[ankittiwari-04]

Summary

Fixes #2395

@lightprotocol/stateless.js declares "@solana/web3.js": ">=1.73.5" in peerDependencies. When consumers install @solana/web3.js@3.x (the v3 compatibility bridge), PublicKey no longer exposes PublicKey.findProgramAddressSync or PublicKey.createProgramAddressSync (which were removed in favor of async WebCrypto PDA helpers in @solana/addresses), causing PackedAccounts.addSystemAccounts(), PackedAccounts.addSystemAccountsV2(), defaultStaticAccountsStruct(), and LightSystemProgram.deriveCompressedSolPda() to throw at runtime:
cd ~/projects/light-protocol

cat << 'EOF' > /tmp/pr_2395_body.md

Summary

Fixes #2395

@lightprotocol/stateless.js declares "@solana/web3.js": ">=1.73.5" in peerDependencies. When consumers install @solana/web3.js@3.x (the v3 compatibility bridge), PublicKey no longer exposes PublicKey.findProgramAddressSync or PublicKey.createProgramAddressSync (which were removed in favor of async WebCrypto PDA helpers in @solana/addresses), causing PackedAccounts.addSystemAccounts(), PackedAccounts.addSystemAccountsV2(), defaultStaticAccountsStruct(), and LightSystemProgram.deriveCompressedSolPda() to throw at runtime:

TypeError: PublicKey.findProgramAddressSync is not a function

Additionally, PublicKey in @solana/web3.js@3.x exposes .toBytes() rather than .toBuffer(), while PublicKey.isOnCurve() remains synchronous.

Changes

• Added js/stateless.js/src/utils/pda.ts with findProgramAddressSync and createProgramAddressSync:
  • Delegates to PublicKey.findProgramAddressSync when available (@solana/web3.js v1.x).
  • Falls back to synchronous SHA-256 PDA derivation using @noble/hashes/sha256 (already a direct dependency of @lightprotocol/stateless.js) + PublicKey.isOnCurve() when PublicKey.findProgramAddressSync is absent (@solana/web3.js v3.x).
  • Safely extracts program ID bytes via programId.toBuffer() or Buffer.from(programId.toBytes()).
• Replaced direct PublicKey.findProgramAddressSync calls in:
  • js/stateless.js/src/constants.ts
  • js/stateless.js/src/utils/instruction.ts
  • js/stateless.js/src/programs/system/program.ts
• Added unit tests in js/stateless.js/tests/unit/utils/packed-accounts.test.ts verifying identical PDA derivation and PackedAccounts behavior when PublicKey.findProgramAddressSync is unavailable.

Test Plan

• pnpm --filter @lightprotocol/stateless.js test:unit:all (126/126 unit tests passing)
• pnpm --filter @lightprotocol/stateless.js lint & pnpm --filter @lightprotocol/stateless.js build

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 5

• js/stateless.js/src/constants.ts is excluded by none and included by none
• js/stateless.js/src/programs/system/program.ts is excluded by none and included by none
• js/stateless.js/src/utils/instruction.ts is excluded by none and included by none
• js/stateless.js/src/utils/pda.ts is excluded by none and included by none
• js/stateless.js/tests/unit/utils/packed-accounts.test.ts is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: Lightprotocol/light-protocol
• Branch: main
• File: .coderabbit.yaml
• Commit: bec7b83
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 543a12ed-baef-4b66-8f61-d07ebe3af649

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn