github.com/stellar/go-stellar-sdk

Breaking Changes

• strkey: Decode and DecodeAny now validate the payload length against the version byte per SEP-23. Fixed-length keys (account ID, seed, muxed account, contract, liquidity pool, claimable balance, hashTx, hashX) must decode to their exact canonical size, and signed payloads must carry a declared payload length of 1–64 bytes matched by their zero padding. Inputs with a valid checksum but a wrong-length payload — previously accepted by Decode, DecodeAny, and every IsValid* helper — are now rejected. (#5977)
  • NewSignedPayload rejects empty payloads, matching CAP-40 (the protocol fails such signers with SET_OPTIONS_BAD_SIGNER/txMALFORMED) and keeping SignedPayload.Encode output decodable.
  • Length re-checks that Decode now subsumes were removed from xdr.AccountId.SetAddress, xdr.MuxedAccount.SetAddress, xdr.SignerKey.SetAddress, xdr.ClaimableBalanceId.DecodeFromStrkey, strkey.DecodeMuxedAccount, strkey.MuxedAccount.SetAccountID, and txnbuild contract-address parsing. For wrong-length inputs, the xdr and txnbuild callers now return strkey's invalid payload length error instead of their own; the strkey muxed-account helpers keep their generic invalid muxed account / invalid ed25519 public key errors; xdr.MuxedAccount.SetAddress is unchanged (it rejects on encoded string length before decoding).
  • keypair.ParseAddress wraps every decode failure with ErrInvalidKey, so errors.Is(err, ErrInvalidKey) keeps matching wrong-length keys (and now also matches checksum/encoding failures, which previously returned the bare strkey error).
  • DecodeSignedPayload delegates structure validation to Decode; structurally invalid inputs now uniformly error with invalid signed payload (previously signed payload too short: ... or invalid signed payload padding).
• xdr: Asset.LessThan now orders assets the way the protocol does — by the raw 32-byte issuer key — instead of by base32 strkey text, and xdr.NewPoolId requires strictly a < b, rejecting reversed and identical pairs (#5974)
• txnbuild: liquidity pool operations reject asset pairs that are not strictly ordered; see the txnbuild changelog (#5974, #5978)

Bug Fixes

• processors/token_transfer: trustline revocation now compares liquidity pool assets by value instead of pointer identity, fixing wrong-leg selection when burning pool shares (#5974)
• ingest: ApplyLedgerMetadata now closes the datastore and the ledger backend, and returns the PrepareRange error instead of discarding it — an early return previously stranded one goroutine per configured worker and a failed prepare went unnoticed (#5974)

Updates

• go.mod: Bumped github.com/stellar/go-xdr to dc590f1, normalizing the schema bound in mergeInputLenAndMaxSize so a variable-length field whose length prefix ends the input keeps both its schema and input-length bounds. Every generated type decodes through this decoder (#5974)

New Features

• ingest: Added ExtractLedgerTxParts plus EventsFromTxParts and FeesFromTxParts (experimental), a single-walk zero-copy extraction API that supersedes the earlier extractor bundles; see the ingest changelog (#5966)

Bug Fixes

• clients/stellartoml: GetStellarToml validates the domain before requesting it, for parity with its sibling client (#5970)

New Features

• xdr: Protocol 28 support (CAP-0083, CAP-0085). XDR regenerated from stellar-xdr@9c9c1459, the commit stellar-core 28.0.0 pins; both CAPs are ungated upstream so XDR_FEATURES is now empty.
• protocols/rpc: Add LatestLedgerCloseTime and OldestLedgerCloseTime to GetHealthResponse, exposing the latest and oldest ledgers' close times (unix seconds) on the getHealth response (#5958)