Skip to content

Conversation

@CJ42
Copy link
Collaborator

@CJ42 CJ42 commented Apr 20, 2023

What does this PR introduce?

Upgrade dependencies to fix Dependabot Security warning for: "flat vulnerable to Prototype Pollution"

📦 Build

NB: hardhat 2.13.1 adds supports for Shangaï upgrade.
see details: https://github.com/NomicFoundation/hardhat/releases/tag/hardhat%402.13.1

Upgrade the following dependencies to fix dependabot security warnings (screenshot below).

  • @openzeppelin/contracts and @openzeppelin/contracts-upgradable: 4.7.3 --> upgraded to 4.8.3
  • hardhat: 2.10.1 --> upgraded to 2.13.1.
  • @nomicfoundation/hardhat-toolbox: 2.0.0 --> 2.0.2

image

PR Checklist

  • Wrote Tests
  • Wrote Documentation
  • Ran npm run lint
  • Ran npm run build
  • Ran npm run test

@CJ42 CJ42 marked this pull request as ready for review April 20, 2023 12:39
@CJ42 CJ42 requested a review from YamenMerhi April 20, 2023 13:05
@CJ42
Copy link
Collaborator Author

CJ42 commented Apr 20, 2023

For the minimatch issue, the dependabot warning comes from the fact that the solidity-coverage dependency in @nomicsfoundation/hardhat-toolbox uses mocha v7.1.2 which uses an old version of minimatch.

I have reported in an already open PR that upgrade mocha in the Solidity coverage repo: sc-forks/solidity-coverage#758 (comment)

image

@CJ42 CJ42 merged commit 7b45c81 into develop Apr 22, 2023
@CJ42 CJ42 deleted the build/upgrade-dependencies branch April 22, 2023 21:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants