Bump the npm_and_yarn group across 1 directories with 5 updates by dependabot[bot] · Pull Request #45 · morph-l2/morph

dependabot · 2024-02-16T17:21:56Z

Bumps the npm_and_yarn group with 4 updates in the /gas-oracle directory: flat, eth-gas-reporter, solidity-coverage and undici.

Updates flat from 4.1.1 to 5.0.2

Commits

e5ffd66 Release 5.0.2
fdb79d5 Update dependencies, refresh lockfile, format with standard.
e52185d Test against node 14 in CI.
0189cb1 Avoid arrow function syntax.
f25d3a1 Release 5.0.1
54cc7ad use standard formatting
779816e drop dependencies
2eea6d3 Bump lodash from 4.17.15 to 4.17.19
a61a554 Bump acorn from 7.1.0 to 7.4.0
20ef0ef Fix prototype pollution on unflatten
Additional commits viewable in compare view

Updates eth-gas-reporter from 0.2.25 to 0.2.27

Release notes

Sourced from eth-gas-reporter's releases.

v0.2.27

What's Changed

Remove @ethersproject/abi, use ethers.utils by @cgewecke in cgewecke/eth-gas-reporter#301

Full Changelog: cgewecke/eth-gas-reporter@v0.2.26...v0.2.27

v0.2.26

What's Changed

Update Mocha to v10 by @frangio in cgewecke/eth-gas-reporter#295

Bump ethers version by @ChristopherDedominici in cgewecke/eth-gas-reporter#296

Remove unused request package by @ChristopherDedominici in cgewecke/eth-gas-reporter#297

Replace request-promise-native with axios by @cgewecke in cgewecke/eth-gas-reporter#299

New Contributors

@ChristopherDedominici made their first contribution in cgewecke/eth-gas-reporter#296

Full Changelog: cgewecke/eth-gas-reporter@v0.2.2...v0.2.26

Changelog

Sourced from eth-gas-reporter's changelog.

0.2.27 / 2023-09-30

Remove @ethersproject/abi, use ethers.utils instead (cgewecke/eth-gas-reporter#301)

0.2.26 / 2023-09-29

Replace request-promise-native with axios / avoid default price API calls (cgewecke/eth-gas-reporter#299)

Remove request package (cgewecke/eth-gas-reporter#297)

Bump ethers version (cgewecke/eth-gas-reporter#296)

Update Mocha to v10 (cgewecke/eth-gas-reporter#295)

0.2.23 / 2021-11-26

Add notes to README about missing price data & remote data fetching race condition

Add support for multiple gas price tokens (BNB, MATIC, AVAX, HR, MOVR) (cgewecke/eth-gas-reporter#251)

Make @codechecks/client peer dep optional (cgewecke/eth-gas-reporter#257)

Update @solidity-parser/parser to 0.14.0 (cgewecke/eth-gas-reporter#261)

0.2.22 / 2021-03-04

Update @solidity-parser/parser to ^0.12.0 (support Panic keyword in catch blocks) (cgewecke/eth-gas-reporter#243)

0.2.21 / 2021-02-16

Fix missing truffle migration deployments data (cgewecke/eth-gas-reporter#240)

Upgrade solidity-parser/parser to 0.11.1 (cgewecke/eth-gas-reporter#239)

0.2.20 / 2020-12-01

Add support for remote contracts data pre-loading (hardhat-gas-reporter feature)

0.2.19 / 2020-10-29

Delegate contract loading/parsing to artifactor & make optional (#227)

0.2.18 / 2020-10-13

Support multiple codechecks reports per CI run

Add CI error threshold options: maxMethodDiff, maxDeploymentDiff

Add async collection methods for BuidlerEVM

Update solidity-parser/parser to 0.8.0 (contribution: @vicnaum)

Update dev deps / use Node 12 in CI

0.2.17 / 2020-04-13

Use @solidity-parser/parser for better solc 0.6.x parsing

Upgrade Mocha to ^7.1.1 (to remove minimist vuln warning)

Stop crashing when parser or ABI Encoder fails

Update @ethersproject/abi to ^5.0.0-beta.146 (and unpin)

... (truncated)

Commits

See full diff in compare view

Updates solidity-coverage from 0.8.2 to 0.8.7

Release notes

Sourced from solidity-coverage's releases.

0.8.7

What's Changed

viaIR now allowed

This release (hopefully) fixes a long-running problem solidity-coverage had with solc's viaIR compilation mode - It's now possible to use it without any special configuration. (Please report any ongoing issues with this to issue #861)

If you've been using .solcover.js options like configureYulOptimizer and solcOptimizerDetails as a work around, you should remove them when upgrading. (Don't forget to run the hardhat clean task after updating any coverage config stuff).

--network no longer allowed

Sadly the ganache client has been deprecated. The coverage plugin never worked with its latest major version and the network flag only existed for its sake. Going forward, the network option throws an error notifying the user that coverage only uses the HardhatEVM network.

--sources cli option

You can now select a single file (or folder) at the command line to generate coverage for. This option should speed things up if you've been waiting for the plugin to instrument everything in a large project whenever you run the command.
$ npx hardhat coverage --sources MyFile.sol
$ npx hardhat coverage --sources MyFolder
(Thanks so much @clauBv23 for adding this!)

Funding

OpenZeppelin has very generously funded recent work at solidity-coverage via DRIPS, a public goods protocol which helps you direct money to projects in your dependency tree. Thanks so much! ❤️

Links to relevant PRs

Add command option to specify the source files to run the coverage on (#806) by @clauBv23 in sc-forks/solidity-coverage#838

Remove ganache-cli related code from API & tests by @cgewecke in sc-forks/solidity-coverage#849

Add missing onPreCompile stage hook by @cgewecke in sc-forks/solidity-coverage#851

Enable coverage when viaIR compiler flag is true by @cgewecke in sc-forks/solidity-coverage#854

Full Changelog: sc-forks/solidity-coverage@v0.8.6...v0.8.7

v0.8.6

What's Changed

Fixes

Perform ternary conditional injections before branch injections (#828) by @cgewecke in sc-forks/solidity-coverage#828

Fix chained ternary conditionals instrumentation by @cgewecke in sc-forks/solidity-coverage#830

Fix instrumentation error for virtual modifiers by @cgewecke in sc-forks/solidity-coverage#832

Throw error when mocha parallel is set to true by @cgewecke in sc-forks/solidity-coverage#833

Documentation

Update faq.md with another viaIR optimizer config workaround by @remedcu in sc-forks/solidity-coverage#822

Document Istanbul check-coverage cli command by @cgewecke in sc-forks/solidity-coverage#834

... (truncated)

Changelog

Sourced from solidity-coverage's changelog.

0.8.7 / 2024-02-09

Documentation Cleanup & Improvements for 0.8.7 release (sc-forks/solidity-coverage#859)

Add tests for file-level function declarations (sc-forks/solidity-coverage#858)

Add try / catch unit tests (sc-forks/solidity-coverage#857)

Fix test project configs for viaIR detection in overrides (sc-forks/solidity-coverage#856)

Enable coverage when viaIR compiler flag is true (sc-forks/solidity-coverage#854)

Add missing onPreCompile hook (sc-forks/solidity-coverage#851)

Remove ganache-cli related code from API & tests (sc-forks/solidity-coverage#849)

Add command option to specify the source files to run the coverage on (sc-forks/solidity-coverage#838)

0.8.6 / 2024-01-28

Add test for multi-contract files with inheritance (sc-forks/solidity-coverage#836)

Add test for modifiers with post-conditions (sc-forks/solidity-coverage#835)

Document Istanbul check-coverage cli command (sc-forks/solidity-coverage#834)

Throw error when mocha parallel is set to true (sc-forks/solidity-coverage#833)

Fix instrumentation error for virtual modifiers (sc-forks/solidity-coverage#832)

Add test for file level using for statements (sc-forks/solidity-coverage#831)

Fix chained ternary conditionals instrumentation (sc-forks/solidity-coverage#830)

Update faq.md with an optimizer config workaround (sc-forks/solidity-coverage#822)

Upgrade solidity-parser to 0.18.0 (sc-forks/solidity-coverage#829)

Perform ternary conditional injections before branch injections (sc-forks/solidity-coverage#828)

Add drips funding config (sc-forks/solidity-coverage#827)

0.8.5 / 2023-09-21

Update contributor list (sc-forks/solidity-coverage#812)

Add dependabot config (sc-forks/solidity-coverage#759)

Add a package description to package.json (sc-forks/solidity-coverage#775)

change .solcoverjs occurencies to .solcover.js (sc-forks/solidity-coverage#777)

Remove all mentions to buidler (sc-forks/solidity-coverage#778)

Update HH dev dep & fix Zeppelin E2E test (sc-forks/solidity-coverage#811)

Update mocha version to 10.2.0, fix deprecated debug package (sc-forks/solidity-coverage#810)

... (truncated)

Commits

931645a Update changelog: 0.8.7
ec5a296 0.8.7
0ab1282 Documentation Cleanup & Improvements for 0.8.7 release (#859)
44a999f Add tests for file-level function declarations (#858)
042a99e Add try / catch unit tests (#857)
01ab173 Fix test project configs for viaIR detection in overrides (#856)
4f007c7 Enable coverage when viaIR compiler flag is true (#854)
d3a5b37 Small API docs edits
ca695f0 Add missing onPreCompile stage hook (#851)
dc9d976 Use Node 20.11.0 in CircleCI for unit and integration tests (#850)
Additional commits viewable in compare view

Updates follow-redirects from 1.15.2 to 1.15.5

Commits

b1677ce Release version 1.15.5 of the npm package.
d8914f7 Preserve fragment in responseUrl.
6585820 Release version 1.15.4 of the npm package.
7a6567e Disallow bracketed hostnames.
05629af Prefer native URL instead of deprecated url.parse.
1cba8e8 Prefer native URL instead of legacy url.resolve.
72bc2a4 Simplify _processResponse error handling.
3d42aec Add bracket tests.
bcbb096 Do not directly set Error properties.
192dbe7 Release version 1.15.3 of the npm package.
Additional commits viewable in compare view

Updates undici from 5.22.0 to 5.28.3

Release notes

Sourced from undici's releases.

v5.28.3

⚠️ Security Release ⚠️

Fixes:

CVE-2024-24758 Proxy-Authorization header not cleared on cross-origin redirect in fetch

Full Changelog: nodejs/undici@v5.28.2...v5.28.3

v5.28.2

What's Changed

fix: remove optional chainning for compatible with Nodejs12 and below by @bugb in nodejs/undici#2470

fix: remove node: prefix by @tsctx in nodejs/undici#2471

perf: avoid Headers initialization by @tsctx in nodejs/undici#2468

fix: handle SharedArrayBuffer correctly by @tsctx in nodejs/undici#2466

fix: Add null type to signal in RequestInit by @gebsh in nodejs/undici#2455

fix: correctly handle data URL with hashes. by @tsctx in nodejs/undici#2475

fix: check response for timinginfo allow flag by @ToshB in nodejs/undici#2477

Make call to onBodySent conditional in RetryHandler by @MzUgM in nodejs/undici#2478

refactor: better integrity check by @tsctx in nodejs/undici#2462

fix: Added support for inline URL username:password proxy auth by @matt-way in nodejs/undici#2473

build(deps-dev): bump jsdom from 22.1.0 to 23.0.0 by @dependabot in nodejs/undici#2472

build(deps-dev): bump sinon from 16.1.3 to 17.0.1 by @dependabot in nodejs/undici#2405

build(deps): bump ossf/scorecard-action from 2.2.0 to 2.3.1 by @dependabot in nodejs/undici#2396

build(deps): bump actions/setup-node from 3.8.1 to 4.0.0 by @dependabot in nodejs/undici#2395

build(deps): bump step-security/harden-runner from 2.5.0 to 2.6.0 by @dependabot in nodejs/undici#2392

build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 by @dependabot in nodejs/undici#2389

build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 by @dependabot in nodejs/undici#2302

New Contributors

@bugb made their first contribution in nodejs/undici#2470

@gebsh made their first contribution in nodejs/undici#2455

@ToshB made their first contribution in nodejs/undici#2477

@MzUgM made their first contribution in nodejs/undici#2478

@matt-way made their first contribution in nodejs/undici#2473

Full Changelog: nodejs/undici@v5.28.1...v5.28.2

v5.28.1

What's Changed

perf: Improve normalizeMethod by @tsctx in nodejs/undici#2456

fix: dispatch error handling by @ronag in nodejs/undici#2459

perf(request): optimize if headers are given by @tsctx in nodejs/undici#2454

Full Changelog: nodejs/undici@v5.28.0...v5.28.1

v5.28.0

What's Changed

fix(parseHeaders): util.parseHeaders handle correctly array of buffer… by @mdoria12 in nodejs/undici#2398

... (truncated)

Commits

e71cb4c Bumped v5.28.3
20c65b8 Fix tests for Node.js v20.11.0 (#2618)
8ec52cd Fix tests for Node.js v21 (#2609)
d3aa574 Merge pull request from GHSA-3787-6prv-h9w3
9a14e5f Bumped v5.28.2
fcdfe87 build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 (#2302)
169c157 build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 (#2389)
9788177 build(deps): bump step-security/harden-runner from 2.5.0 to 2.6.0 (#2392)
1f6d159 build(deps): bump actions/setup-node from 3.8.1 to 4.0.0 (#2395)
a393a86 build(deps): bump ossf/scorecard-action from 2.2.0 to 2.3.1 (#2396)
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps the npm_and_yarn group with 4 updates in the /gas-oracle directory: [flat](https://github.com/hughsk/flat), [eth-gas-reporter](https://github.com/cgewecke/eth-gas-reporter), [solidity-coverage](https://github.com/sc-forks/solidity-coverage) and [undici](https://github.com/nodejs/undici). Updates `flat` from 4.1.1 to 5.0.2 - [Release notes](https://github.com/hughsk/flat/releases) - [Commits](hughsk/flat@4.1.1...5.0.2) Updates `eth-gas-reporter` from 0.2.25 to 0.2.27 - [Release notes](https://github.com/cgewecke/eth-gas-reporter/releases) - [Changelog](https://github.com/cgewecke/eth-gas-reporter/blob/master/CHANGELOG.md) - [Commits](https://github.com/cgewecke/eth-gas-reporter/commits/v0.2.27) Updates `solidity-coverage` from 0.8.2 to 0.8.7 - [Release notes](https://github.com/sc-forks/solidity-coverage/releases) - [Changelog](https://github.com/sc-forks/solidity-coverage/blob/master/CHANGELOG.md) - [Commits](sc-forks/solidity-coverage@v0.8.2...v0.8.7) Updates `follow-redirects` from 1.15.2 to 1.15.5 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.2...v1.15.5) Updates `undici` from 5.22.0 to 5.28.3 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.22.0...v5.28.3) --- updated-dependencies: - dependency-name: flat dependency-type: indirect dependency-group: npm_and_yarn-security-group - dependency-name: eth-gas-reporter dependency-type: indirect dependency-group: npm_and_yarn-security-group - dependency-name: solidity-coverage dependency-type: direct:development dependency-group: npm_and_yarn-security-group - dependency-name: follow-redirects dependency-type: indirect dependency-group: npm_and_yarn-security-group - dependency-name: undici dependency-type: indirect dependency-group: npm_and_yarn-security-group ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2024-04-01T05:02:48Z

Superseded by #164.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Feb 16, 2024

dependabot Bot mentioned this pull request Feb 16, 2024

Bump the npm_and_yarn group across 1 directories with 4 updates #35

Closed

dependabot Bot closed this Apr 1, 2024

dependabot Bot deleted the dependabot/npm_and_yarn/gas-oracle/npm_and_yarn-security-group-a45e46bb51 branch April 1, 2024 05:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directories with 5 updates#45

Bump the npm_and_yarn group across 1 directories with 5 updates#45
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/gas-oracle/npm_and_yarn-security-group-a45e46bb51

dependabot Bot commented on behalf of github Feb 16, 2024 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Apr 1, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Feb 16, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.2.27

What's Changed

v0.2.26

What's Changed

New Contributors

0.2.27 / 2023-09-30

0.2.26 / 2023-09-29

0.2.23 / 2021-11-26

0.2.22 / 2021-03-04

0.2.21 / 2021-02-16

0.2.20 / 2020-12-01

0.2.19 / 2020-10-29

0.2.18 / 2020-10-13

0.2.17 / 2020-04-13

0.8.7

What's Changed

viaIR now allowed

--network no longer allowed

--sources cli option

Funding

Links to relevant PRs

v0.8.6

What's Changed

Fixes

Documentation

0.8.7 / 2024-02-09

0.8.6 / 2024-01-28

0.8.5 / 2023-09-21

v5.28.3

⚠️ Security Release ⚠️

v5.28.2

What's Changed

New Contributors

v5.28.1

What's Changed

v5.28.0

What's Changed

Uh oh!

dependabot Bot commented on behalf of github Apr 1, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Feb 16, 2024 •

edited

Loading

`viaIR` now allowed

`--network` no longer allowed

`--sources` cli option