Fix Dependabot alerts: remove unused dev dependencies, upgrade toolchain - #454
Open
malteish wants to merge 2 commits into
Open
Fix Dependabot alerts: remove unused dev dependencies, upgrade toolchain#454malteish wants to merge 2 commits into
malteish wants to merge 2 commits into
Conversation
added 2 commits
July 15, 2026 13:42
- remove ethereum-waffle, solidity-coverage and @foundry-rs/hardhat-forge: none of them are referenced anywhere; they pulled in most of the critical alerts (handlebars, pbkdf2, sha.js, cipher-base, secp256k1, elliptic, form-data, request) - upgrade hardhat to 2.26.3 (newest version compatible with node 18), hardhat-gas-reporter to v2 (drops the old ethers-v5/request chain) and @nomicfoundation/hardhat-ethers to 3.1.3 - bump ethers to ^6.13.0 (fixes vulnerable ws 8.5.0) - force the @openzeppelin/contracts copy nested in @opengsn/contracts from 4.8.3 to 4.9.6 via resolution (clears all four runtime alerts; opengsn declares ^4.2.0, so this is semver-compatible) - add resolutions for remaining patchable transitive dependencies (elliptic, cookie, tmp, uuid, immutable, js-yaml, lodash, follow-redirects, flatted, braces, undici) Accepted residuals (all development-only, ReDoS class or blocked by node 18 / hardhat constraints): minimatch 3.1.2/5.1.6, picomatch 2.3.1, serialize-javascript 6.0.2 (fix requires node >= 20), undici 5.29.0 (two advisories are only fixed in undici 6, but hardhat pins ^5.14.0). Verified: 800/800 forge tests pass, full hardhat build (via-ir compile, typechain, tsc) succeeds.
- .nvmrc: v18.17.1 -> v24.18.0 (node 18 is end-of-life since April 2025) - wordscan workflow: node 16.x -> 24.x - serialize-javascript resolution ^7.0.5 (fix requires node >= 20, which blocked it in the previous commit) Verified under node 24: 800/800 forge tests pass, full hardhat build (via-ir compile, typechain, tsc) succeeds.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses the 62 open Dependabot alerts (8 critical, 17 high, 24 moderate, 13 low). None of them affect the deployed contracts or the published npm package — the only runtime-scoped alerts were against a nested OpenZeppelin copy that never reaches production bytecode — but the toolchain handles deployment keys, so it deserves a clean bill.
Changes
ethereum-waffle,solidity-coverage,@foundry-rs/hardhat-forge. None are referenced outside package.json (tests are pure Foundry, coverage usesforge coverage, hardhat-forge is archived upstream). Together they accounted for most of the critical alerts (handlebars, pbkdf2, sha.js, cipher-base, secp256k1, form-data, request). Net effect on yarn.lock: −3291/+952 lines.hardhat→ 2.26.3,hardhat-gas-reporter→ v2 (drops the old ethers-v5/requestchain),@nomicfoundation/hardhat-ethers→ 3.1.3,ethers→ ^6.13 (fixes vulnerablews).@openzeppelin/contracts@4.8.3nested inside@opengsn/contracts(used only for the GSNForwarderin tests/deploy script). A resolution forces it to 4.9.6 — semver-compatible with opengsn's declared^4.2.0. The project's own OZ pin was already 4.9.6..nvmrcbumped from the end-of-life v18.17.1 to v24.18.0 (wordscan workflow from 16.x to 24.x). This unlocked the serialize-javascript fix, which requires Node ≥ 20.Accepted residuals (~5 alerts remain open)
All development-only, ReDoS-class or blocked upstream:
minimatch3.1.2 / 5.1.6 andpicomatch2.3.1 (eslint/typechain/mocha chains) — a global resolution would force other consumers across major versions.undici5.29.0 — two advisories are only fixed in undici 6, but every hardhat 2.x pins^5.14.0; undici only talks to the RPC endpoints configured in hardhat.config.ts.Verification
FOUNDRY_PROFILE=fastDev yarn test)yarn buildsucceeds under Node 24 (via-ir hardhat compile, typechain, tsc)🤖 Generated with Claude Code
https://claude.ai/code/session_01BmhG9gFVHiF1XL2AfdAHRr