chore(contracts)(deps): bump soroban-sdk from 27.0.6 to 28.0.0 in /contracts

[dependabot]

Bumps soroban-sdk from 27.0.6 to 28.0.0.

Release notes

Sourced from soroban-sdk's releases.

28.0.0

This is a release supporting Protocol 28. Upgrading requires changes to some contracts. See the migration guide for the full detail on each breaking change below.

Breaking changes

• Build contracts with stellar-cli v25.2.0 or newer. Spec shaking v2 is now always on, so the SDK emits a spec entry for every type and relies on the build system to strip the unreachable ones. Remove the experimental_spec_shaking_v2 feature from the soroban-sdk dependency, and remove any export = ... argument from contracttype, contracterror, and contractevent, which is now a compile error. Native builds and unit tests are unaffected. #1968
• Remove any lib = ... argument from contracttype, contracterror, and contractevent. It is now a compile error, and contractimport! always generates the full type definition instead of aliasing into another crate. #1951 #2000
• A contracttype struct can be read from stored data with extra or missing fields (CAP-86). A field missing from the map reads as None if it is an Option, and errors otherwise, and a map key that is not a field of the struct is ignored and dropped, where both used to panic. An Option field can now be added or removed without migrating everything already stored. Writing is unchanged and still writes every field. #2006
• Events no longer publish fields that are unset (CAP-86). In a contractevent with data_format = "map", a field whose value is void, or Option::None, is left out of the published map rather than written as a key with a void value. Any off-chain system consuming the events must tolerate the absent key. Keep publishing every field with #[contractevent(sparse = false)]. #2008
• Deploying and upgrading take a ContractExecutable (CAP-85). deploy_contract replaces deploy_v2, and update_current_contract replaces update_current_contract_wasm; the old ones still work but are deprecated. Wrap the Wasm hash in ContractExecutable::Wasm(...) to migrate. #2020
• Test snapshots change for tests that register contracts natively. Every natively registered contract now gets its own contract code entry rather than sharing one empty entry, so snapshot JSON files are regenerated on upgrade. For a test that depended on contracts sharing a code entry, upload the contract once with Env::upload and deploy it repeatedly instead. #2014
• The Approve event field expiration_ledger is renamed live_until_ledger, matching the name SEP-41 uses. Rename it wherever the event is constructed or matched on. #1985
• #[contractimpl(contracttrait)] on an impl block that does not implement a trait is now a compile error. It was accepted and silently did nothing. #1992
• Some test utilities now panic when called inside a contract function. Call them from the test, outside the contract. #2010

New features

• Protocol 28 support, with soroban-env-* at 28.0.2 and stellar-xdr at 28.0.0. #1986
• Manage contract executable references from a contract (CAP-85) with Env::executable_refs(), and deploy from one by passing ContractExecutable::ExternalRef. #2020
• Upload a natively defined contract in tests with Env::upload and Env::upload_at, making it possible to test a factory, or any other contract that deploys from an existing code entry, without needing to build the contract to Wasm. #2007
• Fuzz and property test with account addresses using the new ArbitraryAddressAccount prototype, which generates G... addresses so the account path of a contract gets exercised. ArbitraryAddress still generates contract addresses and is also named ArbitraryAddressContract. #2024
• Use SorobanArbitrary prototypes with proptest, now documented in testutils::proptest. #2011

Fixes

• MuxedAddress values from different Envs can be compared in tests. #2047
• BytesN<N> rejects an N larger than u32::MAX when converting from Bytes. #2050
• Generated and internal spec XDR statics are now private and hidden from docs. #2054 #2032

Full Changelog: stellar/rs-soroban-sdk@v27.0.6...v28.0.0

28.0.0-rc.2

This is a pre-release supporting Protocol 28, and follows v28.0.0-rc.1. Upgrading requires changes to some contracts. See the migration guide for the full detail on each breaking change, including those released in rc.1.

Note that any changes including breaking changes may be made until the stable release.

Breaking changes

• None

Fixes

• MuxedAddress values from different Envs can be compared in tests. Comparison now falls back to comparing serialized values when the object handles come from separate environments, matching every other SDK type. Such comparisons used to panic. Tests only. #2047
• BytesN<N> rejects an N larger than u32::MAX when converting from Bytes. On 64-bit hosts N was truncated to u32, so a Bytes of a different length could be accepted. Contracts built for Wasm were unaffected, where usize is 32 bits. #2050
• Generated spec XDR statics are now private and hidden from docs. The __SPEC_XDR_TYPE_*, __SPEC_XDR_EVENT_* and __SPEC_XDR_FN_* statics generated by contracttype, contracterror, contractevent and contractimpl, and the module wrapping the function one, no longer appear in the public API or in rustdoc. They exist only to place the contractspecv0 link section in the Wasm, and are __-prefixed #[doc(hidden)] internals nothing external is meant to reference. Rebuilt test Wasms are byte-identical. #2054 #2032

Docs

• The auth docs include a full custom account example, showing a contract account implementing CustomAccountInterface end to end. #2053
• Add AFL++ fuzzing examples #2016

... (truncated)

Commits

• 48d5067 Bump version to 28.0.0 (#2067)
• 3bb283c Fix contractimport! doc example and generated-client name in docs (#2056)
• 9bafcef Add migration docs for check auth contract executable changes (#2057)
• 5e875b5 Bump version to 28.0.0-rc.2 (#2055)
• f4f46a2 Reject oversized BytesN lengths in try_from Bytes (#2050)
• aa700d0 Make generated spec XDR statics private (#2054)
• b230e55 Add custom account example to auth docs (#2053)
• c632f79 Fix MuxedAddress comparison across environments in tests (#2047)
• 73a2a8c Fix duplicate banner on published docs index (#2039)
• a9b3c62 Improve the default example in the SDK docs (#2041)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: contracts, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
web3-student-lab	Ready	Preview	Sep 27, 2026 6:54pm UTC

[github-actions]

==> Running gas benchmark suite (threshold: 10%)
==> Building comparison report

Gas & CPU Benchmark Report

Endpoint	Baseline CPU	Current CPU	Δ CPU	Δ %	Status
certificate_nft::mint_certificate	70303	65319	-4984	-7.1%	🟢 OPTIMISED
dao_governance::initialize	49935	45146	-4789	-9.6%	🟢 OPTIMISED
dao_governance::grant_credits	76131	68362	-7769	-10.2%	🟢 OPTIMISED
dao_governance::create_proposal	107082	99618	-7464	-7.0%	🟢 OPTIMISED
dao_governance::vote	183038	176849	-6189	-3.4%	✅ OK
dao_governance::finalize	99546	91741	-7805	-7.8%	🟢 OPTIMISED
dao_governance::execute	145546	138376	-7170	-4.9%	✅ OK
dao_governance::get_proposal	72297	63725	-8572	-11.9%	🟢 OPTIMISED
dao_governance::credits_of	45341	36800	-8541	-18.8%	🟢 OPTIMISED
dao_governance::vote_of	43556	34958	-8598	-19.7%	🟢 OPTIMISED
hello_world::hello	19358	14008	-5350	-27.6%	🟢 OPTIMISED
payment_gateway::initialize	48310	43532	-4778	-9.9%	🟢 OPTIMISED
payment_gateway::deposit	80397	73641	-6756	-8.4%	🟢 OPTIMISED
payment_gateway::get_balance	44061	35662	-8399	-19.1%	🟢 OPTIMISED
payment_gateway::process_payment	155991	149624	-6367	-4.1%	✅ OK
payment_gateway::get_payment	62960	53712	-9248	-14.7%	🟢 OPTIMISED
payment_gateway::get_admin	31791	22712	-9079	-28.6%	🟢 OPTIMISED
payment_gateway::is_paused	31669	22592	-9077	-28.7%	🟢 OPTIMISED
payment_gateway::withdraw	86629	78490	-8139	-9.4%	🟢 OPTIMISED
payment_gateway::refund	174448	167677	-6771	-3.9%	✅ OK
payment_gateway::pause	64343	56474	-7869	-12.2%	🟢 OPTIMISED
payment_gateway::unpause	64834	56965	-7869	-12.1%	🟢 OPTIMISED
payment_gateway::update_fee_bps	65866	57993	-7873	-12.0%	🟢 OPTIMISED
payment_gateway::transfer_admin	68271	60396	-7875	-11.5%	🟢 OPTIMISED
smart_vault::deposit	70574	68556	-2018	-2.9%	✅ OK
smart_vault::shares_of	40235	34135	-6100	-15.2%	🟢 OPTIMISED
smart_vault::assets_of	41223	35148	-6075	-14.7%	🟢 OPTIMISED
smart_vault::withdraw	86075	83284	-2791	-3.2%	✅ OK
smart_vault::stake	56741	52301	-4440	-7.8%	🟢 OPTIMISED
smart_vault::harvest	89043	87244	-1799	-2.0%	✅ OK
smart_vault::compound	114004	114548	+544	0.5%	✅ OK

✅ No endpoint regressed past the 10% threshold.

[github-actions]

==> Running gas benchmark suite (threshold: 5%)
==> Building comparison report

Gas & CPU Benchmark Report

Endpoint	Baseline CPU	Current CPU	Δ CPU	Δ %	Status
certificate_nft::mint_certificate	70303	65319	-4984	-7.1%	🟢 OPTIMISED
dao_governance::initialize	49935	45146	-4789	-9.6%	🟢 OPTIMISED
dao_governance::grant_credits	76131	68362	-7769	-10.2%	🟢 OPTIMISED
dao_governance::create_proposal	107082	99618	-7464	-7.0%	🟢 OPTIMISED
dao_governance::vote	183038	176849	-6189	-3.4%	✅ OK
dao_governance::finalize	99546	91741	-7805	-7.8%	🟢 OPTIMISED
dao_governance::execute	145546	138376	-7170	-4.9%	✅ OK
dao_governance::get_proposal	72297	63725	-8572	-11.9%	🟢 OPTIMISED
dao_governance::credits_of	45341	36800	-8541	-18.8%	🟢 OPTIMISED
dao_governance::vote_of	43556	34958	-8598	-19.7%	🟢 OPTIMISED
hello_world::hello	19358	14008	-5350	-27.6%	🟢 OPTIMISED
payment_gateway::initialize	48310	43532	-4778	-9.9%	🟢 OPTIMISED
payment_gateway::deposit	80397	73641	-6756	-8.4%	🟢 OPTIMISED
payment_gateway::get_balance	44061	35662	-8399	-19.1%	🟢 OPTIMISED
payment_gateway::process_payment	155991	149624	-6367	-4.1%	✅ OK
payment_gateway::get_payment	62960	53712	-9248	-14.7%	🟢 OPTIMISED
payment_gateway::get_admin	31791	22712	-9079	-28.6%	🟢 OPTIMISED
payment_gateway::is_paused	31669	22592	-9077	-28.7%	🟢 OPTIMISED
payment_gateway::withdraw	86629	78490	-8139	-9.4%	🟢 OPTIMISED
payment_gateway::refund	174448	167677	-6771	-3.9%	✅ OK
payment_gateway::pause	64343	56474	-7869	-12.2%	🟢 OPTIMISED
payment_gateway::unpause	64834	56965	-7869	-12.1%	🟢 OPTIMISED
payment_gateway::update_fee_bps	65866	57993	-7873	-12.0%	🟢 OPTIMISED
payment_gateway::transfer_admin	68271	60396	-7875	-11.5%	🟢 OPTIMISED
smart_vault::deposit	70574	68556	-2018	-2.9%	✅ OK
smart_vault::shares_of	40235	34135	-6100	-15.2%	🟢 OPTIMISED
smart_vault::assets_of	41223	35148	-6075	-14.7%	🟢 OPTIMISED
smart_vault::withdraw	86075	83284	-2791	-3.2%	✅ OK
smart_vault::stake	56741	52301	-4440	-7.8%	🟢 OPTIMISED
smart_vault::harvest	89043	87244	-1799	-2.0%	✅ OK
smart_vault::compound	114004	114548	+544	0.5%	✅ OK

✅ No endpoint regressed past the 5% threshold.

[github-actions]

Gas & CPU Benchmark Report

The benchmark suite ran; see contracts/gas_benchmarks for details.

[github-actions]

Gas & CPU Benchmark Report

The benchmark suite ran; see contracts/gas_benchmarks for details.