build(deps): bump stellar/stellar-cli from 25.1.0 to 26.0.0

[dependabot]

Bumps stellar/stellar-cli from 25.1.0 to 26.0.0.

Release notes

Sourced from stellar/stellar-cli's releases.

26.0.0

Stellar CLI v26.0.0 Release Notes

Protocol 26 Support

This release adds full support for Stellar Protocol 26. The CLI now runs against Protocol 26 by default, including updated network dependencies and the Soroban SDK.

New Features

Confirmation prompt when removing keys

Deleting a key with stellar keys rm now asks for confirmation before removing it, preventing accidental key loss.

Contract name validation on init

When creating a new contract with stellar contract init --name, the name is now validated and sanitized automatically, giving you a clear error if the name doesn't meet requirements instead of generating a broken project.

Smarter npm package name handling

When initializing JavaScript/TypeScript projects, package names are now validated against npm naming rules using the same logic npm itself uses, catching issues earlier in the workflow.

SHA-256 verification when fetching contract code

When fetching a contract's Wasm bytecode from the network, the CLI now verifies that the SHA-256 hash of the downloaded code matches the hash stored on-chain. This ensures the contract code you receive hasn't been tampered with.

Bug Fixes

Fixed crash in xdr decode with Val type

Running stellar xdr decode on data of type Val would panic. This is now fixed and returns a proper result.

Breaking Changes / Removals

Removed deprecated --list flag for plugins

The --list option for listing plugins was deprecated and has been removed. Use stellar plugin list instead (or the equivalent subcommand in your workflow).

Removed deprecated --global flag

The --global flag, which was previously deprecated in favour of the new global-by-default behaviour, has been removed.

Docker Image

Official Docker images are now published automatically with each release.

Full Changelog: stellar/stellar-cli@v25.2.0...v26.0.0

25.2.0

🚀 New Features

• Auto-build on deploy: stellar contract deploy and stellar contract upload now automatically build your contracts when no WASM is provided — no manual build step required. (#2378)
• Self-describing events: stellar events and contract invoke now display human-readable event descriptions from the contract spec. (#2380)
• Fee bump for large transactions: Transactions that exceed the base fee threshold are automatically wrapped in a fee bump transaction. (#2382)
• Pipe secrets from stdin: Key secrets can now be passed via pipe, making it easier to integrate with secret managers in scripts and CI. (#2403)
• stellar network root-account: New command to retrieve the root account for a given network. (#2402)

... (truncated)

Commits

• 60f7458 Bump version to 26.0.0 (#2476)
• 46bfb04 Fix xdr_to_json panic when output type is Val. (#2474)
• ceb34a6 Prepare for Protocol 26 release. (#2470)
• 8579c49 feat: add user confirmation for keys rm command (#2452)
• cadec3f Verify SHA-256 of contract code matches contract hash when fetching (#2465)
• b36124d Publish docker image. (#2448)
• 84c254d Bump the all-actions group with 2 updates (#2450)
• 8a6c883 Use serde to build package json and check npm package name. (#2428)
• 57f067f Sanitize contract name when calling stellar contract init --name. (#2449)
• 2848488 Bump version to 25.2.0 (#2444)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #5.