Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build: upgrade dependencies to fix dependabot security warnings #207

Merged
merged 4 commits into from
Apr 22, 2023

Conversation

CJ42
Copy link
Collaborator

@CJ42 CJ42 commented Apr 20, 2023

What does this PR introduce?

Upgrade dependencies to fix Dependabot Security warning for: "flat vulnerable to Prototype Pollution"

📦 Build

NB: hardhat 2.13.1 adds supports for Shangaï upgrade.
see details: https://github.com/NomicFoundation/hardhat/releases/tag/hardhat%402.13.1

Upgrade the following dependencies to fix dependabot security warnings (screenshot below).

  • @openzeppelin/contracts and @openzeppelin/contracts-upgradable: 4.7.3 --> upgraded to 4.8.3
  • hardhat: 2.10.1 --> upgraded to 2.13.1.
  • @nomicfoundation/hardhat-toolbox: 2.0.0 --> 2.0.2

image

PR Checklist

  • Wrote Tests
  • Wrote Documentation
  • Ran npm run lint
  • Ran npm run build
  • Ran npm run test

@CJ42 CJ42 marked this pull request as ready for review April 20, 2023 12:39
@CJ42 CJ42 requested a review from YamenMerhi April 20, 2023 13:05
@CJ42
Copy link
Collaborator Author

CJ42 commented Apr 20, 2023

For the minimatch issue, the dependabot warning comes from the fact that the solidity-coverage dependency in @nomicsfoundation/hardhat-toolbox uses mocha v7.1.2 which uses an old version of minimatch.

I have reported in an already open PR that upgrade mocha in the Solidity coverage repo: sc-forks/solidity-coverage#758 (comment)

image

@CJ42 CJ42 merged commit 7b45c81 into develop Apr 22, 2023
@CJ42 CJ42 deleted the build/upgrade-dependencies branch April 22, 2023 21:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants