chore(deps): bump immutable, @nomicfoundation/hardhat-toolbox, @openzeppelin/hardhat-upgrades and hardhat in /e2e - #2674
Conversation
…eppelin/hardhat-upgrades and hardhat Removes [immutable](https://github.com/immutable-js/immutable-js). It's no longer used after updating ancestor dependencies [immutable](https://github.com/immutable-js/immutable-js), [@nomicfoundation/hardhat-toolbox](https://github.com/NomicFoundation/hardhat/tree/HEAD/packages/hardhat-toolbox), [@openzeppelin/hardhat-upgrades](https://github.com/OpenZeppelin/openzeppelin-upgrades) and [hardhat](https://github.com/NomicFoundation/hardhat/tree/HEAD/packages/hardhat). These dependencies need to be updated together. Removes `immutable` Updates `@nomicfoundation/hardhat-toolbox` from 4.0.0 to 7.0.0 - [Release notes](https://github.com/NomicFoundation/hardhat/releases) - [Changelog](https://github.com/NomicFoundation/hardhat/blob/@nomicfoundation/hardhat-toolbox@7.0.0/packages/hardhat-toolbox/CHANGELOG.md) - [Commits](https://github.com/NomicFoundation/hardhat/commits/@nomicfoundation/hardhat-toolbox@7.0.0/packages/hardhat-toolbox) Updates `@openzeppelin/hardhat-upgrades` from 3.9.1 to 4.1.0 - [Release notes](https://github.com/OpenZeppelin/openzeppelin-upgrades/releases) - [Commits](https://github.com/OpenZeppelin/openzeppelin-upgrades/compare/@openzeppelin/hardhat-upgrades@3.9.1...@openzeppelin/hardhat-upgrades@4.1.0) Updates `hardhat` from 2.26.3 to 3.15.0 - [Release notes](https://github.com/NomicFoundation/hardhat/releases) - [Changelog](https://github.com/NomicFoundation/hardhat/blob/main/packages/hardhat/CHANGELOG.md) - [Commits](https://github.com/NomicFoundation/hardhat/commits/hardhat@3.15.0/packages/hardhat) --- updated-dependencies: - dependency-name: immutable dependency-version: dependency-type: indirect - dependency-name: "@nomicfoundation/hardhat-toolbox" dependency-version: 7.0.0 dependency-type: direct:development - dependency-name: "@openzeppelin/hardhat-upgrades" dependency-version: 4.1.0 dependency-type: direct:development - dependency-name: hardhat dependency-version: 3.15.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
✅ cargo-vet: already fully vetted with No audits needed. |
🧾 cargo-vet automated audit summary
CI did not commit anything. Review the patch locally and create the final signed commit yourself. Apply the patch locallyThe patch artifact is attached to this workflow run as a zip archive. Download it, extract Preferred: GitHub CLI git checkout <pr-branch>
gh run download 33846477790 -n dependabot-auto-vet-patch-pr-2674
git apply --index auto-vet.patch
git status
git commit -S -m "chore(vet): apply automated audits"
git pushFallback: direct artifact download git checkout <pr-branch>
curl -L \
-H "Authorization: Bearer <github-token>" \
-o auto-vet-artifact.zip \
https://github.com/cloudwalk/stratus/actions/runs/33846477790/artifacts/9926758494
unzip -p auto-vet-artifact.zip vet/auto-vet.patch > auto-vet.patch
git apply --index auto-vet.patch
git status
git commit -S -m "chore(vet): apply automated audits"
git push |
![cloudwalk-review-agent[bot]](https://avatars.githubusercontent.com/u/6581007?s=60&v=4){kind=small}
There was a problem hiding this comment.
⛔ Blocking: Hardhat 2 → 3 is a breaking migration — this PR breaks all E2E CI
This Dependabot multi-bump moves hardhat 2.26.3 → 3.15.0, @nomicfoundation/hardhat-toolbox 4.0.0 → 7.0.0, and @openzeppelin/hardhat-upgrades 3.9.1 → 4.1.0, but only touches package.json + lockfile. Hardhat 3 is ESM-only and has breaking config/plugin changes, and the e2e project has not been migrated. All four E2E suites fail at the Run e2e tests step on this PR's CI (run 33846477901) with:
Hardhat only supports ESM projects.
Please make sure you have `"type": "module"` in your package.json.
Confirmed from the job logs (e.g. E2E Admin Password, job 100939379125). What a valid migration would require (none of it is in this PR):
"type": "module"ine2e/package.jsonandtsconfig.jsonmoved off"module": "commonjs".hardhat.config.tsrewritten for HH3: plugin registration via thepluginsconfig array instead of side-effect imports;import "@openzeppelin/hardhat-upgrades"is no longer valid in 4.x (asyncupgrades(hre, connection)factory instead).hardhat-toolbox@7.0.0is a deprecation-redirect meta-package with zero dependencies — it no longer pulls in the plugins the config imports directly (chai,@typechain/hardhat) nor the ones the tests rely on transitively (@nomicfoundation/hardhat-network-helpers,@nomicfoundation/hardhat-chai-matchers,@nomicfoundation/hardhat-ethers). Verified against the new lockfile:chai,@typechain/hardhat, network-helpers, and chai-matchers are all absent from the tree, whilehardhat.config.tsdoesimport chai, { expect } from "chai"andimport "@typechain/hardhat".
Recommendation: close this PR and do the Hardhat 3 migration as a dedicated change (or rework this one to include the migration + green CI). A lockfile-only bump cannot pass here.
Note: the removal of the immutable override/package is fine on its own — nothing in e2e sources imports it; it was only a transitive security pin (of Hardhat 2's tree, which no longer needs it).
| "axios": "1.15.2", | ||
| "ethers": "6.15.0", | ||
| "hardhat": "2.26.3", | ||
| "hardhat": "3.15.0", |
There was a problem hiding this comment.
⛔ Blocking: hardhat@3.15.0 is ESM-only, but this project is CommonJS (no "type": "module"", tsconfig module: commonjs). CI on this PR fails every E2E suite at Run e2e tests with Hardhat only supports ESM projects. Please make sure you have "type": "module" in your package.json. Hardhat 2→3 also requires config/plugin migration, so this can't land as a lockfile-only bump.
| "devDependencies": { | ||
| "@nomicfoundation/hardhat-toolbox": "4.0.0", | ||
| "@openzeppelin/hardhat-upgrades": "3.9.1", | ||
| "@nomicfoundation/hardhat-toolbox": "7.0.0", |
There was a problem hiding this comment.
⛔ @nomicfoundation/hardhat-toolbox@7.0.0 is a deprecation-redirect meta-package with no dependencies (it just points users at the HH2→HH3 migration). Toolbox 4.x used to transitively provide chai, @typechain/hardhat, @nomicfoundation/hardhat-network-helpers, @nomicfoundation/hardhat-chai-matchers, and @nomicfoundation/hardhat-ethers — all absent from the new lockfile, while hardhat.config.ts directly imports chai and @typechain/hardhat. The plugins the test suite uses need to be installed explicitly after the migration.
| "@nomicfoundation/hardhat-toolbox": "4.0.0", | ||
| "@openzeppelin/hardhat-upgrades": "3.9.1", | ||
| "@nomicfoundation/hardhat-toolbox": "7.0.0", | ||
| "@openzeppelin/hardhat-upgrades": "4.1.0", |
There was a problem hiding this comment.
@openzeppelin/hardhat-upgrades@4.x requires hardhat@^3.6.0 and changes the import contract: the side-effect import "@openzeppelin/hardhat-upgrades"" in hardhat.config.ts no longer registers hre.upgrades; the plugin must be registered in the HH3 plugins array and the API used via the async upgrades(hre, connection) factory. Part of the same HH3 migration this PR needs.
Removes immutable. It's no longer used after updating ancestor dependencies immutable, @nomicfoundation/hardhat-toolbox, @openzeppelin/hardhat-upgrades and hardhat. These dependencies need to be updated together.
Removes
immutableUpdates
@nomicfoundation/hardhat-toolboxfrom 4.0.0 to 7.0.0Release notes
Sourced from @nomicfoundation/hardhat-toolbox's releases.
Changelog
Sourced from @nomicfoundation/hardhat-toolbox's changelog.
Commits
6372d08Version Packagesa26e822Remove the npm tags from the README.md files18bef56Quote the package in the installation instructions of the readmese5025aeUpdate the formatting and quote the package in the installation instructions ...ee34347Update hardhat-toolbox7ade974Version Packagesa7e4215feat: bump minimum version ofsolidity-coverageto Osakae4ad0adchore: update package metadata for provenancef65ee74Version Packagesa4f1e27Hardhat 2 documentation links updated to reflect the domain change to v2.hard...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@nomicfoundation/hardhat-toolboxsince your current version.Updates
@openzeppelin/hardhat-upgradesfrom 3.9.1 to 4.1.0Release notes
Sourced from @openzeppelin/hardhat-upgrades's releases.
... (truncated)
Commits
2aa252fPrepare Release (#1293)9e286daAdd support for Viem (#1279)4c07151Update examples to hardhat-upgrades 4.0.2 and remove connection casts (#1277)e8d0f6fPrepare Release (#1276)43af631Re-export hardhat-ethers from hardhat-upgrades (#1275)70813e8Rename to hre.network.create() in markdown docs (#1273)7c63a5fUpdate dependencies in Hardhat 3 example projects (#1271)5257231Add error message assertions in Solidity tests (#1272)a4562e9Fix concurrent-publish race in package build scripts (#1268)490cd7bUpdate codecov/codecov-action action to v6 (#1265)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@openzeppelin/hardhat-upgradessince your current version.Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.Updates
hardhatfrom 2.26.3 to 3.15.0Release notes
Sourced from hardhat's releases.
... (truncated)
Changelog
Sourced from hardhat's changelog.
... (truncated)
Commits
25c1aefVersion Packages62ea17ffix(hardhat): allow hyphens in build-info compiler-type ids85732e4refactor(hardhat-slang-solx): rename the compiler type to slang-solx26b3d5ffeat: bump EDR to 0.19.06547d41chore: bump the templates to solc 0.8.34f53d6e7chore: bump forge-std to v1.16.23075549update edrca1f6b8Merge branch 'main' of github.com:NomicFoundation/hardhat into popescuoctavia...e829113Version Packagesce66950undo unused changesMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for hardhat since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.