chore(deps): bump brace-expansion, @nomicfoundation/hardhat-toolbox and hardhat

[dependabot]

Bumps brace-expansion to 2.1.2 and updates ancestor dependencies brace-expansion, @nomicfoundation/hardhat-toolbox and hardhat. These dependencies need to be updated together.

Updates brace-expansion from 1.1.11 to 2.1.2

Release notes

Sourced from brace-expansion's releases.

v2.1.1

• Backport v5.0.6 change to v2 (#109) c3a817c

---

juliangruber/brace-expansion@v2.1.0...v2.1.1

v2.0.2

• pkg: publish on tag 2.x 14f1d91
• fmt ed7780a
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

---

juliangruber/brace-expansion@v2.0.1...v2.0.2

v1.1.15

• Backport v5.0.6 change to v1 (#111) 0b09384

---

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

• pkg: publish on tag 1.x c460dbd
• fmt ccb8ac6
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

---

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

• 9e67a3b 2.1.2
• 835d6be fix: v2 backport for CVE-2026-13149 (#123)
• 64b71d3 2.1.1
• c3a817c Backport v5.0.6 change to v2 (#109)
• 1ee4a90 2.1.0
• b0302ac Add opt-in { max } mitigation to v2 legacy line (#100)
• 73b5459 2.0.3
• 311ac0d Backport fix for GHSA-f886-m6hf-6m8v to v2 (#96)
• a3efcee 2.0.2
• 14f1d91 pkg: publish on tag 2.x
• Additional commits viewable in compare view

Updates @nomicfoundation/hardhat-toolbox from 2.0.2 to 7.0.0

Release notes

Sourced from @​nomicfoundation/hardhat-toolbox's releases.

@​nomicfoundation/hardhat-toolbox-viem@​5.0.7

Changes

• #8339 00720e8 Thanks @​alcuadrado! - The plugin now uses definePlugin from hardhat/plugins in its index.ts, so it participates in Hardhat's new "imported but unused plugin" warning when omitted from a project's plugins array.

• Updated dependencies:

  • hardhat@3.8.0

---

💡 The Nomic Foundation is hiring! Check our open positions.

---

@​nomicfoundation/hardhat-toolbox-viem@​5.0.6

Changes

• #8264 8452f97 Thanks @​alcuadrado! - Export ./package.json so consumers can import the package's manifest.

---

💡 The Nomic Foundation is hiring! Check our open positions.

---

@​nomicfoundation/hardhat-toolbox-viem@​5.0.5

Changes

• #8191 2a4ae8e Thanks @​alcuadrado! - Update how type extensions are handled to optimize the bootstrap process of Hardhat.

---

💡 The Nomic Foundation is hiring! Check our open positions.

---

@​nomicfoundation/hardhat-toolbox-mocha-ethers@​3.0.7

Changes

• #8339 00720e8 Thanks @​alcuadrado! - The plugin now uses definePlugin from hardhat/plugins in its index.ts, so it participates in Hardhat's new "imported but unused plugin" warning when omitted from a project's plugins array.

• Updated dependencies:

  • hardhat@3.8.0

---

💡 The Nomic Foundation is hiring! Check our open positions.

---

@​nomicfoundation/hardhat-toolbox-mocha-ethers@​3.0.6

Changes

• #8264 8452f97 Thanks @​alcuadrado! - Export ./package.json so consumers can import the package's manifest.

---

💡 The Nomic Foundation is hiring! Check our open positions.

---

... (truncated)

Changelog

Sourced from @​nomicfoundation/hardhat-toolbox's changelog.

7.0.0

Major Changes

• 09ae6db: Deprecate the latest npm tag and redirect users to migrate to Hardhat 3 or to the hh2 tag.

Commits

• 6372d08 Version Packages
• a26e822 Remove the npm tags from the README.md files
• 18bef56 Quote the package in the installation instructions of the readmes
• e5025ae Update the formatting and quote the package in the installation instructions ...
• ee34347 Update hardhat-toolbox
• 7ade974 Version Packages
• a7e4215 feat: bump minimum version of solidity-coverage to Osaka
• e4ad0ad chore: update package metadata for provenance
• f65ee74 Version Packages
• a4f1e27 Hardhat 2 documentation links updated to reflect the domain change to v2.hard...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​nomicfoundation/hardhat-toolbox since your current version.

Updates hardhat from 2.22.15 to 2.29.0

Release notes

Sourced from hardhat's releases.

Hardhat v2.29.0

This is a small Hardhat 2 release that upgrades the version of Mocha to make it compatible with Node 26, and uses a newer version of typescript when initializing projects.

Changes

• a81ad1d: Upgrade Mocha to version ^11.1.0 to make it compatible with Node 26.
• 6ea5832: Update the initialization of new projects to use a newer typescript

Changelog

Sourced from hardhat's changelog.

hardhat

3.11.0

Minor Changes

• #8447 dff401d Thanks @​kanej! - Added experimental EIP-7778 support to the Amsterdam hardfork: a block's gasUsed excludes gas refunds; transaction receipts are unchanged.

• #8447 dff401d Thanks @​kanej! - Added experimental EIP-7928 support to the Amsterdam hardfork: blocks on Amsterdam now include the blockAccessListHash header field. The value is simulated, not the real keccak256(rlp(blockAccessList)).

Patch Changes

• #8447 dff401d Thanks @​kanej! - Fixed JSON-RPC provider call traces omitting event logs (NomicFoundation/edr#1542)

3.10.0

Minor Changes

• #8431 39c93e4 Thanks @​anaPerezGhiglia! - Add support for the new experimental amsterdam L1 hardfork, which currently implements EIP-7708 (ETH transfers emit logs).

Patch Changes

• #8421 1ab0408 Thanks @​BROCCOLO1D! - Fix SolidityBuildSystem#compileBuildInfo so build infos produced by non-solc compiler types are replayed through the Solidity compiler hooks.

• #8414 6ba2bf3 Thanks @​goutamadwant! - Fixed Solidity tests failing to run in projects with very large compilation outputs.

• #8438 d8d2eb7 Thanks @​kanej! - Fixed the hardhat node task so the --chain-id, --fork, and --fork-block-number CLI options are applied to the network again.

• #8417 eb4826a Thanks @​ChristopherDedominici! - Fix a bug where the EIP-712 collector throws for a struct of the same name in a source file the user didn't include.

• #8443 b5674ea Thanks @​Kropiunig! - Fixed the HD wallet derivation-path validator so malformed paths containing stray colons (e.g. m:/44'/60'/0'/0) are rejected with the INVALID_HD_PATH error.

• #8411 5eb4f0e Thanks @​BROCCOLO1D! - Support Solidity test memoryLimit and fuzz/invariant timeout config options.

• Updated dependencies:

  • @​nomicfoundation/hardhat-utils@​4.1.5
  • @​nomicfoundation/hardhat-errors@​3.0.17

3.9.1

Patch Changes

• #8234 81871fd Thanks @​tenderdeve! - Explain the unsupported cheatcode eip712HashType(string,string) and point to the documentation for the alternative instead.

• #8400 2f48724 Thanks @​kanej! - Support setting the transaction gas cap in Solidity Tests

• #8367 82d00fc Thanks @​alcuadrado! - Lazy load dependencies to optimize bootstrap time

• #8391 f3c5727 Thanks @​schaable! - Make hardhat test solidity --snapshot-check read-only. It no longer rewrites or deletes .gas-snapshot or snapshots/*.json files, and instead reports differences. The command now fails when a stored gas value differs from the current one, or when no baseline exists, with a hint to run --snapshot.

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hardhat since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​nomicfoundation/​hardhat-toolbox@​2.0.2 ⏵ 7.0.0	+3		-3
	npm/​hardhat@​2.22.15 ⏵ 2.29.0	+3		+3	+2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm yargs is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/hardhat@2.29.0 → npm/yargs@17.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report