chore(deps): update hardhat packages (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
@nomicfoundation/hardhat-foundry (source)	dependencies	major	1.2.0 → 3.0.0
@nomicfoundation/hardhat-ignition-viem (source)	dependencies	major	0.15.16 → 3.1.1
@nomicfoundation/hardhat-toolbox-viem (source)	dependencies	major	4.1.1 → 5.0.3
@nomiclabs/hardhat-solhint (source)	dependencies	major	4.1.0 → 5.0.0
hardhat (source)	dependencies	major	2.27.1 → 3.3.0

---

Release Notes

NomicFoundation/hardhat (@​nomicfoundation/hardhat-foundry)

v3.0.0

Compare Source

Major Changes

• 4cd63e9: Introduce the @nomicfoundation/hardhat-foundry plugin for Hardhat 3

v1.2.1

Compare Source

NomicFoundation/hardhat (@​nomicfoundation/hardhat-ignition-viem)

v3.1.1

Compare Source

Changes

• #​8088 23c0d36 Thanks @​alcuadrado! - Optimize imports.

• Updated dependencies:

  • @​nomicfoundation/hardhat-errors@​3.0.10

---

💡 The Nomic Foundation is hiring! Check our open positions.

---

v3.1.0

Compare Source

Minor Changes

• #​7967 481b221 Thanks @​manuelwedler! - Added support for verifying on all enabled verification services (e.g. Sourcify) (#​7538).

Patch Changes

• Updated dependencies:
  • @​nomicfoundation/hardhat-errors@​3.0.9

v3.0.9

Compare Source

Patch Changes

• 2cbf218: Fix an issue that prevented the verification of contracts using FQNs (#​8014)
• 13918b4: Add support for custom chains not in viem's built-in chain list, thanks @​daanporon! (#​7763)

v3.0.8

Compare Source

Patch Changes

• 6674b00: Bump hardhat-utils major

v3.0.7

Compare Source

Patch Changes

• 2bc18b2: Bumped viem version across all packages 7861.

v3.0.6

Compare Source

Patch Changes

• dac916b: Expose ignition retry loop variables in user config (Hardhat v3) (#​7303)

v3.0.5

Compare Source

Patch Changes

• d1c1803: Make @nomicfoundation/hardhat-ignition's UI work well with other plugins, like Ledger's.

v3.0.4

Compare Source

Patch Changes

• 843c1ae: Fixed a bug preventing Ignition from using the hre.config.ignition settings when deploying via script (#​7641)
• 558ac5b: Update installation and config instructions

v3.0.3

Compare Source

Patch Changes

• bebf87c: Added support for Linea network verification, thanks @​kyzooghost (#​7357)

v3.0.2

Compare Source

Patch Changes

• ddefbff: Added guard to stop multiple simultaneous calls to ignition.deploy(...) at once (#​6440)

v3.0.1

Compare Source

Patch Changes

• 86cecc7: Fix the type guard to include m.encodeFunctionCall in those that do not submit transactions, thanks @​radik878 (#​7264)

v3.0.0

Compare Source

Major Changes

• 29cc141: First release of Hardhat 3!

NomicFoundation/hardhat (@​nomicfoundation/hardhat-toolbox-viem)

v5.0.3

Compare Source

Patch Changes

• 13918b4: Add support for custom chains not in viem's built-in chain list, thanks @​daanporon! (#​7763)

v5.0.2

Compare Source

Patch Changes

• 2bc18b2: Bumped viem version across all packages 7861.

v5.0.1

Compare Source

Patch Changes

• 558ac5b: Update installation and config instructions

v5.0.0

Compare Source

Major Changes

• 29cc141: First release of Hardhat 3!

v4.1.2

Compare Source

This release is a small bump to the version of solidity-coverage to include changes for the Osaka transaction gas limit.

Changes

• a7e4215: Update solidity-coverage minimum version to include Osaka changes

---

💡 The Nomic Foundation is hiring! Check our open positions.

---

NomicFoundation/hardhat (@​nomiclabs/hardhat-solhint)

v5.0.0

Compare Source

v4.1.2

Compare Source

v4.1.1

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cubic-dev-ai]

No issues found across 2 files

[sentry]

Bug: The update to @nomicfoundation/hardhat-toolbox-viem introduces peer dependency conflicts. Several related @nomicfoundation packages are not updated to the required major version.
_{Severity: CRITICAL | Confidence: High}

🔍 Detailed Analysis

Updating @nomicfoundation/hardhat-toolbox-viem to 5.0.1 requires several peer dependencies like @nomicfoundation/hardhat-network-helpers and @nomicfoundation/hardhat-viem to be at version ^3.0.0. However, the lockfile indicates that older, incompatible versions (e.g., 1.1.2, 2.1.3) are still in use. This mismatch will likely lead to installation warnings or failures with npm/bun, and could cause runtime errors due to API incompatibilities between major versions if the installation succeeds.

💡 Suggested Fix

Update all related @nomicfoundation packages in package.json to their required major versions (^3.0.0) to satisfy the peer dependencies of @nomicfoundation/hardhat-toolbox-viem@5.0.1. After updating package.json, run the package manager's install command to regenerate the lockfile.

🤖 Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: package.json#L41

Potential issue: Updating `@nomicfoundation/hardhat-toolbox-viem` to `5.0.1` requires
several peer dependencies like `@nomicfoundation/hardhat-network-helpers` and
`@nomicfoundation/hardhat-viem` to be at version `^3.0.0`. However, the lockfile
indicates that older, incompatible versions (e.g., `1.1.2`, `2.1.3`) are still in use.
This mismatch will likely lead to installation warnings or failures with `npm`/`bun`,
and could cause runtime errors due to API incompatibilities between major versions if
the installation succeeds.

_{Did we get this right? 👍 / 👎 to inform future reviews.
Reference ID: 6983511}

[sentry]

Bug: The hardhat.config.ts file has not been updated for Hardhat 3's new plugin system, which will cause plugins to fail to load and tests to crash.
_{Severity: CRITICAL | Confidence: High}

🔍 Detailed Analysis

The upgrade to Hardhat 3.1.0 introduces a breaking change in how plugins are loaded. The hardhat.config.ts file still uses the old Hardhat 2 method of importing plugins for their side effects. The new required method is to explicitly list plugins in a plugins array within a defineConfig call. Because the plugins are not loaded correctly, extensions to the Hardhat Runtime Environment, such as hre.viem, will be undefined. This will cause tests calling hre.viem.deployContract() to fail with a TypeError.

💡 Suggested Fix

Refactor hardhat.config.ts to use the defineConfig function from hardhat/config. Import the plugins directly and list them in the plugins array within the configuration object. This will ensure they are loaded correctly by Hardhat 3.

🤖 Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: package.json#L40-L43

Potential issue: The upgrade to Hardhat 3.1.0 introduces a breaking change in how
plugins are loaded. The `hardhat.config.ts` file still uses the old Hardhat 2 method of
importing plugins for their side effects. The new required method is to explicitly list
plugins in a `plugins` array within a `defineConfig` call. Because the plugins are not
loaded correctly, extensions to the Hardhat Runtime Environment, such as `hre.viem`,
will be `undefined`. This will cause tests calling `hre.viem.deployContract()` to fail
with a `TypeError`.

_{Did we get this right? 👍 / 👎 to inform future reviews.
Reference ID: 6983511}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​nomiclabs/​hardhat-solhint@​4.1.0 ⏵ 5.0.0			-13	+6
	@​nomicfoundation/​hardhat-foundry@​1.2.0 ⏵ 3.0.0	+1		+4	+7
	hardhat@​2.27.1 ⏵ 3.3.0	+6		-9	-1	+20
	@​nomicfoundation/​hardhat-ignition-viem@​0.15.16 ⏵ 3.1.1	+2		-2	+4
	@​nomicfoundation/​hardhat-toolbox-viem@​4.1.1 ⏵ 5.0.3	-6		+14	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm typescript License: LicenseRef-W3C-Community-Final-Specification-Agreement - the applicable license policy does not allow this license (4) (package/ThirdPartyNoticeText.txt) From: ? → npm/@nomicfoundation/hardhat-toolbox-viem@5.0.3 → npm/@nomicfoundation/hardhat-ignition-viem@3.1.1 → npm/@graphprotocol/graph-cli@0.96.0 → npm/solhint@6.0.1 → npm/typescript@6.0.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@6.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report