Modernize dependency toolchain and prune vulnerable packages

.github/workflows/contracts.yml

@@ -40,10 +40,10 @@ jobs:
     outputs:
       system-tests: ${{ steps.filter.outputs.system-tests }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
         if: github.event_name == 'pull_request'
 
-      - uses: dorny/paths-filter@v2
+      - uses: dorny/paths-filter@v4.0.3
         if: github.event_name == 'pull_request'
         id: filter
         with:
@@ -55,18 +55,15 @@ jobs:
   contracts-build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v7
         with:
-          # Using fixed version, because 18.16 was sometimes causing issues with
-          # artifacts generation during `hardhat compile` - see
-          # https://github.com/NomicFoundation/hardhat/issues/3877
-          node-version: "18.15.0"
+          node-version-file: ".nvmrc"
           cache: "yarn"
 
       - name: Install dependencies
-        run: yarn install
+        run: yarn install --frozen-lockfile
 
       - name: Build contracts
         run: yarn build
@@ -78,18 +75,15 @@ jobs:
   contracts-deployment-dry-run:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v7
         with:
-          # Using fixed version, because 18.16 was sometimes causing issues with
-          # artifacts generation during `hardhat compile` - see
-          # https://github.com/NomicFoundation/hardhat/issues/3877
-          node-version: "18.15.0"
+          node-version-file: ".nvmrc"
           cache: "yarn"
 
       - name: Install dependencies
-        run: yarn install
+        run: yarn install --frozen-lockfile
 
       - name: Deploy contracts
         run: yarn deploy
@@ -100,15 +94,17 @@ jobs:
       github.event_name == 'workflow_dispatch'
         && github.ref != 'refs/heads/dapp-development'
     runs-on: ubuntu-latest
+    env:
+      # setup-node's generated npmrc references this during Yarn install and
+      # the npm-version-bump action's registry read below. The publish step
+      # overrides it with the real registry token.
+      NODE_AUTH_TOKEN: unused
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v7
         with:
-          # Using fixed version, because 18.16 was sometimes causing issues with
-          # artifacts generation during `hardhat compile` - see
-          # https://github.com/NomicFoundation/hardhat/issues/3877
-          node-version: "18.15.0"
+          node-version-file: ".nvmrc"
           cache: "yarn"
           registry-url: "https://registry.npmjs.org"
 
@@ -153,7 +149,7 @@ jobs:
           version: ${{ steps.npm-version-bump.outputs.version }}
 
       - name: Upload files needed for etherscan verification
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v7
         with:
           name: Artifacts for etherscan verifcation
           path: |
@@ -165,19 +161,16 @@ jobs:
     needs: [contracts-deployment-testnet]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
       - name: Download files needed for etherscan verification
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v8
         with:
           name: Artifacts for etherscan verifcation
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v7
         with:
-          # Using fixed version, because 18.16 was sometimes causing issues with
-          # artifacts generation during `hardhat compile` - see
-          # https://github.com/NomicFoundation/hardhat/issues/3877
-          node-version: "18.15.0"
+          node-version-file: ".nvmrc"
           cache: "yarn"
 
       - name: Install needed dependencies
@@ -201,15 +194,17 @@ jobs:
       github.event_name == 'workflow_dispatch'
         && github.ref == 'refs/heads/dapp-development'
     runs-on: ubuntu-latest
+    env:
+      # setup-node's generated npmrc references this during Yarn install and
+      # the npm-version-bump action's registry read below. The publish step
+      # overrides it with the real registry token.
+      NODE_AUTH_TOKEN: unused
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v7
         with:
-          # Using fixed version, because 18.16 was sometimes causing issues with
-          # artifacts generation during `hardhat compile` - see
-          # https://github.com/NomicFoundation/hardhat/issues/3877
-          node-version: "18.15.0"
+          node-version-file: ".nvmrc"
           cache: "yarn"
           registry-url: "https://registry.npmjs.org"
 
@@ -257,17 +252,14 @@ jobs:
       github.event_name != 'workflow_dispatch'
         && github.event_name != 'schedule'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v7
         with:
-          # Using fixed version, because 18.16 was sometimes causing issues with
-          # artifacts generation during `hardhat compile` - see
-          # https://github.com/NomicFoundation/hardhat/issues/3877
-          node-version: "18.15.0"
+          node-version-file: ".nvmrc"
           cache: "yarn"
 
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v7
         with:
           python-version: 3.10.8
 
@@ -285,7 +277,7 @@ jobs:
         run: pip3 install slither-analyzer==$SLITHER_VERSION
 
       - name: Install dependencies
-        run: yarn install
+        run: yarn install --frozen-lockfile
 
       - name: Run Slither
         run: slither .

.github/workflows/format.yml

@@ -11,13 +11,15 @@ jobs:
   code-lint-and-format:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v7
         with:
-          node-version: "18"
+          node-version-file: ".nvmrc"
           cache: "yarn"
 
       - name: Install dependencies
-        run: yarn install
+        run: yarn install --frozen-lockfile
 
+      - name: Run lint and formatting checks
+        run: yarn format

.github/workflows/npm.yml

@@ -8,22 +8,27 @@ on:
       - "contracts/**"
       - "deploy/**"
       - "hardhat.config.ts"
+      - ".nvmrc"
       - "package.json"
+      - "tsconfig.json"
+      - "tsconfig.export.json"
       - "yarn.lock"
   workflow_dispatch:
 
 jobs:
   npm-compile-publish-contracts:
     runs-on: ubuntu-latest
+    env:
+      # setup-node's generated npmrc references this during Yarn install and
+      # the npm-version-bump action's registry read below. The publish step
+      # overrides it with the real registry token.
+      NODE_AUTH_TOKEN: unused
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v7
         with:
-          # Using fixed version, because 18.16 may cause issues with the
-          # artifacts generation during `hardhat compile` - see
-          # https://github.com/NomicFoundation/hardhat/issues/3877.
-          node-version: "18.15.0"
+          node-version-file: ".nvmrc"
           registry-url: "https://registry.npmjs.org"
           cache: "yarn"
 

.nvmrc

@@ -0,0 +1 @@
+22

.prettierignore

@@ -5,3 +5,4 @@ cache/
 deployments/
 docgen-templates/
 export/
+export.json

README.adoc

@@ -16,8 +16,8 @@ below.
 
 Please make sure you have the following prerequisites installed on your machine:
 
-- https://nodejs.org[Node.js] >14.17.4
-- https://yarnpkg.com[Yarn] >1.22.10
+- https://nodejs.org[Node.js] 22.x (see `.nvmrc`)
+- https://yarnpkg.com[Yarn] 1.22.22 (pinned in `package.json`)
 
 === Build contracts
 

hardhat.config.ts

@@ -1,15 +1,29 @@
-import { HardhatUserConfig } from "hardhat/config"
+import { extendEnvironment, HardhatUserConfig } from "hardhat/config"
+import { lazyObject } from "hardhat/plugins"
 
 import "@keep-network/hardhat-helpers"
-import "@nomiclabs/hardhat-waffle"
+import "@nomiclabs/hardhat-ethers"
+import "@nomicfoundation/hardhat-chai-matchers"
 import "@openzeppelin/hardhat-upgrades"
-import "@tenderly/hardhat-tenderly"
+import { Tenderly } from "@tenderly/hardhat-tenderly/dist/Tenderly"
+import "@tenderly/hardhat-tenderly/dist/type-extensions"
 
 import "hardhat-contract-sizer"
 import "hardhat-deploy"
 import "hardhat-gas-reporter"
 import "solidity-docgen"
 
+// Tenderly 1.8's public setup() registers one module-scope extendEnvironment
+// (which fetches the network catalog via populateNetworks() on every hardhat
+// command) plus one extendConfig, and separately registers tenderly:push /
+// tenderly:verify tasks. This adapter imports Tenderly/type-extensions
+// directly to skip setup() and avoid that network call; only hre.tenderly is
+// used by deploy/*.ts. Revalidate against dist/tenderly/extender.js before
+// changing the pin.
+extendEnvironment((hre) => {
+  hre.tenderly = lazyObject(() => new Tenderly(hre))
+})
+
 const config: HardhatUserConfig = {
   solidity: {
     compilers: [
@@ -96,6 +110,11 @@ const config: HardhatUserConfig = {
   mocha: {
     timeout: 60000,
   },
+  gasReporter: {
+    // Off by default: hardhat-gas-reporter v2 pulls in a second EVM client
+    // stack (viem) and network-capable HTTP client, so keep it opt-in.
+    enabled: !!process.env.REPORT_GAS,
+  },
   docgen: {
     outputDir: "generated-docs",
     templates: "docgen-templates",

package.json

@@ -2,6 +2,7 @@
   "name": "@threshold-network/solidity-contracts",
   "version": "1.3.0-dev",
   "license": "GPL-3.0-or-later",
+  "packageManager": "yarn@1.22.22",
   "files": [
     "artifacts/",
     "build/contracts/",
@@ -13,49 +14,49 @@
     "export.json"
   ],
   "scripts": {
-    "clean": "hardhat clean && rm -rf cache/ deployments/ export/ external/npm export.json",
+    "clean": "hardhat clean && rm -rf artifacts/ cache/ deployments/ export/ external/npm export.json",
     "build": "hardhat compile",
     "deploy": "hardhat deploy --export export.json",
     "format": "npm run lint && prettier --check .",
     "format:fix": "npm run lint:fix && prettier --write .",
-    "lint": "npm run lint:js && npm run lint:sol",
+    "lint": "npm run typecheck && npm run lint:js && npm run lint:sol",
     "lint:fix": "npm run lint:fix:js && npm run lint:fix:sol",
     "lint:fix:js": "eslint . --fix",
     "lint:fix:sol": "solhint 'contracts/**/*.sol' --fix",
     "lint:js": "eslint . ",
     "lint:sol": "solhint 'contracts/**/*.sol'",
     "test": "hardhat test",
     "test:system": "NODE_ENV=system-test hardhat test ./test/system/*.test.js",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
     "prepack": "tsc -p tsconfig.export.json && hardhat export-artifacts export/artifacts",
-    "prepublishOnly": "hardhat prepare-artifacts --network $npm_config_network"
+    "prepublishOnly": "hardhat export-deployment-artifacts --network $npm_config_network"
   },
   "devDependencies": {
-    "@keep-network/hardhat-helpers": "^0.6.0-pre.8",
+    "@keep-network/hardhat-helpers": "^0.6.0-pre.21",
     "@keep-network/prettier-config-keep": "github:keep-network/prettier-config-keep#d6ec02e",
-    "@nomiclabs/hardhat-ethers": "^2.0.2",
-    "@nomiclabs/hardhat-waffle": "^2.0.1",
-    "@openzeppelin/hardhat-upgrades": "^1.12.0",
-    "@tenderly/hardhat-tenderly": ">=1.0.12 <1.1.0",
-    "@types/chai": "^4.2.22",
-    "@types/mocha": "^9.0.0",
-    "@types/node": "^16.11.6",
-    "chai": "^4.3.4",
-    "eslint": "^7.27.0",
+    "@nomicfoundation/hardhat-chai-matchers": "^1.0.6",
+    "@nomiclabs/hardhat-ethers": "^2.2.3",
+    "@openzeppelin/hardhat-upgrades": "^1.28.0",
+    "@tenderly/hardhat-tenderly": "1.8.0",
+    "@types/chai": "^4.3.20",
+    "@types/mocha": "^10.0.10",
+    "@types/node": "^22.20.1",
+    "chai": "^4.5.0",
+    "eslint": "^7.32.0",
     "eslint-config-keep": "github:keep-network/eslint-config-keep#0c27ade",
-    "ethereum-waffle": "^3.4.0",
-    "ethers": "^5.5.3",
-    "hardhat": "^2.8.3",
-    "hardhat-contract-sizer": "^2.5.0",
-    "hardhat-deploy": "^0.11.37",
-    "hardhat-gas-reporter": "^1.0.6",
-    "prettier": "^2.3.2",
+    "ethers": "^5.8.0",
+    "hardhat": "^2.29.0",
+    "hardhat-contract-sizer": "^2.10.1",
+    "hardhat-deploy": "^0.11.45",
+    "hardhat-gas-reporter": "^2.3.0",
+    "prettier": "2.5.1",
     "prettier-plugin-sh": "^0.7.1",
-    "prettier-plugin-solidity": "^1.0.0-beta.14 ",
-    "solhint": "^3.3.6",
+    "prettier-plugin-solidity": "1.0.0-beta.19",
+    "solhint": "^3.6.2",
     "solhint-config-keep": "github:keep-network/solhint-config-keep",
-    "solidity-docgen": "^0.6.0-beta.35",
-    "ts-node": "^10.4.0",
-    "typescript": "^4.4.4"
+    "solidity-docgen": "^0.6.0-beta.36",
+    "ts-node": "^10.9.2",
+    "typescript": "^5.9.3"
   },
   "dependencies": {
     "@openzeppelin/contracts": "~4.5.0",

tsconfig.json

@@ -1,4 +1,11 @@
 {
+  "compilerOptions": {
+    "esModuleInterop": true,
+    "lib": ["es5", "dom", "scripthost"],
+    "module": "commonjs",
+    "moduleResolution": "node",
+    "target": "es2017"
+  },
   "files": ["./hardhat.config.ts"],
   "include": ["./deploy"]
 }