Skip to content

build(deps): bump undici, @openzeppelin/hardhat-upgrades, hardhat, @nomicfoundation/hardhat-toolbox and @nomicfoundation/hardhat-verify - #147

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-50f0f947e7
Open

build(deps): bump undici, @openzeppelin/hardhat-upgrades, hardhat, @nomicfoundation/hardhat-toolbox and @nomicfoundation/hardhat-verify#147
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-50f0f947e7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 4, 2026

Copy link
Copy Markdown

Bumps undici to 6.28.0 and updates ancestor dependencies undici, @openzeppelin/hardhat-upgrades, hardhat, @nomicfoundation/hardhat-toolbox and @nomicfoundation/hardhat-verify. These dependencies need to be updated together.

Updates undici from 6.27.0 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

Commits
  • 01a912e Bumped v6.28.0 (#5591)
  • 481ecfc Use Node 22 and npm 11 to release
  • 740a0b7 fix: validate blob body content type
  • 2698e49 fix: validate coerced header values for CRLF (#5579)
  • 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
  • cba3a52 fix(retry): reject partial content length mismatch
  • af74840 fix: harden cookie domain, path, and unparsed attribute validation
  • See full diff in compare view

Updates @openzeppelin/hardhat-upgrades from 3.2.0 to 4.1.0

Release notes

Sourced from @​openzeppelin/hardhat-upgrades's releases.

@​openzeppelin/hardhat-upgrades@​4.1.0

  • Add a viem-based API at @openzeppelin/hardhat-upgrades/viem, following @nomicfoundation/hardhat-viem conventions: contracts are identified by name, addresses are typed as `0x${string}`, and the returned contract instances are viem contract instances. (#1279)
    • To use the viem-based API, install viem and @nomicfoundation/hardhat-viem, then import both the plugin (for your Hardhat config's plugins array) and the API (for your scripts) from @openzeppelin/hardhat-upgrades/viem. It supports wallet clients backed by local accounts, such as viem's privateKeyToAccount. The proxyFilesToBuild helper for Solidity tests is also exported from this entry point, so viem-only projects can configure npmFilesToBuild without importing the ethers-typed root entry.
    • The ethers-based API is unchanged. Import its plugin and API from @openzeppelin/hardhat-upgrades as before, or from the new @openzeppelin/hardhat-upgrades/ethers alias.
    • Potentially breaking changes: ethers and @nomicfoundation/hardhat-ethers are now optional peer dependencies, required only by the ethers-based API; viem-only projects no longer need them. If you use the ethers-based API, install them explicitly with npm install --save-dev @nomicfoundation/hardhat-ethers ethers. Previously they were required peer dependencies that package managers installed automatically.

@​openzeppelin/hardhat-upgrades@​4.0.2

  • Re-export @nomicfoundation/hardhat-ethers types so that TypeScript recognizes connection.ethers when only this plugin is registered. (#1275)

@​openzeppelin/hardhat-upgrades@​4.0.1

  • Update dependencies. (#1255)

@​openzeppelin/hardhat-upgrades@​4.0.0

  • Migrate to Hardhat 3 with ESM module structure and plugin hooks architecture. (#1241)

    Breaking Changes

    • Requires Hardhat 3: minimum hardhat@^3.6.0 required.
    • ESM-only: package converted to ESM; CommonJS is no longer supported.
    • API Changes:
      • No automatic hre.upgrades — call the upgrades(hre, connection) factory explicitly.
      • Factory functions (upgrades, defender) are async and require a network connection.
      • Network connection must be explicitly created: const connection = await hre.network.create(). Share one connection across operations.
      • ethers now comes from the connection (const { ethers } = connection), not hre.ethers.
    • Import Changes: import factory functions instead of a side-effect import.
      • Before: import '@openzeppelin/hardhat-upgrades'
      • After: import { upgrades, defender } from '@openzeppelin/hardhat-upgrades'

    Usage and Migration

    See the README for Hardhat 3 usage, the examples directory for sample projects, and the Migration Guide for Hardhat 2 to 3 migration steps.

    Changes

    • Migrated from extendEnvironment to Hardhat 3's HardhatPlugin with hookHandlers.
    • Converted package to ESM.
    • Etherscan verification requires @nomicfoundation/hardhat-verify@^3.0.10 (optional peer dependency).
    • Support Solidity tests in Hardhat 3 with @openzeppelin/foundry-upgrades.
    • Added example projects for Hardhat 3 (Transparent, UUPS, and Solidity-test scaffolds under packages/plugin-hardhat/examples/).
  • Updated dependencies [7f3e4c6, 668f70c]:

    • @​openzeppelin/upgrades-core@​1.45.0

@​openzeppelin/hardhat-upgrades@​4.0.0-alpha.0

Note ⚠️ This version is still in testing. Do not use it to deploy or upgrade production deployments.

  • Migrate to Hardhat 3 with ESM module structure and plugin hooks architecture. (#1194)

    Breaking Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​openzeppelin/hardhat-upgrades since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates hardhat from 2.22.6 to 3.15.0

Release notes

Sourced from hardhat's releases.

Hardhat v3.15.0

This release includes two highlights: improved Solidity Test compilation speed through a porting of our inline configuration parsing to Rust, and bumps of our default templates to Solidity 0.8.34.

Changes


💡 The Nomic Foundation is hiring! Check our open positions.


Hardhat v3.14.0

This is a small bug fix release, but includes a reworking of our EDR dependencies to be platform specific, reducing the install size of a Hardhat project's node_modules.

Changes

  • #8540 99306ea Thanks @​kanej! - EDR now uses platform specific optionalDependencies, reducing Hardhat's install size.

  • #8514 f7c6228 Thanks @​questfever! - Fixed Solidity resolver containment checks for paths whose names share a prefix with the project root, a package source-name root, or node_modules.

  • #8540 99306ea Thanks @​kanej! - Fixed missing Solidity test stack trace when setUp() fails and stack traces are collected with CollectStackTraces::Always.

  • #8500 54973b2 Thanks @​SnowingFox! - Fixed the format of fuzz test counterexamples: byte array values such as calldata, sender and address are now printed as hexadecimal strings (e.g. 0x3e2033b3...) instead of comma-separated byte lists.

  • #8522 8640b4b Thanks @​JasonColapietro! - Remove Holesky testnet (chain id 17000) as a supported chain as it has been shut down.

  • #8488 edd1069 Thanks @​ChristopherDedominici! - Stores gas snapshot cheatcode values as raw strings and calculates diffs using BigInt.


💡 The Nomic Foundation is hiring! Check our open positions.


Hardhat v3.13.0

This release adds two new features: a --tolerance option for --snapshot-check to allow for a small amount of drift between gas snapshots as you develop and default values for config variables in hardhat.config.ts, see the config docs for more details.

Changes

  • #8453 38b9f2d Thanks @​ChristopherDedominici! - Add a fallback value for configVariable.

  • #8487 7b7af19 Thanks @​ChristopherDedominici! - Added a --tolerance option to --snapshot-check in Solidity tests, allowing snapshot values to drift by a given percentage before the check fails.

  • #8486 2ccd059 Thanks @​Kropiunig! - Fixed the EDR network config validation rejecting mining.interval: 0, a valid value which disables interval mining.

  • #8490 22667f6 Thanks @​kanej! - Added detection and custom error for failed native binding loads (HHE27) of @nomicfoundation/edr or @nomicfoundation/solidity-analyzer.

  • #8454 47793de Thanks @​ChristopherDedominici! - Only collect Solidity test stack traces at verbosity level 5 (-vvvvv) and above, fixing excessive memory usage when running large test suites with -vvv/-vvvv.


💡 The Nomic Foundation is hiring! Check our open positions.

... (truncated)

Changelog

Sourced from hardhat's changelog.

3.15.0

Minor Changes

Patch Changes

3.14.0

Minor Changes

  • #8540 99306ea Thanks @​kanej! - EDR now uses platform specific optionalDependencies, reducing Hardhat's install size.

Patch Changes

  • #8514 f7c6228 Thanks @​questfever! - Fixed Solidity resolver containment checks for paths whose names share a prefix with the project root, a package source-name root, or node_modules.

  • #8540 99306ea Thanks @​kanej! - Fixed missing Solidity test stack trace when setUp() fails and stack traces are collected with CollectStackTraces::Always.

  • #8500 54973b2 Thanks @​SnowingFox! - Fixed the format of fuzz test counterexamples: byte array values such as calldata, sender and address are now printed as hexadecimal strings (e.g. 0x3e2033b3...) instead of comma-separated byte lists.

  • #8522 8640b4b Thanks @​JasonColapietro! - Remove Holesky testnet (chain id 17000) as a supported chain as it has been shut down.

  • #8488 edd1069 Thanks @​ChristopherDedominici! - Stores gas snapshot cheatcode values as raw strings and calculates diffs using BigInt.

3.13.0

Minor Changes

Patch Changes

  • #8486 2ccd059 Thanks @​Kropiunig! - Fixed the EDR network config validation rejecting mining.interval: 0, a valid value which disables interval mining.

  • #8490 22667f6 Thanks @​kanej! - Added detection and custom error for failed native binding loads (HHE27) of @nomicfoundation/edr or @nomicfoundation/solidity-analyzer.

  • #8454 47793de Thanks @​ChristopherDedominici! - Only collect Solidity test stack traces at verbosity level 5 (-vvvvv) and above, fixing excessive memory usage when running large test suites with -vvv/-vvvv.

3.12.0

Minor Changes

... (truncated)

Commits
  • 25c1aef Version Packages
  • 62ea17f fix(hardhat): allow hyphens in build-info compiler-type ids
  • 85732e4 refactor(hardhat-slang-solx): rename the compiler type to slang-solx
  • 26b3d5f feat: bump EDR to 0.19.0
  • 6547d41 chore: bump the templates to solc 0.8.34
  • f53d6e7 chore: bump forge-std to v1.16.2
  • 3075549 update edr
  • ca1f6b8 Merge branch 'main' of github.com:NomicFoundation/hardhat into popescuoctavia...
  • e829113 Version Packages
  • ce66950 undo unused changes
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hardhat since your current version.


Updates @nomicfoundation/hardhat-toolbox from 5.0.0 to 7.0.0

Release notes

Sourced from @​nomicfoundation/hardhat-toolbox's releases.

@​nomicfoundation/hardhat-toolbox-viem@​5.0.7

Changes

  • #8339 00720e8 Thanks @​alcuadrado! - The plugin now uses definePlugin from hardhat/plugins in its index.ts, so it participates in Hardhat's new "imported but unused plugin" warning when omitted from a project's plugins array.

  • Updated dependencies:

    • hardhat@3.8.0

💡 The Nomic Foundation is hiring! Check our open positions.


@​nomicfoundation/hardhat-toolbox-viem@​5.0.6

Changes


💡 The Nomic Foundation is hiring! Check our open positions.


Changelog

Sourced from @​nomicfoundation/hardhat-toolbox's changelog.

7.0.0

Major Changes

  • 09ae6db: Deprecate the latest npm tag and redirect users to migrate to Hardhat 3 or to the hh2 tag.
Commits
  • 6372d08 Version Packages
  • a26e822 Remove the npm tags from the README.md files
  • 18bef56 Quote the package in the installation instructions of the readmes
  • e5025ae Update the formatting and quote the package in the installation instructions ...
  • ee34347 Update hardhat-toolbox
  • 7ade974 Version Packages
  • a7e4215 feat: bump minimum version of solidity-coverage to Osaka
  • e4ad0ad chore: update package metadata for provenance
  • f65ee74 Version Packages
  • a4f1e27 Hardhat 2 documentation links updated to reflect the domain change to v2.hard...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​nomicfoundation/hardhat-toolbox since your current version.


Updates @nomicfoundation/hardhat-verify from 2.0.8 to 3.1.0

Release notes

Sourced from @​nomicfoundation/hardhat-verify's releases.

@​nomicfoundation/hardhat-verify@​3.1.0

Changes

  • #8510 7c85703 Thanks @​nikitosing! - Added support for an optional apiKey in the verify.blockscout config. This is required by Blockscout instances that don't expose a keyless API, like the Pro API.
  • #8577 27a145d Thanks @​kanej! - Report a directory with no importable entry point as a module-not-found error, instead of the generic "importing the module failed".

💡 The Nomic Foundation is hiring! Check our open positions.


@​nomicfoundation/hardhat-verify@​3.0.22

Changes


💡 The Nomic Foundation is hiring! Check our open positions.


@​nomicfoundation/hardhat-verify@​3.0.21

Changes

  • #8367 82d00fc Thanks @​alcuadrado! - Lazy load dependencies to optimize bootstrap time

  • Updated dependencies:

    • @​nomicfoundation/hardhat-errors@​3.0.16
    • @​nomicfoundation/hardhat-utils@​4.1.4

💡 The Nomic Foundation is hiring! Check our open positions.


@​nomicfoundation/hardhat-verify@​3.0.20

Changes

  • #8374 c67a5bb Thanks @​gultekinmakif! - Running verify against local development networks (chain IDs 31337 and 1337) now fails with a clear NETWORK_NOT_SUPPORTED error.

💡 The Nomic Foundation is hiring! Check our open positions.


@​nomicfoundation/hardhat-verify@​3.0.19

Changes

  • #8339 00720e8 Thanks @​alcuadrado! - The plugin now uses definePlugin from hardhat/plugins in its index.ts, so it participates in Hardhat's new "imported but unused plugin" warning when omitted from a project's plugins array.

  • #8349 af31a41 Thanks @​schaable! - Improved hardhat verify to fail faster when the block explorer reports that the constructor arguments are incorrect.

    Thanks to @​gultekinmakif for the original idea and implementation in #8333.

... (truncated)

Changelog

Sourced from @​nomicfoundation/hardhat-verify's changelog.

3.1.0

Minor Changes

  • #8510 7c85703 Thanks @​nikitosing! - Added support for an optional apiKey in the verify.blockscout config. This is required by Blockscout instances that don't expose a keyless API, like the Pro API.

Patch Changes

  • #8577 27a145d Thanks @​kanej! - Report a directory with no importable entry point as a module-not-found error, instead of the generic "importing the module failed".

3.0.22

Patch Changes

3.0.21

Patch Changes

  • #8367 82d00fc Thanks @​alcuadrado! - Lazy load dependencies to optimize bootstrap time

  • Updated dependencies:

    • @​nomicfoundation/hardhat-errors@​3.0.16
    • @​nomicfoundation/hardhat-utils@​4.1.4

3.0.20

Patch Changes

  • #8374 c67a5bb Thanks @​gultekinmakif! - Running verify against local development networks (chain IDs 31337 and 1337) now fails with a clear NETWORK_NOT_SUPPORTED error.

3.0.19

Patch Changes

  • #8339 00720e8 Thanks @​alcuadrado! - The plugin now uses definePlugin from hardhat/plugins in its index.ts, so it participates in Hardhat's new "imported but unused plugin" warning when omitted from a project's plugins array.

  • #8349 af31a41 Thanks @​schaable! - Improved hardhat verify to fail faster when the block explorer reports that the constructor arguments are incorrect.

    Thanks to @​gultekinmakif for the original idea and implementation in #8333.

  • Updated dependencies:

    • hardhat@3.8.0
    • @​nomicfoundation/hardhat-errors@​3.0.15

3.0.18

Patch Changes

... (truncated)

Commits
  • 25c1aef Version Packages
  • 27a145d fix(hardhat-verify): treat a directory import as module not found
  • 0c1c607 Merge pull request #8510 from nikitosing/claude/blockscout-apikey-support-s609wm
  • a619567 remove implementation details from docs and changeset
  • d84ce51 chore: bump eslint 9.25.1 → 9.39.5
  • 7c85703 feat(hardhat-verify): support an optional apiKey for Blockscout
  • 9106af0 refactor: move error-handler to cli/error-handling/
  • 7cf7797 Version Packages
  • 6e1818e chore: bump cbor2 1 → 2 in hardhat-verify and ignition-core
  • ff73c0a chore: reformat repo with prettier 3.9.6
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​nomicfoundation/hardhat-verify since your current version.


@dependabot dependabot Bot added dependencies javascript Pull requests that update javascript code labels Aug 4, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 4, 2026 11:59
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Aug 4, 2026
@dependabot
dependabot Bot requested a review from amishpatel1994 August 4, 2026 11:59
@dependabot
dependabot Bot requested a review from chandnimehta09 August 4, 2026 11:59
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-50f0f947e7 branch 2 times, most recently from 9871176 to 7544d60 Compare August 17, 2026 13:11
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-50f0f947e7 branch from 7544d60 to e6c457d Compare August 21, 2026 08:35
…omicfoundation/hardhat-toolbox and @nomicfoundation/hardhat-verify

Bumps [undici](https://github.com/nodejs/undici) to 6.28.0 and updates ancestor dependencies [undici](https://github.com/nodejs/undici), [@openzeppelin/hardhat-upgrades](https://github.com/OpenZeppelin/openzeppelin-upgrades), [hardhat](https://github.com/NomicFoundation/hardhat/tree/HEAD/packages/hardhat), [@nomicfoundation/hardhat-toolbox](https://github.com/NomicFoundation/hardhat/tree/HEAD/packages/hardhat-toolbox) and [@nomicfoundation/hardhat-verify](https://github.com/NomicFoundation/hardhat/tree/HEAD/packages/hardhat-verify). These dependencies need to be updated together.


Updates `undici` from 6.27.0 to 6.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.27.0...v6.28.0)

Updates `@openzeppelin/hardhat-upgrades` from 3.2.0 to 4.1.0
- [Release notes](https://github.com/OpenZeppelin/openzeppelin-upgrades/releases)
- [Commits](https://github.com/OpenZeppelin/openzeppelin-upgrades/compare/@openzeppelin/hardhat-upgrades@3.2.0...@openzeppelin/hardhat-upgrades@4.1.0)

Updates `hardhat` from 2.22.6 to 3.15.0
- [Release notes](https://github.com/NomicFoundation/hardhat/releases)
- [Changelog](https://github.com/NomicFoundation/hardhat/blob/main/packages/hardhat/CHANGELOG.md)
- [Commits](https://github.com/NomicFoundation/hardhat/commits/hardhat@3.15.0/packages/hardhat)

Updates `@nomicfoundation/hardhat-toolbox` from 5.0.0 to 7.0.0
- [Release notes](https://github.com/NomicFoundation/hardhat/releases)
- [Changelog](https://github.com/NomicFoundation/hardhat/blob/@nomicfoundation/hardhat-toolbox@7.0.0/packages/hardhat-toolbox/CHANGELOG.md)
- [Commits](https://github.com/NomicFoundation/hardhat/commits/@nomicfoundation/hardhat-toolbox@7.0.0/packages/hardhat-toolbox)

Updates `@nomicfoundation/hardhat-verify` from 2.0.8 to 3.1.0
- [Release notes](https://github.com/NomicFoundation/hardhat/releases)
- [Changelog](https://github.com/NomicFoundation/hardhat/blob/main/packages/hardhat-verify/CHANGELOG.md)
- [Commits](https://github.com/NomicFoundation/hardhat/commits/@nomicfoundation/hardhat-verify@3.1.0/packages/hardhat-verify)

---
updated-dependencies:
- dependency-name: "@nomicfoundation/hardhat-toolbox"
  dependency-version: 7.0.0
  dependency-type: direct:development
- dependency-name: "@nomicfoundation/hardhat-verify"
  dependency-version: 3.0.22
  dependency-type: direct:development
- dependency-name: "@openzeppelin/hardhat-upgrades"
  dependency-version: 4.1.0
  dependency-type: direct:production
- dependency-name: hardhat
  dependency-version: 3.12.0
  dependency-type: direct:development
- dependency-name: undici
  dependency-version: 6.28.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-50f0f947e7 branch from e6c457d to 7dd3004 Compare September 3, 2026 10:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants