Pin patched npm transitives for open Dependabot alerts - #52
Closed
vm06007 wants to merge 6 commits into
Closed
Conversation
Force axios, ws, form-data, minimatch, nanoid, and related crypto helpers onto patched releases so Dependabot can close the open lockfile alerts. Regenerating with legacy-peer-deps drops unused ganache/request/tar trees left over from Hardhat 2. Co-authored-by: Cursor <cursoragent@cursor.com>
Keep the Hardhat 3 lockfile refresh and union npm overrides with pins already landed from sha.js, brace-expansion, and js-yaml. Co-authored-by: Cursor <cursoragent@cursor.com>
Re-resolve the lockfile after the picomatch bump and record Balancer, OpenZeppelin, and Permit2 as git submodules so Foundry CI can compile. Co-authored-by: Cursor <cursoragent@cursor.com>
.gitmodules already listed these libraries, but they were never stored as gitlinks, so Foundry CI checkout could not fetch them. Co-authored-by: Cursor <cursoragent@cursor.com>
This reverts commit e158571.
Keep this PR limited to npm pins. Foundry submodule gitlinks belong with a dedicated compile fix. Co-authored-by: Cursor <cursoragent@cursor.com>
2 tasks
Member
Author
|
Closing — superseded by #57, which dropped the unused Hardhat/npm lockfile that was generating these alerts. Remaining Dependabot items should auto-close on the next scan. Foundry CI removal is in a follow-up PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
axios1.19.0,ws7.5.13,form-data2.5.6,minimatch3.1.5/5.1.9,nanoid3.3.18,elliptic6.6.1, plussha.js,cipher-base,base-x,secp256k1,tough-cookie,tar).package-lock.jsonagainst Hardhat 3 so unused ganache/request/swarm-js trees drop out (sha.js,cipher-base,base-x,secp256k1,tough-cookie,tarare gone from the install graph)..npmrcwithlegacy-peer-deps=trueso CInpm installmatches the Hardhat 3 vs@nomiclabs/hardhat-*v2 peer mismatch.What this should close
The selected form-data, ws, axios, sha.js, cipher-base, minimatch, base-x, secp256k1, tough-cookie, tar, elliptic (critical ECDSA), and nanoid alerts.
Elliptic GHSA-848j (
<= 6.6.1, low, no patch) will remain.Test plan
npm installsucceeds with the committed.npmrcmain(missing Balancer/OpenZeppelin gitlinks, plus stale BasketSwap/FlexibleDraw tests). Merge needs admin bypass of those two required checks.