chore: bump stellar SDK to 16.0.1 by Julink-eth · Pull Request #148 · MetaMask/snap-stellar-wallet

Julink-eth · 2026-06-30T08:05:31Z

Explanation

Summary

Bumps @stellar/stellar-sdk from ^15.0.1 to ^16.0.1 and applies the small compatibility changes needed for the Snap runtime and tests.

Changes

Updated @stellar/stellar-sdk to ^16.0.1.
Updated the root Node engine requirement to >=22.
Updated Jest config for SDK v16 ESM dependencies:
- ts-jest now allows JS transforms.
- Transform scope is limited to the SDK dependency graph packages needed in tests.
Updated SDK v16 transaction typing changes:
- Use OperationRecord for decoded transaction operations.
- Keep Operation.* types where specific operation shapes are needed.
- Handle the split revoke sponsorship operation types introduced by SDK v16.
Added guards for SDK fields that are now typed as optional, such as Asset.getIssuer().
Updated changeTrust operation construction typing to follow the v16 API.
Added Snap-safe network clients:
- HorizonClient for the Horizon endpoints this Snap uses.
- SorobanRpcClient for the Soroban JSON-RPC methods this Snap uses.
Updated NetworkService to use those clients instead of SDK Horizon.Server / rpc.Server.
Updated MultiCall to depend on a small simulateTransaction interface instead of rpc.Server.
Removed the previous eventsource shim and webpack alias. The Snap bundle now builds without that workaround.

Why the custom Horizon/RPC clients were added

The Snap runs in SES and does not have the same globals as a browser or Node runtime. SDK v16’s server clients use their own transport layer, which can rely on globals such as URLSearchParams, Blob, AbortController, and EventSource-related code paths.

This PR moves only the network transport layer into small Snap-controlled clients that use the Snap fetch endowment directly.

The SDK is still used for Stellar primitives such as transactions, XDR, assets, accounts, contracts, addresses, and Soroban parsing/assembly data structures.

Why the Jest config changed

SDK v16 and some of its dependencies are ESM-first packages distributed through node_modules. Jest was previously ignoring node_modules transforms, which caused tests to fail when loading these packages.

The Jest config now:

Uses ts-jest with allowJs: true so JavaScript files from selected ESM dependencies can be transformed.
Allows transformation for the specific packages needed by the Stellar SDK v16 dependency graph:
- @stellar/stellar-sdk
- @noble/ed25519
- @noble/hashes
- uint8array-extras

This keeps the transform scope narrow instead of transpiling all of node_modules.

References

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for packages I've changed
I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

socket-security · 2026-06-30T08:05:59Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@stellar/stellar-sdk@15.0.1 ⏵ 16.0.1			⁺¹	⁺²

View full report

socket-security · 2026-06-30T08:06:01Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

@stellar/stellar-sdk@16.0.1

View full report

Julink-eth · 2026-06-30T08:29:54Z

@SocketSecurity ignore npm/@stellar/stellar-sdk@16.0.1

Reviewed as acceptable risk for this PR.

Reasoning:

@stellar/stellar-sdk is the official Stellar JavaScript SDK and network access is expected functionality for its Horizon/RPC clients.
In v16 the SDK intentionally defaults to a native fetch HTTP client instead of the older axios transport.
Reviewed local package source: node_modules/@stellar/stellar-sdk/lib/esm/http-client/fetch-client.js uses fetch(currentUrl, currentInit) as the HTTP adapter for SDK requests.
This is not install-time or background network access; it is runtime HTTP behavior used when our Snap calls Stellar Horizon/RPC APIs.
The Snap already declares endowment:network-access.
Horizon streaming remains unsupported in the Snap runtime via the local eventsource shim, so this PR does not enable SDK streaming behavior.

Copilot

Pull request overview

Updates the Snap to be compatible with @stellar/stellar-sdk v16 by upgrading the dependency and adjusting transaction typing, simulation helpers, and network access to work reliably in the SES Snap runtime (using Snap-controlled fetch instead of SDK server clients).

Changes:

Bumped @stellar/stellar-sdk to ^16.0.1 and raised the repo Node engine requirement to >= 22.
Updated transaction parsing/simulation code to align with SDK v16 types (OperationRecord, optional fields, revoke sponsorship split).
Introduced Snap-safe HorizonClient / SorobanRpcClient and refactored NetworkService / MultiCall to use them; adjusted Jest transforms for ESM dependencies.

Reviewed changes

Copilot reviewed 24 out of 25 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
yarn.lock	Updates lockfile for Stellar SDK v16 and related dependency graph changes.
packages/snap/src/utils/caip.ts	Adds issuer guards for classic asset CAIP conversion with updated SDK typing.
packages/snap/src/services/transaction/xdrParser.ts	Adjusts imports and adds issuer undefined handling in CAIP conversion.
packages/snap/src/services/transaction/utils.ts	Switches operation helpers to accept `OperationRecord` and refines type guards.
packages/snap/src/services/transaction/TransactionSimulator.ts	Updates simulator internals to operate on `OperationRecord[]`.
packages/snap/src/services/transaction/TransactionSimulator.test.ts	Updates tests/fixtures usage for `OperationRecord` typing.
packages/snap/src/services/transaction/TransactionBuilder.ts	Updates `changeTrust` operation typing to match v16 API surface.
packages/snap/src/services/transaction/Transaction.ts	Updates `transactionOperations` to return `OperationRecord[]`.
packages/snap/src/services/transaction/simulation/utils.ts	Updates simulation helpers to use `OperationRecord`.
packages/snap/src/services/transaction/simulation/simulators.ts	Refactors simulator op typing and adds issuer guards for trustlines.
packages/snap/src/services/transaction/simulation/api.ts	Updates simulation API types to accept `OperationRecord` and readonly lists.
packages/snap/src/services/transaction/OperationMapper.ts	Updates mapper to consume `OperationRecord`, handles optional decoded fields, and supports new revoke sponsorship variants.
packages/snap/src/services/transaction/api.ts	Extends operation type enum for SDK v16 revoke sponsorship split.
packages/snap/src/services/network/utils.ts	Switches account-not-found detection to Snap Horizon client error type.
packages/snap/src/services/network/SorobanRpcClient.ts	Adds Snap-safe JSON-RPC Soroban client built on `fetch` with XDR parsing helpers.
packages/snap/src/services/network/SorobanRpcClient.test.ts	Adds unit tests for the Soroban RPC client fetch wiring and error mapping.
packages/snap/src/services/network/NetworkService.ts	Refactors to use `HorizonClient` / `SorobanRpcClient` instead of SDK server clients.
packages/snap/src/services/network/NetworkService.test.ts	Updates tests to spy/match new client methods and error types.
packages/snap/src/services/network/MultiCall.ts	Depends on a minimal `simulateTransaction` interface and adjusts simulation error handling.
packages/snap/src/services/network/HorizonClient.ts	Adds Snap-safe Horizon REST client built on `fetch` (pagination, assets, transactions, base fee).
packages/snap/src/services/network/HorizonClient.test.ts	Adds unit tests for Horizon client base fee, account helper mapping, and 404 behavior.
packages/snap/snap.manifest.json	Updates bundle shasum to match the rebuilt Snap artifact.
packages/snap/package.json	Bumps `@stellar/stellar-sdk` dependency to v16.
packages/snap/jest.config.js	Updates Jest transforms/ignore patterns to handle ESM dependencies needed by SDK v16.
package.json	Raises Node engine requirement to `>= 22`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

chore: bump stellar SDK to 16.0.1

5e45f9e

Julink-eth requested a review from a team as a code owner June 30, 2026 08:05

Julink-eth added 2 commits June 30, 2026 10:30

Merge branch 'main' into chore/bump-stellar-sdk

85fa299

chore: make the migration deeper and remove shim files

2262735

stanleyyconsensys requested a review from Copilot June 30, 2026 13:17

Copilot started reviewing on behalf of stanleyyconsensys June 30, 2026 13:18 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

Comment thread packages/snap/src/services/network/HorizonClient.ts

Comment thread packages/snap/src/services/network/HorizonClient.ts

Comment thread packages/snap/src/services/network/HorizonClient.ts

Comment thread packages/snap/src/services/network/MultiCall.ts Outdated

Julink-eth and others added 6 commits June 30, 2026 15:37

Potential fix for pull request finding

2ad9c40

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

57df779

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

caae06d

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

dcbf08b

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Merge branch 'main' into chore/bump-stellar-sdk

0715662

chore: fix recent changes from copilot + added tests

c189807

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: bump stellar SDK to 16.0.1#148

chore: bump stellar SDK to 16.0.1#148
Julink-eth wants to merge 9 commits into
mainfrom
chore/bump-stellar-sdk

Julink-eth commented Jun 30, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 30, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 30, 2026 •

edited

Loading

Uh oh!

Julink-eth commented Jun 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Julink-eth commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

Summary

Changes

Why the custom Horizon/RPC clients were added

Why the Jest config changed

References

Checklist

Uh oh!

socket-security Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Julink-eth commented Jun 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Julink-eth commented Jun 30, 2026 •

edited

Loading

socket-security Bot commented Jun 30, 2026 •

edited

Loading

socket-security Bot commented Jun 30, 2026 •

edited

Loading