[dependabot]

Updates the requirements on stellar-sdk to permit the latest version.

Release notes

Sourced from stellar-sdk's releases.

17.0.0

This release adds support for Protocol 30.

Breaking changes

• Remove the deprecated EventInfo.in_successful_contract_call. Stellar RPC v30 no longer returns inSuccessfulContractCall, and since 16.1.1 the field was None for its responses. Responses from older RPC servers that still include it parse as before; the value is ignored. (#1237)
• Several APIs now raise ValueError up front for addresses the Soroban host never accepts there. They used to build a ledger key that matches no entry, or an entry the host can never authorize, so the mistake only showed up later as a missing result or a failed simulation. (#1244)
  • SorobanServer[Async].get_contract_data requires a contract address (C...), and rejects a key that contains a muxed address (M... or W...) anywhere, since the host never stores such keys.
  • SorobanServer[Async].get_contract_wasm, and so get_contract_meta, get_contract_spec and get_contract_info, require a contract address (C...).
  • TransactionBuilder.append_restore_asset_balance_entry_op requires balance_owner to be a contract address (C...). Only contracts hold SAC balances in contract data; an account's balance lives in its trustline.
  • auth.build_with_delegates_entry requires the address of the entry it wraps to be an account (G...) or a contract (C...), as the other auth helpers already do. It used to check only the delegate addresses.

Update

• Upgrade the generated XDR definitions to Protocol 30 (stellar-xdr v30.0). (#1228)
• Support CAP-84 muxed contract addresses (W..., SEP-23 STRKEY_MUXED_CONTRACT): a contract ID plus a 64-bit muxed ID. Like a muxed account (M...), it is only valid as a payment destination, such as the to of a SAC transfer or mint. (#1238)
  • New StrKey.encode_muxed_contract / decode_muxed_contract / is_valid_muxed_contract. The raw data is 40 bytes: the 32-byte contract ID followed by the big-endian 8-byte muxed ID, the same layout as a muxed account.
  • Address accepts W... addresses as the new AddressType.MUXED_CONTRACT, converts them to and from SC_ADDRESS_TYPE_MUXED_CONTRACT, and gains Address.from_raw_muxed_contract. scval.to_address / from_address handle them through Address, so contract return values and events that hold a muxed contract address now decode.
  • scval.to_map sorts muxed contract address keys like the Soroban host, by (id, contract ID).
  • Cover CAP-84 in the py-stellar-base agent skill. (#1239)

Fixes

• StrKey.decode_claimable_balance / is_valid_claimable_balance now reject a claimable balance strkey (B...) whose type byte is not 0, as SEP-23 requires; CLAIMABLE_BALANCE_ID_TYPE_V0 is the only type. Such a key used to be accepted, so Address(...) took it and the error only surfaced in Address.to_xdr_sc_address. Address(...) now raises ValueError up front. (#1241)

Changelog

Sourced from stellar-sdk's changelog.

Version 17.0.0

Released on October 30, 2026

This release adds support for Protocol 30.

Breaking changes

• Remove the deprecated EventInfo.in_successful_contract_call. Stellar RPC v30 no longer returns inSuccessfulContractCall, and since 16.1.1 the field was None for its responses. Responses from older RPC servers that still include it parse as before; the value is ignored. (#1237)
• Several APIs now raise ValueError up front for addresses the Soroban host never accepts there. They used to build a ledger key that matches no entry, or an entry the host can never authorize, so the mistake only showed up later as a missing result or a failed simulation. (#1244)
  • SorobanServer[Async].get_contract_data requires a contract address (C...), and rejects a key that contains a muxed address (M... or W...) anywhere, since the host never stores such keys.
  • SorobanServer[Async].get_contract_wasm, and so get_contract_meta, get_contract_spec and get_contract_info, require a contract address (C...).
  • TransactionBuilder.append_restore_asset_balance_entry_op requires balance_owner to be a contract address (C...). Only contracts hold SAC balances in contract data; an account's balance lives in its trustline.
  • auth.build_with_delegates_entry requires the address of the entry it wraps to be an account (G...) or a contract (C...), as the other auth helpers already do. It used to check only the delegate addresses.

Update

• Upgrade the generated XDR definitions to Protocol 30 (stellar-xdr v30.0). (#1228)
• Support CAP-84 muxed contract addresses (W..., SEP-23 STRKEY_MUXED_CONTRACT): a contract ID plus a 64-bit muxed ID. Like a muxed account (M...), it is only valid as a payment destination, such as the to of a SAC transfer or mint. (#1238)
  • New StrKey.encode_muxed_contract / decode_muxed_contract / is_valid_muxed_contract. The raw data is 40 bytes: the 32-byte contract ID followed by the big-endian 8-byte muxed ID, the same layout as a muxed account.
  • Address accepts W... addresses as the new AddressType.MUXED_CONTRACT, converts them to and from SC_ADDRESS_TYPE_MUXED_CONTRACT, and gains Address.from_raw_muxed_contract. scval.to_address / from_address handle them through Address, so contract return values and events that hold a muxed contract address now decode.
  • scval.to_map sorts muxed contract address keys like the Soroban host, by (id, contract ID).
  • Cover CAP-84 in the py-stellar-base agent skill. (#1239)

Fixes

• StrKey.decode_claimable_balance / is_valid_claimable_balance now reject a claimable balance strkey (B...) whose type byte is not 0, as SEP-23 requires; CLAIMABLE_BALANCE_ID_TYPE_V0 is the only type. Such a key used to be accepted, so Address(...) took it and the error only surfaced in Address.to_xdr_sc_address. Address(...) now raises ValueError up front. (#1241)

Version 16.1.1

Released on October 22, 2026

Fixes

• SorobanServer[Async].get_events no longer fails against Stellar RPC v30. RPC v30 stopped returning the inSuccessfulContractCall field (deprecated since Protocol 23), which EventInfo.in_successful_contract_call required, so every response was rejected with a ValidationError. The field is now optional and is None when the server omits it. It is still deprecated and will be removed in the next major release. (#1235)
• auth.authorize_entry now raises ValueError instead of silently invalidating signatures already on the entry. A CAP-71-01 (SOROBAN_CREDENTIALS_ADDRESS_WITH_DELEGATES) entry stores one signature_expiration_ledger, and every signature on it — the top-level account's and each (nested) delegate's — commits to that value. Signing one node with a different valid_until_ledger_sequence re-stamped it and left the other signatures unverifiable, with nothing raised until the host rejected the entry. The error names the stored expiration ledger; pass that value to add a signature, or start from an entry whose other nodes are unsigned. Re-signing only the targeted node(s), and refreshing a plain ADDRESS / ADDRESS_V2 entry, still work as before. (#1215, #1218)
  • AssembledTransaction[Async].authorize / sign_auth_entries sign only the top-level node, but the expiration they stamp (latest_ledger + 100 by default) is the shared one, so they reach the same guard: signing the top level of an entry whose delegates already signed now raises unless their valid_until_ledger_sequence is passed explicitly. A rejected entry now leaves the transaction untouched; previously entries signed earlier in the same call were kept.

Version 16.1.0

Released on September 02, 2026

Update

• Round out the CAP-85 (Protocol 28) external executable reference support added in 16.0.0: (#1216)
  • New stellar_sdk.scval.to_executable_tag / from_executable_tag build and read an SCV_EXECUTABLE_TAG value — the pair that was missing for the one SCVal variant CAP-85 introduced. Wrapped in that value, a tag is the key of the persistent contract data entry on the owner contract that holds the Wasm hash, so to_executable_tag is what you pass to SorobanServer[Async].get_contract_data to read a tag entry directly. It encodes a str as UTF-8 and passes bytes through undecoded; from_executable_tag returns the raw bytes, since a lenient decode would render two distinct tags identically.
  • ExternalRefNotFoundError now carries the owner and tag it looked up and names them in its message, showing the tag as bytes rather than lenient-decoded text. Its constructor takes those two values in place of a message string — a source-incompatible change to a class introduced in 16.0.0, although the SDK raises it and nothing is expected to construct it.
  • SorobanServer[Async].get_contract_wasm now documents the ValueError it raises for a ledger entry that is structurally unusable, such as an external executable reference whose owner is not a contract. Behavior is unchanged.
  • Document the ContractWasmRetrievalError family in the API reference, where none of it appeared, and cover CAP-85 in the py-stellar-base agent skill, which had no mention of it.
• Add a use_upgraded_auth opt-out to sep.stellar_soroban_web_authentication.build_challenge_authorization_entries[_async], defaulting to True. A SEP-45 challenge is made of the entries simulation records, so 16.0.0's useUpgradedAuth flip also flipped challenges to ADDRESS_V2 — with no way to decline, even though it is the remote client, not the anchor, that has to sign them. Pass use_upgraded_auth=False to keep issuing legacy challenges.

Fixes

• AssembledTransaction[Async].restore_footprint now simulates the restore transaction with the caller's use_upgraded_auth instead of the default. The restore itself is unaffected — a RestoreFootprint operation records no authorization entries — but an explicit opt-out is no longer silently dropped. (#1216)

Version 16.0.0

... (truncated)

Commits

• 8400be5 release: 17.0.0 (#1245)
• a684a2b fix: reject CAP-84 muxed contract addresses where the host does not accept th...
• f00d9b8 chore: bump pytest-asyncio (#1243)
• 1efd9b0 fix: read the return value from TransactionMetaV4 in the tx builder invoke ex...
• 2db35cb fix: reject claimable balance strkeys with a non-zero type byte (#1241)
• 66c7f30 chore: update flit-core requirement (#1240)
• 636ba7b docs: cover CAP-84 muxed contract addresses in the agent skill (#1239)
• 5ba0e78 feat: support CAP-84 muxed contract addresses (#1238)
• 7372e5d refactor!: remove deprecated EventInfo.in_successful_contract_call (#1237)
• 08471d6 fix: decode contract spec event names as strings after Protocol 30 XDR (#1229)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)