[dependabot]

Bumps @stellar/stellar-sdk from 17.1.0 to 17.2.0.

Release notes

Sourced from @​stellar/stellar-sdk's releases.

v17.2.0

v17.2.0

Added

• A stellar-contract-bindings-typescript binary implementing the Stellar CLI plugin convention, reachable as stellar contract bindings typescript. It delegates to stellar-js generate. The package also adds a stellar-sdk binary, an alias for stellar-js (#1738).

Fixed

• AssembledTransaction.signAuthEntries() forwards a wallet's returned signerAddress to the default authorizer, so a classic-multisig signature made by a key other than the account being authorized is no longer rejected (#1681). A muxed M… signerAddress resolves to its base account; null or an empty string counts as omitted, and any other value that is not an account address is rejected by name. A custom authorizeEntry still receives raw bytes. A wallet that returns a signerAddress other than the key it signed with now fails with "signature doesn't match payload" instead of having the value ignored (#1744).
• AssembledTransaction.signAuthEntries() throws NoSignatureNeeded when it matched no auth entry, instead of returning as if it had signed (#1681, #1610). A custom authorizeEntry skips the pre-flight check that reports this for the default authorizer, so a wrong address was silent there. When address came from its publicKey default, the error says so. Every call that signs at least one entry is unaffected (#1743).
• authorizeEntry verifies a bare-Uint8Array signing callback against forAddress when one is given, rather than always against the entry's top-level credential address. A valid CAP-71 delegate signature was previously rejected with signature doesn't match payload (#1683, #1742). For every signer form, a forAddress that names no credential node is now rejected before the signer runs, rather than after.
• authorizeEntry throws a TypeError naming signatureScVal when the address it would verify against is a contract, instead of StrKey's invalid version byte (#1742).
• AssembledTransaction.needsNonInvokerSigningBy() walks CAP-71 delegate trees: it also lists the unsigned delegates under a contract account, even when the account itself has signed, and with includeAlreadySigned it lists every delegate under a contract account (#1655, #1747). signAuthEntries() still signs top-level addresses only, and names an unsigned delegate passed as address. sign() and signAndSend() now also reject an unsigned G… delegate under a contract account, whether or not the account has signed. This assumes every listed delegate must sign, so it can reject a transaction the network would accept when __check_auth uses only some of them. Pass ignoreContractDelegates to either method to skip that check for delegates under contract accounts; G… addresses are still checked.

New Contributors

• @​devtechedge made their first contribution in stellar/js-stellar-sdk#1725

Full Changelog: stellar/js-stellar-sdk@v17.1.0...v17.2.0

Changelog

Sourced from @​stellar/stellar-sdk's changelog.

v17.2.0

Added

• A stellar-contract-bindings-typescript binary implementing the Stellar CLI plugin convention, reachable as stellar contract bindings typescript. It delegates to stellar-js generate. The package also adds a stellar-sdk binary, an alias for stellar-js (#1738).

Fixed

• AssembledTransaction.signAuthEntries() forwards a wallet's returned signerAddress to the default authorizer, so a classic-multisig signature made by a key other than the account being authorized is no longer rejected (#1681). A muxed M… signerAddress resolves to its base account; null or an empty string counts as omitted, and any other value that is not an account address is rejected by name. A custom authorizeEntry still receives raw bytes. A wallet that returns a signerAddress other than the key it signed with now fails with "signature doesn't match payload" instead of having the value ignored (#1744).
• AssembledTransaction.signAuthEntries() throws NoSignatureNeeded when it matched no auth entry, instead of returning as if it had signed (#1681, #1610). A custom authorizeEntry skips the pre-flight check that reports this for the default authorizer, so a wrong address was silent there. When address came from its publicKey default, the error says so. Every call that signs at least one entry is unaffected (#1743).
• authorizeEntry verifies a bare-Uint8Array signing callback against forAddress when one is given, rather than always against the entry's top-level credential address. A valid CAP-71 delegate signature was previously rejected with signature doesn't match payload (#1683, #1742). For every signer form, a forAddress that names no credential node is now rejected before the signer runs, rather than after.
• authorizeEntry throws a TypeError naming signatureScVal when the address it would verify against is a contract, instead of StrKey's invalid version byte (#1742).
• AssembledTransaction.needsNonInvokerSigningBy() walks CAP-71 delegate trees: it also lists the unsigned delegates under a contract account, even when the account itself has signed, and with includeAlreadySigned it lists every delegate under a contract account (#1655, #1747). signAuthEntries() still signs top-level addresses only, and names an unsigned delegate passed as address. sign() and signAndSend() now also reject an unsigned G… delegate under a contract account, whether or not the account has signed. This assumes every listed delegate must sign, so it can reject a transaction the network would accept when __check_auth uses only some of them. Pass ignoreContractDelegates to either method to skip that check for delegates under contract accounts; G… addresses are still checked.

Commits

• 7cfd51a chore(release): prepare v17.2.0 (#1760)
• 40a8376 fix(contract): walk delegate trees in needsNonInvokerSigningBy (#1747)
• 284f4d1 docs(contract): explain what needsNonInvokerSigningBy can and cannot see (#1745)
• 791e4cf fix(contract): forward wallet signerAddress to default authorizer (#1744)
• a6ba91a fix(contract): report when signAuthEntries signs no auth entry (#1743)
• 7b6469e fix(auth): verify bare signature callbacks against forAddress (#1742)
• 74ac0c6 docs: regroup the Migration Guide and fix the guides-local race (#1740)
• 6f47496 Add Stellar CLI plugin for generating TypeScript bindings (#1738)
• 3033dbc docs: wire docs/migration/ into the docs pipeline (#1725)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #77.