[Snyk] Upgrade hardhat from 2.26.3 to 3.0.1 #1708

Dargon789 · 2025-09-11T20:18:35Z

Snyk has created this PR to upgrade hardhat from 2.26.3 to 3.0.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

The recommended version is 36 versions ahead of your current version.
The recommended version was released 21 days ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Cross-site Scripting (XSS) SNYK-JS-COOKIE-8163060	44	No Known Exploit
	Symlink Attack SNYK-JS-TMP-11501554	44	Proof of Concept

Release notes

Package name: hardhat

3.0.1 - 2025-08-21
This release adds rpc utils that are used from Hardhat.

Changes
- 8c1cb1e: Fixed dependencies for Hardhat so rpc utils can be loaded (#7415)
💡 The Nomic Foundation is hiring! Check our open positions.
3.0.0 - 2025-08-13
3.0.0-next.32 - 2025-08-13
3.0.0-next.31 - 2025-08-12
3.0.0-next.30 - 2025-08-11
3.0.0-next.29 - 2025-08-08
3.0.0-next.28 - 2025-08-07
3.0.0-next.27 - 2025-08-07
3.0.0-next.26 - 2025-07-30
3.0.0-next.25 - 2025-07-28
3.0.0-next.24 - 2025-07-23
3.0.0-next.23 - 2025-07-18
3.0.0-next.22 - 2025-07-18
3.0.0-next.21 - 2025-07-04
3.0.0-next.20 - 2025-06-26
3.0.0-next.19 - 2025-06-26
3.0.0-next.18 - 2025-06-23
3.0.0-next.17 - 2025-06-20
3.0.0-next.16 - 2025-06-17
3.0.0-next.15 - 2025-06-13
3.0.0-next.14 - 2025-06-04
3.0.0-next.13 - 2025-05-29
3.0.0-next.12 - 2025-05-27
3.0.0-next.11 - 2025-05-23
3.0.0-next.10 - 2025-05-23
3.0.0-next.9 - 2025-05-22
3.0.0-next.8 - 2025-05-14
3.0.0-next.7 - 2025-05-07
3.0.0-next.6 - 2025-04-30
3.0.0-next.5 - 2025-04-24
3.0.0-next.4 - 2025-04-11
3.0.0-next.3 - 2025-03-26
3.0.0-next.2 - 2025-03-20
3.0.0-next.1 - 2025-03-06
3.0.0-next.0 - 2025-02-20
2.27.1-alpha.0 - 2025-08-18
2.26.3 - 2025-08-12

from hardhat GitHub release notes

Important

Warning: This PR contains a major version upgrade, and may be a breaking change.
Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade hardhat from 2.26.3 to 3.0.1. See this package in npm: hardhat See this project in Snyk: https://app.snyk.io/org/dargon789/project/493afec9-46ee-406c-b759-34d7a4fd4246?utm_source=github&utm_medium=referral&page=upgrade-pr

codesandbox · 2025-09-11T20:18:38Z

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

vercel · 2025-09-11T20:18:38Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
hardhat-project-uz7z	Ready	Preview	Comment	Sep 11, 2025 8:18pm

gemini-code-assist

Summary of Changes

Hello @Dargon789, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request automates a critical dependency update to enhance the project's security posture and ensure compatibility with the latest features and fixes. It focuses on bringing the hardhat package to its most recent stable major version, which is essential for maintaining a robust and secure development environment.

Highlights

Dependency Upgrade: Upgraded the hardhat dependency from version 2.26.3 to 3.0.1.
Security Fixes: This upgrade addresses two medium-severity vulnerabilities: a Cross-site Scripting (XSS) vulnerability (SNYK-JS-COOKIE-8163060) and a Symlink Attack vulnerability (SNYK-JS-TMP-11501554).
Major Version Change: This is a major version upgrade for hardhat, which may introduce breaking changes. Review of the hardhat release notes is recommended to assess potential impacts.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

github-actions · 2025-09-11T20:19:17Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/hardhat	^3.0.1	Unknown	Unknown

Scanned Files

packages/hardhat-verify/package.json

gemini-code-assist

Code Review

This pull request from Snyk upgrades the hardhat development dependency to version 3.0.1 to address security vulnerabilities. While this is an important update, it's a major version change. My review has identified a critical issue: the peerDependencies for hardhat in package.json has not been updated accordingly. This will cause dependency conflicts and likely break the plugin for users. This must be fixed before merging.

gemini-code-assist · 2025-09-11T20:19:43Z

packages/hardhat-verify/package.json

    "eslint-plugin-prettier": "5.5.1",
    "ethers": "^6.14.1",
-    "hardhat": "^2.0.4",
+    "hardhat": "^3.0.1",


While the hardhat version in devDependencies is updated, the peerDependencies on line 86 remains "^2.0.4". This mismatch is critical for a major version bump. The peerDependencies should be updated to be compatible with Hardhat v3, for instance "hardhat": "^3.0.0".

Note that this is a breaking change for the plugin's users, so the package version for @nomicfoundation/hardhat-verify should likely be bumped to a new major version as well (e.g., 3.0.0).

gemini-code-assist bot reviewed Sep 11, 2025

View reviewed changes

vercel bot temporarily deployed to Preview September 11, 2025 20:18 Inactive

github-actions bot added the status:ready label Sep 11, 2025

gemini-code-assist bot reviewed Sep 11, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Snyk] Upgrade hardhat from 2.26.3 to 3.0.1 #1708

[Snyk] Upgrade hardhat from 2.26.3 to 3.0.1 #1708

Uh oh!

Dargon789 commented Sep 11, 2025

Changes

Uh oh!

codesandbox bot commented Sep 11, 2025

Uh oh!

vercel bot commented Sep 11, 2025 •

edited

Loading

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

github-actions bot commented Sep 11, 2025

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Sep 11, 2025

Uh oh!

Uh oh!

[Snyk] Upgrade hardhat from 2.26.3 to 3.0.1 #1708

Are you sure you want to change the base?

[Snyk] Upgrade hardhat from 2.26.3 to 3.0.1 #1708

Uh oh!

Conversation

Dargon789 commented Sep 11, 2025

Snyk has created this PR to upgrade hardhat from 2.26.3 to 3.0.1.

Issues fixed by the recommended upgrade:

Changes

Uh oh!

codesandbox bot commented Sep 11, 2025

Review or Edit in CodeSandbox

Uh oh!

vercel bot commented Sep 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

github-actions bot commented Sep 11, 2025

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Sep 11, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vercel bot commented Sep 11, 2025 •

edited

Loading