset.fromOperation() and transaction.operations showed XLM:G… for an operation on xlm:G…. Encoding the decoded asset again also changed its bytes. An asset built as new Asset("xlm", issuer) now encodes xlm, so its contract ID changes. To keep the old asset, pass XLM (#1784).
• Transaction and FeeBumpTransaction now decode their own copy of a TransactionEnvelope object passed to the constructor, to TransactionBuilder.fromXdr() or from TransactionBuilder.build(). Before, they kept the caller's object. A later change to that object altered what hash(), sign() and toXdr() used, but not always what operations showed. An envelope that cannot be encoded, such as one with more than 100 operations, now fails in the constructor and in TransactionBuilder.build(), not later in toXdr() or sign() (#1784).
• WebAuth.readChallengeTx(), verifyChallengeTxSigners() and verifyChallengeTxThreshold() throw an InvalidChallengeError when a challenge's client_domain operation has no source account. SEP-10 requires that source to be the client domain's signing key. The verifiers previously skipped the client domain signature check for such a challenge. (#1788)
• WebAuth.buildChallengeTx() throws when clientSigningKey is the server's public key. WebAuth.readChallengeTx(), verifyChallengeTxSigners() and verifyChallengeTxThreshold() throw InvalidChallengeError when the client_domain operation's source account is the server account. The server signature previously also counted as the client domain signature, and verifyChallengeTxSigners() could leave a valid client signer out of its result. (#1791)
• In Node, when maxRedirects is set, the Fetch client rejects a redirect to a URL that is not http: or https:. It also rejects a redirect from https: to http:. Before, it followed both. For example, StellarToml.Resolver.resolve() with allowedRedirects returned the content of a data: URL. When a redirect changes the method to GET, the client now also removes the Content-Encoding, Content-Language, Content-Location and Content-Range headers. (#1799)
• rpc.Server now applies its timeout option to each request. Before, the option was ignored, so a request to a server that did not answer stayed pending. This also fixes the --timeout flag of the bindings CLI, which had no effect (#1802).
• The Fetch client sends params when the URL has a # fragment. Before, it added them after the fragment, so the server did not receive them. When there are params, the fragment is now left out of the request URL, as in the Axios build (#1804).
• In Node, when maxRedirects is set, the Fetch client keeps only a safe set of headers on a redirect to another origin: Accept, Accept-Encoding, Accept-Language, Content-Type, Content-Length, Content-Encoding, Content-Language, Content-Location, Content-Range, User-Agent, Range, Cache-Control, Pragma, the If-* conditional headers, X-Client-Name, X-Client-Version, X-App-Name and X-App-Version. Other custom headers, such as traceparent, are dropped too. An http: to https: redirect on the same host counts as another origin. Before, the client removed only Authorization, Proxy-Authorization and Cookie. Other credential headers, such as the Horizon authToken (X-Auth-Token) or an API key in headers, reached the new origin. A redirect to the same origin keeps all headers (#1814).
• AssembledTransaction.sign() and signAndSend() keep the fee from simulation. Before, they added the Soroban resource fee to the fee a second time, which raised the inclusion fee bid. The automatic footprint restore now uses the fee option (or BASE_FEE) as the inclusion fee. Before, it used the restore's resource fee as the inclusion fee and ignored fee. Set fee to bid more during surge pricing. restoreFootprint() still accepts minResourceFee but does not use it (#1808).
• Contract client MuxedAddress parameters accept an Address object, as their string | Address type says. Before, they threw "was not address, but value was Address" (#1811).
• TransactionBuilder.build() throws for a Soroban transaction that has a muxed M… source account, on the transaction or on an operation, or that has a memo. addSacTransferOperation() throws as soon as it is called on a builder with a muxed source. The network rejects all of these, so the transaction could never succeed (#1811, #1835).
• In Node, and in the Fetch build in a browser, Federation.Server no longer follows redirects. Before, it followed up to 21 redirects in the Axios build and up to 20 in the Fetch build, although the v15.1.0 entry for #1390 listed a redirect guard for it. The Axios build in a browser, and both builds in React Native, still follow redirects, because XHR follows them itself. To follow redirects, set the new allowedRedirects option, as for StellarToml.Resolver.resolve(). createForDomain() and resolve() also apply it to the stellar.toml request. The constructor, createForDomain() and resolve() throw when allowedRedirects is not 0 or a whole number up to Number.MAX_SAFE_INTEGER, such as NaN, Infinity, -1, 1.5 or 2 ** 54 (#1809).

... (truncated)

Changelog

Sourced from @​stellar/stellar-sdk's changelog.

v17.4.0

Added

• rpc.Server.queryEvents() fetches one page of events with the new queryEvents RPC method. Only the archival RPC node serves it, and it is in beta. A request is a ledger range query or a cursor continuation, and filter topics can be ScVals. rpc.Api.isQueryEventsError() narrows its typed errors, and rpc.parseRawQueryEvents() parses a raw response from _queryEvents(). getEvents() is unchanged (#1839).

Fixed

• Operation.toXdrPrice() throws "price must be positive" for a {n, d} price whose n is 0. Before, it returned a zero price, which the network rejects as malformed. This affects manageSellOffer(), manageBuyOffer(), createPassiveSellOffer() and liquidityPoolDeposit(). A zero price in number or string form already threw (#1843).

v17.3.0

Added

• CAP-84 muxed contract (W…) addresses. StrKey adds encodeMuxedContract(), decodeMuxedContract() and isValidMuxedContract(). Address adds the muxedContract type and Address.muxedContract(). The new encodeMuxedContractAddress() builds a W… address from a C… address and an ID. extractBaseAddress() also accepts a C… address, which it returns unchanged, and a W… address, for which it returns the base C… address. TransactionBuilder.addSacTransferOperation() accepts a W… destination (#1811).
• Horizon contract_credited effects (ContractCredited) have optional contract_muxed and contract_muxed_id fields. Horizon sets them when a Stellar Asset Contract transfer or mint sends to a muxed contract (W…) address. contract_muxed_id is a decimal string (#1836, stellar-horizon#237).
• The XDR types are regenerated from stellar-xdr with CAP-84, CAP-87 and CAP-88 enabled. xdr.ScAddress adds the scAddressTypeMuxedContract arm and xdr.MuxedContract. xdr.ContractCostType adds the ML-DSA cost types, from mlDsa44DecodeVerifyingKey to verifyMlDsa87Sig. xdr.StellarValueType adds stellarValueSignedMs and stellarValueEmptyTxSetMs, with xdr.StellarValueSignedMsValue and xdr.StellarValueProposedMsValue. The new SC_SPEC_TYPE_NAME_LIMIT constant (1024) raises the limit on contract spec type names from 60. Code that switches over these unions with an exhaustive check must handle the new arms (#1795, #1796, #1797).

Changed

• inSuccessfulContractCall on rpc.Api.EventResponse and rpc.Api.RawEventResponse is optional and deprecated, because newer RPC servers no longer return it from getEvents (#1836, stellar-rpc#1050). With such a server it is undefined. Code that uses it as a boolean can fail to compile under strict. The field will be removed in the next major release.
• The rpc.Server constructor throws when timeout is not 0 or a whole number of milliseconds up to 2147483647. Examples are NaN, a negative number or a fraction. Before, it accepted any value and ignored it. The CLI's --timeout flag has the same upper limit (#1802).
• StellarToml.Resolver.resolve() rejects before the request when allowedRedirects is not 0 or a whole number up to Number.MAX_SAFE_INTEGER. Before, it passed the value to the HTTP client. In Node, the Fetch build followed redirects without limit for NaN, and both builds did so for Infinity (#1809).
• TransactionBuilder.setTimeout() now throws "timeout ends before min_time" when a positive timeout ends before an existing minTime. Before, it built a transaction with minTime after maxTime, which is never valid (#1781).
• When you set maxRedirects or maxContentLength, the Fetch client rejects a successful response whose body is not valid UTF-8, with "Response body is not valid UTF-8". Before, it replaced the invalid bytes with U+FFFD and returned the result. The client still ignores the charset of Content-Type, because a stellar.toml file and a federation response must be UTF-8. A non-2xx response still rejects with its HTTP error (#1804).
• Federation.Server.createForDomain() and Federation.Server.resolve() reject a FEDERATION_SERVER URL from stellar.toml that has a user name or password, or a scheme other than http: or https:, even when allowHttp is set. The SDK does not check the host, so a URL can point to a private or local address, such as https://10.0.0.5. A server-side application that resolves untrusted addresses must filter the hosts it connects to. When allowedRedirects is set, redirect targets are not checked. The Federation.Server constructor does not check the URL that you pass to it (#1809).
• Contract clients reject a muxed (M… or W…) address for an Address parameter; pass it to a MuxedAddress parameter instead. authorizeEntry(), authorizeInvocation() and buildWithDelegatesEntry() reject a muxed signer or delegate address. rpc.Server.getContractData() rejects a muxed owner and a key that contains a muxed address. rpc.Server.getAssetBalance() and getSACBalance() reject a muxed address, since balances are held by the base address. Before, each of these built a request that the network rejects or can never match (#1811, #1835).
• nativeToScVal() and Spec.nativeToScVal() throw a TypeError for a function value. Before, they called the function and converted its result. To keep the old result, call the function and pass its return value. Spec also treats a struct field named like an inherited Object.prototype function as missing when the value does not set it. Examples are toString and constructor. Before, contract clients encoded that field from the inherited function, for example toString as "[object Undefined]" (#1834).

Fixed

• toJson() on a MuxedEd25519Account, or on an ScAddress that holds one, throws when the ID is outside the uint64 range. Before, it wrapped the ID, so -1n gave an M… address with ID 2^64 - 1 and 2n ** 64n gave one with ID 0. toXdr() already threw for these IDs (#1811).
• CallBuilder.stream() passes an event that it cannot parse to onerror and keeps the stream open. onerror gets a MessageEvent of type "error" whose data is the parse error. The stream moves its cursor to the event's SSE id, so a reconnect does not get the event again. An onerror handler that closes the stream now also closes it on such an event. Before, the event listener threw the error as an uncaught exception, which stops a Node.js process that has no handler for it (#1806).
• Horizon records no longer get a link method whose name is then, toJSON, paging_token, _links or the name of an Object.prototype property, such as __proto__ or constructor. The link stays in _links. Before, a then link made call() hang while it sent requests in a loop. A toJSON link made JSON.stringify() return {} and send a request. A __proto__ link changed the record's prototype. A paging_token link made stream() reconnect with the link function's source code as its cursor. A _links link replaced _links with a function, so each link method after it threw (#1806).
• scValToNative() throws a TypeError when two keys of an scvMap convert to the same object property, such as u32 1 and symbol "1". It previously kept only the last entry. Maps whose keys all convert to distinct properties decode as before. Because any contract can emit such a map, humanizeEvents() and contract-client decoding of Val-typed values can now throw on data read from the network (#1778).
• Templated Horizon _links functions now resolve a relative href the same way non-templated links do. They previously threw TypeError: Invalid URL (#1771).
• MuxedAccount, encodeMuxedAccount() and Keypair.xdrMuxedAccount() accept an ID only as decimal digits. MuxedAccount returns the ID in canonical form from id(). Before, any string that BigInt() accepts passed, such as "0x10", " 16 " or "". id() returned that string as typed, so two objects for the same M-address could report different IDs, and an empty string silently became ID 0. An ID string longer than 22 characters is now rejected before it is parsed, so a very long string no longer costs CPU time and memory (#1780).
• Operation.manageSellOffer() and Operation.manageBuyOffer() accept offerId only as a non-negative safe integer, a non-negative bigint, or a string of decimal digits, up to the int64 maximum. Operation.revokeOfferSponsorship() applies the same rule, and now also accepts a number or a bigint offerId, such as the offerId of a decoded LedgerKeyOffer. Before, a number above 2^53 - 1 was rounded and could name a different offer. An empty string meant offer 0, and a negative ID built an operation that the network rejects. An offerId string longer than 22 characters is now rejected before it is parsed (#1780).
• TransactionBuilder.setTimeout(TimeoutInfinite) keeps an existing minTime. Before, it reset both time bounds to 0, so a transaction meant to become valid later was valid at once (#1781).
• new Asset(code, issuer) keeps an issued asset's code as given. It previously changed every spelling of xlm to XLM, even when an issuer was present. As a result, Asset.fromOperation() and transaction.operations showed XLM:G… for an operation on xlm:G…. Encoding the decoded asset again also changed its bytes. An asset built as new Asset("xlm", issuer) now encodes xlm, so its contract ID changes. To keep the old asset, pass XLM (#1784).
• Transaction and FeeBumpTransaction now decode their own copy of a TransactionEnvelope object passed to the constructor, to TransactionBuilder.fromXdr() or from TransactionBuilder.build(). Before, they kept the caller's object. A later change to that object altered what hash(), sign() and toXdr() used, but not always what operations showed. An envelope that cannot be encoded, such as one with more than 100 operations, now fails in the constructor and in TransactionBuilder.build(), not later in toXdr() or sign() (#1784).
• WebAuth.readChallengeTx(), verifyChallengeTxSigners() and verifyChallengeTxThreshold() throw an InvalidChallengeError when a challenge's client_domain operation has no source account. SEP-10 requires that source to be the client domain's signing key. The verifiers previously skipped the client domain signature check for such a challenge. (#1788)
• WebAuth.buildChallengeTx() throws when clientSigningKey is the server's public key. WebAuth.readChallengeTx(), verifyChallengeTxSigners() and verifyChallengeTxThreshold() throw InvalidChallengeError when the client_domain operation's source account is the server account. The server signature previously also counted as the client domain signature, and verifyChallengeTxSigners() could leave a valid client signer out of its result. (#1791)
• In Node, when maxRedirects is set, the Fetch client rejects a redirect to a URL that is not http: or https:. It also rejects a redirect from https: to http:. Before, it followed both. For example, StellarToml.Resolver.resolve() with allowedRedirects returned the content of a data: URL. When a redirect changes the method to GET, the client now also removes the Content-Encoding, Content-Language, Content-Location and Content-Range headers. (#1799)
• rpc.Server now applies its timeout option to each request. Before, the option was ignored, so a request to a server that did not answer stayed pending. This also fixes the --timeout flag of the bindings CLI, which had no effect (#1802).
• The Fetch client sends params when the URL has a # fragment. Before, it added them after the fragment, so the server did not receive them. When there are params, the fragment is now left out of the request URL, as in the Axios build (#1804).
• In Node, when maxRedirects is set, the Fetch client keeps only a safe set of headers on a redirect to another origin: Accept, Accept-Encoding, Accept-Language, Content-Type, Content-Length, Content-Encoding, Content-Language, Content-Location, Content-Range, User-Agent, Range, Cache-Control, Pragma, the If-* conditional headers, X-Client-Name, X-Client-Version, X-App-Name and X-App-Version. Other custom headers, such as traceparent, are dropped too. An http: to https: redirect on the same host counts as another origin. Before, the client removed only Authorization, Proxy-Authorization and Cookie. Other credential headers, such as the Horizon authToken (X-Auth-Token) or an API key in headers, reached the new origin. A redirect to the same origin keeps all headers (#1814).
• AssembledTransaction.sign() and signAndSend() keep the fee from simulation. Before, they added the Soroban resource fee to the fee a second time, which raised the inclusion fee bid. The automatic footprint restore now uses the fee option (or BASE_FEE) as the inclusion fee. Before, it used the restore's resource fee as the inclusion fee and ignored fee. Set fee to bid more during surge pricing. restoreFootprint() still accepts minResourceFee but does not use it (#1808).
• Contract client MuxedAddress parameters accept an Address object, as their string | Address type says. Before, they threw "was not address, but value was Address" (#1811).
• TransactionBuilder.build() throws for a Soroban transaction that has a muxed M… source account, on the transaction or on an operation, or that has a memo. addSacTransferOperation() throws as soon as it is called on a builder with a muxed source. The network rejects all of these, so the transaction could never succeed (#1811, #1835).
• In Node, and in the Fetch build in a browser, Federation.Server no longer follows redirects. Before, it followed up to 21 redirects in the Axios build and up to 20 in the Fetch build, although the v15.1.0 entry for #1390 listed a redirect guard for it. The Axios build in a browser, and both builds in React Native, still follow redirects, because XHR follows them itself. To follow redirects, set the new allowedRedirects op...

  Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
auto-mint	Error		Nov 9, 2026 3:27am UTC