Update stellar-strkey to 0.0.18

[leighmcculloch]

What

Bumps the direct stellar-strkey dependency in soroban-env-host from 0.0.13 to 0.0.18, and adapts the two strkey-encoding call sites in host/conversion.rs to the new API. In 0.0.17+ the crate is no_std by default and Strkey::to_string() now returns a fixed-capacity heapless::String rather than std::string::String, so those sites now convert via .as_str().to_string(). The lockfile re-resolves to contain both 0.0.18 (for soroban-env-host) and 0.0.13 (transitively via the published stellar-xdr 27.0.0, which still pins 0.0.13); the 0.0.13 entry is expected and left in place, and deny.toml skips the duplicate.

Why

This moves soroban-env-host onto the stellar-strkey release line targeted for protocol 28.

This supersedes the earlier 0.0.17 bump: 0.0.17 contained a CLI bug (Decoded<Strkey> rejected owned JSON keys, breaking strkey encode), fixed in 0.0.18 by stellar/rs-stellar-strkey#125.

Known limitations

N/A

---

Protocol 28 coordination

⚠️ This change targets versions of software that will ship for Protocol 28, and should not be merged unless this repository is ready to accept Protocol 28 changes.

This is one of a coordinated set of PRs bumping stellar-strkey to 0.0.18 across the Protocol 28 component stack. It is preferred that all Protocol 28 releases of these components depend on the same version of stellar-strkey:

• Update stellar-strkey to 0.0.18 rs-stellar-xdr#547
• Update stellar-strkey to 0.0.18 #1694
• Update stellar-strkey to 0.0.18 rs-soroban-sdk#1913
• Update stellar-strkey to 0.0.18 rs-stellar-rpc-client#99
• Update stellar-strkey to 0.0.18 stellar-cli#2614

stellar-strkey 0.0.18 raises the minimum supported Rust version to 1.87 and updates/adds transitive dependencies (heapless 0.9, zeroize), so MSRV and supply-chain policy (cargo-deny / cackle) updates may be required in some repositories before CI is green.

[leighmcculloch]

Few comments inline for why changes are required.

[leighmcculloch]

The string returned from strkey's is now a heapless string, so this seemingly odd dance is converting that heapless string into an alloc String.

[Copilot]

Pull request overview

This PR updates the workspace to use stellar-strkey v0.0.18 (needed for Protocol 28) and raises the workspace MSRV to Rust 1.87, adapting soroban-env-host call sites to the updated stellar-strkey string-returning API.

Changes:

• Bump stellar-strkey in soroban-env-host from 0.0.13 to 0.0.18 and adjust strkey encoding conversions in host/conversion.rs.
• Raise rust-version to 1.87.0 in the workspace and affected crates.
• Update supply-chain policy configuration (deny.toml, cackle.toml) and Cargo.lock to account for new/duplicate dependencies.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
Cargo.toml	Raises workspace MSRV to Rust 1.87.0.
soroban-env-host/Cargo.toml	Bumps direct stellar-strkey dependency to 0.0.18 and sets crate MSRV to 1.87.0.
soroban-fuzz-targets/Cargo.toml	Raises crate MSRV to 1.87.0.
soroban-env-host/src/host/conversion.rs	Updates strkey encoding call sites to convert heapless::String to std::string::String.
soroban-env-host/src/crypto/poseidon/poseidon2.rs	Replaces a divisibility check implementation (currently introduces a compile issue).
soroban-env-host/src/crypto/poseidon/poseidon2_params.rs	Replaces an evenness check implementation (currently introduces a compile issue).
soroban-env-host/src/crypto/poseidon/poseidon_params.rs	Replaces an evenness check implementation (currently introduces a compile issue).
deny.toml	Skips the expected transitional duplicate stellar-strkey 0.0.13 in cargo-deny duplicates.
cackle.toml	Updates cackle allowlists for newly introduced transitive crates.
Cargo.lock	Lockfile refresh reflecting stellar-strkey 0.0.18 and new transitive dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.