28.0.0

stellar-cli v28.0.0 — Release Notes

🚀 New Features

• 📦 Build contracts in a container — stellar contract build can now run inside a container, giving you reproducible builds without fussing over your local toolchain. (#2678)
• 🤖 AGENTS.md on init — stellar contract init now generates an AGENTS.md file so AI coding agents have project context out of the box. (#2687)
• 🔗 Protocol 28 support — the CLI now speaks Protocol 28. (#2702)

🛠️ Improvements

• 🔍 Better failure diagnostics — when a transaction fails on-chain, the CLI now surfaces the diagnostic events so you can actually see what went wrong. (#2700)

🐛 Bug Fixes

• 💸 Fixed tx simulate re-assembly — no longer drops auth entries or double-counts fees. (#2666)
• 📁 Fixed manifest path separator in container builds. (#2688)

🔒 Security & Hardening

• 🧹 Strip control characters from auth entry prompts, contract read output, and other terminal output — closing off a class of terminal-injection tricks. (#2667, #2672, #2673)
• 📏 XDR depth limits — decoding contract spec/meta sections and XDR encoding/decoding now enforce nesting depth limits to guard against malicious or malformed input. (#2668, #2675)

---

🎉 New Contributors

• @rohansingh4 made their first contribution in #2687

Full Changelog: v27.1.0...v28.0.0