build(deps): bump stellar/stellar-cli from 25.1.0 to 26.1.0

[dependabot]

Bumps stellar/stellar-cli from 25.1.0 to 26.1.0.

Release notes

Sourced from stellar/stellar-cli's releases.

26.1.0

Ledger hardware wallets, end-to-end

• Derive and display addresses with stellar keys address --ledger (#2557).
• Fund accounts directly from Ledger-derived public keys with stellar keys fund --ledger (#2558).
• Register Ledger identities with stellar keys add --ledger (#2563).
• Pick the derivation path consistently with --hd-path across all of the above (#2539, #2540).
• Sign contract authorization entries from Ledger identities, enabling multi-auth contract invocations entirely from a hardware wallet — no secret material ever leaves the device (#2569).

Smaller wasm by default

• stellar contract build now optimizes wasm output by default (#2581).
• The --optimize flag is no longer required — what comes out of build is production-ready bytecode you can deploy as-is.

New: stellar contract info hash

• Returns the wasm hash for a deployed contract (#2576).
• Useful for scripting verification flows, comparing deployments across networks, or confirming that two contracts run the exact same bytecode.

Organized, discoverable help output

• --help output now groups flags into logical sections instead of dumping them in a single flat list (#2567).
• Finding the right network, signing, output, or identity flag is much faster — especially for high-surface commands like contract invoke.

Security hardening across the board

This release closes a number of paths where secrets, credentials, or untrusted input could surface in places they shouldn't:

• Secret values are no longer echoed in error messages, help output, signing previews, or RPC headers.
• Passwords embedded in RPC URLs are redacted in cached config, network display output, and the remaining places URLs were printed.
• Config, cache, and identity files are now created with 0600 permissions, and permissions are correctly reset when overwriting via --config-dir.
• STELLAR_SECRET_KEY is validated before being persisted and is rejected entirely when --secure-store is in use, preventing accidental disk writes of secret material.
• Keyring entries are cleaned up properly when overwriting a key, eliminating stale credential leftovers.
• stellar tx edit is hardened against temp-file swap attacks, and stellar contract build --print-commands-only now shell-escapes its output so it can be safely piped into a shell.
• Authorization entries are validated before signing, and the transaction source is no longer silently mixed into auth signing logic.
• Several dependency advisories were addressed (rustls-webpki, astral-tokio-tar, and others).

Quality-of-life and bug fixes

• Identity aliases now resolve inside nested invoke arguments (#2552).
• The CLI hints when a contract ID looks like a wasm hash (#2550).
• Secure-store public keys are cached in identity files, so you don't re-hit the keyring on every read (#2533).
• --hd-path is now persisted on plain seed-phrase keys (#2540).
• --docker-host is honored for TCP/HTTP Docker connections (#2503).
• Control characters in signed messages are escaped in previews.
• Fixed a panic when the global config directory didn't exist.
• Fixed an early-EOF bug in SkipWhitespace on whitespace-only chunks.

New Contributors

... (truncated)

Commits

• 1228cff Bump version to 26.1.0 (#2590)
• d1d71f5 Escape --manifest-path arg in build --print-commands-only tests. (#2591)
• 1607ad5 Upgrade to stable dependencies. (#2589)
• 9da8687 Bump astral-tokio-tar for RUSTSEC-2026-0145 (#2587)
• c925646 Validate auth entries before signing (#2530)
• 2f81472 Upgrade crate-git-revision to 0.0.8 (#2582)
• b17d3f0 Optimize wasm by default on contract build (#2581)
• b763532 Redact password in URLs at remaining display sites. (#2578)
• 81594e7 Add Claude Code PR review workflow (#2570)
• 5034aab Show alias name as plain string in overwrite warning (#2577)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)