build(deps): Bump @solana/addresses from 3.0.3 to 7.0.0

[dependabot]

Bumps @solana/addresses from 3.0.3 to 7.0.0.

Release notes

Sourced from @​solana/addresses's releases.

v7.0.0

@​solana/kit

v7.0.0 (2026-06-30)

Major Changes

• [@solana/codecs-data-structures] #1683 99667a1 Thanks @​oritwoen! - Align the return types of the union, predicate, and pattern-match codecs so that a fixed-size result is only exposed when every branch is fixed-size and of the same statically-known size. Branches whose sizes are unequal or not statically known now widen from FixedSize* to VariableSize* (when at least one branch is variable-size) or to a plain Encoder/Decoder/Codec (when the branches are fixed-size but their sizes are not statically comparable), matching what these codecs actually produce at runtime.

  This is a type-only change with no runtime impact, but it is breaking in two ways:

  • Return types change. Consumers that relied on the previous (unsound) fixed-size typing — e.g. reading .fixedSize, or passing the result where a FixedSize* is required — will need to adjust.
  • The predicate and pattern-match signatures changed. Their value/output type is now inferred from the branch encoders, decoders, or codecs rather than from an explicit type argument. Passing an explicit type argument no longer sets the branch domain: getPatternMatchEncoder<MyType>([...]) (and the decoder/codec equivalents) now fails to compile, and getPredicateEncoder<MyType>(...) silently degrades its return to a plain Encoder<MyType>. Instead, type the branch predicates' parameters (e.g. (value: MyType) => ...) and let the return type be inferred.

• [@solana/instruction-plans] #1723 069d56d Thanks @​mcintyre94! - Add configurable instruction-count limits to transaction planners and message packers, and default planned and packed transaction messages to 16 instructions. The planner limit applies to the final transaction message, including instructions returned by createTransactionMessage or added by onTransactionMessageUpdated, and can be overridden when creating a planner or for an individual planning call.

  This is useful because Solana limits transactions to 64 instructions, including inner instructions. Kit does not know how many inner instructions each instruction will require when executed. The default of 16 assumes an average of 3 additional inner instructions per top-level instruction.

  When a transaction message reaches this configured ceiling, the planner and message packer throw the new SOLANA_ERROR__INSTRUCTION_PLANS__MAX_INSTRUCTIONS_PER_TRANSACTION_EXCEEDED error rather than the SOLANA_ERROR__TRANSACTION__TOO_MANY_INSTRUCTIONS error reserved for the hard 64-instruction limit, so the configurable soft limit is distinguishable from the format-enforced one. Throws SOLANA_ERROR__INSTRUCTION_PLANS__INVALID_MAX_INSTRUCTIONS_PER_TRANSACTION is the configured max is invalid (not a positive integer, or greater than 64).

  Configure a maximum for every plan created by a transaction planner:

  const transactionPlanner = createTransactionPlanner({
      createTransactionMessage,
      maxInstructionsPerTransaction: 32,
  });

  Override the maximum for an individual planning request:

  const transactionPlan = await transactionPlanner(instructionPlan, {
      maxInstructionsPerTransaction: 8,
  });

  Override the maximum when packing a message directly:

  const packedTransactionMessage = messagePacker.packMessageToCapacity(transactionMessage, {
      maxInstructions: 32,
  });

  BREAKING CHANGES

  Transaction planners and message packers now default to 16 instructions per transaction. Plans and direct message packer calls that previously fit 17 to 64 top-level instructions in one transaction message may now be split into multiple transaction messages. Apps that depend on larger single-transaction plans can preserve the previous top-level instruction limit by configuring maxInstructionsPerTransaction: 64 on transaction planners or maxInstructions: 64 on direct message packer calls; the hard transaction-message limit of 64 top-level instructions still applies.

... (truncated)

Commits

• 58df993 Version Packages (#1768)
• cab6d7e Always include replacementBlockhash on simulateTransaction response (#1803)
• c5d8219 docs: add transaction introspection advanced guide (#1801)
• 2845b5c add typetest for getversion (#1797)
• e6dd38c add typetest for getEpochSchedule (#1796)
• 6947740 Remove deprecated getMinimumBalanceForRentExemption and createEmptyClient (#1...
• c3db383 Add a guide for reactive stores (#1782)
• acec0be Remove deprecated functions from ReactiveStreamStore (#1780)
• 1defa9c Add react guides to docs (#1779)
• 069d56d Add configurable max instructions per transaction to transaction planner (#1723)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​solana/addresses since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

PR-Codex overview

This PR focuses on updating various package versions in the package.json and pnpm-lock.yaml files, which includes major updates for dependencies and improvements in the overall package management.

Detailed summary

• Updated @solana/addresses from ^3.0.0 to ^7.0.0.
• Updated versions of several dependencies in pnpm-lock.yaml, including:
  • @noble/hashes to 2.2.0.
  • @babel/core to 7.29.7.
  • @babel/plugin-proposal-decorators to 7.29.7.
  • @babel/plugin-transform-runtime to 7.29.7.
• Updated utf-8-validate from 6.0.5 to 6.0.6.
• Updated @stripe/react-stripe-js version.
• Updated next and next-themes versions.

The following files were skipped due to too many changes: pnpm-lock.yaml

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

[changeset-bot]

⚠️ No Changeset found

Latest commit: f63f0e2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-v2	Ready	Preview	Aug 3, 2026 8:50pm
nebula	Ready	Preview	Aug 3, 2026 8:50pm
thirdweb_playground	Error		Aug 3, 2026 8:50pm
thirdweb-www	Error		Aug 3, 2026 8:50pm
wallet-ui	Ready	Preview	Aug 3, 2026 8:50pm

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​wagmi/​cli@​2.10.0
	@​solana/​addresses@​7.0.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @walletconnect/sign-client is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@abstract-foundation/agw-react@1.10.0 → npm/@walletconnect/sign-client@2.23.7 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@walletconnect/sign-client@2.23.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm node-fetch-native is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@abstract-foundation/agw-react@1.10.0 → npm/node-fetch-native@1.6.7 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/node-fetch-native@1.6.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm node-forge is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@coinbase/wallet-mobile-sdk@1.1.2 → npm/expo-application@6.0.1 → npm/@mobile-wallet-protocol/client@1.0.0 → npm/expo-linking@8.0.8 → npm/@abstract-foundation/agw-react@1.10.0 → npm/expo-web-browser@15.0.9 → npm/wagmi@2.19.4 → npm/node-forge@1.4.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/node-forge@1.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm yargs is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@coinbase/wallet-mobile-sdk@1.1.2 → npm/expo-application@6.0.1 → npm/@mobile-wallet-protocol/client@1.0.0 → npm/vitest@3.2.4 → npm/expo-linking@8.0.8 → npm/@abstract-foundation/agw-react@1.10.0 → npm/expo-web-browser@15.0.9 → npm/wagmi@2.19.4 → npm/yargs@17.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report