update Go and deps

.github/actions/setup-stellar-cli/action.yml

@@ -10,11 +10,11 @@ inputs:
   version:
     description: stellar-cli version
     required: false
-    default: "25.1.0"
+    default: "28.0.0"
   shasum:
     description: SHA256 of the release tarball for the requested version
     required: false
-    default: "e6fac619b2ae9b3ecb843a9e8e3bfc94dce79e0b73c63cb1cbbd08682bb0a0ba"
+    default: "207544486734fccb4df1afc4a7745478f9f1e21688b2f9506f0ef36f60ce3fdc"
 
 runs:
   using: composite

.github/workflows/build-push-ecr.yaml

@@ -43,7 +43,7 @@
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 

.github/workflows/check-formatting.yaml

@@ -29,7 +29,9 @@ jobs:
           rustfmt: "true"
 
       - name: Install Just
-        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+        uses: taiki-e/install-action@a4d3f3f761dcd95cce1b72cb61cb6d1963438177 # v2.87.30
+        with:
+          tool: just@1.59.0
 
       - name: Check Rust formatting
         run: just fmt-contracts-check

.github/workflows/data-feeds-contracts.yaml

@@ -37,7 +37,9 @@ jobs:
           workspaces: contracts/data-feeds
 
       - name: Install Just
-        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+        uses: taiki-e/install-action@a4d3f3f761dcd95cce1b72cb61cb6d1963438177 # v2.87.30
+        with:
+          tool: just@1.59.0
 
       - name: Run tests
         run: just test
@@ -60,7 +62,9 @@ jobs:
           workspaces: contracts/data-feeds
 
       - name: Install Just
-        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+        uses: taiki-e/install-action@a4d3f3f761dcd95cce1b72cb61cb6d1963438177 # v2.87.30
+        with:
+          tool: just@1.59.0
 
       - name: Check formatting
         run: just fmt-check
@@ -86,7 +90,9 @@ jobs:
           workspaces: contracts/data-feeds
 
       - name: Install Just
-        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+        uses: taiki-e/install-action@a4d3f3f761dcd95cce1b72cb61cb6d1963438177 # v2.87.30
+        with:
+          tool: just@1.59.0
 
       - name: Install Stellar CLI
         uses: ./.github/actions/setup-stellar-cli

.github/workflows/test-contracts.yaml

@@ -32,7 +32,7 @@ jobs:
         uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@de6bbd1333b8f331563d54a051e542c7dfef81c3 # v2.68.34
+        uses: taiki-e/install-action@a4d3f3f761dcd95cce1b72cb61cb6d1963438177 # v2.87.30
         with:
           tool: cargo-llvm-cov
 

.github/workflows/test-coverage-report.yaml

@@ -21,7 +21,7 @@
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           fetch-depth: 0
 
@@ -51,7 +51,9 @@
             chainlink-stellar-go-${{ runner.os }}-
 
       - name: Install just
-        uses: extractions/setup-just@69d82fb0233557aec017ef13706851d0694e0f1d # v2.0.0
+        uses: taiki-e/install-action@a4d3f3f761dcd95cce1b72cb61cb6d1963438177 # v2.87.30
+        with:
+          tool: just@1.59.0
 
       - name: Run tests (current ref)
         run: |
@@ -109,10 +111,14 @@
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
+            // Read branch names from the event payload, not from workflow-expression
+            // expansion: the head branch name is the PR author's and must never be
+            // interpolated into this script (it would execute as JS with this token).
+            const pr = context.payload.pull_request;
             const coverage_report = process.env.coverage_report;
             await github.rest.issues.createComment({
               issue_number: context.issue.number,
               owner: context.repo.owner,
               repo: context.repo.repo,
-              body: `Code coverage report:\n| Top package | \`${{ github.base_ref }}\` | \`${{ github.head_ref }}\` | diff |\n${coverage_report}`
+              body: `Code coverage report:\n| Top package | \`${pr.base.ref}\` | \`${pr.head.ref}\` | diff |\n${coverage_report}`
             });

.github/workflows/test-e2e-tcapi.yaml

@@ -109,7 +109,9 @@ jobs:
       # (gen_interfaces.sh runs stellar contract build), so make build below is a
       # warm rebuild. .dockerignore excludes target/ from the image builds' context.
       - name: Install just
-        uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
+        uses: taiki-e/install-action@a4d3f3f761dcd95cce1b72cb61cb6d1963438177 # v2.87.30
+        with:
+          tool: just@1.59.0
 
       # Image-cache strategy mirrors test-e2e.yaml (shared cache keys): the CCV
       # key rotates only when the ccv pin moves; the Stellar key hashes the Go

.github/workflows/test-e2e.yaml

@@ -55,7 +55,9 @@ jobs:
       # (gen_interfaces.sh runs stellar contract build), so make build below is a
       # warm rebuild. .dockerignore excludes target/ from the image builds' context.
       - name: Install just
-        uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
+        uses: taiki-e/install-action@a4d3f3f761dcd95cce1b72cb61cb6d1963438177 # v2.87.30
+        with:
+          tool: just@1.59.0
 
       # The dev images are cached so a cold runner does not pay the full 7-service
       # CCV + 2-service Stellar rebuild (~19 min) every run. The CCV image cache key

.github/workflows/test-go.yaml

@@ -57,3 +57,10 @@ jobs:
       - name: Run unit tests (capabilities module)
         working-directory: capabilities
         run: go test -v -race -fullpath -shuffle on ./...
+
+      # The /relayer directory is also a separate Go module (relayer/go.mod):
+      # the Stellar relayer (txm, monitor, chain/client adapters). Its deps
+      # resolve from the Go proxy, so no local replaces are needed here.
+      - name: Run unit tests (relayer module)
+        working-directory: relayer
+        run: go test -v -race -fullpath -shuffle on ./...

Dockerfile.executor

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.7
-FROM golang:1.27.1-alpine AS builder
+FROM golang:1.27.3-alpine AS builder
 WORKDIR /build
 
 # git is needed for module resolution of dependencies that use VCS metadata.

Dockerfile.verifier

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.7
-FROM golang:1.27.1-alpine AS builder
+FROM golang:1.27.3-alpine AS builder
 WORKDIR /build
 
 # git is needed for module resolution of dependencies that use VCS metadata.

bindings/go.mod

@@ -1,9 +1,9 @@
 module github.com/smartcontractkit/chainlink-stellar/bindings
 
-go 1.26.6
+go 1.27.3
 
 require (
-	github.com/stellar/go-stellar-sdk v0.7.3
+	github.com/stellar/go-stellar-sdk v0.8.0
 	github.com/stretchr/testify v1.11.1
 )
 
@@ -14,7 +14,5 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/stellar/go-xdr v0.0.0-20260806060815-dc590f17552a // indirect
-	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

ccv/go.mod

@@ -1,6 +1,6 @@
 module github.com/smartcontractkit/chainlink-stellar/ccv
 
-go 1.27.1
+go 1.27.3
 
 require (
 	github.com/BurntSushi/toml v1.6.0
@@ -16,7 +16,7 @@ require (
 	github.com/smartcontractkit/chainlink-stellar/bindings v0.0.0-20260930174906-8fac26710632
 	github.com/smartcontractkit/chainlink-stellar/deployment v0.0.0-00010101000000-000000000000
 	github.com/smartcontractkit/chainlink-stellar/relayer v0.0.0-00010101000000-000000000000
-	github.com/stellar/go-stellar-sdk v0.7.3
+	github.com/stellar/go-stellar-sdk v0.8.0
 	github.com/stretchr/testify v1.12.1
 )
 
@@ -36,15 +36,15 @@ require (
 	github.com/aptos-labs/aptos-go-sdk v1.13.0 // indirect
 	github.com/avast/retry-go/v4 v4.7.0 // indirect
 	github.com/aws/aws-sdk-go v1.55.8 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.42.1 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.45.1 // indirect
 	github.com/aws/aws-sdk-go-v2/config v1.32.28 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.27 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.1 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.1 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.1 // indirect
 	github.com/aws/aws-sdk-go-v2/service/kms v1.54.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/signin v1.3.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.32.0 // indirect

deployment/go.mod

@@ -1,6 +1,6 @@
 module github.com/smartcontractkit/chainlink-stellar/deployment
 
-go 1.27.1
+go 1.27.3
 
 require (
 	github.com/BurntSushi/toml v1.6.0
@@ -16,7 +16,7 @@ require (
 	github.com/smartcontractkit/chainlink-protos/job-distributor v0.20.0
 	github.com/smartcontractkit/chainlink-stellar/bindings v0.0.0-20260930174906-8fac26710632
 	github.com/smartcontractkit/mcms v0.56.1
-	github.com/stellar/go-stellar-sdk v0.7.3
+	github.com/stellar/go-stellar-sdk v0.8.0
 	github.com/stretchr/testify v1.12.1
 )
 
@@ -29,15 +29,15 @@ require (
 	github.com/aptos-labs/aptos-go-sdk v1.13.0 // indirect
 	github.com/avast/retry-go/v4 v4.7.0 // indirect
 	github.com/aws/aws-sdk-go v1.55.8 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.42.1 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.45.1 // indirect
 	github.com/aws/aws-sdk-go-v2/config v1.32.28 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.27 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.1 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.1 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.1 // indirect
 	github.com/aws/aws-sdk-go-v2/service/kms v1.54.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/signin v1.3.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.32.0 // indirect