[ericglau]

Includes #886 #889

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 64bad12b-5bec-44d2-a8da-78fded08c126

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​openzeppelin/​hardhat-tron-upgrades@​0.1.0 ⏵ 0.1.1	+1			+3
	npm/​@​nomicfoundation/​hardhat-toolbox@​6.1.0 ⏵ 6.1.2	+1			-2
	npm/​@​openzeppelin/​tronbox-upgrades@​0.1.0 ⏵ 0.1.1	+1			+3
	npm/​@​openzeppelin/​confidential-contracts@​0.3.1 ⏵ 0.3.2		+16	+1	+3
	npm/​tsx@​4.22.4 ⏵ 4.23.15
	npm/​postcss@​8.5.6 ⏵ 8.5.31	+1	+24
	npm/​@​nomicfoundation/​hardhat-ignition@​0.15.13 ⏵ 3.1.9	+1		-9	-7
	npm/​hardhat@​3.9.0 ⏵ 3.21.0			+1	+1
	npm/​tronbox@​4.10.0 ⏵ 4.11.0	-11
	npm/​@​openzeppelin/​contracts@​5.6.1
	npm/​tronweb@​6.5.0 ⏵ 6.5.1				+1
	npm/​@​nomicfoundation/​hardhat-ethers@​4.0.13 ⏵ 4.2.1				+1
	npm/​@​openzeppelin/​hardhat-upgrades@​4.0.2 ⏵ 4.1.0			+1	+1
	npm/​@​changesets/​cli@​2.29.5 ⏵ 2.31.1	+1			+1
	npm/​rollup@​4.55.1 ⏵ 4.65.0	+1	+16		+2
	npm/​@​modelcontextprotocol/​sdk@​1.29.0 ⏵ 1.32.1	+1	+31

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• npm/@inquirer/external-editor@1.0.3
• npm/yargs@16.2.2
• npm/ajv@8.20.0
• npm/@nomicfoundation/hardhat-ignition@3.1.9
• npm/@nomicfoundation/hardhat-utils@5.1.0
• npm/@sentry/core@9.47.2
• npm/esbuild@0.27.7
• npm/hardhat@3.21.0
• npm/ws@8.22.0
• npm/js-yaml@3.15.2
• npm/lodash-es@4.18.1
• npm/tar@7.5.22
• npm/undici@6.29.1
• npm/undici@7.30.1
• npm/undici@8.12.3
• npm/solc@0.8.38
• npm/solc@0.8.30
• npm/tronweb@6.5.1
• npm/@changesets/apply-release-plan@7.1.1
• npm/@modelcontextprotocol/sdk@1.32.1
• npm/@smithy/core@3.36.2
• npm/@babel/core@7.29.7
• npm/@babel/helper-module-imports@7.29.7
• npm/@babel/helper-module-transforms@7.29.7
• npm/@babel/helper-string-parser@7.29.7
• npm/@babel/helpers@7.29.10
• npm/@protobufjs/codegen@2.0.5
• npm/deepmerge-ts@7.1.6
• npm/docker-modem@5.0.7
• npm/mlly@1.8.2
• npm/ox@0.14.57
• npm/protobufjs@7.6.6
• npm/viem@2.57.10

View full report

[ericglau]

Socket alerts on this PR come from the dependency updates in #889 and are for functionality that the Wizard and its generated sample projects don't use, or that works as intended for their use:

• AI-signal alerts: these flag standard functionality of upstream packages, used here as intended. Examples: Babel compiler internals, lodash _.template, Hardhat telemetry and Sentry error reporting, the solc compiler loader, esbuild's binary installer, and Ignition's file-open helper. The flagged @modelcontextprotocol/sdk files are the SDK's bundled example server, which the MCP server doesn't import.
• diff: the advisory concerns parsePatch/applyPatch, which aren't used through mocha/ts-node in these projects. Upgrading requires v8, which those dependents don't support.
• deepmerge-ts: only used by the Polkadot CLI tooling to merge its own config. Upgrading requires a major version not supported by its dependents.
• esbuild: the advisory concerns the dev server on Windows, which the Polkadot tooling doesn't use.

[ericglau]

@SocketSecurity ignore npm/@modelcontextprotocol/sdk@1.32.1 npm/hardhat@3.21.0 npm/lodash-es@4.18.1 npm/@babel/core@7.29.7 npm/@babel/helper-module-imports@7.29.7 npm/@babel/helper-module-transforms@7.29.7 npm/@babel/helper-string-parser@7.29.7 npm/@babel/helpers@7.29.10 npm/@changesets/apply-release-plan@7.1.1 npm/@inquirer/external-editor@1.0.3 npm/@nomicfoundation/hardhat-ignition@3.1.9 npm/@nomicfoundation/hardhat-utils@5.1.0 npm/@protobufjs/codegen@2.0.5 npm/@sentry/core@9.47.2 npm/esbuild@0.27.7 npm/esbuild@0.28.0 npm/ws@8.22.0 npm/js-yaml@3.15.2 npm/tar@7.5.22 npm/undici@6.29.1 npm/undici@7.30.1 npm/undici@8.12.3 npm/solc@0.8.30 npm/solc@0.8.38 npm/tronweb@6.5.1 npm/@smithy/core@3.36.2 npm/docker-modem@5.0.7 npm/mlly@1.8.2 npm/ox@0.14.57 npm/protobufjs@7.6.6 npm/viem@2.57.10 npm/ajv@8.20.0 npm/yargs@16.2.2 npm/diff@4.0.2 npm/diff@5.2.0 npm/diff@7.0.0 npm/diff@8.0.2 npm/deepmerge-ts@7.1.5 npm/deepmerge-ts@7.1.6

[tirumerla]

lgtm