chore(deps): bump tar, @0x/subproviders, ethereum-waffle and @nomiclabs/hardhat-waffle#68
Open
dependabot[bot] wants to merge 1 commit into
Open
chore(deps): bump tar, @0x/subproviders, ethereum-waffle and @nomiclabs/hardhat-waffle#68dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
…bs/hardhat-waffle Removes [tar](https://github.com/isaacs/node-tar). It's no longer used after updating ancestor dependencies [tar](https://github.com/isaacs/node-tar), [@0x/subproviders](https://github.com/0xProject/tools/tree/HEAD/subproviders), [ethereum-waffle](https://github.com/EthWorks/Waffle) and [@nomiclabs/hardhat-waffle](https://github.com/NomicFoundation/hardhat-waffle). These dependencies need to be updated together. Removes `tar` Updates `@0x/subproviders` from 6.0.8 to 8.0.1 - [Release notes](https://github.com/0xProject/tools/releases) - [Changelog](https://github.com/0xProject/tools/blob/development/subproviders/CHANGELOG.md) - [Commits](https://github.com/0xProject/tools/commits/@0x/subproviders@8.0.1/subproviders) Updates `ethereum-waffle` from 3.4.0 to 4.0.10 - [Release notes](https://github.com/EthWorks/Waffle/releases) - [Commits](https://github.com/EthWorks/Waffle/compare/ethereum-waffle@3.4.0...ethereum-waffle@4.0.10) Updates `@nomiclabs/hardhat-waffle` from 2.0.3 to 2.0.6 - [Release notes](https://github.com/NomicFoundation/hardhat-waffle/releases) - [Changelog](https://github.com/NomicFoundation/hardhat-waffle/blob/main/CHANGELOG.md) - [Commits](https://github.com/NomicFoundation/hardhat-waffle/commits) --- updated-dependencies: - dependency-name: tar dependency-version: dependency-type: indirect - dependency-name: "@0x/subproviders" dependency-version: 8.0.1 dependency-type: direct:production - dependency-name: ethereum-waffle dependency-version: 4.0.10 dependency-type: direct:production - dependency-name: "@nomiclabs/hardhat-waffle" dependency-version: 2.0.6 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
R2D2-im
reviewed
Mar 10, 2026
R2D2-im
left a comment
R2D2-im
left a comment
There was a problem hiding this comment.
Review Summary
Overall: 🟡 Approve with suggestions
这是一个比普通 dependabot 更“重”的工具链升级：
@0x/subproviders6.0.8 -> 8.0.1ethereum-waffle3.4.0 -> 4.0.10@nomiclabs/hardhat-waffle2.0.1 -> 2.0.6
Findings
-
🟡 Major — Compatibility — 这里包含多组跨 major 的 EVM 测试栈升级，lockfile 变化非常大。虽然没有业务代码变更，但这类升级可能影响：provider 行为、test helpers、peer dependency 组合，以及 Hardhat 周边插件兼容性。建议 merge 前至少确认一轮完整的 compile + test。
-
🟢 Minor — CI / Tooling — CI 日志里已经出现
@nomicfoundation/edr-*对 Node>=20的EBADENGINEwarning，而当前 workflow 仍跑在 Node 16。虽然这次失败的直接原因是ALCHEMY_TOKEN401，不是编译挂掉，但这说明工具链已经开始偏离当前 CI runtime。建议后续把 CI Node version 一并升级，或者明确 pin 在仍兼容 Node 16 的依赖组合。 -
🟢 Minor — Security — 依赖升级本身是正向的，尤其能把一些过旧的 transitive packages 往上带。
-
💭 Nit — Observability — 这类大 lockfile 变更如果能在 PR description 标注“仅依赖升级、无源码改动、CI 关注点是什么”，后续排查会轻松很多。
整体可以继续推进，但它更像一次工具链演进，不建议当成纯 patch bump 直接无脑合并。
Reviewed by R2D2 🤖 (claude-opus-4-6)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes tar. It's no longer used after updating ancestor dependencies tar, @0x/subproviders, ethereum-waffle and @nomiclabs/hardhat-waffle. These dependencies need to be updated together.
Removes
tarUpdates
@0x/subprovidersfrom 6.0.8 to 8.0.1Release notes
Sourced from
@0x/subproviders's releases.... (truncated)
Changelog
Sourced from
@0x/subproviders's changelog.... (truncated)
Commits
c33f74aPublishd0fe875Updated CHANGELOGS & MD docs8d21ec1chore: update subproviders version to 8.0.0bf9aaeachore: clean unused code from@0x/subproviders8c79268Publishd6e3f73Updated CHANGELOGS & MD docs2dbb546Bump sinon from 4.5.0 to 15.0.0aad2bd4Publishae6753aUpdated CHANGELOGS & MD docse003034fix: Update deps fix (#65)Maintainer changes
This version was pushed to npm by tobernguyen, a new releaser for
@0x/subproviderssince your current version.Install script changes
This version modifies
postinstallscript that runs during installation. Review the package contents before updating.Updates
ethereum-wafflefrom 3.4.0 to 4.0.10Release notes
Sourced from ethereum-waffle's releases.
... (truncated)
Commits
0915e72🎉 Release new version (#823)4d83cde⭐️ Support events not defined in a contract (#822)a1d89d0🎉 Release new version (#821)216f1d8🌏 Switch hardhat errors priority (#820)13d1af0🎉 Release new version (#796)5637cc5🦉 Optimism tests use latest commit (#819)1fa1312🥑 Add mock contract typing (#818)702c6ab🗾 Extend matching of Hardhat revert reasons (#802)46b954e🖼 Mock contract chaining behaviour (#816)fb6863d🍶 Implement mocking receive function to revert (#807)Updates
@nomiclabs/hardhat-wafflefrom 2.0.3 to 2.0.6Release notes
Sourced from
@nomiclabs/hardhat-waffle's releases.Changelog
Sourced from
@nomiclabs/hardhat-waffle's changelog.Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.