Skip to content

chore(deps): update hardhat packages (major)#277

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/major-hardhat-packages
Open

chore(deps): update hardhat packages (major)#277
renovate[bot] wants to merge 1 commit intomainfrom
renovate/major-hardhat-packages

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Nov 4, 2025

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change OpenSSF
@nomicfoundation/hardhat-foundry (source) devDependencies major 1.2.03.0.2 OpenSSF Scorecard
@nomicfoundation/hardhat-ignition-viem (source) devDependencies major 0.15.163.1.3 OpenSSF Scorecard
@nomicfoundation/hardhat-toolbox-viem (source) devDependencies major 4.1.15.0.4 OpenSSF Scorecard
@nomiclabs/hardhat-solhint (source) devDependencies major 4.1.05.0.0 OpenSSF Scorecard
hardhat (source) devDependencies major 2.27.13.4.1 OpenSSF Scorecard

Release Notes

NomicFoundation/hardhat (@​nomicfoundation/hardhat-foundry)

v3.0.2

Compare Source

Patch Changes

v3.0.1

Compare Source

Patch Changes

v3.0.0

Compare Source

Major Changes
  • 4cd63e9: Introduce the @nomicfoundation/hardhat-foundry plugin for Hardhat 3

v1.2.1

Compare Source

NomicFoundation/hardhat (@​nomicfoundation/hardhat-ignition-viem)

v3.1.3

Compare Source

Patch Changes

v3.1.2

Compare Source

Patch Changes

v3.1.1

Compare Source

Patch Changes

v3.1.0

Compare Source

Minor Changes
Patch Changes

v3.0.9

Compare Source

Patch Changes

v3.0.8

Compare Source

Patch Changes
  • 6674b00: Bump hardhat-utils major

v3.0.7

Compare Source

Patch Changes
  • 2bc18b2: Bumped viem version across all packages 7861.

v3.0.6

Compare Source

Patch Changes
  • dac916b: Expose ignition retry loop variables in user config (Hardhat v3) (#​7303)

v3.0.5

Compare Source

Patch Changes
  • d1c1803: Make @nomicfoundation/hardhat-ignition's UI work well with other plugins, like Ledger's.

v3.0.4

Compare Source

Patch Changes
  • 843c1ae: Fixed a bug preventing Ignition from using the hre.config.ignition settings when deploying via script (#​7641)
  • 558ac5b: Update installation and config instructions

v3.0.3

Compare Source

Patch Changes

v3.0.2

Compare Source

Patch Changes
  • ddefbff: Added guard to stop multiple simultaneous calls to ignition.deploy(...) at once (#​6440)

v3.0.1

Compare Source

Patch Changes

v3.0.0

Compare Source

Major Changes
  • 29cc141: First release of Hardhat 3!
NomicFoundation/hardhat (@​nomicfoundation/hardhat-toolbox-viem)

v5.0.4

Compare Source

Patch Changes
  • #​8104 e27a7ad Thanks @​ChristopherDedominici! - Use code 3 for JSON-RPC revert error codes to align with standard node behavior and preserve error causes in viem/ethers.

  • #​8096 7fb721b Thanks @​alcuadrado! - [chore] Move to packages/ folder.

  • #​8116 88787e1 Thanks @​kanej! - Deprecate the hre.network.connect() method in favour of hre.network.create(), exactly the same method but more clearly indicating that it will create a new connection.

  • Updated dependencies:

    • hardhat@​3.4.0

v5.0.3

Compare Source

Patch Changes

v5.0.2

Compare Source

Patch Changes
  • 2bc18b2: Bumped viem version across all packages 7861.

v5.0.1

Compare Source

Patch Changes
  • 558ac5b: Update installation and config instructions

v5.0.0

Compare Source

Major Changes
  • 29cc141: First release of Hardhat 3!

v4.1.2

Compare Source

This release is a small bump to the version of solidity-coverage to include changes for the Osaka transaction gas limit.

Changes
  • a7e4215: Update solidity-coverage minimum version to include Osaka changes

💡 The Nomic Foundation is hiring! Check our open positions.


NomicFoundation/hardhat (@​nomiclabs/hardhat-solhint)

v5.0.0

Compare Source

v4.1.2

Compare Source

v4.1.1

Compare Source

NomicFoundation/hardhat (hardhat)

v3.4.1

Compare Source

Patch Changes

v3.4.0

Compare Source

Minor Changes
Patch Changes

v3.3.0

Compare Source

Minor Changes
Patch Changes

v3.2.0

Compare Source

Minor Changes
Patch Changes

v3.1.12

Compare Source

Patch Changes
  • 01b41ee: Added support for function gas snapshots and snapshot cheatcodes in Solidity tests with --snapshot and --snapshot-check flags (#​7769)
  • e37f96c: Add TestRunResult type that wraps TestSummary, allowing plugins to extend test results with additional data
  • bda5a0a: Bumped EDR version to 0.12.0-next.28

v3.1.11

Compare Source

Patch Changes
  • 2cbf218: Bumped EDR version to 0.12.0-next.27

    BREAKING CHANGE: Memory capture used to be enabled by default on geth, but has since been flipped ethereum/go-ethereum#23558 and is now disabled by default. We have followed suit and disabled it by default as well. If you were relying on memory capture, you will need to explicitly enable it by setting the enableMemory option to true in your tracer configuration.

  • bc193be: Use concrete value types for contract names in hardhat-viem and hardhat-ethers

  • 2cbf218: Make SolidityBuildSystem easier to work with (#​7988)

  • 19b691d: Fix typo in assertion message #​8028

  • 2cbf218: Expose Result type for task action success/failure signaling.

  • 2cbf218: Fixed the acceptance of relative paths to node_modules in npm remappings (#​8007)

  • 2cbf218: Implement a global banner logic in Hardhat 3 #​8021

  • 4ff11c1: Return typed Result from test runners and telemetry tasks (#​8015).

  • 2cbf218: Show fs paths and better error messages when a Solidity file can't be compiled with any configured compiler (#​7988)

  • 2cbf218: Add onTestRunStart, onTestWorkerDone, and onTestRunDone test hooks (#​8001)

v3.1.10

Compare Source

Patch Changes
  • ca26adb: Update hardhat node to always use the new node network (#​7989)[#​7989]
  • 87623db: Introduce new inter-process mutex implementation (7942).
  • 88e9cb5: Add a SolidityHooks#readNpmPackageRemappings hook
  • ec03a01: Allow overriding the type of the network configs default and localhost #​7805
  • 2c2e1f5: Throw better error messages when trying to use a Hardhat 2 plugin with Hardhat 3 #​7991.
  • 90b5eec: Suggest installing hardhat-foundry when appropriate
  • 87623db: Make the solc downloader safe when run by multiple processes (7946).
  • 726ff37: Update the --coverage table output to match the style used by --gas-stats. Thanks @​jose-blockchain! (#​7733)
  • f1e9b05: Added support for inline actions in tasks 7851.
  • 73cb725: Expose gasLimit configuration for Solidity tests #​7996

v3.1.9

Compare Source

Patch Changes
  • 621d07e: Make the coverage work with versions of Solidity that aren't fully supported by EDR #​7982
  • 3e39a06: Round average and median gas usage in the gas analytics output
  • 78af2ed: Allow multiple parallel downloads of different compilers (7946).

v3.1.8

Compare Source

Patch Changes
  • a6947fb: Use the official Linux ARM64 builds of solc in the production profile when available (#​7917).
  • fd42744: Fixed missing EIP-7212 precompile in Solidity Tests (#​7872).

v3.1.7

Compare Source

Patch Changes
  • 4995121: Suppressed pragma and license warnings in Solidity test files (7894).
  • 22adbcb: Added support for eth_getProof (3345).

v3.1.6

Compare Source

Patch Changes
  • 98fbf44: Implemented SolidityBuildSystemImplementation#compileBuildInfo (#​7891)
  • a9445c9: Added ArtifactManager#getAllArtifactPaths (#​7902)
  • a9445c9: Fixed typechain type generation when compiling a subset of the Solidity files (#​7902)
  • 127ce88: Suppress Hardhat console.sol memory-safe-assembly warning #​7862.
  • c40697b: Added a Solidity#build hook (#​7890)
  • 8e5610f: Fixed a bug where nested folders were not created during the HTML coverage report generation (#​7889)
  • 13a1e4b: Multiple internal fixes to the solidity build system (#​7900)
  • 0c47a69: Added compiler downloader retry in case of failure (#​7031)

v3.1.5

Compare Source

Patch Changes
  • 346f92a: Improve how solidity tests are displayed, making it more consistent with the js reporters.
  • 2bc18b2: Bumped viem version across all packages 7861.
  • 865e346: Updated the incorrect JSDOC against the preprocessProjectFileBeforeBuilding Solidity Hook (#​7870)
  • c9bdbd0: Added invokeSolc in SolidityHooks to allow plugins to respond to the input/output from solc (#​7646)

v3.1.4

Compare Source

Patch Changes
  • d7c13fa: Fixes a bug in how code coverage for Solidity tests is calculated (7767).
  • b6a9d5a: Hardhat tries to use the latest Solidity version supported by Slang in case the a newer, unsupported version is selected (7846).
  • 268acbf: Added HTML coverage report for solidity tests (7787).

v3.1.3

Compare Source

Patch Changes

v3.1.2

Compare Source

Patch Changes
Minor Changes
Patch Changes

v3.1.1

Compare Source

Patch Changes
  • 01b41ee: Added support for function gas snapshots and snapshot cheatcodes in Solidity tests with --snapshot and --snapshot-check flags (#​7769)
  • e37f96c: Add TestRunResult type that wraps TestSummary, allowing plugins to extend test results with additional data
  • bda5a0a: Bumped EDR version to 0.12.0-next.28

v3.1.0

Compare Source

Minor Changes
  • 7b851f3: Bumped EDR version to 0.12.0-next.17
    • Changed default L1 hardfork to Osaka
    • Changed default OP stack hardfork to Isthmus
    • Fixed default transaction gas limit for post-Osaka hardforks in OP stack and generic chains
Patch Changes
  • 7697451: Test summaries are now merged when running multiple test tasks (#​7053)
  • a3bf244: Fixed the download of solc, which broke for v0.8.31

v3.0.17

Compare Source

Patch Changes
  • [9f4020b](http

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies label Nov 4, 2025
Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 2 files

@renovate renovate Bot force-pushed the renovate/major-hardhat-packages branch 5 times, most recently from bfca5b0 to 8149590 Compare November 11, 2025 14:43
@renovate renovate Bot force-pushed the renovate/major-hardhat-packages branch 3 times, most recently from d326b24 to ebc3155 Compare November 16, 2025 03:41
@renovate renovate Bot force-pushed the renovate/major-hardhat-packages branch 4 times, most recently from 1be7eed to 1065076 Compare December 4, 2025 04:50
@renovate renovate Bot force-pushed the renovate/major-hardhat-packages branch 2 times, most recently from 80106fb to b253b9a Compare December 11, 2025 03:27
Comment thread package.json
"@nomicfoundation/hardhat-toolbox-viem": "5.0.1",
"@nomiclabs/hardhat-solhint": "4.1.0",
"@openzeppelin/contracts": "5.4.0",
"@types/node": "24.10.2",
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The upgrade to Hardhat v3.1.0 requires adding "type": "module" to package.json because the hardhat.config.ts uses ESM syntax, which will otherwise fail to load.
Severity: CRITICAL | Confidence: High

🔍 Detailed Analysis

The project's hardhat dependency is being upgraded to version 3.1.0. Hardhat 3.0+ is an ESM-first library and requires "type": "module" to be set in the root package.json. The hardhat.config.ts file uses ESM syntax with import and export default statements. Without the "type": "module" declaration, Node.js will default to CommonJS and fail to parse the configuration file, causing any hardhat command to crash. This will break all development and CI workflows that rely on Hardhat.

💡 Suggested Fix

Add the "type": "module" field to the root package.json file. This will ensure Node.js correctly interprets .ts and .js files as ES Modules, which is required for Hardhat v3.0+ to load its configuration.

🤖 Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: package.json#L42

Potential issue: The project's `hardhat` dependency is being upgraded to version 3.1.0.
Hardhat 3.0+ is an ESM-first library and requires `"type": "module"` to be set in the
root `package.json`. The `hardhat.config.ts` file uses ESM syntax with `import` and
`export default` statements. Without the `"type": "module"` declaration, Node.js will
default to CommonJS and fail to parse the configuration file, causing any `hardhat`
command to crash. This will break all development and CI workflows that rely on Hardhat.

Did we get this right? 👍 / 👎 to inform future reviews.
Reference ID: 6985729

@renovate renovate Bot force-pushed the renovate/major-hardhat-packages branch 2 times, most recently from ada5a58 to 4b85f17 Compare December 30, 2025 15:44
@renovate renovate Bot force-pushed the renovate/major-hardhat-packages branch 2 times, most recently from 16eb7b8 to e8af450 Compare January 14, 2026 19:42
@renovate renovate Bot force-pushed the renovate/major-hardhat-packages branch from e8af450 to 78b2a36 Compare January 19, 2026 22:53
@renovate renovate Bot force-pushed the renovate/major-hardhat-packages branch 2 times, most recently from 06b33d2 to 6fc53a0 Compare February 5, 2026 19:45
@renovate renovate Bot force-pushed the renovate/major-hardhat-packages branch from 6fc53a0 to 94a69dc Compare February 12, 2026 12:51
@renovate renovate Bot force-pushed the renovate/major-hardhat-packages branch 3 times, most recently from 3d19fcc to 7fcfce6 Compare February 26, 2026 19:06
@renovate renovate Bot force-pushed the renovate/major-hardhat-packages branch 2 times, most recently from 47b1ebe to 0a2115d Compare March 11, 2026 15:49
@renovate renovate Bot force-pushed the renovate/major-hardhat-packages branch 2 times, most recently from 22f7b69 to 6baf820 Compare March 19, 2026 22:10
@renovate renovate Bot force-pushed the renovate/major-hardhat-packages branch 2 times, most recently from 437a36e to e2171f8 Compare March 31, 2026 15:59
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Mar 31, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​nomiclabs/​hardhat-solhint@​4.1.0 ⏵ 5.0.09310069 -1388 +6100
Updated@​nomicfoundation/​hardhat-foundry@​1.2.0 ⏵ 3.0.288 +110079 +591 +10100
Updatedhardhat@​2.27.1 ⏵ 3.4.199 +610082 -996 -1100 +20
Updated@​nomicfoundation/​hardhat-ignition-viem@​0.15.16 ⏵ 3.1.388 +210083 -296 +2100
Updated@​nomicfoundation/​hardhat-toolbox-viem@​4.1.1 ⏵ 5.0.483 -610089 +1494 +1100

View full report

@renovate renovate Bot force-pushed the renovate/major-hardhat-packages branch from e2171f8 to 3c0e52d Compare April 16, 2026 21:07
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 16, 2026

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
High CVE: lodash vulnerable to Code Injection via _.template imports key names in npm `lodash-es`

CVE: GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via _.template imports key names (HIGH)

Affected versions: >= 4.0.0 < 4.18.0

Patched version: 4.18.0

From: ?npm/@nomicfoundation/hardhat-toolbox-viem@5.0.4npm/@nomicfoundation/hardhat-ignition-viem@3.1.3npm/lodash-es@4.17.21

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lodash-es@4.17.21. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate Bot force-pushed the renovate/major-hardhat-packages branch from 3c0e52d to 9944d9e Compare April 22, 2026 19:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants