chore: fix audit:ci and harden dependency installs - #443
Merged
Conversation
The lockfile had not been refreshed since 2026-01-10, so a large number of transitive dependencies were pinned to versions that had since been patched upstream. Refreshing resolves 40 of the 81 advisories blocking audit:ci, including the only critical one (handlebars 4.7.8 -> 4.7.9, JavaScript injection via AST type confusion). No package.json changes: every version moved stays inside the semver ranges already declared, so this is purely a lockfile catch-up.
Both are pinned by parents that will never widen their range on the Hardhat 2 line, so a lockfile refresh cannot reach the fixes: hardhat-deploy pins axios ^0.21.1 in every release through 1.0.4; axios is only dropped in hardhat-deploy 2.x, which requires Hardhat 3. The override is scoped to hardhat-deploy so eth-gas-reporter keeps its already-patched axios 1.18.1, and uses a floating >=0.33.0 <1 range so future 0.x security backports arrive via a plain lockfile refresh rather than another pin bump. hardhat and @nomicfoundation/hardhat-verify both pin undici ^5.14.0 and share one hoisted copy; the fix needs hardhat-verify 3.x, which requires Hardhat 3. Overridden globally because scoping to one declarer leaves the other behind. Clears 29 of the 41 advisories blocking audit:ci. Rationale and the conditions for removing both overrides are recorded in audit-ci.jsonc.
…tries Removes five allowlist entries that no longer match anything now that axios and undici are patched (audit-ci reported them under "Consider not allowlisting"). Adds the twelve remaining advisories, all in dev tooling that cannot reach an executed code path here. Each group records the specific condition that makes it safe -- mocha not running in parallel, no WebSocketProvider anywhere, hardhat calling only uuid v4, adm-zip used solely on checksum-verified solc downloads -- so the entry can be re-checked rather than taken on trust, and must be deleted rather than re-justified if the condition stops holding. Entries are per-advisory, not per-module, so a future advisory in any of these packages still fails the build.
The six dependency installs ran as bare `yarn`/`yarn install`, which lets yarn 1 rewrite yarn.lock to satisfy package.json instead of failing. That silently papers over a lockfile/manifest mismatch and loses the guarantee that CI tested the tree that was committed and reviewed. Also pins the six OffchainLabs/actions references from the mutable @main branch to a commit hash. These run with a token that has write access, so a mutable ref means anyone able to push to that branch can execute code in this repository's pipeline.
The refreshed lockfile pulls two packages that refuse to install on node 18: @nomicfoundation/edr (engines >= 20, via hardhat 2.29.0) and brace-expansion 5.0.8 (engines "20 || >=22", via @types/minimatch asking for minimatch at "*"). Every job died at yarn install as a result. Holding those back is not viable -- the dependency bumps in that refresh are what clear the advisories audit:ci is meant to catch, so the refresh and the audit fix are the same change. Node 24 is the active LTS (supported to 2028-04-30); node 18 and 20 are both already end-of-life. setup-node v3 is deprecated and was being force-migrated to the node 24 runtime anyway, so bump it on the same lines.
eljobe
approved these changes
Jul 30, 2026
TucksonDev
approved these changes
Jul 30, 2026
TucksonDev
left a comment
TucksonDev
left a comment
Contributor
There was a problem hiding this comment.
LGTM, one minor flag (probably no need to change)
| }, | ||
| "resolutions": { | ||
| "hardhat-deploy/axios": ">=0.33.0 <1", | ||
| "undici": "^6.27.0" |
Contributor
There was a problem hiding this comment.
undici comes from hardhat-verify, which uses ^v5.14, and here we force ^v6. It should be fine, since it looks like it's only used for stable request/fetch APIs, but something to keep in mind.
Collaborator
Author
There was a problem hiding this comment.
yeh, ci is passing so it should be fine
This was referenced Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes
audit:cipass.yarn.lockwithin existing version ranges.resolutions:hardhat-deploy/axiosto>=0.33.0 <1(scoped, soeth-gas-reporterkeeps its own axios; floating so future 0.x backports land on a refresh), andundicito^6.27.0(global, ashardhatandhardhat-verifyshare one hoisted copy).audit-ci.jsoncallowlist: removed entries that no longer match anything, and added new ones.setup-nodeto v4, audit matrix to[24]: the package lock refresh pulls@nomicfoundation/edr(engines >= 20, viahardhat2.29.0) andbrace-expansion5.0.8 (engines "20 || >=22", via@types/minimatch→minimatch@*), and yarn treats anenginesmismatch as a hard error, so every job died atyarn install. 18 and 20 are both EOL, 24 is the active LTS, andsetup-node@v3was already being force-migrated to the node 24 runtime.Closes #441, #442, #433.