build(deps): Bump @solana/rpc from 3.0.3 to 8.1.0

[dependabot]

Bumps @solana/rpc from 3.0.3 to 8.1.0.

Release notes

Sourced from @​solana/rpc's releases.

v8.1.0

@​solana/kit

v8.1.0 (2026-08-27)

Minor Changes

• [@solana/errors, @solana/transaction-messages] #1972 7d56e29 Thanks @​skyyycodes! - Validate compute unit limit and heap size when they are set on a transaction message

  setTransactionMessageComputeUnitLimit, setTransactionMessageHeapSize and setTransactionMessageConfig now reject values the runtime will not honor as written, throwing SOLANA_ERROR__TRANSACTION__COMPUTE_UNIT_LIMIT_OUT_OF_RANGE or SOLANA_ERROR__TRANSACTION__INVALID_HEAP_SIZE at the point the value is set. An invalid heap size fails the transaction on-chain; a compute unit limit above the maximum is instead clamped down by the runtime, so the transaction quietly runs with a budget other than the one requested. A compute unit limit must be an integer in the range [0, 1,400,000]; a heap size must be an integer multiple of 1 KiB between 32 KiB and 256 KiB inclusive.

  Decoding is unaffected: decompileTransactionMessage still returns messages carrying out-of-range values so that callers can inspect any transaction that reaches them.

• [@solana/instruction-plans] #1995 95a2788 Thanks @​mcintyre94! - Add createTransactionPlanExecutorWithConcurrentLeaves to concurrently transform every transaction plan leaf while preserving the plan's result shape.

Patch Changes

• [@solana/codecs-core] #1970 be30e32 Thanks @​koriyoshi2041! - Fix toArrayBuffer slicing SharedArrayBuffer-backed views from a non-zero byte offset.

• [@solana/codecs-data-structures] #1971 c51b9f6 Thanks @​shin4141! - Preserve the literal fixedSize type for single-field fixed-size struct codecs.

• [@solana/codecs-strings] #1979 6852054 Thanks @​amilz! - Fixed getBase64Decoder() throwing RangeError: Maximum call stack size exceeded in browser builds when decoding byte arrays larger than roughly 65KB. The bytes are now converted to a binary string in chunks rather than spread into a single String.fromCharCode call.

• [@solana/rpc, @solana/transaction-confirmation] #1994 490ac9e Thanks @​matusbalascak! - Fix transaction confirmation and coalesced RPC request cancellation in environments where abort events have a null target.

v8.0.0

@​solana/kit

v8.0.0 (2026-08-21)

Major Changes

• [@solana/instruction-plans] #1913 80368eb Thanks @​mcintyre94! - Stop writing to the execution context in createTransactionPlanExecutor

  The executeTransactionMessage callback can no longer return a Signature or a Transaction. Those return values were deprecated when the callback gained the ability to return the context that a successful result should carry, and they are now gone: that context, a complete TContext, is the only thing the callback returns. Nothing is written to it on your behalf.

  const transactionPlanExecutor = createTransactionPlanExecutor({
    executeTransactionMessage: async (context, message) => {
      const transaction = await signTransactionMessageWithSigners(message);
      context.transaction = transaction;
  +   const signature = getSignatureFromTransaction(transaction);
      await sendAndConfirmTransaction(transaction, { commitment: 'confirmed' });
  -   return transaction;
  +   return { signature, transaction };
    },
  });

  The mutable context argument is still there, and still serves the failure path: whatever the callback stores on it before it throws is preserved in the resulting FailedSingleTransactionPlanResult. The two channels differ only in which outcome they feed. Mutating the context makes a value available to a failed result; returning it makes a value available to a successful one. On success the two are merged, with the returned value taking precedence, so a property stored but not returned is still reported.

... (truncated)

Commits

• bb54243 Version Packages (#1980)
• 7d56e29 validate compute unit limit and heap size in transaction messages (#1972)
• c51b9f6 Preserve fixedSize for single-field struct codecs (#1971)
• 241da5a Add a note about the Equal helper in CLAUDE.md (#2002)
• be30e32 fix shared array buffer view slicing (#1970)
• 95a2788 Add concurrent transaction plan leaf executor (#1995)
• 8c94351 Bump yoctocolors from 2.1.2 to 2.2.0 (#1999)
• 3c11ff1 Bump @​types/react-dom from 19.2.4 to 19.2.5 in /docs (#2001)
• 7d8bceb Bump vercel from 59.1.4 to 59.5.0 in /docs (#2000)
• 4daa5d1 Bump @​types/node from 26.0.0 to 26.2.0 (#1997)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​solana/rpc since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

PR-Codex overview

This PR focuses on updating package dependencies and versions across various packages, particularly improving the compatibility and functionality of the @solana/rpc package, along with other library updates.

Detailed summary

• Updated @solana/rpc from ^3.0.0 to ^8.1.0 in packages/vault-sdk/package.json.
• Updated versions in pnpm-lock.yaml for various packages, including:
  • next to 15.3.8 with updated dependencies.
  • @babel/core to 7.29.7.
  • storybook and related packages to use utf-8-validate@6.0.6.
  • zod to 4.1.12.
  • wagmi to 2.19.4 with updated dependencies.
• Adjusted versions of several plugins and dependencies to their latest versions for improved compatibility and performance.

The following files were skipped due to too many changes: pnpm-lock.yaml

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

[changeset-bot]

⚠️ No Changeset found

Latest commit: f04e581

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs-v2	Ready	Preview	Aug 31, 2026 8:52pm
nebula	Ready	Preview	Aug 31, 2026 8:52pm
thirdweb_playground	Error		Aug 31, 2026 8:52pm
thirdweb-www	Ready	Preview	Aug 31, 2026 8:52pm
wallet-ui	Ready	Preview	Aug 31, 2026 8:52pm

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​wagmi/​cli@​2.10.0
	@​solana/​rpc@​8.1.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @walletconnect/sign-client is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@abstract-foundation/agw-react@1.10.0 → npm/@walletconnect/sign-client@2.23.7 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@walletconnect/sign-client@2.23.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm yargs is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@coinbase/wallet-mobile-sdk@1.1.2 → npm/expo-application@6.0.1 → npm/@mobile-wallet-protocol/client@1.0.0 → npm/vitest@3.2.4 → npm/expo-linking@8.0.8 → npm/@abstract-foundation/agw-react@1.10.0 → npm/expo-web-browser@15.0.9 → npm/wagmi@2.19.4 → npm/yargs@17.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report