chore(deps): bump the all-dependencies group across 1 directory with 56 updates

[dependabot]

Bumps the all-dependencies group with 54 updates in the / directory:

Package	From	To
@across-protocol/constants	3.1.123	3.1.124
@arbitrum/sdk	4.0.5	4.1.0
@coral-xyz/anchor	0.31.1	0.32.1
@ethersproject/abi	5.7.0	5.8.0
@ethersproject/abstract-provider	5.7.0	5.8.0
@ethersproject/abstract-signer	5.7.0	5.8.0
@google-cloud/kms	5.4.0	6.0.0
@google-cloud/pubsub	5.3.0	6.0.1
@google-cloud/storage	7.19.0	8.0.1
@layerzerolabs/lz-v2-utilities	3.0.147	3.0.168
@maticnetwork/maticjs	3.6.0	3.9.13
@maticnetwork/maticjs-ethers	1.0.3	1.1.0
@nktkas/hyperliquid	0.25.9	0.33.3
@solana-program/address-lookup-table	0.7.0	0.14.0
@solana-program/compute-budget	0.8.0	0.18.0
@solana/kit	5.4.0	8.1.0
binance-api-node	0.12.7	0.13.10
dotenv	16.3.1	17.4.2
ethers	5.7.2	6.17.0
express	4.21.2	5.2.1
google-auth-library	10.6.2	11.0.2
redis	5.12.1	6.2.1
superstruct	1.0.3	2.0.2
tronweb	6.2.2	6.5.0
tsx	4.21.0	4.23.12
viem	2.47.10	2.56.0
winston	3.18.3	3.19.0
zksync-ethers	5.11.1	6.21.2
@nomicfoundation/hardhat-chai-matchers	1.0.6	3.0.0
@nomicfoundation/hardhat-verify	2.1.3	3.1.0
@openzeppelin/hardhat-upgrades	1.28.0	4.1.0
@solana-program/system	0.7.0	0.14.0
@solana-program/token	0.5.1	0.16.0
@types/lodash	4.17.24	4.17.25
@types/node	24.3.0	26.4.0
@typescript-eslint/eslint-plugin	8.58.1	8.68.0
@typescript-eslint/parser	8.58.1	8.68.0
@typescript/native-preview	7.0.0-dev.20260421.2	7.0.0-dev.20260707.2
chai	4.3.7	6.2.2
chai-exclude	2.1.0	3.0.1
eslint	8.57.1	10.9.1
eslint-config-prettier	9.1.2	10.1.8
eslint-plugin-chai-expect	3.0.0	4.1.0
eslint-plugin-mocha	10.1.0	12.0.2
eslint-plugin-n	16.6.2	18.3.0
eslint-plugin-prettier	5.5.5	5.5.6
hardhat	2.28.3	3.15.0
hardhat-deploy	0.11.34	2.0.24
prettier	3.8.1	3.9.6
prettier-plugin-solidity	1.1.3	2.4.1
sinon	21.1.2	22.1.0
@types/sinon	21.0.1	22.0.0
tar	7.5.21	7.5.22
typescript	6.0.2	7.0.2

Updates @across-protocol/constants from 3.1.123 to 3.1.124

Release notes

Sourced from @​across-protocol/constants's releases.

v3.1.124

Full Changelog: across-protocol/constants@v3.1.123...v3.1.124

Commits

• 88ca994 bump package version
• c798ef3 add back mainnet for WBTC-BNB
• c371c82 token consts cleanup
• See full diff in compare view

Updates @arbitrum/sdk from 4.0.5 to 4.1.0

Release notes

Sourced from @​arbitrum/sdk's releases.

v4.1.0

Summary

This release adds support for reverse tracing bridge transfers for easier lookup.

What's Changed

• fix: allowlist new audit-ci dependency advisories by @​douglance in OffchainLabs/arbitrum-sdk#643
• feat: add reverse tracing for bridge transactions by @​douglance in OffchainLabs/arbitrum-sdk#623
• fix: clear new audit-ci dependency advisories by @​douglance in OffchainLabs/arbitrum-sdk#644
• chore: allowlist 4 new undici advisories in audit-ci by @​douglance in OffchainLabs/arbitrum-sdk#646
• chore: bump version to 4.1.0 by @​douglance in OffchainLabs/arbitrum-sdk#645

Full Changelog: OffchainLabs/arbitrum-sdk@v4.0.5...v4.1.0

Commits

• 4a467b2 chore: bump version to 4.1.0 (#645)
• 44c2fb3 chore: allowlist 4 new undici advisories (<6.27.0) in audit-ci (#646)
• e6bbff7 fix: clear new audit-ci dependency advisories (#644)
• 5b61b87 feat: add reverse tracing for bridge transactions (#623)
• a38f7da chore: update dependencies and allowlist for audit (#643)
• See full diff in compare view

Updates @coral-xyz/anchor from 0.31.1 to 0.32.1

Release notes

Sourced from @​coral-xyz/anchor's releases.

v0.32.1

The 0.32.1 patch release is here. This patch is aimed to fix the anchor deploy race condition found in 0.32.0.

Check out the release notes from Anchor website or GitHub.

For a list of notable changes with their associated PRs, see the CHANGELOG.

v0.32.0

The 0.32.0 major release is here. This release targets a number of optimizations we wanted to make before 1.0 major release.

Check out the release notes from Anchor website or GitHub.

For a list of notable changes with their associated PRs, see the CHANGELOG.

Changelog

Sourced from @​coral-xyz/anchor's changelog.

[0.32.1] - 2025-10-09

Features

Fixes

• lang: Fix deprecation warnings on alloc and add solana-program to prelude (#3975).
• cli: Fix race condition that could happen when deploying a program (#3976).

Breaking

[0.32.0] - 2025-10-08

Features

• lang: Add #[error] attribute to declare_program! (#3757).
• cli: Replace anchor verify to use solana-verify under the hood, adding automatic installation via AVM, local path support, and future-proof argument passing (#3768).
• lang: Replace solana-program crate with smaller crates (#3819).
• cli: Make anchor deploy to upload the IDL to the cluster by default unless --no-idl is passed (#3863).
• lang: Use solana-invoke instead of solana_cpi::invoke (#3900).
• client: remove solana-client from anchor-client and cli (#3877).
• idl: Build IDL on stable Rustc (#3842).
• lang: Add custom error when using init on SystemAccount (#3828).
• ts: Add support for Bun as a package manager (#3586).
• lang: Add support for tuple types in space calculation (#3744).
• lang: Add missing pubkey const generation (#3677).
• cli: Add the Minimum Supported Rust Version (MSRV) to the Rust template, since an arbitrary compiler version isn't supported (#3873).
• lang: Update mollusk test template dependencies to ~0.4 and remove redundant solana-program dev-dependency from generated template (#3790).

Fixes

• docker: Upgrade node to 20.18.0 LTS (#3687).
• cli: Fix using deprecated commitment recent in migration scripts (#3725).
• cli: Fix not respecting provider.cluster in keys sync command (#3761).
• lang: Fix deprecated realloc, store_current_index and clippy warnings (#3819).
• avm: fix AVM instability with solana-verify (#3867).
• avm: update AVM to only use non-draft releases(#3931).
• lang: update bytemuck (#3858).
• idl: disable Locale in camelCase (#3845).
• ts: Remove event parsing panic (#3657).
• avm: Expose anchor on PATH via $CARGO_HOME/bin symlink (#3835).

Breaking

• spl: Update SPL dependencies to latest compatible versions (#3860).
• cli: Replace anchor verify to use solana-verify under the hood, adding automatic installation via AVM, local path support, and future-proof argument passing (#3768).
• cli: Upload IDL by default with an option to skip (#3863).
• lang: remove Solang (#3824).

... (truncated)

Commits

• 1ebbe58 v0.32.1 (#3978)
• 059bc20 fix(cli): Wait for program confirmation before IDL init during deploy (#3976)
• 45beb40 Fix: realloc and prelude (#3975)
• d4502a6 v0.32.0 (#3968)
• b1b20af feat: 2.3.0 update (#3967)
• d5d7eb9 chore: Update security advisory info (#3906)
• 152d431 feat(cli): Add MSRV (#3873)
• 56b21ed chore: update changelog in prep for 0.32 (#3951)
• 5300d7c fix(avm): Only use non-draft releases (#3931)
• 18d0ca0 feat: Use solana-invoke insteam of solana_cpi::invoke (#3900)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by solana-devs, a new releaser for @​coral-xyz/anchor since your current version.

Updates @ethersproject/abi from 5.7.0 to 5.8.0

Release notes

Sourced from @​ethersproject/abi's releases.

ethers/v5.8.0 (2025-02-25 19:15) [legacy version]

This is a security update for the legacy Ethers v5 branch, addressing two security fixes.

• A bug in elliptic, which does not affect ethers but triggers a critical security warning during nom audit [see: missing signature length check, missing check for leading bit, allow BER-encoded signatures, false negative verification, signing malformed input]
• A bug in ws which can be used as DoS vector when communicating with malicious WebSocket service providers, triggering a high security warning during nom audit [see: too many HTTP headers]

For those that wish to audit the specific changes in the the bundled version between v5.7 and v5.8, see this gist.

Changes

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

---

Embedding UMD with SRI:

<script type="text/javascript"
  integrity="sha384-KpyAXoFibPIUEi79EsnN1EtEWCCrOQ8MtGsa4IrVxeZo514PYarFXujnjyu0DzgC"
  crossorigin="anonymous"
  src="https://cdnjs.cloudflare.com/ajax/libs/ethers/5.8.0/ethers.umd.min.js">
</script>

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

---

Embedding UMD with SRI:

<script type="text/javascript"
        integrity="sha384-Htz1SE4Sl5aitpvFgr2j0sfsGUIuSXI6t8hEyrlQ93zflEF3a29bH2AvkUROUw7J"
        crossorigin="anonymous"
        src="https://cdn-cors.ethers.io/lib/ethers-5.7.2.umd.min.js">
</script>

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

---

... (truncated)

Changelog

Sourced from @​ethersproject/abi's changelog.

ethers/v5.8.0 (2025-02-25 19:15)

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

Commits

• fa5f647 admin: updated dist files
• See full diff in compare view

Updates @ethersproject/abstract-provider from 5.7.0 to 5.8.0

Release notes

Sourced from @​ethersproject/abstract-provider's releases.

ethers/v5.8.0 (2025-02-25 19:15) [legacy version]

This is a security update for the legacy Ethers v5 branch, addressing two security fixes.

• A bug in elliptic, which does not affect ethers but triggers a critical security warning during nom audit [see: missing signature length check, missing check for leading bit, allow BER-encoded signatures, false negative verification, signing malformed input]
• A bug in ws which can be used as DoS vector when communicating with malicious WebSocket service providers, triggering a high security warning during nom audit [see: too many HTTP headers]

For those that wish to audit the specific changes in the the bundled version between v5.7 and v5.8, see this gist.

Changes

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

---

Embedding UMD with SRI:

<script type="text/javascript"
  integrity="sha384-KpyAXoFibPIUEi79EsnN1EtEWCCrOQ8MtGsa4IrVxeZo514PYarFXujnjyu0DzgC"
  crossorigin="anonymous"
  src="https://cdnjs.cloudflare.com/ajax/libs/ethers/5.8.0/ethers.umd.min.js">
</script>

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

---

Embedding UMD with SRI:

<script type="text/javascript"
        integrity="sha384-Htz1SE4Sl5aitpvFgr2j0sfsGUIuSXI6t8hEyrlQ93zflEF3a29bH2AvkUROUw7J"
        crossorigin="anonymous"
        src="https://cdn-cors.ethers.io/lib/ethers-5.7.2.umd.min.js">
</script>

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

---

... (truncated)

Changelog

Sourced from @​ethersproject/abstract-provider's changelog.

ethers/v5.8.0 (2025-02-25 19:15)

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

Commits

• fa5f647 admin: updated dist files
• See full diff in compare view

Updates @ethersproject/abstract-signer from 5.7.0 to 5.8.0

Release notes

Sourced from @​ethersproject/abstract-signer's releases.

ethers/v5.8.0 (2025-02-25 19:15) [legacy version]

This is a security update for the legacy Ethers v5 branch, addressing two security fixes.

• A bug in elliptic, which does not affect ethers but triggers a critical security warning during nom audit [see: missing signature length check, missing check for leading bit, allow BER-encoded signatures, false negative verification, signing malformed input]
• A bug in ws which can be used as DoS vector when communicating with malicious WebSocket service providers, triggering a high security warning during nom audit [see: too many HTTP headers]

For those that wish to audit the specific changes in the the bundled version between v5.7 and v5.8, see this gist.

Changes

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

---

Embedding UMD with SRI:

<script type="text/javascript"
  integrity="sha384-KpyAXoFibPIUEi79EsnN1EtEWCCrOQ8MtGsa4IrVxeZo514PYarFXujnjyu0DzgC"
  crossorigin="anonymous"
  src="https://cdnjs.cloudflare.com/ajax/libs/ethers/5.8.0/ethers.umd.min.js">
</script>

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

---

Embedding UMD with SRI:

<script type="text/javascript"
        integrity="sha384-Htz1SE4Sl5aitpvFgr2j0sfsGUIuSXI6t8hEyrlQ93zflEF3a29bH2AvkUROUw7J"
        crossorigin="anonymous"
        src="https://cdn-cors.ethers.io/lib/ethers-5.7.2.umd.min.js">
</script>

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

---

... (truncated)

Changelog

Sourced from @​ethersproject/abstract-signer's changelog.

ethers/v5.8.0 (2025-02-25 19:15)

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

Commits

• fa5f647 admin: updated dist files
• See full diff in compare view

Updates @ethersproject/bignumber from 5.7.0 to 5.8.0

Release notes

Sourced from @​ethersproject/bignumber's releases.

ethers/v5.8.0 (2025-02-25 19:15) [legacy version]

This is a security update for the legacy Ethers v5 branch, addressing two security fixes.

• A bug in elliptic, which does not affect ethers but triggers a critical security warning during nom audit [see: missing signature length check, missing check for leading bit, allow BER-encoded signatures, false negative verification, signing malformed input]
• A bug in ws which can be used as DoS vector when communicating with malicious WebSocket service providers, triggering a high security warning during nom audit [see: too many HTTP headers]

For those that wish to audit the specific changes in the the bundled version between v5.7 and v5.8, see this gist.

Changes

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

---

Embedding UMD with SRI:

<script type="text/javascript"
  integrity="sha384-KpyAXoFibPIUEi79EsnN1EtEWCCrOQ8MtGsa4IrVxeZo514PYarFXujnjyu0DzgC"
  crossorigin="anonymous"
  src="https://cdnjs.cloudflare.com/ajax/libs/ethers/5.8.0/ethers.umd.min.js">
</script>

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

---

Embedding UMD with SRI:

<script type="text/javascript"
        integrity="sha384-Htz1SE4Sl5aitpvFgr2j0sfsGUIuSXI6t8hEyrlQ93zflEF3a29bH2AvkUROUw7J"
        crossorigin="anonymous"
        src="https://cdn-cors.ethers.io/lib/ethers-5.7.2.umd.min.js">
</script>

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

---

... (truncated)

Changelog

Sourced from @​ethersproject/bignumber's changelog.

ethers/v5.8.0 (2025-02-25 19:15)

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

Commits

• fa5f647 admin: updated dist files
• See full diff in compare view

Updates @google-cloud/kms from 5.4.0 to 6.0.0

Release notes

Sourced from @​google-cloud/kms's releases.

workflows: v6.0.0

6.0.0 (2026-08-04)

� BREAKING CHANGES

• upgrade minimum Node.js version to 22 (#9026)

Features

• Upgrade minimum Node.js version to 22 (#9026) (1ed703f)

Changelog

Sourced from @​google-cloud/kms's changelog.

6.0.0 (2026-08-04)

⚠ BREAKING CHANGES

• upgrade minimum Node.js version to 22 (#9026)

Features

• Upgrade minimum Node.js version to 22 (#9026) (1ed703f)

5.7.0 (2026-07-21)

Features

• Update API sources and regenerate (#8914) (e9d308b)

5.6.0 (2026-07-13)

Features

• Update googleapis source and regenerate client libraries (#8821) (2a3a77c)

5.5.1 (2026-06-01)

Bug Fixes

• deps: Remove vulnerable dependency uuid (#8120) (3ec901e)

5.5.0 (2026-05-01)

Features

• [kms] support external-μ in the Digest (#8014) (048f3db)

Bug Fixes

• Change the copyright year for files in the packages folder (#8109) (c1a03fe)
• Do not publish the protos to npm (#8079) (816216b)
• Revert "fix: Do not publish the protos to npm" (#8096) (ac0fbb6)

Commits

• d163c4f chore: release main (#9019)
• 1ed703f feat!: upgrade minimum Node.js version to 22 (#9026)
• 328a654 chore(deps): update librarian toolchain to v0.30.1 and gapic-node-processing ...
• 020999e chore: release main (#8925)
• e9d308b feat: update API sources and regenerate (#8914)
• 6935a6a chore: librarian version update (#8905)
• 5a81450 chore: release main (#8825)
...

Description has been truncated

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	ethers@​6.13.5 ⏵ 6.17.0	-3			-4
	@​nomicfoundation/​hardhat-chai-matchers@​1.0.6 ⏵ 3.0.0	+2		-18	+6
	@​across-protocol/​constants@​3.1.118 ⏵ 3.1.124	+10
	@​typescript-eslint/​parser@​8.58.1 ⏵ 8.68.0			+1
	@​types/​sinon@​21.0.1 ⏵ 22.0.0	+1		+1	+7
	@​maticnetwork/​maticjs-ethers@​1.0.3 ⏵ 1.1.0	+2		+2	+3
	@​arbitrum/​sdk@​4.0.5 ⏵ 4.1.0	+1		+1	+4
	@​coral-xyz/​anchor@​0.32.1
	@​types/​lodash@​4.17.24 ⏵ 4.17.25			+1
	chai-exclude@​2.1.0 ⏵ 3.0.1	+1
	@​typescript-eslint/​eslint-plugin@​8.58.1 ⏵ 8.68.0			+1
	@​types/​node@​24.3.0 ⏵ 26.4.0			+1	+2
	tsx@​4.21.0 ⏵ 4.23.13	+1		+1	-1
	@​solana-program/​compute-budget@​0.8.0 ⏵ 0.18.0
	@​solana-program/​address-lookup-table@​0.7.0 ⏵ 0.14.0	+3			+2
	@​typescript/​native-preview@​7.0.0-dev.20260421.2 ⏵ 7.0.0-dev.20260707.2	+1		+11	-3
	hardhat@​2.28.3 ⏵ 3.15.0	+8		-9		+20
	chai@​4.3.7 ⏵ 6.2.2	+1			-2
	eslint-plugin-chai-expect@​3.0.0 ⏵ 4.1.0			+2
	eslint-config-prettier@​9.1.2 ⏵ 10.1.8	+1		+29
	@​solana-program/​system@​0.7.0 ⏵ 0.14.0	+1		+1
	binance-api-node@​0.12.7 ⏵ 0.13.10	+1		+1	+11
	@​solana-program/​token@​0.5.1 ⏵ 0.16.0			+1
	@​maticnetwork/​maticjs@​3.6.0 ⏵ 3.9.13	+1		-13	+10
	express@​5.2.1
	@​layerzerolabs/​lz-v2-utilities@​3.0.147 ⏵ 3.0.168				-7
	winston@​3.18.3 ⏵ 3.19.0	+1		+1
	typescript@​6.0.2 ⏵ 7.0.2			-1		+10
	zksync-ethers@​5.11.1 ⏵ 6.21.2	-5		+1	+3
	tar@​7.5.21 ⏵ 7.5.22				-3
	eslint-plugin-prettier@​5.5.5 ⏵ 5.5.6			+1	+5
See 18 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @coral-xyz/anchor is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/@coral-xyz/anchor@0.32.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@coral-xyz/anchor@0.32.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report