[Easy] npm audit fix

[bh2smith]

Repairing all vulnerabilities that can be fixed by package upgrade.

[fleupold]

What happened, why did you close the issue?

[bh2smith]

I want to make sure it is working first. Also I thought it was the cause of the 🐛 I reported (but no longer believe this to be true).

[bh2smith]

This build is failing because of

npm ERR! code ENOLOCAL
npm ERR! Could not install from "node_modules/eth-gas-reporter/node_modules/abi-decoder/node_modules/web3/bignumber.js@git+https:/github.com/debris/bignumber.js.git#94d7146671b9719e00a09c29b01a691bc85048c2" as it does not contain a package.json file.
npm ERR! A complete log of this run can be found in:
npm ERR!     /home/travis/.npm/_logs/2019-06-24T18_32_33_404Z-debug.log

which appears to be related to this issue. Will look into bignumber and see what the deal is.

[bh2smith]

I have no idea what to do here. Do either of you @josojo or @fleupold ?

[fleupold]

I have no idea what to do here. Do either of you @josojo or @fleupold ?

You could create a PR in the eth-gas-reporter repo trying to change the version of abi-decoder to something that works?

But you are right that the error doesn't make sense. https:/github.com/debris/bignumber.js.git#94d7146671b9719e00a09c29b01a691bc85048c2 does include a package.json

[josojo]

I cannot assess this one.

[cgewecke]

Out of curiosity is Denis Granha (the maintainer of abi-decoder) still at Gnosis? There are PRs open in that repo to upgrade the web3 version which could resolve this problem at it's source. I'd rather not find another decoding solution - it's a really nice package.

Also, web3 1.0-beta.37 has recently been selected as the official 'stable' version of web3 1.0 and a PR for that release is in progress. This might be an opportune time to revisit abi-decoder maintenance.

[bh2smith]

Thanks for the suggestions @cgewecke, I'll get in touch with @denisgranha about this one!

[bh2smith]

So finally, the web3 dependency in abi-decoder was updated and this fix no longer depends on using yarn.

I am unsure what is the deal with displaying solidity-bytes utils update. This has clearly already been changes in master so should not appear as different here.

[fleupold]

Would love to see the unrelated travis changes be in a separate PR but otherwise this seems good to go.

⬆️