From 38149136b1638485dbe47b9ed0dcbba9eef011a3 Mon Sep 17 00:00:00 2001
From: Leigh <351529+leighmcculloch@users.noreply.github.com>
Date: Wed, 17 Jun 2026 02:53:26 +0000
Subject: [PATCH 1/7] update stellar-strkey to 0.0.17

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XiSfu2MM5xbdGjxj7oXys8
---
 Cargo.lock                              | 48 +++++++++++++++++++++++--
 soroban-env-host/Cargo.toml             |  2 +-
 soroban-env-host/src/host/conversion.rs |  4 +--
 3 files changed, 49 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 98174aeea..85de0e54c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -297,6 +297,12 @@ version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "374d28ec25809ee0e23827c2ab573d729e293f281dfe393500e7ad618baa61c6"
 
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
 [[package]]
 name = "bytes-lit"
 version = "0.0.5"
@@ -785,6 +791,15 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "hash32"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d60b12902ba28e2730cd37e95b8c9223af2808df9e902d4df49588d1470606"
+dependencies = [
+ "byteorder",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -806,6 +821,17 @@ dependencies = [
  "allocator-api2",
 ]
 
+[[package]]
+name = "heapless"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25ba4bd83f9415b58b4ed8dc5714c76e626a105be4646c02630ad730ad3b5aa4"
+dependencies = [
+ "hash32",
+ "stable_deref_trait",
+ "zeroize",
+]
+
 [[package]]
 name = "hermit-abi"
 version = "0.3.3"
@@ -1694,7 +1720,7 @@ dependencies = [
  "soroban-test-wasms",
  "soroban-wasmi",
  "static_assertions",
- "stellar-strkey",
+ "stellar-strkey 0.0.17",
  "tabwriter",
  "textplots",
  "thousands",
@@ -1790,6 +1816,12 @@ dependencies = [
  "der",
 ]
 
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
 [[package]]
 name = "static_assertions"
 version = "1.1.0"
@@ -1806,6 +1838,18 @@ dependencies = [
  "data-encoding",
 ]
 
+[[package]]
+name = "stellar-strkey"
+version = "0.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0247b168bdee20244445e3d9cdea697dde6211e88742dd04acfd1b498661e936"
+dependencies = [
+ "crate-git-revision 0.0.9",
+ "data-encoding",
+ "heapless",
+ "zeroize",
+]
+
 [[package]]
 name = "stellar-xdr"
 version = "27.0.0"
@@ -1822,7 +1866,7 @@ dependencies = [
  "serde",
  "serde_with",
  "sha2",
- "stellar-strkey",
+ "stellar-strkey 0.0.13",
 ]
 
 [[package]]
diff --git a/soroban-env-host/Cargo.toml b/soroban-env-host/Cargo.toml
index 379498809..b44d4547c 100644
--- a/soroban-env-host/Cargo.toml
+++ b/soroban-env-host/Cargo.toml
@@ -18,7 +18,7 @@ soroban-builtin-sdk-macros = { workspace = true }
 soroban-env-common = { workspace = true, features = ["std", "wasmi", "shallow-val-hash"] }
 wasmi = { workspace = true }
 wasmparser = { workspace = true }
-stellar-strkey = "0.0.13"
+stellar-strkey = "0.0.17"
 static_assertions = "1.1.0"
 sha2 = "0.10.8"
 hex-literal = "0.4.1"
diff --git a/soroban-env-host/src/host/conversion.rs b/soroban-env-host/src/host/conversion.rs
index 1d297ed9d..e9193b545 100644
--- a/soroban-env-host/src/host/conversion.rs
+++ b/soroban-env-host/src/host/conversion.rs
@@ -686,7 +686,7 @@ impl Host {
                 ))
             }
         };
-        Ok(strkey.to_string())
+        Ok(strkey.to_string().as_str().to_string())
     }
 
     pub(crate) fn muxed_sc_address_to_strkey(
@@ -708,7 +708,7 @@ impl Host {
                         ed25519: muxed_account.ed25519.0.metered_clone(self)?,
                     },
                 );
-                Ok(strkey.to_string())
+                Ok(strkey.to_string().as_str().to_string())
             }
             _ => Err(self.err(
                 ScErrorType::Object,

From 46691dc6f61eb2b77203b081df283e36b99e9b94 Mon Sep 17 00:00:00 2001
From: Leigh <351529+leighmcculloch@users.noreply.github.com>
Date: Wed, 17 Jun 2026 05:22:40 +0000
Subject: [PATCH 2/7] bump msrv to 1.87 and allowlist strkey 0.0.17 deps

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XiSfu2MM5xbdGjxj7oXys8
---
 Cargo.toml                      | 2 +-
 cackle.toml                     | 7 +++++++
 deny.toml                       | 4 ++++
 soroban-env-host/Cargo.toml     | 2 +-
 soroban-fuzz-targets/Cargo.toml | 2 +-
 5 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 907b6f2d0..8e4073775 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -22,7 +22,7 @@ exclude = ["soroban-test-wasms/wasm-workspace"]
 # code guarded by `unstable-*` features to make it enabled
 # unconditionally.
 version = "27.0.0"
-rust-version = "1.84.0"
+rust-version = "1.87.0"
 
 [workspace.dependencies]
 soroban-env-common = { version = "=27.0.0", path = "soroban-env-common", default-features = false }
diff --git a/cackle.toml b/cackle.toml
index 32998ea98..8daa112ad 100644
--- a/cackle.toml
+++ b/cackle.toml
@@ -245,6 +245,13 @@ build.allow_apis = [
     "env",
 ]
 
+[pkg.heapless]
+build.allow_apis = [
+    "env",
+    "fs",
+    "process",
+]
+
 [pkg.tracking-allocator]
 allow_unsafe = true
 from.test.allow_apis = [
diff --git a/deny.toml b/deny.toml
index 5a607e97a..8b825a464 100644
--- a/deny.toml
+++ b/deny.toml
@@ -246,6 +246,10 @@ skip = [
     { name = "hashbrown", version = "=0.14.1" },
     { name = "syn", version = "=1.0.109" },
     { name = "crate-git-revision", version = "=0.0.6" },
+    # Transitional duplicate: we depend on stellar-strkey 0.0.17 directly while
+    # the published stellar-xdr 27.0.0 still pulls in 0.0.13. This goes away once
+    # the stellar-xdr v28 (protocol-28) release also ships on strkey 0.0.17.
+    { name = "stellar-strkey", version = "=0.0.13" },
 ]
 # Similarly to `skip` allows you to skip certain crates during duplicate
 # detection. Unlike skip, it also includes the entire tree of transitive
diff --git a/soroban-env-host/Cargo.toml b/soroban-env-host/Cargo.toml
index b44d4547c..046dfe415 100644
--- a/soroban-env-host/Cargo.toml
+++ b/soroban-env-host/Cargo.toml
@@ -8,7 +8,7 @@ license = "Apache-2.0"
 version.workspace = true
 readme = "../README.md"
 edition = "2021"
-rust-version = "1.84.0"
+rust-version = "1.87.0"
 build = "build.rs"
 
 exclude = ["observations/"]
diff --git a/soroban-fuzz-targets/Cargo.toml b/soroban-fuzz-targets/Cargo.toml
index 1931ef255..206f461b5 100644
--- a/soroban-fuzz-targets/Cargo.toml
+++ b/soroban-fuzz-targets/Cargo.toml
@@ -7,7 +7,7 @@ authors = ["Stellar Development Foundation <info@stellar.org>"]
 license = "Apache-2.0"
 version.workspace = true
 edition = "2021"
-rust-version = "1.84.0"
+rust-version = "1.87.0"
 publish = false
 
 [dependencies]

From 4ea6b1ac32f633d7a8e45079b637ef8deea13ce8 Mon Sep 17 00:00:00 2001
From: Leigh <351529+leighmcculloch@users.noreply.github.com>
Date: Wed, 17 Jun 2026 05:35:51 +0000
Subject: [PATCH 3/7] allowlist unsafe in new strkey 0.0.17 transitive deps for
 cackle

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XiSfu2MM5xbdGjxj7oXys8
---
 cackle.toml | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/cackle.toml b/cackle.toml
index 8daa112ad..fb25e7019 100644
--- a/cackle.toml
+++ b/cackle.toml
@@ -109,6 +109,9 @@ allow_apis = [
 
 [pkg.rand]
 allow_unsafe = true
+allow_apis = [
+    "rand",
+]
 
 [pkg.backtrace]
 allow_apis = [
@@ -146,6 +149,18 @@ allow_unsafe = true
 [pkg.subtle]
 allow_unsafe = true
 
+[pkg.byteorder]
+allow_unsafe = true
+
+[pkg.hash32]
+allow_unsafe = true
+
+[pkg.stable_deref_trait]
+allow_unsafe = true
+
+[pkg.stellar-strkey]
+allow_unsafe = true
+
 [pkg.zeroize]
 allow_unsafe = true
 
@@ -246,11 +261,7 @@ build.allow_apis = [
 ]
 
 [pkg.heapless]
-build.allow_apis = [
-    "env",
-    "fs",
-    "process",
-]
+allow_unsafe = true
 
 [pkg.tracking-allocator]
 allow_unsafe = true

From 85bbe7438caa88b9e06213bb505ac5629be1095e Mon Sep 17 00:00:00 2001
From: Leigh <351529+leighmcculloch@users.noreply.github.com>
Date: Wed, 17 Jun 2026 05:41:26 +0000
Subject: [PATCH 4/7] fix pre-existing manual_is_multiple_of lint in poseidon
 for rust 1.96

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XiSfu2MM5xbdGjxj7oXys8
---
 soroban-env-host/src/crypto/poseidon/poseidon2.rs        | 2 +-
 soroban-env-host/src/crypto/poseidon/poseidon2_params.rs | 2 +-
 soroban-env-host/src/crypto/poseidon/poseidon_params.rs  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/soroban-env-host/src/crypto/poseidon/poseidon2.rs b/soroban-env-host/src/crypto/poseidon/poseidon2.rs
index 35f89060d..8c8f984ef 100644
--- a/soroban-env-host/src/crypto/poseidon/poseidon2.rs
+++ b/soroban-env-host/src/crypto/poseidon/poseidon2.rs
@@ -89,7 +89,7 @@ impl<F: MeteredScalar> Poseidon2<F> {
     /// (https://eprint.iacr.org/2023/323)
     fn matmul_m4(&self, host: &Host, state: &mut [F]) -> Result<(), HostError> {
         let t = self.params.t;
-        if t % 4 != 0 {
+        if !t.is_multiple_of(4) {
             return Err(host.error(
                 INVALID_INPUT,
                 "Poseidon2: matmul_m4 state size must be divisible by 4",
diff --git a/soroban-env-host/src/crypto/poseidon/poseidon2_params.rs b/soroban-env-host/src/crypto/poseidon/poseidon2_params.rs
index 58a9d6c87..7fa56c298 100644
--- a/soroban-env-host/src/crypto/poseidon/poseidon2_params.rs
+++ b/soroban-env-host/src/crypto/poseidon/poseidon2_params.rs
@@ -46,7 +46,7 @@ impl<F: MeteredScalar> Poseidon2Params<F> {
                 ],
             ));
         }
-        if rounds_f % 2 != 0 {
+        if !rounds_f.is_multiple_of(2) {
             return Err(host.error(
                 INVALID_INPUT,
                 "Poseidon2: `rounds_f` must be even",
diff --git a/soroban-env-host/src/crypto/poseidon/poseidon_params.rs b/soroban-env-host/src/crypto/poseidon/poseidon_params.rs
index eee355bd1..96f4b7473 100644
--- a/soroban-env-host/src/crypto/poseidon/poseidon_params.rs
+++ b/soroban-env-host/src/crypto/poseidon/poseidon_params.rs
@@ -46,7 +46,7 @@ impl<S: MeteredScalar> PoseidonParams<S> {
                 ],
             ));
         }
-        if rounds_f % 2 != 0 {
+        if !rounds_f.is_multiple_of(2) {
             return Err(host.error(
                 INVALID_INPUT,
                 "Poseidon: `rounds_f` must be even",

From 34800ffb23b9bcbe1fcb636a62faf495fb0573bf Mon Sep 17 00:00:00 2001
From: Leigh <351529+leighmcculloch@users.noreply.github.com>
Date: Wed, 17 Jun 2026 05:43:20 +0000
Subject: [PATCH 5/7] allow heapless build script fs/env/process apis

---
 cackle.toml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/cackle.toml b/cackle.toml
index fb25e7019..c9ea34742 100644
--- a/cackle.toml
+++ b/cackle.toml
@@ -262,6 +262,11 @@ build.allow_apis = [
 
 [pkg.heapless]
 allow_unsafe = true
+build.allow_apis = [
+    "env",
+    "fs",
+    "process",
+]
 
 [pkg.tracking-allocator]
 allow_unsafe = true

From 45786e9215324fd9efe81504e2e5cfb9ee0f074d Mon Sep 17 00:00:00 2001
From: Leigh <351529+leighmcculloch@users.noreply.github.com>
Date: Wed, 17 Jun 2026 14:49:35 +0000
Subject: [PATCH 6/7] update stellar-strkey to 0.0.18

0.0.18 includes the strkey CLI fix (accept owned variant keys for
Decoded<Strkey>). It is not yet on crates.io, so temporarily patch
stellar-strkey to the release/v0.0.18 branch to validate ahead of the
release. Remove the patch once 0.0.18 is published.
---
 Cargo.lock                  | 7 +++----
 Cargo.toml                  | 6 ++++++
 deny.toml                   | 4 ++--
 soroban-env-host/Cargo.toml | 2 +-
 4 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 85de0e54c..9c6bbea19 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1720,7 +1720,7 @@ dependencies = [
  "soroban-test-wasms",
  "soroban-wasmi",
  "static_assertions",
- "stellar-strkey 0.0.17",
+ "stellar-strkey 0.0.18",
  "tabwriter",
  "textplots",
  "thousands",
@@ -1840,9 +1840,8 @@ dependencies = [
 
 [[package]]
 name = "stellar-strkey"
-version = "0.0.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0247b168bdee20244445e3d9cdea697dde6211e88742dd04acfd1b498661e936"
+version = "0.0.18"
+source = "git+https://github.com/stellar/rs-stellar-strkey?rev=73bf43778a4acad5e7b3589f54a5ec3607c4b7b1#73bf43778a4acad5e7b3589f54a5ec3607c4b7b1"
 dependencies = [
  "crate-git-revision 0.0.9",
  "data-encoding",
diff --git a/Cargo.toml b/Cargo.toml
index 8e4073775..5e94b1d6b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -53,6 +53,12 @@ rev = "0ed3f3dee30dc41ebe21972399e0a73a41944aa0"
 # soroban-wasmi = { path = "../wasmi/crates/wasmi/" }
 # soroban-wasmi_core = { path = "../wasmi/crates/core/" }
 
+# Temporary: stellar-strkey 0.0.18 is not yet published to crates.io. Point at
+# the release/v0.0.18 branch so this PR can be validated against the actual
+# 0.0.18 code ahead of the release. Remove once 0.0.18 is published.
+[patch.crates-io]
+stellar-strkey = { git = "https://github.com/stellar/rs-stellar-strkey", rev = "73bf43778a4acad5e7b3589f54a5ec3607c4b7b1" }
+
 [profile.release]
 lto = true
 debug = true
diff --git a/deny.toml b/deny.toml
index 8b825a464..297b63647 100644
--- a/deny.toml
+++ b/deny.toml
@@ -246,9 +246,9 @@ skip = [
     { name = "hashbrown", version = "=0.14.1" },
     { name = "syn", version = "=1.0.109" },
     { name = "crate-git-revision", version = "=0.0.6" },
-    # Transitional duplicate: we depend on stellar-strkey 0.0.17 directly while
+    # Transitional duplicate: we depend on stellar-strkey 0.0.18 directly while
     # the published stellar-xdr 27.0.0 still pulls in 0.0.13. This goes away once
-    # the stellar-xdr v28 (protocol-28) release also ships on strkey 0.0.17.
+    # the stellar-xdr v28 (protocol-28) release also ships on strkey 0.0.18.
     { name = "stellar-strkey", version = "=0.0.13" },
 ]
 # Similarly to `skip` allows you to skip certain crates during duplicate
diff --git a/soroban-env-host/Cargo.toml b/soroban-env-host/Cargo.toml
index 046dfe415..c1651add2 100644
--- a/soroban-env-host/Cargo.toml
+++ b/soroban-env-host/Cargo.toml
@@ -18,7 +18,7 @@ soroban-builtin-sdk-macros = { workspace = true }
 soroban-env-common = { workspace = true, features = ["std", "wasmi", "shallow-val-hash"] }
 wasmi = { workspace = true }
 wasmparser = { workspace = true }
-stellar-strkey = "0.0.17"
+stellar-strkey = "0.0.18"
 static_assertions = "1.1.0"
 sha2 = "0.10.8"
 hex-literal = "0.4.1"

From db368ed8368a138bdb3231d3b784f35f22192335 Mon Sep 17 00:00:00 2001
From: Leigh <351529+leighmcculloch@users.noreply.github.com>
Date: Thu, 18 Jun 2026 03:22:05 +0000
Subject: [PATCH 7/7] depend on published stellar-strkey 0.0.18

0.0.18 is now published to crates.io, so drop the temporary
[patch.crates-io] that pointed stellar-strkey at the release/v0.0.18 git
branch (and the matching stellar-cli deny.toml allow-git entry). The
dependency now resolves from crates.io.
---
 Cargo.lock | 3 ++-
 Cargo.toml | 6 ------
 2 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 9c6bbea19..83afe4934 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1841,7 +1841,8 @@ dependencies = [
 [[package]]
 name = "stellar-strkey"
 version = "0.0.18"
-source = "git+https://github.com/stellar/rs-stellar-strkey?rev=73bf43778a4acad5e7b3589f54a5ec3607c4b7b1#73bf43778a4acad5e7b3589f54a5ec3607c4b7b1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f34ff61c0ca6f1c2b4169e8d1633417bd9225f58b6175e4e317204565d16277"
 dependencies = [
  "crate-git-revision 0.0.9",
  "data-encoding",
diff --git a/Cargo.toml b/Cargo.toml
index 5e94b1d6b..8e4073775 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -53,12 +53,6 @@ rev = "0ed3f3dee30dc41ebe21972399e0a73a41944aa0"
 # soroban-wasmi = { path = "../wasmi/crates/wasmi/" }
 # soroban-wasmi_core = { path = "../wasmi/crates/core/" }
 
-# Temporary: stellar-strkey 0.0.18 is not yet published to crates.io. Point at
-# the release/v0.0.18 branch so this PR can be validated against the actual
-# 0.0.18 code ahead of the release. Remove once 0.0.18 is published.
-[patch.crates-io]
-stellar-strkey = { git = "https://github.com/stellar/rs-stellar-strkey", rev = "73bf43778a4acad5e7b3589f54a5ec3607c4b7b1" }
-
 [profile.release]
 lto = true
 debug = true