chore: bump soroban-sdk to 27.0.0 and close out scanner noise - #87
Conversation
- Bump soroban-sdk from 23.5.2 → 27.0.0 in workspace Cargo.toml
- Bump Rust toolchain from 1.90.0 → 1.91.0 in rust-toolchain.toml
(required by soroban-sdk 27.0.0)
- Update build target reference in CLAUDE.md from wasm32-unknown-unknown
to wasm32v1-none (required by Soroban environment ≥ SDK 22+, deploy
scripts already used the correct target)
- Update docs/scout-audit-report.md:
- Mark soroban_version ENHANCEMENT as resolved
- Record all ~44 storage_change_events ENHANCEMENT flags as no action
(flagged functions already emit events; Scout cannot trace through
dispatcher wrappers; ManagerChanged gap tracked in issue boundlessfi#3)
All 197 events + 66 profile tests pass at soroban-sdk 27.0.0.
Closes boundlessfi#77
|
Warning Review limit reached
Next review available in: 55 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe PR upgrades the Soroban SDK, Rust toolchain, and Stellar CLI, changes documented contract builds to use ChangesSoroban maintenance
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CLAUDE.md`:
- Line 30: Replace both documented cargo build commands in the CLAUDE.md build
examples with the stellar contract build workflow used by the contracts/events
Makefile, including the corresponding command for each documented contract build
location.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: d697674e-8754-4a02-89c7-753e75159d2d
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (4)
CLAUDE.mdCargo.tomldocs/scout-audit-report.mdrust-toolchain.toml
soroban-sdk 27.0.0 has MSRV 1.91.0, but the Stellar contract build tool
blocklists Rust 1.91.0 exactly ("use a rust version other than 1.81,
1.82, 1.83 or 1.91.0"), so `make build` fails under the previously
pinned 1.91.0. Pin 1.93.0 instead: it clears the SDK MSRV and is not on
the blocklist. Verified with `stellar contract build` (cli 27.0.0), not
just `cargo build` — the plain cargo path skips the blocklist check.
Also bump the CI-pinned stellar-cli 23.1.3 -> 27.0.0 to match Protocol
27 (mainnet + testnet both run core 27.x), with its verified linux
tarball SHA-256. Merge current testnet in to pick up the hardened CI
action and the 1.3.0 contract changes, and regenerate Cargo.lock.
Verified: stellar contract build OK for both contracts; events wasm
53,257 bytes (< 64 KB ceiling); cargo test 210 + 66 green; fmt clean.
Quota reachedYour plan allows 300 CI/CD file units per month. You've used 279 and this scan would add 24 more (total: 303). |
The build job only ran on contracts/** changes, so a Cargo.toml SDK bump or a rust-toolchain.toml / setup-rust-stellar change could merge without the build ever running — exactly the toolchain surface most likely to break the build. Add those paths so make build validates them.
There was a problem hiding this comment.
♻️ Duplicate comments (1)
CLAUDE.md (1)
31-31: 🎯 Functional Correctness | 🟠 MajorUse
stellar contract buildin both documented build examples.Changing the target is not sufficient: both examples still invoke
cargo build, while the repository’s contract workflow usesstellar contract build. This is the same unresolved issue raised in the previous review.Also applies to: 49-49
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CLAUDE.md` at line 31, Update both documented contract build examples in CLAUDE.md to invoke the repository’s stellar contract build workflow instead of cargo build, preserving their existing release/build intent and ensuring both occurrences use stellar contract build.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@CLAUDE.md`:
- Line 31: Update both documented contract build examples in CLAUDE.md to invoke
the repository’s stellar contract build workflow instead of cargo build,
preserving their existing release/build intent and ensuring both occurrences use
stellar contract build.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9e8a00f9-b284-4db2-b275-a32f4b30dfa3
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (3)
.github/actions/setup-rust-stellar/action.ymlCLAUDE.mdrust-toolchain.toml
🚧 Files skipped from review as they are similar to previous changes (1)
- rust-toolchain.toml
2 participants
Summary
soroban-sdkfrom23.5.2→27.0.0in workspaceCargo.toml1.90.0→1.91.0inrust-toolchain.toml(required by soroban-sdk 27.0.0)CLAUDE.mdfromwasm32-unknown-unknown→wasm32v1-none(deploy scripts already used the correct target; this was only a docs inconsistency)docs/scout-audit-report.md:soroban_versionENHANCEMENT as resolved (bumped to 27.0.0)storage_change_eventsENHANCEMENT flags as no action: the flagged functions arelib.rsdispatcher wrappers; the underlying implementation modules already emit a typed Soroban event for every state-changing operation; Scout cannot trace through function calls. The single genuine gap (ManagerChanged) is tracked in issue Enhanced Milestone & Admin Management Functions for On-chain/Frontend Sync #3.Test plan
cargo build --target wasm32v1-none --release -p boundless-events— successcargo build --target wasm32v1-none --release -p boundless-profile— successcargo test -p boundless-events— 197 passed, 0 failedcargo test -p boundless-profile— 66 passed, 0 failedCloses #77
Summary by CodeRabbit
Improvements
Documentation