Skip to content

Upgrade Stellar Wallet Kits to the latest version#1855

Draft
jeesunikim wants to merge 3 commits intomainfrom
issue-1692
Draft

Upgrade Stellar Wallet Kits to the latest version#1855
jeesunikim wants to merge 3 commits intomainfrom
issue-1692

Conversation

@jeesunikim
Copy link
Contributor

No description provided.

- Migrate from @creit.tech/stellar-wallets-kit (npm) to @creit-tech/stellar-wallets-kit (jsr)
- Update to new static API: StellarWalletsKit.init(), .authModal(), .signTransaction(), etc.
- Replace openModal() with authModal() which returns address directly
- Update module imports to use new paths (e.g., /modules/albedo)
- Use Networks enum from /types instead of WalletNetwork
- Add DynamicWalletKitProvider for client-side only loading with next/dynamic
- Simplify WalletKitContextProvider to use static methods
- Update all consumers: ConnectWallet, useSignWithExtensionWallet, InvokeContractForm
Copilot AI review requested due to automatic review settings February 9, 2026 22:40
@github-project-automation github-project-automation bot moved this to Backlog (Not Ready) in DevX Feb 9, 2026
@jeesunikim jeesunikim linked an issue Feb 9, 2026 that may be closed by this pull request
@socket-security
Copy link

socket-security bot commented Feb 9, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
License policy violation: npm @lit-labs/ssr-dom-shim under BSD-3-Clause

Location: Package overview

From: pnpm-lock.yamlnpm/@lit-labs/ssr-dom-shim@1.5.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@lit-labs/ssr-dom-shim@1.5.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @lit/reactive-element under BSD-3-Clause

Location: Package overview

From: pnpm-lock.yamlnpm/@lit/reactive-element@2.1.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@lit/reactive-element@2.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm @lobstrco/signer-extension-api under GPL-3.0

License: GPL-3.0 - the applicable license policy does not allow this license (4) (npm metadata)

License: GPL-3.0 - the applicable license policy does not allow this license (4) (package/package.json)

From: pnpm-lock.yamlnpm/@lobstrco/signer-extension-api@2.0.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@lobstrco/signer-extension-api@2.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm lit-element under BSD-3-Clause

Location: Package overview

From: pnpm-lock.yamlnpm/lit-element@4.2.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lit-element@4.2.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm lit-html under BSD-3-Clause

Location: Package overview

From: pnpm-lock.yamlnpm/lit-html@3.3.2

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lit-html@3.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm lit under BSD-3-Clause

Location: Package overview

From: pnpm-lock.yamlnpm/lit@3.3.0

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lit@3.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
License policy violation: npm rpc-websockets under LGPL-3.0-only

Location: Package overview

From: pnpm-lock.yamlnpm/rpc-websockets@9.3.3

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rpc-websockets@9.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@stellar-jenkins
Copy link

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR upgrades the Stellar Wallets Kit integration to the newer @creit-tech/stellar-wallets-kit SDK, moving from instance-based usage to the SDK’s static API and adjusting client-only initialization in Next.js.

Changes:

  • Replace @creit.tech/stellar-wallets-kit usage with @creit-tech/stellar-wallets-kit (jsr:2.0.0-beta.9) and update imports/APIs accordingly.
  • Refactor wallet-kit initialization to run client-side only (via a dynamic provider + StellarWalletsKit.init()).
  • Update signing/auth flows to use StellarWalletsKit.authModal() / signTransaction() and refresh network limit constants.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
src/hooks/useSignWithExtensionWallet.ts Switch signing/auth to static SDK methods and gate usage on initialization.
src/helpers/getWalletKitNetwork.ts Update network mapping to new SDK types (Networks).
src/helpers/errorUtils.ts Treat new package name as “external” for error classification.
src/constants/networkLimits.ts Update Soroban network limits window values.
src/components/WalletKit/WalletKitContextProvider.tsx Refactor kit setup to StellarWalletsKit.init() + expose isInitialized.
src/components/WalletKit/DynamicWalletKitProvider.tsx New SSR-disabled provider wrapper to ensure client-only loading.
src/components/WalletKit/ConnectWallet.tsx Update connect/disconnect/autoconnect flows to use static SDK methods.
src/app/layout.tsx Swap provider to dynamic client-only wallet kit provider.
src/app/(sidebar)/smart-contracts/contract-explorer/components/InvokeContractForm.tsx Update contract invoke signing to use static SDK signing.
package.json Replace old wallet-kit dependency with new jsr: dependency.
pnpm-lock.yaml Lockfile updates for new wallet-kit SDK + transitive deps.
.tool-versions Add asdf tool pins (Node/Yarn).
Comments suppressed due to low confidence (1)

src/components/WalletKit/ConnectWallet.tsx:45

  • disconnect() now always calls StellarWalletsKit.disconnect() even if the kit hasn't been initialized yet. If disconnect() can run before WalletKitContextProvider finishes initialization (or if init fails), this can throw and prevent local state cleanup. Consider guarding with walletKitContext.isInitialized and/or wrapping the SDK call in a try/catch so updateWalletKit/localStorage cleanup always happens.
  const disconnect = () => {
    updateWalletKit({
      publicKey: undefined,
      walletType: undefined,
    });

    StellarWalletsKit.disconnect();
    setShowModal(false);
    setConnected(false);
    setHasAttemptedAutoConnect(false);
    localStorageSavedWallet.remove();

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +122 to +152
const { address } = await StellarWalletsKit.authModal();

if (!address) {
const errorMessage = "Unable to load wallet information";
setErrorMessageOnConnect(errorMessage);
disconnect();
return;
}

localStorageSavedWallet.set({
id: option.id,
network: {
id: network.id,
label: network.label,
},
});

trackEvent(TrackingEvent.WALLET_KIT_SELECTED, {
walletType: option.id,
});
},
updateWalletKit({
publicKey: address,
});
setConnected(true);

// Get the selected wallet ID to save
const wallets = await StellarWalletsKit.refreshSupportedWallets();
const availableWallet = wallets.find((w) => w.isAvailable);

if (availableWallet) {
localStorageSavedWallet.set({
id: availableWallet.id,
network: {
id: network.id,
label: network.label,
},
});

trackEvent(TrackingEvent.WALLET_KIT_SELECTED, {
walletType: availableWallet.id,
});
}
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

connectWallet() saves availableWallet.id by picking the first wallet where isAvailable is true. This is not necessarily the wallet the user actually selected in authModal(), so the persisted wallet ID (and the tracking event) can be incorrect and break auto-connect on reload. Prefer using the wallet identifier returned by authModal() (if provided), or otherwise capture the actual selected wallet during the auth flow instead of guessing from availability.

Copilot uses AI. Check for mistakes.
Comment on lines 120 to +123
const connectWallet = async () => {
try {
await walletKitInstance.walletKit?.openModal({
onWalletSelected: async (option: ISupportedWallet) => {
walletKitInstance.walletKit?.setWallet(option.id);
const isWalletConnected = await handleSetWalletAddress({
skipRequestAccess: false,
});

if (!isWalletConnected) {
const errorMessage = "Unable to load wallet information";
setErrorMessageOnConnect(errorMessage);
disconnect();
return;
}
const { address } = await StellarWalletsKit.authModal();

Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

connectWallet() calls StellarWalletsKit.authModal() without checking walletKitContext.isInitialized, even though other flows (auto-connect, signing) explicitly gate SDK calls on initialization. If the user clicks “Connect Wallet” before the provider finishes StellarWalletsKit.init(), this can fail and show a confusing error. Consider early-returning (or disabling the button) until walletKitContext.isInitialized is true.

Copilot uses AI. Check for mistakes.
}
}
}
}
Copy link

Copilot AI Feb 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

isInProgress is set to true at the start of signTx, but there are code paths where it never gets reset (e.g., when the user closes authModal() and you intentionally suppress the error message, or when getErrorMsg() returns an empty string for Ledger "is busy" errors). This can leave the hook permanently stuck "in progress" and prevent subsequent signing attempts. Consider resetting isInProgress in a finally block (or explicitly when the modal is closed / when errors are intentionally suppressed).

Suggested change
}
}
setIsInProgress(false);

Copilot uses AI. Check for mistakes.
@jeesunikim jeesunikim marked this pull request as draft February 10, 2026 01:05
@stellar-jenkins
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Backlog (Not Ready)

Development

Successfully merging this pull request may close these issues.

Upgrade Stellar Wallet Kits to the latest version

3 participants