[Snyk] Upgrade @stellar/stellar-sdk from 11.3.0 to 12.2.0 #5
Conversation
Snyk has created this PR to upgrade @stellar/stellar-sdk from 11.3.0 to 12.2.0. See this package in npm: @stellar/stellar-sdk See this project in Snyk: https://app.snyk.io/org/okeamah/project/91391991-0ff9-4e8e-8dd4-8a9361adadd1?utm_source=github&utm_medium=referral&page=upgrade-pr
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
We have skipped reviewing this pull request. Here's why:
- It seems to have been created by a bot ('[Snyk]' found in title). We assume it knows what it's doing!
- We don't review packaging changes - Let us know if you'd like us to change this.
|
🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎ To accept the risk, merge this PR and you will not be notified again.
Next stepsWhat is an install script?Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts. Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Take a deeper look at the dependencyTake a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev. Remove the packageIf you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency. Mark a package as acceptable riskTo ignore an alert, reply with a comment starting with
|
Snyk has created this PR to upgrade @stellar/stellar-sdk from 11.3.0 to 12.2.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 7 versions ahead of your current version.
The recommended version was released on a month ago.
Release notes
Package name: @stellar/stellar-sdk
-
12.2.0 - 2024-07-19
- You can now pass custom headers to both
import { Server } from "@ stellar/stellar-sdk/rpc";
export interface GetFeeStatsResponse {
- @ celestialkylin made their first contribution in #988
- @ aditya1702 made their first contribution in #989
- @ kanwalpreetd made their first contribution in #1008
-
12.1.0 - 2024-06-14
- a
- separate
- In
- In
- If you edit an
-
12.0.1 - 2024-05-30
- The default timeout for transaction calls is now set to 300 seconds (5 minutes) when using
- The
- Previously,
- New methods on
- New methods on
- If
- The breaking changes above (strictly speaking, they are not breaking changes because importing from the inner guts of the SDK is not supported) enable the
- Dependencies have been properly updated to pull in Protocol 21 XDR, where RC1 was not pulling properly for existing installs (#959).
- Each item in the
- @ silence48 made their first contribution in #934
- @ BlaineHeffron made their first contribution in #951
- @ psheth9 made their first contribution in #963
-
12.0.0 - 2024-05-02
-
12.0.0-rc.3 - 2024-05-15
- The
- Previously,
- New methods on
- New methods on
- The breaking changes above (strictly speaking, they are not breaking changes because importing from the inner guts of the SDK is not supported) enable the
-
12.0.0-rc.2 - 2024-05-07
- The default timeout for transaction calls is now set to 300 seconds (5 minutes) from the previous default of 10 seconds. 10 seconds is often not enough time to review transactions before signing, especially in Freighter or using a hardware wallet like a Ledger, which would cause a
- Dependencies have been properly updated to pull in Protocol 21 XDR, where RC1 was not pulling properly for existing installs (#959).
- @ BlaineHeffron made their first contribution in #951
-
12.0.0-rc.1 - 2024-05-02
- This update supports Protocol 21. It is an additive change to the protocol so there are no true backwards incompatibilities, but your software may break if you encounter new unexpected fields from this Protocol (#949).
- Each item in the
- @ silence48 made their first contribution in #934
-
11.3.0 - 2024-03-20
- Introduces an entire suite of helpers to assist with interacting with smart contracts (#929):
- Upgrade underlying dependencies, including
from @stellar/stellar-sdk GitHub release notesFixed
@ stellar/stellar-baseand its underlying dependency@ stellar/js-xdrhave been upgraded to their latest versions; reference their release notes (v12.1.0 and v3.1.2, respectively) for details (#1013).Added
rpc.ServerandHorizon.Server(#1013):const s = new Server("<some URL>", { headers: { "X-Custom-Header": "hello" }})
Horizon.Servernow supports the newPOST /transactions_asyncendpoint via thesubmitAsyncTransactionmethod (#989). Its purpose is to provide an immediate response to the submission rather than waiting for Horizon to determine its status. The response schema is as follows:rpc.Servernow has agetFeeStatsmethod which retrieves fee statistics for a previous chunk of ledgers to provide users with a way to provide informed decisions about getting their transactions included in the following ledgers (#998):sorobanInclusionFee: FeeDistribution;
inclusionFee: FeeDistribution;
latestLedger: number; // uint32
}
interface FeeDistribution {
max: string; // uint64
min: string; // uint64
mode: string; // uint64
p10: string; // uint64
p20: string; // uint64
p30: string; // uint64
p40: string; // uint64
p50: string; // uint64
p60: string; // uint64
p70: string; // uint64
p80: string; // uint64
p90: string; // uint64
p95: string; // uint64
p99: string; // uint64
transactionCount: string; // uint32
ledgerCount: number; // uint32
}
New Contributors
Full Changelog: v12.1.0...v12.2.0
v12.1.0
Added
contractnow exports theDEFAULT_TIMEOUT(#984).contract.AssembledTransactionnow has:toXDRandfromXDRmethods for serializing the transaction to and from XDR. These methods should be used in place ofAssembledTransaction.toJSONandAssembledTransaction.fromJSONfor multi-auth signing. The JSON methods are now deprecated. Note: you must now callsimulateon the transaction before the finalsignAndSendcall after all required signatures are gathered when using the XDR methods (#977).restoreFootprintmethod which accepts therestorePreamblereturned when a simulation call fails due to some contract state that has expired. When invoking a contract function, one can now setrestoretotruein theMethodOptions. When enabled, arestoreFootprinttransaction will be created and await signing when required (#991).signandsendmethods so that you can sign a transaction without sending it (signAndSendstill works as before; #922).contract.Clientnow has atxFromXDRmethod which should be used in place oftxFromJSONfor multi-auth signing (#977).Deprecated
contract.AssembledTransaction,toJSONandfromJSONshould be replaced withtoXDRandfromXDR.contract.Client,txFromJSONshould be replaced withtxFromXDR.Fixed
AssembledTransactionwithtx.raw = cloneFrom(tx.build), thetx.simulationDatawill now be updated correctly (#985).v12.0.1: Protocol 21 Stable Release
This update supports Protocol 21. It is an additive change to the protocol so there are no binary (i.e. XDR-level) incompatibilities, but your software may break if you encounter new unexpected or renamed fields from this Protocol (#949).
The following changelog is a concatenation of all of the RCs since the previous stable release and includes one additional added feature.
Breaking Changes
ContractClientfrom the previous default of 10 seconds. 10 seconds is often not enough time to review transactions before signing, especially in Freighter or using a hardware wallet like a Ledger, which would cause atxTooLateerror response from the server. Five minutes is also the value used by the CLI, so this brings the two into alignment (#956).ContractClientfunctionality previously added in v11.3.0 was exported in a non-standard way. You can now import it as any otherstellar-sdkmodule (#962):Note that this top-level
contractexport is a container for ContractClient and related functionality. TheContractClientclass is now available atcontract.Client, as shown. Further note that there is a capitalizedContractexport as well, which comes from stellar-base. You can remember which is which because capital-CContractis a class, whereas lowercase-ccontractis a container/module with a bunch of classes, functions, and types.Additionally, this is available from the
/contractentrypoint, if your version of Node and TypeScript support theexportsdeclaration. Finally, some of its exports have been renamed:import { AssembledTransaction, SentTransaction, - ContractClient, - ContractClientOptions, -} from '@ stellar/stellar-sdk/lib/contract_client' + Client, + ClientOptions, +} from '@ stellar/stellar-sdk/contract'ContractSpecclass is now nested under thecontractmodule, and has been renamed toSpec(#962). Alternatively, you can import this from thecontractentrypoint, if your version of Node and TypeScript support theexportsdeclaration:AssembledTransaction.signAndSend()would return aSentTransactioneven if the transaction never finalized. That is, if it successfully sent the transaction to the network, but the transaction was stillstatus: 'PENDING', then it wouldconsole.erroran error message, but return the indeterminate transaction anyhow. It now throws aSentTransaction.Errors.TransactionStillPendingerror with that error message instead (#962).Deprecated
SorobanRpcmodule is now also exported asrpc(#962). You can import it with either name for now, butSorobanRpcwill be removed in a future release:You can also now import it at the
/rpcentrypoint, if your version of Node and TypeScript support theexportsdeclaration.Added
contract.Client(#960):from(opts: ContractClientOptions)instantiatescontract.Clientby fetching thecontractId's WASM from the network to fill out the client'sContractSpec.fromWasmandfromWasmHashmethods to instantiate acontract.Clientwhen you already have the WASM bytes or hash alongside thecontract.ClientOptions.rpc.Server(#960):getContractWasmByContractIdandgetContractWasmByHashto retrieve a contract's WASM bytecode via itscontractIdorwasmHash, respectively.rpc.server.simulateTransactionnow supports an optionalstateChanges?: LedgerEntryChange[]field (#963):Beforeis omitted, it constitutes a creation, ifAfteris omitted, it constitutes a deletions, note thatBeforeandAftercannot be be omitted at the same time. Each item follows this schema:Fixed
contractmodule to be used in non-Node environments.GetEventsResponse.eventslist will now have atxHashitem corresponding to the transaction hash that triggered a particular event (#939).ContractClientnow properly handles methods that take no arguments by makingMethodOptionsthe only parameter, bringing it inline with the types generated by Soroban CLI'ssoroban contract bindings typescript(#940).ContractClientnow allowspublicKeyto be undefined (#941).SentTransactionwill only passallowHttpif (and only if) its correspondingAssembledTransaction#optionsconfig allowed it (#952).New Contributors
Full Changelog: v11.3.0...v12.0.1
v12.0.0-rc.3: Protocol 21 Release Candidate 3
This update supports Protocol 21. It is an additive change to the protocol so there are no true backwards incompatibilities, but your software may break if you encounter new unexpected fields from this Protocol (#949).
Breaking Changes
ContractClientfunctionality previously added in v11.3.0 was exported in a non-standard way. You can now import it as any otherstellar-sdkmodule (#962):Note that this top-level
contractexport is a container for ContractClient and related functionality. TheContractClientclass is now available atcontract.Client, as shown. Further note that there is a capitalizedContractexport as well, which comes from stellar-base. You can remember which is which because capital-CContractis a class, whereas lowercase-ccontractis a container/module with a bunch of classes, functions, and types.Additionally, this is available from the
/contractentrypoint, if your version of Node and TypeScript support theexportsdeclaration. Finally, some of its exports have been renamed:import { AssembledTransaction, SentTransaction, - ContractClient, - ContractClientOptions, -} from '@ stellar/stellar-sdk/lib/contract_client' + Client, + ClientOptions, +} from '@ stellar/stellar-sdk/contract'ContractSpecclass is now nested under thecontractmodule, and has been renamed toSpec(#962). Alternatively, you can import this from thecontractentrypoint, if your version of Node and TypeScript support theexportsdeclaration:AssembledTransaction.signAndSend()would return aSentTransactioneven if the transaction never finalized. That is, if it successfully sent the transaction to the network, but the transaction was stillstatus: 'PENDING', then it wouldconsole.erroran error message, but return the indeterminate transaction anyhow. It now throws aSentTransaction.Errors.TransactionStillPendingerror with that error message instead (#962).Deprecated
SorobanRpcmodule is now also exported asrpc(#962). You can import it with either name for now, butSorobanRpcwill be removed in a future release:You can also now import it at the
/rpcentrypoint, if your version of Node and TypeScript support theexportsdeclaration.Added
contract.Client(#960):from(opts: ContractClientOptions)instantiatescontract.Clientby fetching thecontractId's WASM from the network to fill out the client'sContractSpec.fromWasmandfromWasmHashmethods to instantiate acontract.Clientwhen you already have the WASM bytes or hash alongside thecontract.ClientOptions.rpc.Server(#960):getContractWasmByContractIdandgetContractWasmByHashto retrieve a contract's WASM bytecode via itscontractIdorwasmHash, respectively.Fixed
contractmodule to be used in non-Node environments.Full Changelog: v11.3.0...v12.0.0-rc.3
v12.0.0-rc.2: Protocol 21 Release Candidate 2
This update supports Protocol 21. It is an additive change to the protocol so there are no true backwards incompatibilities, but your software may break if you encounter new unexpected fields from this Protocol (#949).
Please refer to RC1 for additional changes since the last major version.
Breaking Changes
txTooLateerror response from the server. Five minutes is also the value used by the CLI, so this brings the two into alignment (#956).Fixed
New Contributors
Full Changelog: v11.3.0...v12.0.0-rc.2
v12.0.0-rc.1: Protocol 21 Release Candidate
Breaking Changes
Fixed
GetEventsResponse.eventslist will now have atxHashitem corresponding to the transaction hash that triggered a particular event (#939).ContractClientnow properly handles methods that take no arguments by makingMethodOptionsthe only parameter, bringing it inline with the types generated by Soroban CLI'ssoroban contract bindings typescript(#940).ContractClientnow allowspublicKeyto be undefined (#941).SentTransactionwill only passallowHttpif (and only if) its correspondingAssembledTransaction#optionsconfig allowed it (#952).New Contributors
Full Changelog: v11.3.0...v12.0.0-rc.1
Added
ContractClient: generate a class from the contract specification where each Rust contract method gets a matching method in this class. Each method returns anAssembledTransactionthat can be used to modify, simulate, decode results, and possibly sign, & submit the transaction.AssembledTransaction: used to wrap a transaction-under-construction and provide high-level interfaces to the most common workflows, while still providing access to low-level transaction manipulation.SentTransaction: transaction sent to the Soroban network, in two steps - initial submission and waiting for it to finalize to get the result (retried with exponential backoff)Fixed
@ stellar/js-xdrwhich should broaden compatibility to pre-ES2016 environments (#932, #930).SorobanRpc.Serverwill no longer use array-based passing to invoke JSON-RPC methods (#924).Full Changelog: v11.2.2...v11.3.0
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information: