26.1.0

What's Changed

Deprecations

• Deprecate and ignore export for spec generation in spec shaking v2 — When experimental_spec_shaking_v2 is enabled, the export argument on contracttype, contracterror, and contractevent is ignored. A deprecation warning is emitted if used. (#1876)

Improvements

• Fix cfg handling for contracttrait and contractimpl blocks — #[contractimpl] methods with cfg attributes now correctly gate their generated args helpers and testutils registration. cfg-gated override methods in #[contractimpl(contracttrait)] blocks are also properly supported. Both cfg and cfg_attr result in compiler errors when used on #[contracttrait] default functions. (#1871)

All Changes

• Deprecate export for spec generation in spec shaking v2 by @mootz12 in #1876
• Fix cfg handling for contracttrait and contractimpl blocks by @mootz12 in #1871
• Fix failing OpenZeppelin CI jobs by @leighmcculloch in #1884

Full Changelog: v26.0.1...v26.1.0

26.0.1

What's Changed

Improvements

• Update docs clarifying guarantees of the Hash type (#1870)
• Surface env!/include! deps in contractmeta! to dep-info (#1872)
• Zero-copy improvement for U256 and I256 (#1867)

All Changes

• Set empty top-level permissions in claude-review by @leighmcculloch in #1864
• Harden Claude review workflow by @leighmcculloch in #1865
• Clarify guarantees for Hash by @mootz12 in #1870
• Surface env!/include! deps in contractmeta! to dep-info by @leighmcculloch in #1872
• Zero-copy improvement for U256 and I256 by @dkcumming in #1867
• Bump version to 26.0.1 by @github-actions[bot] in #1877

New Contributors

• @dkcumming made their first contribution in #1867

Full Changelog: v26.0.0...v26.0.1

v26.0.0

What's Changed

Breaking Changes

• Renamed assert_in_contract to debug_assert_in_contract — The assert_in_contract macro has been renamed to debug_assert_in_contract and hidden from public documentation, as it is intended for internal use only. The old name has been deprecated. (#1806)

• Removed deprecated token event format from soroban-token-sdk — The deprecated TokenUtils::events() helper, the legacy event module, and the Events wrapper have been removed. These were originally deprecated in v23. (#1822)

• Removed #[macro_export] from internal impl_bytesn_repr macro — This macro was only intended as an internal helper. Its public export has been removed. (#1829)

Deprecations

• Deprecate BLS/BN short type aliases and disambiguate Fr — bls12_381::Fr is renamed to Bls12381Fr and bn254::Fr is renamed to Bn254Fr, with the original names kept as deprecated aliases. The other BLS12-381 short aliases (G1Affine, G2Affine, Fp, Fp2) and the crypto::BnScalar re-export are also deprecated. Existing code continues to compile but will emit deprecation warnings pointing to the new names. This avoids a confusing case where a contract using bn254::Fr as a contract type would silently resolve to the BLS12-381 scalar in the spec mapping. (#1714)

New Features

• CAP-73 — Stellar Asset Contract trust() function: Enables the Stellar Asset Contract to create trustlines for classic G-accounts. The new trust() function creates an unlimited trustline for a specified address, requiring the recipient's authorization via require_auth. (#1814)

• CAP-78 — Limited TTL extensions on contract data: Introduces new TTL extension methods that allow developers to set explicit maximum limits on TTL extensions for persistent and instance storage entries. (#1807)

• CAP-79 — Muxed address strkey conversion: Adds host functions for converting between Stellar strkey format strings and muxed address objects (strkey_to_muxed_address and muxed_address_to_strkey). MuxedAddress now uses these for from_string and to_strkey. (#1745)

• CAP-80 — Additional BN254 and BLS12-381 host functions: Adds new functions for BN254 MSM, BN254 modular arithmetic, and curve membership checks for BLS12-381 and BN254. (#1745)

• CAP-82 — Checked arithmetic for 256-bit integers: Adds checked_{add, sub, mul, pow, div, rem_euclid, shl, shr} functions for 256-bit integer types. These return Option instead of trapping on overflow, allowing contracts to handle arithmetic errors gracefully. Also adds min_value and max_value helpers and == operator support for 256-bit number types. (#1801, #1823)

Improvements

• Updated stellar-xdr and soroban-env-* crates — Updates stellar-xdr to 26.0.1 and the soroban-env-common, soroban-env-guest, and soroban-env-host crates to 26.1.3. Includes adjustments to testutils for the renamed invocation hook/event API and dependency updates that patch compiler errors introduced in a recent nightly. (#1830, #1841)

• Return errors instead of panicking in soroban-spec-rust — All code-generation functions in soroban-spec-rust (generate_struct, generate_union, generate_enum, generate_error_enum, generate_event, generate_function, and their _with_options variants) are now fallible and return a GenerateError. Previously, the generator would panic on Wasm contracts with invalid UTF-8 bytes or non-identifier strings in spec entry names. (#1810)

• Fix Result type generation for user-defined error enums named Error — When a contract defines its own error enum named Error and uses it in a Result<T, Error> return type, the generated client code now emits Result<T, Error> (referencing the user-defined enum) instead of Result<T, soroban_sdk::Error>. The on-the-wire spec format is unchanged, so already-deployed contracts benefit immediately the next time their Rust client is regenerated. (#1862)

• Normalize raw identifiers (r#) in contract macros — Names, generated Rust idents, and downstream comparison/sort keys now consistently use the unraw'd form of a user's Ident across the Soroban macros. Tokens that must refer back to user fields, variants, or functions still preserve the raw Ident so the generated code remains valid Rust. (#1837)

• Document version support policy — A new Support section in the repository README, crate README, and lib.rs describes which soroban-sdk versions receive security fixes, bug fixes, and new features. (#1855)

Feature: Experimental Spec Shaking V2

This release includes several improvements to the experimental_spec_shaking_v2 feature. It remains opt-in — users must enable the experimental_spec_shaking_v2 cargo feature to use it.

• Cleaner failure when the build environment variable is missing — When experimental_spec_shaking_v2 is enabled and SOROBAN_SDK_BUILD_SYSTEM_SUPPORTS_SPEC_SHAKING_V2 is not set (e.g. building with cargo build directly instead of stellar-cli), the WASM build now exits with status code 1 and a clear message that the feature requires the CLI, instead of panicking. (#1846)

• Retain panic-only error enums — A #[contracterror] enum used only via panic_with_error! or assert_with_error! (i.e. never appearing in a Result<_, E> return type) is now correctly retained in the contract spec. Previously, such enums were stripped from the WASM even though they are part of the contract's observable error interface. (#1852)

• Keep alive subtype markers for container types via reference — Spec markers for nested types in Vec<T>, Map<K, V>, and reference types are now preserved across the linker's DCE pass without invoking them at runtime. This fixes a stack overflow that could occur with recursive type definitions. Contracts may see a small size increase (~15 bytes per occurrence; ~100 bytes total in the SDK's test contracts). (#1835)

All Changes

• Update to v26 and add support for CAP-73, 78, 79, 80 and 82 by @mootz12 in #1814
• Enable spec shaking v2 by default by @leighmcculloch in #1812
• clean up macro impl_bytesn_repr and remove export by @jayz22 in #1829
• Update soroban-env-* crates to version =v26.1.2 by @mootz12 in #1830
• Rename assert_in_contract to debug_assert_in_contract by @mootz12 in #1806
• Remove deprecated token event format from soroban-token-sdk by @mootz12 in #1822
• Fallback to spec shaking v1 if env var is not set by @mootz12 in #1831
• Deprecate BLS/BN short type aliases and disambiguate Fr by @jayz22 in #1714
• Bump stellar-xdr and soroban-env crates by @mootz12 in #1841
• Return errors instead of panicking in soroban-spec-rust by @leighmcculloch in #1810
• Normalize raw identifiers (r#) in contract macros by @mootz12 in #1837
• Revert #1831 and #1812 by @leighmcculloch in #1850
• Use experimental_spec_shaking_v2 for integration tests and improve WASM build failure by @mootz12 in #1846
• Retain panic-only error enums in spec shaking v2 by @leighmcculloch in #1852
• Add Claude auto-review workflow for pull requests by @leighmcculloch in #1853
• Document version support policy by @leighmcculloch in #1855
• Update spec shaking v2 to keep alive subtype markers via reference by @mootz12 in #1835
• Fix Result type generation for user-defined error enums named "Error" by @mootz12 in #1862
• Bump version to 26.0.0 by @github-actions[bot] in #1863

Full Changelog: v25.3.1...v26.0.0

v26.0.0-rc.1

What's Changed

Breaking Changes

• Spec shaking v2 enabled by default — The experimental_spec_shaking_v2 feature is now included in the default feature set, improving the specification optimization process. Users can still disable it via feature flags if needed. (#1812)

• Renamed assert_in_contract to debug_assert_in_contract — The assert_in_contract macro has been renamed to debug_assert_in_contract and hidden from public documentation, as it is intended for internal use only. The old name has been deprecated. (#1806)

• Removed deprecated token event format from soroban-token-sdk — The deprecated TokenUtils::events() helper, the legacy event module, and the Events wrapper have been removed. These were originally deprecated in v23. (#1822)

• Removed #[macro_export] from internal impl_bytesn_repr macro — This macro was only intended as an internal helper. Its public export has been removed. (#1829)

New Features

• CAP-73 — Stellar Asset Contract trust() function: Enables the Stellar Asset Contract to create trustlines for classic G-accounts. The new trust() function creates an unlimited trustline for a specified address, requiring the recipient's authorization via require_auth. (#1814)

• CAP-78 — Limited TTL extensions on contract data: Introduces new TTL extension methods that allow developers to set explicit maximum limits on TTL extensions for persistent and instance storage entries. (#1807)

• CAP-79 — Muxed address strkey conversion: Adds host functions for converting between Stellar strkey format strings and muxed address objects (strkey_to_muxed_address and muxed_address_to_strkey). MuxesAddress now uses these for from_string and to_strkey. (#1745)

• CAP-80 — Additional BN254 and BLS12-381 host functions: Add new functions for BN254 MSM, BN254 modular arithmetic, and curve membership checks for BLS12-381 and BN254. (#1745)

• CAP-82 — Checked arithmetic for 256-bit integers: Adds checked_{add, sub, mul, pow, div, rem_euclid, shl, shr} functions for 256-bit integer types. These return Option instead of trapping on overflow, allowing contracts to handle arithmetic errors gracefully. Also adds min_value and max_value helpers and == operator support for 256-bit number types. (#1801) (#1823)

Improvements

• Spec shaking v2 gracefully falls back to v1 — When the SOROBAN_SDK_BUILD_SYSTEM_SUPPORTS_SPEC_SHAKING_V2 environment variable is not set (e.g. when building with cargo build directly instead of stellar-cli), spec shaking v2 now falls back to v1 instead of panicking. A compiler warning is emitted on Wasm targets. (#1831)

• Updated soroban-env-* crates to v26.1.2 — Updates soroban-env-common, soroban-env-guest, and soroban-env-host to v26.1.2, including adjustments to testutils for the renamed invocation hook/event API. (#1830)

All Changes

• Update to v26 and add support for CAP-73, 78, 79, 80 and 82 by @mootz12 in #1814
• Enable spec shaking v2 by default by @leighmcculloch in #1812
• clean up macro impl_bytesn_repr and remove export by @jayz22 in #1829
• Update soroban-env-* crates to version =v26.1.2 by @mootz12 in #1830
• Rename assert_in_contract to debug_assert_in_contract by @mootz12 in #1806
• Remove deprecated token event format from soroban-token-sdk by @mootz12 in #1822
• Fallback to spec shaking v1 if env var is not set by @mootz12 in #1831

Full Changelog: v25.3.1...v26.0.0-rc.1

25.3.1

What's Changed

New Features

• MuxedAddress now implements ScVal conversion traits and SorobanArbitrary, allowing it to be used as a field in #[contracttype] structs. (#1782)

Improvements

• Compiler error for reserved type names in contract types: #[contracttype] definitions whose names collide with SDK built-in type names (e.g. Address, Bytes, Symbol) now produce a clear compile-time error instead of silently mapping to the built-in type in the contract spec. (#1788)
• Using #[contractevent(data_format = "single-value")] with more than one data field now produces a clear compile-time error. (#1794)
• #[contractimpl] macro now correctly resolves associated types in function return values (not just inputs), and emits clear compiler errors when it cannot resolve an associated type. (#1780)
• LedgerSnapshot::write_file now writes to a temporary file before atomically replacing the destination, preventing corrupted snapshot files if serialization fails. (#1796)
• Replaces regular subtraction with saturating_sub when computing max_ttl to guard against potential underflow from misconfiguration. (#1792)

Bug Fixes

• Generated try_ client methods were always calling mock_all_auths() and ignoring the allow_non_root_auth flag, causing non-root auth to silently fail. They now correctly call mock_all_auths_allowing_non_root_auth() when the flag is set. (#1761)
• Doc comment truncation could split multi-byte UTF-8 codepoints, producing invalid UTF-8 in the contract's spec XDR. Truncation now always occurs at a valid character boundary. (#1769)
• The build.rs target check was evaluating against the host target instead of the compilation target, so the Rust version check never fired during cross-compilation. This could silently produce Wasm binaries with unsupported features. The error message now also recommends wasm32v1-none as the preferred target. (#1771)
• Added checks in register_contract_with_source and register_stellar_asset_contract_v2 to prevent potential auth manager overrides. (#1803)

Documentation

• Added documentation for the ToXdr and FromXdr traits. (#1767)
• Improved documentation for Val conversion behavior in SDK collection types. (#1774)
• Added documentation for the SHA-256 hash verification options available in contractimport! and contractfile! macros. (#1790)
• Documented how #[contractimpl] determines the exported function names in the contract spec. (#1809)
• Updated the Pausable trait doc examples to include access control patterns. (#1764)
• Expanded documentation on how to use mock auth in test scenarios. (#1798)
• Improved documentation for Poseidon hash functions. (#1816)

All Changes

• Add comment for future EnvTestConfig API privatization by @leighmcculloch in #1752
• Fix try_ client ignoring allow_non_root_auth flag by @leighmcculloch in #1761
• Add access control to Pausable trait examples by @leighmcculloch in #1764
• Document ToXdr and FromXdr traits by @leighmcculloch in #1767
• Fix rust and wasm target check for sdk by @leighmcculloch in #1771
• Improve docs around Val conversion in collections by @mootz12 in #1774
• Add ScVal conversion and SorobanArbitrary impls for MuxedAddress by @mootz12 in #1782
• Improve parsing for associated type usage and add better errors for unsupported patterns by @mootz12 in #1780
• Fix docs_from_attrs truncating mid-UTF-8 codepoint by @leighmcculloch in #1769
• chore: use saturating sub with max_ttl computation by @mootz12 in #1792
• Add compiler error when single value event used with multiple data entries by @mootz12 in #1794
• Expand docs for mock auth usage in tests by @mootz12 in #1798
• Write to a temp file first during snapshot write_file by @mootz12 in #1796
• Add compiler error when reserved type names are used as contract types by @mootz12 in #1788
• Document contractimport! and contractfile! SHA-256 verification options by @mootz12 in #1790
• Fix panic safety in register_contract_with_source and register_stellar_asset_contract_v2 by @mootz12 in #1803
• Fix misc typos and doc links by @mootz12 in #1804
• Document #[contractimpl] export name behaviour by @leighmcculloch in #1809
• Skip privacy-pools in soroban-examples CI by @leighmcculloch in #1811
• improve poseidon, poseidon2_permutation docs by @jayz22 in #1816
• Bump version to 25.3.1 by @github-actions[bot] in #1821

Full Changelog: v25.3.0...v25.3.1

23.5.3

What's Changed

• Fix Fr scalar field to reduce modulo r on construction by @jayz22 in #1758 GHSA-x2hw-px52-wp4m

Full Changelog: v23.5.2...v23.5.3

22.0.11

What's Changed

• Fix Fr scalar field to reduce modulo r on construction by @jayz22 in #1757 GHSA-x2hw-px52-wp4m

Full Changelog: v22.0.10...v22.0.11

25.3.0

What's Changed

• Fix Fr scalar field to reduce modulo r on construction by @jayz22 in #1750 GHSA-x2hw-px52-wp4m
• Bump version to 25.3.0 by @github-actions[bot] in #1751

Full Changelog: v25.2.0...v25.3.0

25.2.0

What's Change

New Experimental Features

• Spec shaking for smaller contract binaries: The SDK now supports automatic removal of unused type and event definitions from the contractspecv0 section of compiled WASM files. By embedding markers that survive dead code elimination, only types and events actually used at contract boundaries (function parameters, return values, and events) are retained. This reduces contract binary size and enables imported contract types to be automatically re-exported when used. Requires Stellar CLI v25.2.0+. Behind a feature flag experimental_spec_shaking_v2 during the v25 release. (#1672)

Improvements

• Compile-time validation for BigInt conversions: BigInt::from<BytesN> now catches length mismatches at compile time instead of panicking at runtime, giving you earlier and clearer error messages. (#1725)

• Remove unnecessary clones in iterators: Iterator implementations no longer perform redundant clones, reducing overhead when iterating over SDK collection types. (#1734)

Bug Fixes

• Fix BytesN::is_empty: BytesN::is_empty previously always returned false. It now correctly returns true for BytesN<0>. (#1733)

Documentation

• Document the alloc feature: The alloc module is now publicly documented in rustdoc, covering how the bump-pointer allocator works, that dealloc is a no-op, and how to use a custom allocator instead. (#1726)

All Changes

• Remove unnecessary clone in iterators by @leighmcculloch in #1734
• Fix BytesN::is_empty to check const length by @leighmcculloch in #1733
• Use compile-time assert in BigInt::from by @leighmcculloch in #1725
• Add commentary to alloc module about use of static_mut_refs and light code reordering and vis changes by @leighmcculloch in #1722
• Document alloc feature by @leighmcculloch in #1726
• Bump deny action by @sisuresh in #1742
• Implement spec shaking using dead code elimination and data section of wasm by @leighmcculloch in #1672
• Bump version to 25.2.0 by @github-actions[bot] in #1749

Full Changelog: v25.1.1...v25.2.0

25.1.1

What's Changed

Bugs Fixed

• Fix trait method call resolution in contractimpl (#1729) (GHSA-4chv-4c6w-w254)

All Changes

• Fix trait method call resolution in contractimpl by @leighmcculloch in #1729
• Bump version to 25.1.1 by @github-actions[bot] in #1732

Full Changelog: v25.1.0...v25.1.1