build(deps): bump undici, @nomicfoundation/hardhat-toolbox and hardhat in /tools/hedera-crosschain-bridge

[dependabot]

Bumps undici to 6.24.1 and updates ancestor dependencies undici, @nomicfoundation/hardhat-toolbox and hardhat. These dependencies need to be updated together.

Updates undici from 5.29.0 to 6.24.1

Release notes

Sourced from undici's releases.

v6.24.1

Full Changelog: nodejs/undici@v6.24.0...v6.24.1

v6.24.0

Undici v6.24.0 Security Release Notes (LTS)

This release backports fixes for security vulnerabilities affecting the v6 line.

Upgrade guidance

All users on v6 should upgrade to v6.24.0 or later.

Fixed advisories

• GHSA-2mjp-6q6p-2qxm / CVE-2026-1525 (Medium)
  Inconsistent interpretation of HTTP requests (request/response smuggling class issue).

• GHSA-f269-vfmq-vjvj / CVE-2026-1528 (High)
  Malicious WebSocket 64-bit frame length handling could crash the client.

• GHSA-4992-7rv2-5pvq / CVE-2026-1527 (Medium)
  CRLF injection via the upgrade option.

• GHSA-v9p9-hfj2-hcw8 / CVE-2026-2229 (High)
  Unhandled exception from invalid server_max_window_bits in WebSocket permessage-deflate negotiation.

• GHSA-vrm6-8vpv-qv8q / CVE-2026-1526 (High)
  Unbounded memory consumption in WebSocket permessage-deflate decompression.

Not applicable to v6

• GHSA-phc3-fgpg-7m6h / CVE-2026-2581 affects >= 7.17.0 < 7.24.0 only.

Affected and patched ranges (v6)

• CVE-2026-1525: affected < 6.24.0, patched 6.24.0
• CVE-2026-1528: affected >= 6.0.0 < 6.24.0, patched 6.24.0
• CVE-2026-1527: affected < 6.24.0, patched 6.24.0
• CVE-2026-2229: affected < 6.24.0, patched 6.24.0
• CVE-2026-1526: affected < 6.24.0, patched 6.24.0

References

• GitHub Security Advisories: https://github.com/nodejs/undici/security/advisories
• NVD CVE-2026-1525: https://nvd.nist.gov/vuln/detail/CVE-2026-1525
• NVD CVE-2026-1528: https://nvd.nist.gov/vuln/detail/CVE-2026-1528
• NVD CVE-2026-1527: https://nvd.nist.gov/vuln/detail/CVE-2026-1527
• NVD CVE-2026-2229: https://nvd.nist.gov/vuln/detail/CVE-2026-2229
• NVD CVE-2026-1526: https://nvd.nist.gov/vuln/detail/CVE-2026-1526

... (truncated)

Commits

• c0cf656 Bumped v6.24.1
• f5a9f0c Fix v6 release workflow branch targeting
• af2cb8f wqremove maxDecompressedMessageSize (#4891)
• 8873c94 Bumped v6.24.0
• 411bd01 test(websocket): use node:assert for Node 18 compatibility
• 844bf59 test: fix http2 lint regressions in backport
• a444e4f test: stabilize h2 and tls-cert-leak under current test runner
• dc032a1 fix: h2 CI (#4395)
• 4cd3f4b test: increase bitness in test/fixtures/*.pem (#3659)
• 7df6442 fix: adapt websocket frame-limit handling for v6 parser
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates @nomicfoundation/hardhat-toolbox from 6.1.0 to 7.0.0

Release notes

Sourced from @​nomicfoundation/hardhat-toolbox's releases.

@​nomicfoundation/hardhat-toolbox@​6.1.2

This release is a small bump to the version of solidity-coverage to include changes for the Osaka transaction gas limit.

Changes

• NomicFoundation/hardhat@a7e4215: Update solidity-coverage minimum version to include Osaka changes

---

💡 The Nomic Foundation is hiring! Check our open positions.

---

Changelog

Sourced from @​nomicfoundation/hardhat-toolbox's changelog.

7.0.0

Major Changes

• 09ae6db: Deprecate the latest npm tag and redirect users to migrate to Hardhat 3 or to the hh2 tag.

Commits

• 6372d08 Version Packages
• a26e822 Remove the npm tags from the README.md files
• 18bef56 Quote the package in the installation instructions of the readmes
• e5025ae Update the formatting and quote the package in the installation instructions ...
• ee34347 Update hardhat-toolbox
• 7ade974 Version Packages
• a7e4215 feat: bump minimum version of solidity-coverage to Osaka
• e4ad0ad chore: update package metadata for provenance
• f65ee74 Version Packages
• a4f1e27 Hardhat 2 documentation links updated to reflect the domain change to v2.hard...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​nomicfoundation/hardhat-toolbox since your current version.

Updates hardhat from 2.28.3 to 3.1.12

Release notes

Sourced from hardhat's releases.

Hardhat v3.1.12

This release adds support for function gas snapshots and snapshot cheatcodes in Solidity tests through the new --snapshot and --snapshot-check flags, along with minor improvements for plugins and an update to EDR.

Changes

• 01b41ee: Added support for function gas snapshots and snapshot cheatcodes in Solidity tests with --snapshot and --snapshot-check flags (#7769)
• e37f96c: Add TestRunResult type that wraps TestSummary, allowing plugins to extend test results with additional data
• bda5a0a: Bumped EDR version to 0.12.0-next.28

---

💡 The Nomic Foundation is hiring! Check our open positions.

---

Hardhat v3.1.11

This release improves the DX of the Viem and Ethers plugins with better autocomplete, improves the errors printed when a contract can't be compiled with the configured compilers, upgrades EDR, and many minor improvements and fixes.

EDR RELATED BREAKING CHANGE: Memory capture used to be enabled by default on geth, but has since been flipped (see ethereum/go-ethereum#23558) and is now disabled by default. We have followed suit and disabled it by default as well. If you were relying on memory capture, you will need to explicitly enable it by setting the enableMemory option to true in your tracer configuration.

Changes

• 2cbf218: Bumped EDR version to 0.12.0-next.27

  BREAKING CHANGE: Memory capture used to be enabled by default on geth, but has since been flipped ethereum/go-ethereum#23558 and is now disabled by default. We have followed suit and disabled it by default as well. If you were relying on memory capture, you will need to explicitly enable it by setting the enableMemory option to true in your tracer configuration.

• bc193be: Use concrete value types for contract names in hardhat-viem and hardhat-ethers

• 2cbf218: Make SolidityBuildSystem easier to work with (#7988)

• 19b691d: Fix typo in assertion message #8028

• 2cbf218: Expose Result type for task action success/failure signaling.

• 2cbf218: Fixed the acceptance of relative paths to node_modules in npm remappings (#8007)

• 2cbf218: Implement a global banner logic in Hardhat 3 #8021

• 4ff11c1: Return typed Result from test runners and telemetry tasks (#8015).

• 2cbf218: Show fs paths and better error messages when a Solidity file can't be compiled with any configured compiler (#7988)

• 2cbf218: Add onTestRunStart, onTestWorkerDone, and onTestRunDone test hooks (#8001)

---

💡 The Nomic Foundation is hiring! Check our open positions.

---

Hardhat v3.1.10

This release contains many improvements and bug fixes, including a cleaner display of test coverage reports (--coverage) and support for inline actions in tasks.

Changes

• 726ff37: Update the --coverage table output to match the style used by --gas-stats. Thanks @​jose-blockchain! (#7733)
• f1e9b05: Added support for inline actions in tasks 7851.
• ca26adb: Update hardhat node to always use the new node network (#7989)
• ec03a01: Allow overriding the type of the network configs default and localhost #7805
• 87623db: Introduce new inter-process mutex implementation (7942).
• 2c2e1f5: Throw better error messages when trying to use a Hardhat 2 plugin with Hardhat 3 #7991.

... (truncated)

Changelog

Sourced from hardhat's changelog.

3.1.12

Patch Changes

• 01b41ee: Added support for function gas snapshots and snapshot cheatcodes in Solidity tests with --snapshot and --snapshot-check flags (#7769)
• e37f96c: Add TestRunResult type that wraps TestSummary, allowing plugins to extend test results with additional data
• bda5a0a: Bumped EDR version to 0.12.0-next.28

3.1.11

Patch Changes

• 2cbf218: Bumped EDR version to 0.12.0-next.27

  BREAKING CHANGE: Memory capture used to be enabled by default on geth, but has since been flipped ethereum/go-ethereum#23558 and is now disabled by default. We have followed suit and disabled it by default as well. If you were relying on memory capture, you will need to explicitly enable it by setting the enableMemory option to true in your tracer configuration.

• bc193be: Use concrete value types for contract names in hardhat-viem and hardhat-ethers

• 2cbf218: Make SolidityBuildSystem easier to work with (#7988)

• 19b691d: Fix typo in assertion message #8028

• 2cbf218: Expose Result type for task action success/failure signaling.

• 2cbf218: Fixed the acceptance of relative paths to node_modules in npm remappings (#8007)

• 2cbf218: Implement a global banner logic in Hardhat 3 #8021

• 4ff11c1: Return typed Result from test runners and telemetry tasks (#8015).

• 2cbf218: Show fs paths and better error messages when a Solidity file can't be compiled with any configured compiler (#7988)

• 2cbf218: Add onTestRunStart, onTestWorkerDone, and onTestRunDone test hooks (#8001)

3.1.10

Patch Changes

• ca26adb: Update hardhat node to always use the new node network (#7989)[https://github.com/Node network config NomicFoundation/hardhat#7989]
• 87623db: Introduce new inter-process mutex implementation (7942).
• 88e9cb5: Add a SolidityHooks#readNpmPackageRemappings hook
• ec03a01: Allow overriding the type of the network configs default and localhost #7805
• 2c2e1f5: Throw better error messages when trying to use a Hardhat 2 plugin with Hardhat 3 #7991.
• 90b5eec: Suggest installing hardhat-foundry when appropriate
• 87623db: Make the solc downloader safe when run by multiple processes (7946).
• 726ff37: Update the --coverage table output to match the style used by --gas-stats. Thanks @​jose-blockchain! (#7733)
• f1e9b05: Added support for inline actions in tasks 7851.
• 73cb725: Expose gasLimit configuration for Solidity tests #7996

3.1.9

Patch Changes

• 621d07e: Make the coverage work with versions of Solidity that aren't fully supported by EDR #7982
• 3e39a06: Round average and median gas usage in the gas analytics output
• 78af2ed: Allow multiple parallel downloads of different compilers (7946).

3.1.8

... (truncated)

Commits

• 72ac31c Version Packages
• 05baf8b Merge pull request #8049 from anaPerezGhiglia/build/edr-0.12.0-next.28
• 68c6408 fix: update format in error message
• fef3c25 fix: adapt gas-analytics and solidity-test to Result pattern after rebase ont...
• 482f346 fix: add missing prop in hardfork tests
• 51d00a1 fix: delete orphaned snapshot cheatcode files when groups are removed
• 3d63a25 fix: remove extra blank line before snapshot output
• 67ad197 fix: only set snapshot cheatcodes written flag when cheatcodes exist
• 4de44e4 feat: add a default fuzz test seed when none is provided (#7886)
• ad17527 Gas snapshots - Show a link to the test file on failures (#7883)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
hardhat	[>= 3.a, < 4]

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[jasuwienas]

Approving Dependabot PR with all required checks passing.

[jasuwienas]

hardhat 3udpate requeis more changes in the code

[github-actions]

Test Results

    1 files  ±    0    751 suites  +740   1m 15s ⏱️ - 3m 16s
2 602 tests +2 580  2 600 ✅ +2 578  2 💤 +2  0 ❌ ±0 
2 617 runs  +2 595  2 615 ✅ +2 593  2 💤 +2  0 ❌ ±0 

Results for commit c33d474. ± Comparison against base commit 12b5b57.

This pull request removes 22 and adds 2602 tests. Note that renamed tests count towards both.

should be able to execute getTokenKey ‑ RPC Server Acceptance Tests Acceptance tests @tokenmanagement HTS Precompile Token Management Acceptance Tests HTS Precompile Key management Tests should be able to execute getTokenKey
should be able to execute updateTokenKeys ‑ RPC Server Acceptance Tests Acceptance tests @tokenmanagement HTS Precompile Token Management Acceptance Tests HTS Precompile Key management Tests should be able to execute updateTokenKeys
should be able to execute wipeTokenAccount ‑ RPC Server Acceptance Tests Acceptance tests @tokenmanagement HTS Precompile Token Management Acceptance Tests HTS Precompile Wipe Tests should be able to execute wipeTokenAccount
should be able to execute wipeTokenAccountNFT ‑ RPC Server Acceptance Tests Acceptance tests @tokenmanagement HTS Precompile Token Management Acceptance Tests HTS Precompile Wipe Tests should be able to execute wipeTokenAccountNFT
should be able to freeze and unfreeze fungible token transfers ‑ RPC Server Acceptance Tests Acceptance tests @tokenmanagement HTS Precompile Token Management Acceptance Tests HTS Precompile Freeze/Unfreeze Tests should be able to freeze and unfreeze fungible token transfers
should be able to freeze and unfreeze non-fungible token transfers ‑ RPC Server Acceptance Tests Acceptance tests @tokenmanagement HTS Precompile Token Management Acceptance Tests HTS Precompile Freeze/Unfreeze Tests should be able to freeze and unfreeze non-fungible token transfers
should be able to get and update fungible token expiry info ‑ RPC Server Acceptance Tests Acceptance tests @tokenmanagement HTS Precompile Token Management Acceptance Tests HTS Precompile Token Expiry Info Tests should be able to get and update fungible token expiry info
should be able to get and update non fungible token expiry info ‑ RPC Server Acceptance Tests Acceptance tests @tokenmanagement HTS Precompile Token Management Acceptance Tests HTS Precompile Token Expiry Info Tests should be able to get and update non fungible token expiry info
should be able to pause fungible token ‑ RPC Server Acceptance Tests Acceptance tests @tokenmanagement HTS Precompile Token Management Acceptance Tests HTS Precompile Pause/Unpause Tests should be able to pause fungible token
should be able to pause non fungible token ‑ RPC Server Acceptance Tests Acceptance tests @tokenmanagement HTS Precompile Token Management Acceptance Tests HTS Precompile Pause/Unpause Tests should be able to pause non fungible token
…

"eth_blockNumber" return the latest block number on second try ‑ @ethGetBlockByNumber using MirrorNode "eth_blockNumber" return the latest block number on second try
"eth_blockNumber" should return the latest block number ‑ @ethGetBlockByNumber using MirrorNode "eth_blockNumber" should return the latest block number
"eth_blockNumber" should throw an error if no blocks are found after third try ‑ @ethGetBlockByNumber using MirrorNode "eth_blockNumber" should throw an error if no blocks are found after third try
"eth_blockNumber" should throw an error if no blocks are found ‑ @ethGetBlockByNumber using MirrorNode "eth_blockNumber" should throw an error if no blocks are found
Adds a revertReason field for receipts with errorMessage ‑ @ethGetTransactionReceipt eth_getTransactionReceipt tests Adds a revertReason field for receipts with errorMessage
BLOCK_GAS_LIMIT_BY_HAPI_VERSION must be sorted in descending order ‑ blockGasLimit BLOCK_GAS_LIMIT_BY_HAPI_VERSION must be sorted in descending order
BLOCK_HASH filter timeouts and throws the expected error ‑ @ethGetLogs using MirrorNode timeout BLOCK_HASH filter timeouts and throws the expected error
BLOCK_HASH filter ‑ @ethGetLogs using MirrorNode BLOCK_HASH filter
Can extract the account number out of an account pagination next link url ‑ MirrorNodeClient Can extract the account number out of an account pagination next link url
Can extract the evm address out of an account pagination next link url ‑ MirrorNodeClient Can extract the evm address out of an account pagination next link url
…

[quiet-node]

Superseded by #5326 which landed the hardhat 2 to 3 + hardhat-toolbox 7 bump for this directory. The undici part of this PR was transitive only.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@            Coverage Diff             @@
##             main    #5120      +/-   ##
==========================================
- Coverage   95.37%   95.34%   -0.04%     
==========================================
  Files         150      150              
  Lines       25941    25941              
  Branches     2073     2064       -9     
==========================================
- Hits        24741    24733       -8     
- Misses       1174     1181       +7     
- Partials       26       27       +1     

see 5 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.