deps(npm-dependencies): update npm dependencies by renovate[bot] · Pull Request #278 · cowprotocol/contracts

renovate · 2026-09-01T01:21:12Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@0x/contract-artifacts-v2 (source)	`^2.2.2` → `^3.0.0`
@nomicfoundation/hardhat-verify (source)	`^2.0.1` → `^3.0.0`
@nomiclabs/hardhat-waffle	`2.0.5` → `2.0.6`
@safe-global/api-kit	`^1.3.0` → `^5.0.0`
@safe-global/protocol-kit	`^1.2.0` → `^8.0.0`
@safe-global/safe-core-sdk-types	`^2.2.0` → `^5.0.0`
@slack/web-api (source)	`^6.9.0` → `^8.0.0`
@tenderly/hardhat-tenderly (source)	`~1.1.6` → `~2.6.0`
@types/chai (source)	`^4.3.4` → `^5.0.0`
@types/chai-as-promised (source)	`^7.1.5` → `^8.0.0`
@types/debug (source)	`4.1.7` → `4.1.13`
@types/mocha (source)	`10.0.1` → `10.0.10`
@types/node (source)	`^18.15.11` → `^26.0.0`
@types/sinon (source)	`^10.0.13` → `^22.0.0`
@types/yargs (source)	`17.0.24` → `17.0.35`
@typescript-eslint/eslint-plugin (source)	`^5.58.0` → `^8.0.0`
@typescript-eslint/parser (source)	`^5.58.0` → `^8.0.0`
chai (source)	`^4.3.7` → `^6.0.0`
chai-as-promised	`^7.1.1` → `^8.0.0`
chalk	`^4.1.2` → `^6.0.0`
debug	`4.3.4` → `4.4.3`
dotenv	`^16.0.3` → `^17.0.0`
eslint (source)	`^8.38.0` → `^10.0.0`
eslint-config-prettier	`^8.8.0` → `^10.0.0`
eslint-plugin-import	`2.27.5` → `2.32.0`
eslint-plugin-no-only-tests	`3.1.0` → `3.4.0`
eslint-plugin-prettier	`^4.2.1` → `^5.0.0`
ethereum-waffle	`^3.4.4` → `^4.0.0`
ethers (source)	`^5.4.0` → `^5.4.0 \|\| ^6.0.0`
ethers (source)	`^5.7.2` → `^6.0.0`
globby	`^11.0.4` → `^16.0.0`
hardhat (source)	`^2.13.1` → `^3.0.0`
hardhat-deploy (source)	`^0.11.26` → `^2.0.0`
hardhat-gas-reporter	`^1.0.9` → `^2.0.0`
prettier (source)	`^2.8.7` → `^3.0.0`
prettier-plugin-solidity	`^1.1.3` → `^2.0.0`
sinon (source)	`^15.0.3` → `^22.0.0`
solhint (source)	`^5.0.0` → `^6.0.0`
solhint-plugin-prettier	`^0.0.5` → `^0.1.0`
solidity-coverage	`0.8.2` → `0.8.17`
ts-node (source)	`10.9.1` → `10.9.2`
typescript (source)	`^5.0.4` → `^7.0.0`
yargs (source)	`^17.7.1` → `^18.0.0`

Release Notes

0xProject/protocol (@0x/contract-artifacts-v2)

NomicFoundation/hardhat (@nomicfoundation/hardhat-verify)

`v3.0.22`

Compare Source

Patch Changes

#8470 6e1818e Thanks @kanej! - Update the cbor2 runtime dependency to its latest major version.

`v3.0.21`

Compare Source

Patch Changes

#8367 82d00fc Thanks @alcuadrado! - Lazy load dependencies to optimize bootstrap time
Updated dependencies:
- @nomicfoundation/hardhat-errors@3.0.16
- @nomicfoundation/hardhat-utils@4.1.4

`v3.0.20`

Compare Source

Patch Changes

#8374 c67a5bb Thanks @gultekinmakif! - Running verify against local development networks (chain IDs 31337 and 1337) now fails with a clear NETWORK_NOT_SUPPORTED error.

`v3.0.19`

Compare Source

Patch Changes

#8339 00720e8 Thanks @alcuadrado! - The plugin now uses definePlugin from hardhat/plugins in its index.ts, so it participates in Hardhat's new "imported but unused plugin" warning when omitted from a project's plugins array.
#8349 af31a41 Thanks @schaable! - Improved hardhat verify to fail faster when the block explorer reports that the constructor arguments are incorrect.

Thanks to @gultekinmakif for the original idea and implementation in #8333.
Updated dependencies:
- hardhat@3.8.0
- @nomicfoundation/hardhat-errors@3.0.15

`v3.0.18`

Compare Source

Patch Changes

#8264 8452f97 Thanks @alcuadrado! - Export ./package.json so consumers can import the package's manifest.
Updated dependencies:
- @nomicfoundation/hardhat-errors@3.0.13
- @nomicfoundation/hardhat-utils@4.1.2
- @nomicfoundation/hardhat-zod-utils@3.0.5

`v3.0.17`

Compare Source

Patch Changes

#8191 2a4ae8e Thanks @alcuadrado! - Update how type extensions are handled to optimize the bootstrap process of Hardhat.
Updated dependencies:
- @nomicfoundation/hardhat-utils@4.1.1

`v3.0.16`

Compare Source

Patch Changes

#8219 2cad309 Thanks @schaable! - Improved performance by replacing the semver dependency with a lightweight in-tree implementation.
#8195 79205cc Thanks @ChristopherDedominici! - Replace chalk with util.styleText.
#8207 d594209 Thanks @alcuadrado! - Improved performance by replacing the debug logging library with a lightweight in-tree implementation.
Updated dependencies:
- @nomicfoundation/hardhat-utils@4.1.0
- @nomicfoundation/hardhat-errors@3.0.12

`v3.0.15`

Compare Source

Patch Changes

#8179 d16d82a Thanks @alcuadrado! - Await all returned promises for better debuggability
Updated dependencies:
- @nomicfoundation/hardhat-utils@4.0.4

`v3.0.14`

Compare Source

Patch Changes

#8148 49ec5d0 Thanks @alcuadrado! - Don't report HardhatErrors that aren't bugs
#8096 7fb721b Thanks @alcuadrado! - [chore] Move to packages/ folder.
#8116 88787e1 Thanks @kanej! - Deprecate the hre.network.connect() method in favour of hre.network.create(), exactly the same method but more clearly indicating that it will create a new connection.
Updated dependencies:
- hardhat@3.4.0
- @nomicfoundation/hardhat-errors@3.0.11
- @nomicfoundation/hardhat-utils@4.0.3
- @nomicfoundation/hardhat-zod-utils@3.0.4

`v3.0.13`

Compare Source

Patch Changes

#8088 23c0d36 Thanks @alcuadrado! - Optimize imports.
Updated dependencies:
- @nomicfoundation/hardhat-utils@4.0.2
- @nomicfoundation/hardhat-errors@3.0.10

`v3.0.12`

Compare Source

Patch Changes

2cbf218: Make SolidityBuildSystem easier to work with (#7988)

`v3.0.11`

Compare Source

Patch Changes

6674b00: Bump hardhat-utils major

`v3.0.10`

Compare Source

Patch Changes

577e516: Expose an Etherscan instance through the verification property on network.connect() for advanced use cases. This version also adds a customApiCall method to the Etherscan instance, allowing custom requests to the Etherscan API (#7644)

`v3.0.9`

Compare Source

Patch Changes

13a1e4b: Multiple internal fixes to the solidity build system (#7900)

`v3.0.8`

Compare Source

Patch Changes

0635271: Fix Etherscan verification retry with full compiler input, thanks @SyedAsadKazmi! (#7577)

`v3.0.7`

Compare Source

Patch Changes

29acf32: Added fallback for chains not included in chain descriptors (#7657)

`v3.0.6`

Compare Source

Patch Changes

6307578: Added support for verifying contracts via Sourcify, thanks @manuelwedler (#6885).

`v3.0.5`

Compare Source

Patch Changes

d45234d: Fixed Etherscan verification failures by removing hardcoded v1 API URLs from chain descriptors (#7623). Also enhanced config resolution to support partial overrides in block explorer configurations for future extensibility.
558ac5b: Update installation and config instructions

`v3.0.4`

Compare Source

Patch Changes

cbcb5ce: Fixed hardhat-verify by using apiUrl from etherscanConfig for verification (#7509)

`v3.0.3`

Compare Source

Patch Changes

d25eec4: Fixed a bug that prevented verification of contracts imported from npm modules (#7442)

`v3.0.2`

Compare Source

Patch Changes

a475780: Added automatic proxy detection for hardhat-verify and fixed case-insensitive proxy environment variables for network requests (#7407)

`v3.0.1`

Compare Source

Patch Changes

#8148 49ec5d0 Thanks @alcuadrado! - Don't report HardhatErrors that aren't bugs
#8096 7fb721b Thanks @alcuadrado! - [chore] Move to packages/ folder.
#8116 88787e1 Thanks @kanej! - Deprecate the hre.network.connect() method in favour of hre.network.create(), exactly the same method but more clearly indicating that it will create a new connection.
Updated dependencies:
- hardhat@3.4.0
- @nomicfoundation/hardhat-errors@3.0.11
- @nomicfoundation/hardhat-utils@4.0.3
- @nomicfoundation/hardhat-zod-utils@3.0.4

`v3.0.0`

Compare Source

Major Changes

29cc141: First release of Hardhat 3!

`v2.1.3`

Compare Source

`v2.1.2`

Compare Source

This release is a small bug fix for Sourcify verification.

Changes

2dccd4e: Pass all sources in the contract metadata for verification in Sourcify. Thanks @natanasow! (#7070)
9d10226: Links in the code and READMEs updated to point to the Hardhat 2 documentation and resources

💡 The Nomic Foundation is hiring! Check our open positions.

`v2.1.1`

Compare Source

Patch Changes

[11ee260

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-09-01T01:22:00Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Quality	Maintenance	License
	@safe-global/safe-core-sdk-types@2.2.0 ⏵ 5.1.0	⁺²	⁺¹²
	@typescript-eslint/parser@5.58.0 ⏵ 8.69.0		⁺²
	solhint-plugin-prettier@0.0.5 ⏵ 0.1.0
	@types/chai-as-promised@7.1.5 ⏵ 8.0.2	⁺¹
	@types/yargs@17.0.24 ⏵ 17.0.35	⁺¹
	@types/sinon@10.0.13 ⏵ 22.0.0			⁺⁷
	@types/chai@4.3.4 ⏵ 5.2.3
	@types/mocha@10.0.1 ⏵ 10.0.10
	@nomiclabs/hardhat-waffle@2.0.5 ⏵ 2.0.6		⁺¹
	hardhat-gas-reporter@1.0.9 ⏵ 2.3.0	^-1	⁺¹
	@typescript-eslint/eslint-plugin@5.58.0 ⏵ 8.69.0		⁺²
	ethereum-waffle@3.4.4 ⏵ 4.0.10
	@tenderly/hardhat-tenderly@1.1.6 ⏵ 2.6.0	^-7	⁺¹	⁺³	⁺³¹
	@types/debug@4.1.7 ⏵ 4.1.13		^-2
	@types/node@8.10.66 ⏵ 26.4.0		⁺³
	@0x/contract-artifacts@2.2.2 ⏵ 3.19.0	⁺²	⁺⁴	⁺¹
	ts-node@10.9.1 ⏵ 10.9.2
	hardhat@2.13.1 ⏵ 3.15.0	⁺⁸	^-6		⁺²⁰
	chai-as-promised@7.1.1 ⏵ 8.0.2	⁺¹	⁺¹
	chai@4.3.7 ⏵ 6.2.2	⁺¹		^-2
	eslint-plugin-no-only-tests@3.1.0 ⏵ 3.4.0		⁺¹⁰
	eslint-config-prettier@8.8.0 ⏵ 10.1.8	⁺¹	⁺²⁹	^-3
	eslint-plugin-import@2.27.5 ⏵ 2.32.0	⁺¹¹
	solidity-coverage@0.8.2 ⏵ 0.8.17		⁺¹
	chalk@1.1.3 ⏵ 6.0.0	⁺¹	⁺¹
	ethers@5.7.2 ⏵ 5.8.0	⁺¹	⁺¹
	dotenv@16.0.3 ⏵ 17.4.2		⁺¹
	yargs@17.7.1 ⏵ 18.1.0	⁺¹	⁺¹	^-1
	@safe-global/api-kit@1.3.0 ⏵ 5.0.3	⁺¹	^-12	⁺⁴
	typescript@5.0.4 ⏵ 7.0.2		^-1	⁺⁵	⁺¹⁰
	globby@11.0.4 ⏵ 16.2.4		⁺¹	⁺⁷
	eslint-plugin-prettier@4.2.1 ⏵ 5.5.6	⁺¹
See 9 more rows in the dashboard

View full report

socket-security · 2026-09-01T01:22:02Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@noble/hashes` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: yarn.lock → `npm/solidity-coverage@0.8.17` → `npm/@safe-global/protocol-kit@8.0.6` → `npm/@safe-global/api-kit@5.0.3` → `npm/hardhat-gas-reporter@2.3.0` → `npm/@noble/hashes@1.8.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@noble/hashes@1.8.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@noble/hashes` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: yarn.lock → `npm/solidity-coverage@0.8.17` → `npm/@safe-global/protocol-kit@8.0.6` → `npm/@safe-global/api-kit@5.0.3` → `npm/hardhat-gas-reporter@2.3.0` → `npm/@noble/hashes@1.8.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@noble/hashes@1.8.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `encoding-down` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: yarn.lock → `npm/ethereum-waffle@4.0.10` → `npm/encoding-down@6.3.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/encoding-down@6.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

renovate · 2026-09-01T11:01:05Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

igorroncevic · 2026-09-01T11:01:28Z

Closing, as we will not update major version of dev or NPM packages. New PR to enforce that rule is coming.

renovate Bot requested a review from a team as a code owner September 1, 2026 01:21

deps(npm-dependencies): update npm dependencies

622d528

renovate Bot force-pushed the renovate/npm-dependencies branch from 0cfe0b9 to 622d528 Compare September 1, 2026 10:58

Merge branch 'main' into renovate/npm-dependencies

4d05039

igorroncevic closed this Sep 1, 2026

github-actions Bot locked and limited conversation to collaborators Sep 1, 2026

Navigation Menu

Uh oh!

deps(npm-dependencies): update npm dependencies - #278

deps(npm-dependencies): update npm dependencies#278
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/npm-dependencies

renovate Bot commented Sep 1, 2026

Uh oh!

socket-security Bot commented Sep 1, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 1, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Sep 1, 2026

Uh oh!

igorroncevic commented Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Sep 1, 2026

Release Notes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Major Changes

Changes

Patch Changes

Configuration

Uh oh!

socket-security Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

renovate Bot commented Sep 1, 2026

Edited/Blocked Notification

Uh oh!

igorroncevic commented Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

socket-security Bot commented Sep 1, 2026 •

edited

Loading

socket-security Bot commented Sep 1, 2026 •

edited

Loading