Skip to content

Bump undici, @nomicfoundation/hardhat-foundry, @nomicfoundation/hardhat-toolbox, @openzeppelin/hardhat-upgrades and hardhat in /contracts - #30

Open
dependabot[bot] wants to merge 1 commit into
release/firehosefrom
dependabot/npm_and_yarn/contracts/multi-8a04f51ec6
Open

Bump undici, @nomicfoundation/hardhat-foundry, @nomicfoundation/hardhat-toolbox, @openzeppelin/hardhat-upgrades and hardhat in /contracts#30
dependabot[bot] wants to merge 1 commit into
release/firehosefrom
dependabot/npm_and_yarn/contracts/multi-8a04f51ec6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown

Bumps undici to 7.29.0 and updates ancestor dependencies undici, @nomicfoundation/hardhat-foundry, @nomicfoundation/hardhat-toolbox, @openzeppelin/hardhat-upgrades and hardhat. These dependencies need to be updated together.

Updates undici from 7.10.0 to 7.29.0

Release notes

Sourced from undici's releases.

v7.29.0

⚠️ Security fixes

High severity

  • GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
  • GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.

Action required: Upgrade to undici 7.28.0 or later.

npm install undici@^7.28.0

The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 7.28.0 8cb10f98
GHSA-vmh5-mc38-953g CVE-2026-9697 High (7.4) 7.28.0 04201f89
GHSA-hm92-r4w5-c3mj CVE-2026-6734 High (7.5) 7.28.0 3805b8f8
GHSA-pr7r-676h-xcf6 CVE-2026-9678 Moderate (5.9) 7.28.0 85a24055
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 7.28.0 d0574cc4
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 7.28.0 d0574cc4
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 7.28.0 ea8930cf

... (truncated)

Commits
  • 9e38fc1 Bumped v7.29.0 (#5590)
  • d887e34 fix: validate coerced header values for CRLF (#5579)
  • 33928bc fix: validate blob body content type
  • 98011a8 fix(cache): harden cache directive parsing
  • 4a9dafb test(retry): correct broken content-range fixtures in retry-handler.js
  • 1b5a531 fix(retry): reject partial content length mismatch
  • 466e99d test: cover crash on mixed unqualified and qualified private cache directives
  • 9f10f1e fix: handle empty qualified private cache directive
  • 3bf91dd fix: harden cookie domain, path, and unparsed attribute validation
  • f9eba0a Bumped v7.28.0 (#5430)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.


Updates @nomicfoundation/hardhat-foundry from 1.1.4 to 3.0.4

Release notes

Sourced from @​nomicfoundation/hardhat-foundry's releases.

@​nomicfoundation/hardhat-foundry@​3.0.4

Changes

  • #8339 00720e8 Thanks @​alcuadrado! - The plugin now uses definePlugin from hardhat/plugins in its index.ts, so it participates in Hardhat's new "imported but unused plugin" warning when omitted from a project's plugins array.

  • Updated dependencies:

    • hardhat@3.8.0
    • @​nomicfoundation/hardhat-errors@​3.0.15

💡 The Nomic Foundation is hiring! Check our open positions.


@​nomicfoundation/hardhat-foundry@​3.0.3

Changes

  • #8264 8452f97 Thanks @​alcuadrado! - Export ./package.json so consumers can import the package's manifest.

  • Updated dependencies:

    • @​nomicfoundation/hardhat-errors@​3.0.13
    • @​nomicfoundation/hardhat-utils@​4.1.2

💡 The Nomic Foundation is hiring! Check our open positions.


Changelog

Sourced from @​nomicfoundation/hardhat-foundry's changelog.

3.0.4

Patch Changes

  • #8339 00720e8 Thanks @​alcuadrado! - The plugin now uses definePlugin from hardhat/plugins in its index.ts, so it participates in Hardhat's new "imported but unused plugin" warning when omitted from a project's plugins array.

  • Updated dependencies:

    • hardhat@3.8.0
    • @​nomicfoundation/hardhat-errors@​3.0.15

3.0.3

Patch Changes

  • #8264 8452f97 Thanks @​alcuadrado! - Export ./package.json so consumers can import the package's manifest.

  • Updated dependencies:

    • @​nomicfoundation/hardhat-errors@​3.0.13
    • @​nomicfoundation/hardhat-utils@​4.1.2

3.0.2

Patch Changes

  • #8179 d16d82a Thanks @​alcuadrado! - Await all returned promises for better debuggability

  • Updated dependencies:

    • @​nomicfoundation/hardhat-utils@​4.0.4

3.0.1

Patch Changes

  • #8096 7fb721b Thanks @​alcuadrado! - [chore] Move to packages/ folder.

  • Updated dependencies:

    • @​nomicfoundation/hardhat-errors@​3.0.11
    • @​nomicfoundation/hardhat-utils@​4.0.3

3.0.0

Major Changes

  • 4cd63e9: Introduce the @nomicfoundation/hardhat-foundry plugin for Hardhat 3
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​nomicfoundation/hardhat-foundry since your current version.


Updates @nomicfoundation/hardhat-toolbox from 4.0.0 to 7.0.0

Release notes

Sourced from @​nomicfoundation/hardhat-toolbox's releases.

@​nomicfoundation/hardhat-toolbox-viem@​5.0.7

Changes

  • #8339 00720e8 Thanks @​alcuadrado! - The plugin now uses definePlugin from hardhat/plugins in its index.ts, so it participates in Hardhat's new "imported but unused plugin" warning when omitted from a project's plugins array.

  • Updated dependencies:

    • hardhat@3.8.0

💡 The Nomic Foundation is hiring! Check our open positions.


@​nomicfoundation/hardhat-toolbox-viem@​5.0.6

Changes


💡 The Nomic Foundation is hiring! Check our open positions.


@​nomicfoundation/hardhat-toolbox-viem@​5.0.5

Changes


💡 The Nomic Foundation is hiring! Check our open positions.


Changelog

Sourced from @​nomicfoundation/hardhat-toolbox's changelog.

7.0.0

Major Changes

  • 09ae6db: Deprecate the latest npm tag and redirect users to migrate to Hardhat 3 or to the hh2 tag.
Commits
  • 6372d08 Version Packages
  • a26e822 Remove the npm tags from the README.md files
  • 18bef56 Quote the package in the installation instructions of the readmes
  • e5025ae Update the formatting and quote the package in the installation instructions ...
  • ee34347 Update hardhat-toolbox
  • 7ade974 Version Packages
  • a7e4215 feat: bump minimum version of solidity-coverage to Osaka
  • e4ad0ad chore: update package metadata for provenance
  • f65ee74 Version Packages
  • a4f1e27 Hardhat 2 documentation links updated to reflect the domain change to v2.hard...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​nomicfoundation/hardhat-toolbox since your current version.


Updates @openzeppelin/hardhat-upgrades from 3.9.0 to 4.1.0

Release notes

Sourced from @​openzeppelin/hardhat-upgrades's releases.

@​openzeppelin/hardhat-upgrades@​4.1.0

  • Add a viem-based API at @openzeppelin/hardhat-upgrades/viem, following @nomicfoundation/hardhat-viem conventions: contracts are identified by name, addresses are typed as `0x${string}`, and the returned contract instances are viem contract instances. (#1279)
    • To use the viem-based API, install viem and @nomicfoundation/hardhat-viem, then import both the plugin (for your Hardhat config's plugins array) and the API (for your scripts) from @openzeppelin/hardhat-upgrades/viem. It supports wallet clients backed by local accounts, such as viem's privateKeyToAccount. The proxyFilesToBuild helper for Solidity tests is also exported from this entry point, so viem-only projects can configure npmFilesToBuild without importing the ethers-typed root entry.
    • The ethers-based API is unchanged. Import its plugin and API from @openzeppelin/hardhat-upgrades as before, or from the new @openzeppelin/hardhat-upgrades/ethers alias.
    • Potentially breaking changes: ethers and @nomicfoundation/hardhat-ethers are now optional peer dependencies, required only by the ethers-based API; viem-only projects no longer need them. If you use the ethers-based API, install them explicitly with npm install --save-dev @nomicfoundation/hardhat-ethers ethers. Previously they were required peer dependencies that package managers installed automatically.

@​openzeppelin/hardhat-upgrades@​4.0.2

  • Re-export @nomicfoundation/hardhat-ethers types so that TypeScript recognizes connection.ethers when only this plugin is registered. (#1275)

@​openzeppelin/hardhat-upgrades@​4.0.1

  • Update dependencies. (#1255)

@​openzeppelin/hardhat-upgrades@​4.0.0

  • Migrate to Hardhat 3 with ESM module structure and plugin hooks architecture. (#1241)

    Breaking Changes

    • Requires Hardhat 3: minimum hardhat@^3.6.0 required.
    • ESM-only: package converted to ESM; CommonJS is no longer supported.
    • API Changes:
      • No automatic hre.upgrades — call the upgrades(hre, connection) factory explicitly.
      • Factory functions (upgrades, defender) are async and require a network connection.
      • Network connection must be explicitly created: const connection = await hre.network.create(). Share one connection across operations.
      • ethers now comes from the connection (const { ethers } = connection), not hre.ethers.
    • Import Changes: import factory functions instead of a side-effect import.
      • Before: import '@openzeppelin/hardhat-upgrades'
      • After: import { upgrades, defender } from '@openzeppelin/hardhat-upgrades'

    Usage and Migration

    See the README for Hardhat 3 usage, the examples directory for sample projects, and the Migration Guide for Hardhat 2 to 3 migration steps.

    Changes

    • Migrated from extendEnvironment to Hardhat 3's HardhatPlugin with hookHandlers.
    • Converted package to ESM.
    • Etherscan verification requires @nomicfoundation/hardhat-verify@^3.0.10 (optional peer dependency).
    • Support Solidity tests in Hardhat 3 with @openzeppelin/foundry-upgrades.
    • Added example projects for Hardhat 3 (Transparent, UUPS, and Solidity-test scaffolds under packages/plugin-hardhat/examples/).
  • Updated dependencies [7f3e4c6, 668f70c]:

    • @​openzeppelin/upgrades-core@​1.45.0

@​openzeppelin/hardhat-upgrades@​4.0.0-alpha.0

Note ⚠️ This version is still in testing. Do not use it to deploy or upgrade production deployments.

  • Migrate to Hardhat 3 with ESM module structure and plugin hooks architecture. (#1194)

    Breaking Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​openzeppelin/hardhat-upgrades since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates hardhat from 2.25.0 to 3.12.0

Release notes

Sourced from hardhat's releases.

Hardhat v3.12.0

This release includes two new features: negative test filtering with the --grep-exclude flag for both Solidity tests and Mocha test suite, and experimental Amsterdam "EIP-7843: SLOTNUM" support, see our Amsterdam support guide.

Changes

  • #8442 4904c72 Thanks @​ChristopherDedominici! - Support test name filter negation (--grep-exclude) for Solidity and Mocha tests.

  • #8472 2a66c2e Added experimental EIP-7843 support to the Amsterdam hardfork: blocks now include the slotNumber header field, and the SLOTNUM (0x4b) opcode returns it. EDR has no consensus layer, so the value is simulated: it increments by one per mined block, starting at 0 on a new chain, or from the forked block's slot number when forking.

  • #8464 b2b69f7 Thanks @​nishant-uxs! - Prefer environment variables over configurationVariables hooks when resolving config vars.

  • #8474 49cc2f0 Thanks @​Wodann! - Report chain type to Google Analytics

  • #8458 0c60e08 Thanks @​schaable! - Fixed project initialization so that compilation and build output directories are never copied from a template into a new project.

  • #8472 2a66c2e Thanks @​kanej! - Fixed empty stack traces on Solidity test failures when running with -vvv or above.

  • #8472 2a66c2e Thanks @​kanej! - Fixed missing stack traces when an invariant already fails on its initial check, when running with -vvv or above.

  • #8470 341807c Thanks @​kanej! - Update the chokidar runtime dependency to its latest major version.

  • #8470 4a71543 Thanks @​kanej! - Update the p-map dependency.

  • #8461 841423a Thanks @​kanej! - Reduce installation warnings with updated dependencies.


💡 The Nomic Foundation is hiring! Check our open positions.


Hardhat v3.11.1

This release removes the Hardhat 2 option from project initialization and fixes how Solidity files are classified when the same directory is configured for both sources and tests.

Changes

  • #8451 5c9d4a4 Thanks @​kanej! - Remove Hardhat 2 option from init process

  • #8452 724b7cd Thanks @​kanej! - Fixed Solidity source classification so that a directory listed in both paths.sources.solidity and paths.tests.solidity is treated as a source.

  • Updated dependencies:

    • @​nomicfoundation/hardhat-utils@​4.1.6

💡 The Nomic Foundation is hiring! Check our open positions.


Hardhat v3.11.0

This release adds two further EIPs to Hardhat's experimental Amsterdam support: EIP-7778: block gas accounting without refunds and EIP-7928: Block-Level Access Lists. See our Amsterdam support reference for full details of how these work within Hardhat.

Changes

... (truncated)

Changelog

Sourced from hardhat's changelog.

3.12.0

Minor Changes

  • #8442 4904c72 Thanks @​ChristopherDedominici! - Support test name filter negation (--grep-exclude) for Solidity and Mocha tests.

  • #8472 2a66c2e Thanks @​kanej! - Added experimental EIP-7843 support to the Amsterdam hardfork: blocks now include the slotNumber header field, and the SLOTNUM (0x4b) opcode returns it. EDR has no consensus layer, so the value is simulated: it increments by one per mined block, starting at 0 on a new chain, or from the forked block's slot number when forking.

Patch Changes

  • #8464 b2b69f7 Thanks @​nishant-uxs! - Prefer environment variables over configurationVariables hooks when resolving config vars.

  • #8474 49cc2f0 Thanks @​Wodann! - Report chain type to Google Analytics

  • #8458 0c60e08 Thanks @​schaable! - Fixed project initialization so that compilation and build output directories are never copied from a template into a new project.

  • #8472 2a66c2e Thanks @​kanej! - Fixed empty stack traces on Solidity test failures when running with -vvv or above.

  • #8472 2a66c2e Thanks @​kanej! - Fixed missing stack traces when an invariant already fails on its initial check, when running with -vvv or above.

  • #8470 341807c Thanks @​kanej! - Update the chokidar runtime dependency to its latest major version.

  • #8470 4a71543 Thanks @​kanej! - Update the p-map dependency.

  • #8461 841423a Thanks @​kanej! - Reduce installation warnings with updated dependencies.

3.11.1

Patch Changes

  • #8451 5c9d4a4 Thanks @​kanej! - Remove Hardhat 2 option from init process

  • #8452 724b7cd Thanks @​kanej! - Fixed Solidity source classification so that a directory listed in both paths.sources.solidity and paths.tests.solidity is treated as a source.

  • Updated dependencies:

    • @​nomicfoundation/hardhat-utils@​4.1.6

3.11.0

Minor Changes

  • #8447 dff401d Thanks @​kanej! - Added experimental EIP-7778 support to the Amsterdam hardfork: a block's gasUsed excludes gas refunds; transaction receipts are unchanged.

  • #8447 dff401d Thanks @​kanej! - Added experimental EIP-7928 support to the Amsterdam hardfork: blocks on Amsterdam now include the blockAccessListHash header field. The value is simulated, not the real keccak256(rlp(blockAccessList)).

Patch Changes

3.10.0

... (truncated)

Commits
  • 7cf7797 Version Packages
  • 633ddb2 Merge pull request #8479 from NomicFoundation/fix-for-grep-exclude-args
  • a778da5 fix: only forward grep options to subtasks that declare them
  • 414df77 Merge pull request #8474 from NomicFoundation/feat/chain-type-analytics
  • 94a2189 Update packages/hardhat/src/internal/builtin-plugins/solidity-test/helpers.ts
  • e7181d3 refactor: move supporting function bellow the main function
  • 144c56a add grep-exclude in gas analytics
  • cd60672 remove unused imports
  • 103aed0 remove useless test
  • f898044 add logic for throw with node test runner
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hardhat since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…at-toolbox, @openzeppelin/hardhat-upgrades and hardhat

Bumps [undici](https://github.com/nodejs/undici) to 7.29.0 and updates ancestor dependencies [undici](https://github.com/nodejs/undici), [@nomicfoundation/hardhat-foundry](https://github.com/NomicFoundation/hardhat/tree/HEAD/packages/hardhat-foundry), [@nomicfoundation/hardhat-toolbox](https://github.com/NomicFoundation/hardhat/tree/HEAD/packages/hardhat-toolbox), [@openzeppelin/hardhat-upgrades](https://github.com/OpenZeppelin/openzeppelin-upgrades) and [hardhat](https://github.com/NomicFoundation/hardhat/tree/HEAD/packages/hardhat). These dependencies need to be updated together.


Updates `undici` from 7.10.0 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.10.0...v7.29.0)

Updates `@nomicfoundation/hardhat-foundry` from 1.1.4 to 3.0.4
- [Release notes](https://github.com/NomicFoundation/hardhat/releases)
- [Changelog](https://github.com/NomicFoundation/hardhat/blob/main/packages/hardhat-foundry/CHANGELOG.md)
- [Commits](https://github.com/NomicFoundation/hardhat/commits/@nomicfoundation/hardhat-foundry@3.0.4/packages/hardhat-foundry)

Updates `@nomicfoundation/hardhat-toolbox` from 4.0.0 to 7.0.0
- [Release notes](https://github.com/NomicFoundation/hardhat/releases)
- [Changelog](https://github.com/NomicFoundation/hardhat/blob/@nomicfoundation/hardhat-toolbox@7.0.0/packages/hardhat-toolbox/CHANGELOG.md)
- [Commits](https://github.com/NomicFoundation/hardhat/commits/@nomicfoundation/hardhat-toolbox@7.0.0/packages/hardhat-toolbox)

Updates `@openzeppelin/hardhat-upgrades` from 3.9.0 to 4.1.0
- [Release notes](https://github.com/OpenZeppelin/openzeppelin-upgrades/releases)
- [Commits](https://github.com/OpenZeppelin/openzeppelin-upgrades/compare/@openzeppelin/hardhat-upgrades@3.9.0...@openzeppelin/hardhat-upgrades@4.1.0)

Updates `hardhat` from 2.25.0 to 3.12.0
- [Release notes](https://github.com/NomicFoundation/hardhat/releases)
- [Changelog](https://github.com/NomicFoundation/hardhat/blob/main/packages/hardhat/CHANGELOG.md)
- [Commits](https://github.com/NomicFoundation/hardhat/commits/hardhat@3.12.0/packages/hardhat)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.29.0
  dependency-type: indirect
- dependency-name: "@nomicfoundation/hardhat-foundry"
  dependency-version: 3.0.4
  dependency-type: direct:development
- dependency-name: "@nomicfoundation/hardhat-toolbox"
  dependency-version: 7.0.0
  dependency-type: direct:development
- dependency-name: "@openzeppelin/hardhat-upgrades"
  dependency-version: 4.1.0
  dependency-type: direct:development
- dependency-name: hardhat
  dependency-version: 3.12.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 3, 2026
@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

BuildFormatLintBreakingUpdated (UTC)
✅ passed✅ passed✅ passed✅ passedAug 3, 2026, 9:44 PM

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

BuildFormatLintBreakingUpdated (UTC)
✅ passed✅ passed✅ passed✅ passedAug 3, 2026, 9:44 PM

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

BuildFormatLintBreakingUpdated (UTC)
✅ passed✅ passed✅ passed✅ passedAug 3, 2026, 9:44 PM

@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

BuildFormatLintBreakingUpdated (UTC)
✅ passed✅ passed✅ passed✅ passedAug 3, 2026, 9:44 PM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants