build(deps): bump stellar/stellar-cli from 26.0.0 to 26.1.0 in the actions-minor group

[dependabot]

Bumps the actions-minor group with 1 update: stellar/stellar-cli.

Updates stellar/stellar-cli from 26.0.0 to 26.1.0

Release notes

Sourced from stellar/stellar-cli's releases.

26.1.0

Ledger hardware wallets, end-to-end

• Derive and display addresses with stellar keys address --ledger (#2557).
• Fund accounts directly from Ledger-derived public keys with stellar keys fund --ledger (#2558).
• Register Ledger identities with stellar keys add --ledger (#2563).
• Pick the derivation path consistently with --hd-path across all of the above (#2539, #2540).
• Sign contract authorization entries from Ledger identities, enabling multi-auth contract invocations entirely from a hardware wallet — no secret material ever leaves the device (#2569).

Smaller wasm by default

• stellar contract build now optimizes wasm output by default (#2581).
• The --optimize flag is no longer required — what comes out of build is production-ready bytecode you can deploy as-is.

New: stellar contract info hash

• Returns the wasm hash for a deployed contract (#2576).
• Useful for scripting verification flows, comparing deployments across networks, or confirming that two contracts run the exact same bytecode.

Organized, discoverable help output

• --help output now groups flags into logical sections instead of dumping them in a single flat list (#2567).
• Finding the right network, signing, output, or identity flag is much faster — especially for high-surface commands like contract invoke.

Security hardening across the board

This release closes a number of paths where secrets, credentials, or untrusted input could surface in places they shouldn't:

• Secret values are no longer echoed in error messages, help output, signing previews, or RPC headers.
• Passwords embedded in RPC URLs are redacted in cached config, network display output, and the remaining places URLs were printed.
• Config, cache, and identity files are now created with 0600 permissions, and permissions are correctly reset when overwriting via --config-dir.
• STELLAR_SECRET_KEY is validated before being persisted and is rejected entirely when --secure-store is in use, preventing accidental disk writes of secret material.
• Keyring entries are cleaned up properly when overwriting a key, eliminating stale credential leftovers.
• stellar tx edit is hardened against temp-file swap attacks, and stellar contract build --print-commands-only now shell-escapes its output so it can be safely piped into a shell.
• Authorization entries are validated before signing, and the transaction source is no longer silently mixed into auth signing logic.
• Several dependency advisories were addressed (rustls-webpki, astral-tokio-tar, and others).

Quality-of-life and bug fixes

• Identity aliases now resolve inside nested invoke arguments (#2552).
• The CLI hints when a contract ID looks like a wasm hash (#2550).
• Secure-store public keys are cached in identity files, so you don't re-hit the keyring on every read (#2533).
• --hd-path is now persisted on plain seed-phrase keys (#2540).
• --docker-host is honored for TCP/HTTP Docker connections (#2503).
• Control characters in signed messages are escaped in previews.
• Fixed a panic when the global config directory didn't exist.
• Fixed an early-EOF bug in SkipWhitespace on whitespace-only chunks.

New Contributors

... (truncated)

Commits

• 1228cff Bump version to 26.1.0 (#2590)
• d1d71f5 Escape --manifest-path arg in build --print-commands-only tests. (#2591)
• 1607ad5 Upgrade to stable dependencies. (#2589)
• 9da8687 Bump astral-tokio-tar for RUSTSEC-2026-0145 (#2587)
• c925646 Validate auth entries before signing (#2530)
• 2f81472 Upgrade crate-git-revision to 0.0.8 (#2582)
• b17d3f0 Optimize wasm by default on contract build (#2581)
• b763532 Redact password in URLs at remaining display sites. (#2578)
• 81594e7 Add Claude Code PR review workflow (#2570)
• 5034aab Show alias name as plain string in overwrite warning (#2577)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions