[dependabot]

Bumps the solana group with 3 updates in the / directory: @solana/kit, @solana-program/compute-budget and @solana-program/token.

Updates @solana/kit from 8.3.0 to 8.4.0

Release notes

Sourced from @​solana/kit's releases.

v8.4.0

@​solana/kit

v8.4.0 (2026-09-28)

Minor Changes

• [@solana/codecs-data-structures, @solana/errors] #2061 0e76741 Thanks @​lorisleiva! - Add a sentinel size strategy to the array, set, and map codecs. Passing a { __kind: 'sentinel', sentinel, strategy? } object as the size option ends the collection when the bytes at the next item position match the given sentinel, compared at item boundaries only. The optional strategy ('required' by default, or 'optional' / 'omitted') controls whether the sentinel is written when encoding and required when decoding. This provides codec support for Codama's sentinelCountNode.

  Two new errors accompany this: SOLANA_ERROR__CODECS__SENTINEL_MISSING_AT_END_OF_BYTES (thrown under the 'required' strategy when the byte array ends without the sentinel) and SOLANA_ERROR__CODECS__SENTINEL_MUST_NOT_BE_EMPTY (thrown when constructing a codec with an empty sentinel).

• [@solana/errors, @solana/instruction-plans] #2073 5be269c Thanks @​lorisleiva! - Add helpers for writing custom message packers. resolveMaxInstructionsPerTransaction, assertMaxInstructionsPerTransaction and assertMessageCanAccommodateSize enforce the instruction-count and size limits the built-in packers rely on, and a new SOLANA_ERROR__INSTRUCTION_PLANS__MESSAGE_REJECTED_BY_PACKER error lets a packer refuse a transaction message for any other reason by providing a reason. The transaction planner treats this error like the existing capacity errors and opens a new transaction message. Use isMessagePackerErrorThatRequiresNewCandidate to identify every error that calls for a new transaction message.

Patch Changes

• [@solana/codecs-numbers] #2067 56b4960 Thanks @​latent-9! - Fixed getShortU16Decoder() silently accepting malformed input: a truncated buffer decoded to garbage with an offset past the end of the byte array, and continuation chains longer than the documented three-byte encoding decoded to values outside the u16 domain. Malformed input now throws SOLANA_ERROR__CODECS__INVALID_BYTE_LENGTH, and decoded values above 65,535 now throw SOLANA_ERROR__CODECS__NUMBER_OUT_OF_RANGE, matching the guards every other number decoder already uses.

• [@solana/instruction-plans] #2071 75653e9 Thanks @​lorisleiva! - Fix getReallocMessagePackerInstructionPlan producing a 0-byte instruction when totalSize is an exact multiple of the realloc limit (10,240 bytes), which left the account one chunk short of the requested size.

Commits

• 0a296c6 Version Packages (#2072)
• c8e3ad3 Bump the undici group with 2 updates (#2087)
• 6f6ca99 Bump the solana-program-clients group with 4 updates (#2086)
• 6325e61 Bump eslint-plugin-react-refresh from 0.5.4 to 0.5.7 (#2085)
• 4a618c4 Bump @​solana/wallet-standard-features in the wallet-standard group (#2082)
• 56b4960 fix(codecs-numbers): reject truncated and overlong shortU16 encodings (#2067)
• 5be269c Add helpers and a generic rejection error for custom message packers (#2073)
• bcad027 Bump @​solana-program/memo in the solana-program-clients group (#2079)
• 8ce4dc9 Bump vercel from 59.23.1 to 59.23.2 in /docs (#2080)
• 8792b90 Bump github/codeql-action from 4.38.0 to 4.38.1 (#2078)
• Additional commits viewable in compare view

Updates @solana-program/compute-budget from 0.18.1 to 0.19.0

Release notes

Sourced from @​solana-program/compute-budget's releases.

js@v0.19.0

What's new

• Publish js@v0.19.0 by @​github-actions[bot]
• Bump Codama renderers and regenerate clients (#41) by @​lorisleiva

Commits

• b68894c Publish js@v0.19.0
• 9c77013 Bump Codama renderers and regenerate clients (#41)
• See full diff in compare view

Updates @solana-program/token from 0.16.1 to 0.17.0

Release notes

Sourced from @​solana-program/token's releases.

js@v0.17.0

What's new

• Publish js@v0.17.0 by @​github-actions[bot]
• Bump Codama JS renderer and regenerate client (#182) by @​lorisleiva

Commits

• 8185db1 Publish js@v0.17.0
• ba3eb5a Bump Codama JS renderer and regenerate client (#182)
• 408c9c1 Update rustls to address RUSTSEC-2026-0285 (#179)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions