build(deps): bump the npm_and_yarn group across 2 directories with 23 updates

[dependabot]

Bumps the npm_and_yarn group with 6 updates in the /tests/integration_tests/hardhat directory:

Package	From	To
@openzeppelin/contracts	4.8.2	4.9.6
@openzeppelin/contracts-upgradeable	4.8.2	4.9.6
semver	6.3.0	6.3.1
semver	5.7.1	6.3.1
ethereum-waffle	3.4.4	4.0.10
follow-redirects	1.15.1	1.15.6
undici	5.19.1	5.28.4

Bumps the npm_and_yarn group with 8 updates in the /tests/solidity directory:

Package	From	To
follow-redirects	1.14.8	1.15.6
browserify-sign	4.2.1	4.2.3
es5-ext	0.10.53	0.10.64
express	4.18.2	4.19.2
apollo-server-core	2.26.0	2.26.2
get-func-name	2.0.0	2.0.2
protobufjs	6.11.3	6.11.4
word-wrap	1.2.3	1.2.5

Updates @openzeppelin/contracts from 4.8.2 to 4.9.6

Release notes

Sourced from @​openzeppelin/contracts's releases.

v4.9.6

• Base64: Fix issue where dirty memory located just after the input buffer is affecting the result. (#4929)

v4.9.5

• Multicall: Make aware of non-canonical context (i.e. msg.sender is not _msgSender()), allowing compatibility with ERC2771Context. Patch duplicated Address.functionDelegateCall in v4.9.4 (removed).

v4.9.4

• ERC2771Context and Context: Introduce a _contextPrefixLength() getter, used to trim extra information appended to msg.data.
• Multicall: Make aware of non-canonical context (i.e. msg.sender is not _msgSender()), allowing compatibility with ERC2771Context.

v4.9.3

Note This release contains a fix for GHSA-g4vp-m682-qqmp.

• ERC2771Context: Return the forwarder address whenever the msg.data of a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. msg.data.length is less than 20 bytes), as specified by ERC-2771. (#4481)
• ERC2771Context: Prevent revert in _msgData() when a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. msg.data.length is less than 20 bytes). Return the full calldata in that case. (#4484)

v4.9.2

Note This release contains a fix for GHSA-wprv-93r4-jj2p.

• MerkleProof: Fix a bug in processMultiProof and processMultiProofCalldata that allows proving arbitrary leaves if the tree contains a node with value 0 at depth 1.

v4.9.1

Note This release contains a fix for GHSA-5h3x-9wvq-w4m2.

• Governor: Add a mechanism to restrict the address of the proposer using a suffix in the description.

v4.9.0

• ReentrancyGuard: Add a _reentrancyGuardEntered function to expose the guard status. (#3714)
• ERC721Wrapper: add a new extension of the ERC721 token which wraps an underlying token. Deposit and withdraw guarantee that the ownership of each token is backed by a corresponding underlying token with the same identifier. (#3863)
• EnumerableMap: add a keys() function that returns an array containing all the keys. (#3920)
• Governor: add a public cancel(uint256) function. (#3983)
• Governor: Enable timestamp operation for blockchains without a stable block time. This is achieved by connecting a Governor's internal clock to match a voting token's EIP-6372 interface. (#3934)
• Strings: add equal method. (#3774)
• IERC5313: Add an interface for EIP-5313 that is now final. (#4013)
• IERC4906: Add an interface for ERC-4906 that is now Final. (#4012)
• StorageSlot: Add support for string and bytes. (#4008)
• Votes, ERC20Votes, ERC721Votes: support timestamp checkpointing using EIP-6372. (#3934)
• ERC4626: Add mitigation to the inflation attack through virtual shares and assets. (#3979)
• Strings: add toString method for signed integers. (#3773)
• ERC20Wrapper: Make the underlying variable private and add a public accessor. (#4029)
• EIP712: add EIP-5267 support for better domain discovery. (#3969)
• AccessControlDefaultAdminRules: Add an extension of AccessControl with additional security rules for the DEFAULT_ADMIN_ROLE. (#4009)
• SignatureChecker: Add isValidERC1271SignatureNow for checking a signature directly against a smart contract using ERC-1271. (#3932)
• SafeERC20: Add a forceApprove function to improve compatibility with tokens behaving like USDT. (#4067)

... (truncated)

Changelog

Sourced from @​openzeppelin/contracts's changelog.

4.9.6 (2024-02-29)

• Base64: Fix issue where dirty memory located just after the input buffer is affecting the result. (#4929)

4.9.5 (2023-12-08)

• Multicall: Make aware of non-canonical context (i.e. msg.sender is not _msgSender()), allowing compatibility with ERC2771Context. Patch duplicated Address.functionDelegateCall in v4.9.4 (removed).

4.9.3 (2023-07-28)

• ERC2771Context: Return the forwarder address whenever the msg.data of a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. msg.data.length is less than 20 bytes), as specified by ERC-2771. (#4481)
• ERC2771Context: Prevent revert in _msgData() when a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. msg.data.length is less than 20 bytes). Return the full calldata in that case. (#4484)

4.9.2 (2023-06-16)

• MerkleProof: Fix a bug in processMultiProof and processMultiProofCalldata that allows proving arbitrary leaves if the tree contains a node with value 0 at depth 1.

4.9.1 (2023-06-07)

• Governor: Add a mechanism to restrict the address of the proposer using a suffix in the description.

4.9.0 (2023-05-23)

• ReentrancyGuard: Add a _reentrancyGuardEntered function to expose the guard status. (#3714)
• ERC721Wrapper: add a new extension of the ERC721 token which wraps an underlying token. Deposit and withdraw guarantee that the ownership of each token is backed by a corresponding underlying token with the same identifier. (#3863)
• EnumerableMap: add a keys() function that returns an array containing all the keys. (#3920)
• Governor: add a public cancel(uint256) function. (#3983)
• Governor: Enable timestamp operation for blockchains without a stable block time. This is achieved by connecting a Governor's internal clock to match a voting token's EIP-6372 interface. (#3934)
• Strings: add equal method. (#3774)
• IERC5313: Add an interface for EIP-5313 that is now final. (#4013)
• IERC4906: Add an interface for ERC-4906 that is now Final. (#4012)
• StorageSlot: Add support for string and bytes. (#4008)
• Votes, ERC20Votes, ERC721Votes: support timestamp checkpointing using EIP-6372. (#3934)
• ERC4626: Add mitigation to the inflation attack through virtual shares and assets. (#3979)
• Strings: add toString method for signed integers. (#3773)
• ERC20Wrapper: Make the underlying variable private and add a public accessor. (#4029)
• EIP712: add EIP-5267 support for better domain discovery. (#3969)
• AccessControlDefaultAdminRules: Add an extension of AccessControl with additional security rules for the DEFAULT_ADMIN_ROLE. (#4009)
• SignatureChecker: Add isValidERC1271SignatureNow for checking a signature directly against a smart contract using ERC-1271. (#3932)
• SafeERC20: Add a forceApprove function to improve compatibility with tokens behaving like USDT. (#4067)
• ERC1967Upgrade: removed contract-wide oz-upgrades-unsafe-allow delegatecall annotation, replaced by granular annotation in UUPSUpgradeable. (#3971)
• ERC20Wrapper: self wrapping and deposit by the wrapper itself are now explicitly forbidden. (#4100)
• ECDSA: optimize bytes32 computation by using assembly instead of abi.encodePacked. (#3853)
• ERC721URIStorage: Emit ERC-4906 MetadataUpdate in _setTokenURI. (#4012)
• ShortStrings: Added a library for handling short strings in a gas efficient way, with fallback to storage for longer strings. (#4023)
• SignatureChecker: Allow return data length greater than 32 from EIP-1271 signers. (#4038)
• UUPSUpgradeable: added granular oz-upgrades-unsafe-allow-reachable annotation to improve upgrade safety checks on latest version of the Upgrades Plugins (starting with @openzeppelin/upgrades-core@1.21.0). (#3971)
• Initializable: optimize _disableInitializers by using != instead of <. (#3787)
• Ownable2Step: make acceptOwnership public virtual to enable usecases that require overriding it. (#3960)
• UUPSUpgradeable.sol: Change visibility to the functions upgradeTo and upgradeToAndCall from external to public. (#3959)

... (truncated)

Commits

• dc44c9f Release v4.9.6 (#4931)
• a6286d0 Port Base64 tests to truffle (#4926) (#4929)
• bd325d5 Release v4.9.5 (#4790)
• ad6a5b6 Add changeset
• 88ac712 Replace double functionDelegateCall
• a83918d Bump node CI version to 16.x
• 0d5f54e Release v4.9.4 (#4784)
• ccfffe1 Make Multicall context-aware
• 9329cfa Remove Wizard page from 4.x
• e1b3d8c Remove Wizard from 4.x navigation
• Additional commits viewable in compare view

Updates @openzeppelin/contracts-upgradeable from 4.8.2 to 4.9.6

Release notes

Sourced from @​openzeppelin/contracts-upgradeable's releases.

v4.9.6

• Base64: Fix issue where dirty memory located just after the input buffer is affecting the result. (#4926)

v4.9.5

• Multicall: Patch duplicated Address.functionDelegateCall.

v4.9.4

• ERC2771Context and Context: Introduce a _contextPrefixLength() getter, used to trim extra information appended to msg.data.
• Multicall: Make aware of non-canonical context (i.e. msg.sender is not _msgSender()), allowing compatibility with ERC2771Context.

v4.9.3

Note This release contains a fix for GHSA-g4vp-m682-qqmp.

• ERC2771Context: Return the forwarder address whenever the msg.data of a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. msg.data.length is less than 20 bytes), as specified by ERC-2771. (#4481)
• ERC2771Context: Prevent revert in _msgData() when a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. msg.data.length is less than 20 bytes). Return the full calldata in that case. (#4484)

v4.9.2

Note This release contains a fix for GHSA-wprv-93r4-jj2p.

• MerkleProof: Fix a bug in processMultiProof and processMultiProofCalldata that allows proving arbitrary leaves if the tree contains a node with value 0 at depth 1.

v4.9.1

Note This release contains a fix for GHSA-5h3x-9wvq-w4m2.

• Governor: Add a mechanism to restrict the address of the proposer using a suffix in the description.

v4.9.0

• ReentrancyGuard: Add a _reentrancyGuardEntered function to expose the guard status. (#3714)
• ERC721Wrapper: add a new extension of the ERC721 token which wraps an underlying token. Deposit and withdraw guarantee that the ownership of each token is backed by a corresponding underlying token with the same identifier. (#3863)
• EnumerableMap: add a keys() function that returns an array containing all the keys. (#3920)
• Governor: add a public cancel(uint256) function. (#3983)
• Governor: Enable timestamp operation for blockchains without a stable block time. This is achieved by connecting a Governor's internal clock to match a voting token's EIP-6372 interface. (#3934)
• Strings: add equal method. (#3774)
• IERC5313: Add an interface for EIP-5313 that is now final. (#4013)
• IERC4906: Add an interface for ERC-4906 that is now Final. (#4012)
• StorageSlot: Add support for string and bytes. (#4008)
• Votes, ERC20Votes, ERC721Votes: support timestamp checkpointing using EIP-6372. (#3934)
• ERC4626: Add mitigation to the inflation attack through virtual shares and assets. (#3979)
• Strings: add toString method for signed integers. (#3773)
• ERC20Wrapper: Make the underlying variable private and add a public accessor. (#4029)
• EIP712: add EIP-5267 support for better domain discovery. (#3969)
• AccessControlDefaultAdminRules: Add an extension of AccessControl with additional security rules for the DEFAULT_ADMIN_ROLE. (#4009)
• SignatureChecker: Add isValidERC1271SignatureNow for checking a signature directly against a smart contract using ERC-1271. (#3932)

... (truncated)

Changelog

Sourced from @​openzeppelin/contracts-upgradeable's changelog.

4.9.6 (2024-02-29)

• Base64: Fix issue where dirty memory located just after the input buffer is affecting the result. (#4929)

4.9.5 (2023-12-08)

• Multicall: Make aware of non-canonical context (i.e. msg.sender is not _msgSender()), allowing compatibility with ERC2771Context. Patch duplicated Address.functionDelegateCall in v4.9.4 (removed).

4.9.3 (2023-07-28)

• ERC2771Context: Return the forwarder address whenever the msg.data of a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. msg.data.length is less than 20 bytes), as specified by ERC-2771. (#4481)
• ERC2771Context: Prevent revert in _msgData() when a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. msg.data.length is less than 20 bytes). Return the full calldata in that case. (#4484)

4.9.2 (2023-06-16)

• MerkleProof: Fix a bug in processMultiProof and processMultiProofCalldata that allows proving arbitrary leaves if the tree contains a node with value 0 at depth 1.

4.9.1 (2023-06-07)

• Governor: Add a mechanism to restrict the address of the proposer using a suffix in the description.

4.9.0 (2023-05-23)

• ReentrancyGuard: Add a _reentrancyGuardEntered function to expose the guard status. (#3714)
• ERC721Wrapper: add a new extension of the ERC721 token which wraps an underlying token. Deposit and withdraw guarantee that the ownership of each token is backed by a corresponding underlying token with the same identifier. (#3863)
• EnumerableMap: add a keys() function that returns an array containing all the keys. (#3920)
• Governor: add a public cancel(uint256) function. (#3983)
• Governor: Enable timestamp operation for blockchains without a stable block time. This is achieved by connecting a Governor's internal clock to match a voting token's EIP-6372 interface. (#3934)
• Strings: add equal method. (#3774)
• IERC5313: Add an interface for EIP-5313 that is now final. (#4013)
• IERC4906: Add an interface for ERC-4906 that is now Final. (#4012)
• StorageSlot: Add support for string and bytes. (#4008)
• Votes, ERC20Votes, ERC721Votes: support timestamp checkpointing using EIP-6372. (#3934)
• ERC4626: Add mitigation to the inflation attack through virtual shares and assets. (#3979)
• Strings: add toString method for signed integers. (#3773)
• ERC20Wrapper: Make the underlying variable private and add a public accessor. (#4029)
• EIP712: add EIP-5267 support for better domain discovery. (#3969)
• AccessControlDefaultAdminRules: Add an extension of AccessControl with additional security rules for the DEFAULT_ADMIN_ROLE. (#4009)
• SignatureChecker: Add isValidERC1271SignatureNow for checking a signature directly against a smart contract using ERC-1271. (#3932)
• SafeERC20: Add a forceApprove function to improve compatibility with tokens behaving like USDT. (#4067)
• ERC1967Upgrade: removed contract-wide oz-upgrades-unsafe-allow delegatecall annotation, replaced by granular annotation in UUPSUpgradeable. (#3971)
• ERC20Wrapper: self wrapping and deposit by the wrapper itself are now explicitly forbidden. (#4100)
• ECDSA: optimize bytes32 computation by using assembly instead of abi.encodePacked. (#3853)
• ERC721URIStorage: Emit ERC-4906 MetadataUpdate in _setTokenURI. (#4012)
• ShortStrings: Added a library for handling short strings in a gas efficient way, with fallback to storage for longer strings. (#4023)
• SignatureChecker: Allow return data length greater than 32 from EIP-1271 signers. (#4038)
• UUPSUpgradeable: added granular oz-upgrades-unsafe-allow-reachable annotation to improve upgrade safety checks on latest version of the Upgrades Plugins (starting with @openzeppelin/upgrades-core@1.21.0). (#3971)
• Initializable: optimize _disableInitializers by using != instead of <. (#3787)
• Ownable2Step: make acceptOwnership public virtual to enable usecases that require overriding it. (#3960)
• UUPSUpgradeable.sol: Change visibility to the functions upgradeTo and upgradeToAndCall from external to public. (#3959)

... (truncated)

Commits

• 2d081f2 Transpile dc44c9f1
• 2492017 Transpile a6286d0f
• a40cb0b Transpile bd325d56
• 4c73bfa Transpile ad6a5b68
• 31f9fb9 Transpile 88ac712e
• f55babc Transpile a83918df
• 5bc5999 Transpile 98c7a4cf
• 152b820 Transpile 0ed435b7
• f34a3a7 Transpile 17c1a3a4
• 3d4c0d5 Transpile fd81a96f
• Additional commits viewable in compare view

Updates semver from 6.3.0 to 6.3.1

Release notes

Sourced from semver's releases.

v6.3.1

6.3.1 (2023-07-10)

Bug Fixes

• 928e56d #591 better handling of whitespace (#591) (@​lukekarrys, @​joaomoreno, @​nicolo-ribaudo)

Changelog

Sourced from semver's changelog.

6.3.1 (2023-07-10)

Bug Fixes

• 928e56d #591 better handling of whitespace (#591) (@​lukekarrys, @​joaomoreno, @​nicolo-ribaudo)

6.2.0

• Coerce numbers to strings when passed to semver.coerce()
• Add rtl option to coerce from right to left

6.1.3

• Handle X-ranges properly in includePrerelease mode

6.1.2

• Do not throw when testing invalid version strings

6.1.1

• Add options support for semver.coerce()
• Handle undefined version passed to Range.test

6.1.0

• Add semver.compareBuild function
• Support * in semver.intersects

6.0

• Fix intersects logic.

  This is technically a bug fix, but since it is also a change to behavior that may require users updating their code, it is marked as a major version increment.

5.7

• Add minVersion method

5.6

• Move boolean loose param to an options object, with backwards-compatibility protection.
• Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

... (truncated)

Commits

• 44d27bc chore: release 6.3.1
• 928e56d fix: better handling of whitespace (#591)
• 39f6326 chore: @​npmcli/template-oss@​4.16.0
• See full diff in compare view

Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.

Updates semver from 5.7.1 to 6.3.1

Release notes

Sourced from semver's releases.

v6.3.1

6.3.1 (2023-07-10)

Bug Fixes

• 928e56d #591 better handling of whitespace (#591) (@​lukekarrys, @​joaomoreno, @​nicolo-ribaudo)

Changelog

Sourced from semver's changelog.

6.3.1 (2023-07-10)

Bug Fixes

• 928e56d #591 better handling of whitespace (#591) (@​lukekarrys, @​joaomoreno, @​nicolo-ribaudo)

6.2.0

• Coerce numbers to strings when passed to semver.coerce()
• Add rtl option to coerce from right to left

6.1.3

• Handle X-ranges properly in includePrerelease mode

6.1.2

• Do not throw when testing invalid version strings

6.1.1

• Add options support for semver.coerce()
• Handle undefined version passed to Range.test

6.1.0

• Add semver.compareBuild function
• Support * in semver.intersects

6.0

• Fix intersects logic.

  This is technically a bug fix, but since it is also a change to behavior that may require users updating their code, it is marked as a major version increment.

5.7

• Add minVersion method

5.6

• Move boolean loose param to an options object, with backwards-compatibility protection.
• Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

... (truncated)

Commits

• 44d27bc chore: release 6.3.1
• 928e56d fix: better handling of whitespace (#591)
• 39f6326 chore: @​npmcli/template-oss@​4.16.0
• See full diff in compare view

Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.

Updates ethereum-waffle from 3.4.4 to 4.0.10

Release notes

Sourced from ethereum-waffle's releases.

@​ethereum-waffle/chai@​4.0.10

Patch Changes

• 4d83cde: Emit matcher improvement

ethereum-waffle@4.0.10

Patch Changes

• Updated dependencies [4d83cde]
  • @​ethereum-waffle/mock-contract@​4.0.4
  • @​ethereum-waffle/chai@​4.0.10
  • @​ethereum-waffle/compiler@​4.0.3

@​ethereum-waffle/chai@​4.0.9

Patch Changes

• 216f1d8: Switch hardhat error priority

ethereum-waffle@4.0.9

Patch Changes

• Updated dependencies [216f1d8]
  • @​ethereum-waffle/chai@​4.0.9
  • @​ethereum-waffle/compiler@​4.0.3
  • @​ethereum-waffle/mock-contract@​4.0.3

@​ethereum-waffle/chai@​4.0.8

Patch Changes

• f93abe9: Move call history injection logic to hardhat plugin
• 9602243: 👔 revertedWith().withArgs no longer fails for uint values exceeding JavaScript's max int limit
• b54c6b9: Add delta to balance changing matchers
• 64707ae: Allow special characters in revertedWith regex
• 702c6ab: 🗾 Extend matching of Hardhat revert reasons
• a0f721a: Move ethers to peer deps
• f6d240e: 🛶 Updates for hardhat v2.11
• Updated dependencies [ee1d1b8]
• Updated dependencies [a0f721a]
  • @​ethereum-waffle/provider@​4.0.5

ethereum-waffle@4.0.8

Patch Changes

• f93abe9: Move call history injection logic to hardhat plugin
• a0f721a: Move ethers to peer deps
• Updated dependencies [da92375]
• Updated dependencies [f93abe9]
• Updated dependencies [46b954e]
• Updated dependencies [9602243]
• Updated dependencies [fb6863d]

... (truncated)

Commits

• 0915e72 🎉 Release new version (#823)
• 4d83cde ⭐️ Support events not defined in a contract (#822)
• a1d89d0 🎉 Release new version (#821)
• 216f1d8 🌏 Switch hardhat errors priority (#820)
• 13d1af0 🎉 Release new version (#796)
• 5637cc5 🦉 Optimism tests use latest commit (#819)
• 1fa1312 🥑 Add mock contract typing (#818)
• 702c6ab 🗾 Extend matching of Hardhat revert reasons (#802)
• 46b954e 🖼 Mock contract chaining behaviour (#816)
• fb6863d 🍶 Implement mocking receive function to revert (#807)
• Additional commits viewable in compare view

Updates ws from 3.3.3 to 7.4.6

Release notes

Sourced from ws's releases.

7.4.6

Bug fixes

• Fixed a ReDoS vulnerability (00c425ec).

A specially crafted value of the Sec-Websocket-Protocol header could be used to significantly slow down a ws server.

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();
value.trim().split(/ *, */);
const end = process.hrtime.bigint();
console.log('length = %d, time = %f ns', length, end - start);
}

The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

7.4.5

Bug fixes

• UTF-8 validation is now done even if utf-8-validate is not installed (23ba6b29).
• Fixed an edge case where websocket.close() and websocket.terminate() did not close the connection (67e25ff5).

7.4.4

Bug fixes

• Fixed a bug that could cause the process to crash when using the permessage-deflate extension (92774377).

7.4.3

Bug fixes

• The deflate/inflate stream is now reset instead of reinitialized when context takeover is disabled (#1840).

7.4.2

Bug fixes

... (truncated)

Commits

• f5297f7 [dist] 7.4.6
• 00c425e [security] Fix ReDoS vulnerability
• 990306d [lint] Fix prettier error
• 32e3a84 [security] Remove reference to Node Security Project
• 8c914d1 [minor] Fix nits
• fc7e27d [ci] Test on node 16
• 587c201 [ci] Do not test on node 15
• f672710 [dist] 7.4.5
• 67e25ff [fix] Fix case where abortHandshake() does not close the connection
• 23ba6b2 [fix] Make UTF-8 validation work even if utf-8-validate is not installed
• Additional commits viewable in compare view

Updates async from 1.5.2 to 2.6.4

Release notes

Sourced from async's releases.

v2.3.0

• Added support for ES2017 async functions. Wherever you can pass a Node-style/CPS function that uses a callback, you can also pass an async function. Previously, you had to wrap async functions with asyncify. The caveat is that it will only work if async functions are supported natively in your environment, transpiled implementations can't be detected. (#1386, #1390)

v2.2.0

• Added groupBy, and the Series/Limit equivalents, analogous to _.groupBy (#1364)
• Fixed transform bug when callback was not passed (#1381)

v2.1.5

• Fix auto bug when function names collided with Array.prototype (#1358)
• Improve some error messages (#1349)
• Avoid stack overflow case in queue
• Fixed an issue in some, every and find where processing would continue after the result was determined.
• Cleanup implementations of some, every and find

v2.1.3

• Make bundle size smaller
• Create optimized hotpath for filter in array case.

v2.1.2

• Fixed a stackoverflow bug with detect, some, every on large inputs (#1293).

v2.1.0

• retry and retryable now support an optional errorFilter function that determines if the task should retry on the error (#1256, #1261)
• Optimized array iteration in race, cargo, queue, and priorityQueue (#1253)

v2.0.0

Lots of changes here!

First and foremost, we have a slick new site for docs. Special thanks to @​hargasinski for his work converting our old docs to jsdoc format and implementing the new website. Also huge ups to @​ivanseidel for designing our new logo. It was a long process for both of these tasks, but I think these changes turned out extraordinary well.

The biggest feature is modularization. You can now require("async/series") to only require the series function. Every Async library function is available this way. You still can require("async") to require the entire library, like you could do before.

We also provide Async as a collection of ES2015 modules. You can now import {each} from 'async-es' or import waterfall from 'async-es/waterfall'. If you are using only a few Async functions, and are using a ES bundler such as Rollup, this can significantly lower your build size.

Major thanks to @​Kikobeats, @​aearly and @​megawac for doing the majority of the modularization work, as well as @​jdalton and @​Rich-Harris for advisory work on the general modularization strategy.

Another one of the general themes of the 2.0 release is standardization of what an "async" function is. We are now more strictly following the node-style continuation passing style. That is, an async function is a function that:

1. Takes a variable number of arguments
2. The last argument is always a callback
3. The callback can accept any number of arguments
4. The first argument passed to the callback will be treated as an error result, if the argument is truthy
5. Any number of result arguments can be passed after the "error" argument
6. The callback is called once and exactly once, either on the same tick or later tick of the JavaScript event loop.

There were several cases where Async accepted some functions that did not strictly have these properties, most notably auto, every, some, and filter.

Another theme is performance. We have eliminated internal deferrals in all cases where they make sense. For example, in waterfall and auto, there was a setImmediate between each task -- these deferrals have been removed. A setImmediate call can add up to 1ms of delay. This might not seem like a lot, but it can add up if you are using many Async functions in the course of processing a HTTP request, for example. Nearly all asynchronous functions that do I/O already have some sort of deferral built in, so the extra deferral is unnecessary. The trade-off of this change is removing our built-in stack-overflow defense. Many synchronous callback calls in series can quickly overflow the JS call stack. If you do have a function that is sometimes synchronous (calling its callback on the same tick), and are running into stack overflows, wrap it with async.ensureAsync().

Another big performance win has been re-implementing queue, cargo, and priorityQueue with doubly linked lists instead of arrays. This has lead to queues being an order of magnitude faster on large sets of tasks.

... (truncated)

Changelog

Sourced from async's changelog.

v2.6.4

• Fix potential prototype pollution exploit (#1828)

v2.6.3

• Updated lodash to squelch a security warning (#1675)

v2.6.2

• Updated lodash to squelch a security warning (#1620)

v2.6.1

• Updated lodash to prevent npm audit warnings. (#1532, #1533)
• Made async-es more optimized for webpack users (#1517)
• Fixed a stack overflow with large collections and a synchronous iterator (#1514)
• Various small fixes/chores (#1505, #1511, #1527, #1530)

v2.6.0

• Added missing aliases for many methods. Previously, you could not (e.g.) require('async/find') or use async.anyLimit. (#1483)
• Improved queue performance. (#1448, #1454)
• Add missing sourcemap (#1452, #1453)
• Various doc updates (#1448, #1471, #1483)

v2.5.0

• Added concatLimit, the Limit equivalent of concat (#1426, #1430)
• concat improvements: it now preserves order, handles falsy values and the iteratee callback takes a variable number of arguments (#1437, #1436)
• Fixed an issue in queue where there was a size discrepancy between workersList().length and running() (#1428, #1429)
• Various doc fixes (#1422, #1424)

v2.4.1

• Fixed a bug preventing functions wrapped with timeout() from being re-used. (#1418, #1419)

v2.4.0

• Added tryEach, for running async functions in parallel, where you only expect one to succeed. (#1365, #687)
• Improved performance, most notably in parallel and waterfall (#1395)
• Added queue.remove(), for removing items in a queue (#1397, #1391)
• Fixed using eval, preventing Async from running in pages with Content Security Policy (#1404, #1403)
• Fixed errors thrown in an asyncifyed function's callback being caught by the underlying Promise (#1408)
• Fixed timing of queue.empty() (#1367)
• Various doc fixes (

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@nomiclabs/hardhat-ethers@2.2.1	Transitive: network	+44	18.1 MB	fvictorio
npm/@nomiclabs/hardhat-waffle@2.0.5	Transitive: environment, eval, filesystem, network, shell, unsafe	+364	200 MB	alcuadrado
npm/@openzeppelin/contracts-upgradeable@4.9.6	None	0	2.11 MB	amxx
npm/@openzeppelin/contracts@4.9.6	None	0	2.02 MB	frangio
npm/@openzeppelin/hardhat-upgrades@1.21.0	filesystem Transitive: environment, eval, network, unsafe	+125	31.8 MB	ericglau
npm/@typechain/ethers-v5@5.0.0	Transitive: network	+44	18.1 MB	ethereum-ts-bot
npm/hardhat-typechain@0.3.5	filesystem	0	17.7 kB	rhlsthrm
npm/hardhat@2.10.1	environment, filesystem, network, shell Transitive: eval, unsafe	+290	78.7 MB	fvictorio
npm/ts-generator@0.1.1	filesystem Transitive: environment, unsafe	+28	18 MB	krzkaczor
npm/ts-node@10.9.1	environment, filesystem, unsafe	+17	3.68 MB	cspotcode
npm/typechain@4.0.3	Transitive: environment, filesystem	+14	1.98 MB	ethereum-ts-bot
npm/typescript@4.7.4	None	0	67.2 MB	typescript-bot

🚮 Removed packages: npm/@apollographql/apollo-tools@0.5.4, npm/@apollographql/graphql-playground-html@1.6.29, npm/@babel/runtime@7.15.4, npm/@consento/sync-randombytes@1.0.5, npm/@graphql-tools/batch-execute@8.4.7, npm/@graphql-tools/delegate@8.7.8, npm/@graphql-tools/merge@8.2.11, npm/@graphql-tools/mock@8.6.9, npm/@graphql-tools/schema@8.3.11, npm/@graphql-tools/utils@8.6.10, npm/@protobufjs/aspromise@1.1.2, npm/@truffle/abi-utils@0.2.13, npm/@truffle/code-utils@1.2.34, npm/@truffle/codec@0.12.12, npm/@truffle/compile-common@0.7.31, npm/@truffle/config@1.3.28, npm/@truffle/db-loader@0.1.16, npm/@truffle/db@1.0.6, npm/@truffle/debugger@10.0.10, npm/@truffle/events@0.1.6, npm/@truffle/interface-adapter@0.5.16, npm/@truffle/preserve-fs@0.2.7, npm/@truffle/preserve-to-buckets@0.2.8, npm/@truffle/preserve-to-filecoin@0.2.9, npm/@truffle/preserve-to-ipfs@0.2.8, npm/@truffle/preserve@0.2.7, npm/@truffle/provider@0.2.54, npm/@truffle/source-map-utils@1.3.84, npm/@types/accepts@1.3.5, npm/@types/body-parser@1.19.2, npm/@types/cors@2.8.12, npm/@types/express-serve-static-core@4.17.28, npm/@types/express@4.17.13, npm/@types/google-protobuf@3.15.5, npm/@types/long@4.0.2, npm/@types/node@18.8.4, npm/@types/ws@7.4.7, npm/abstract-leveldown@7.2.0, npm/accepts@1.3.8, npm/ajv@8.6.3, npm/any-signal@2.1.2, npm/apollo-datasource@3.3.1, npm/apollo-server-core@3.7.0, npm/apollo-server-errors@3.3.1, npm/apollo-server-express@3.7.0, npm/apollo-server@3.7.0, npm/asn1.js@5.4.1, npm/axios@0.26.1, npm/base-x@3.0.8, npm/bech32@1.1.3, npm/bitcore-lib@8.25.10, npm/bn.js@5.2.0, npm/body-parser@1.20.0, npm/browser-headers@0.4.1, npm/browser-readablestream-to-it@1.0.3, npm/catering@2.1.1, npm/cids@1.1.9, npm/cli-cursor@3.1.0, npm/colors@1.4.0, npm/commander@2.20.3, npm/content-disposition@0.5.4, npm/cors@2.8.5, npm/cross-spawn@6.0.5, npm/debug@4.3.2, npm/define-properties@1.1.4, npm/encoding@0.1.13, npm/err-code@2.0.3, npm/escape-html@1.0.3, npm/ethers@4.0.49, npm/events@3.3.0, npm/express@4.18.2, npm/faker@5.5.3, npm/find-yarn-workspace-root@2.0.0, npm/follow-redirects@1.15.0, npm/foreach@2.0.6, npm/get-intrinsic@1.1.3, npm/google-protobuf@3.21.2, npm/graceful-fs@4.2.8, npm/graphql-tag@2.12.6, npm/has@1.0.3, npm/is-buffer@2.0.5, npm/isomorphic-ws@4.0.1, npm/json-pointer@0.6.2, npm/leveldown@6.1.0, npm/loglevel@1.7.1, npm/lower-case@1.1.4, npm/lru-cache@6.0.0, npm/micromatch@4.0.4, npm/mimic-fn@3.1.0, npm/minimatch@3.0.4, npm/minimist@1.2.7, npm/mocha@9.2.2, npm/multiaddr@8.1.2, npm/multibase@3.1.2, npm/multiformats@9.4.8, npm/multihashes@3.1.2, npm/nanoid@3.1.29, npm/napi-macros@2.0.0, npm/native-abort-controller@0.0.3, npm/no-case@2.3.2, npm/node-fetch@2.6.7, npm/object-assign@4.1.1, npm/object-keys@1.1.1, npm/on-finished@2.4.1, npm/onetime@5.1.2, npm/parseurl@1.3.3, npm/pascal-case@2.0.1, npm/patch-package@6.4.7, npm/path-key@2.0.1, npm/picomatch@2.3.0, npm/pouchdb@7.2.2, npm/protobufjs@6.11.3, npm/qs@6.10.3, npm/queue-microtask@1.2.3, npm/reselect-tree@1.3.7, npm/rxjs@6.6.7, npm/secp256k1@4.0.2, npm/setimmediate@1.0.4, npm/stream-to-it@0.2.4, npm/truffle@5.5.8, npm/tslib@2.4.0, npm/type-is@1.6.18, npm/unorm@1.6.0, npm/upper-case-first@1.1.2, npm/upper-case@1.1.3, npm/vary@1.1.2, npm/web-encoding@1.1.5, npm/web3-eth-abi@1.5.3, npm/web3-utils@1.5.3, npm/web3@1.5.3, npm/websocket@1.0.34, npm/which@1.3.1, npm/workerpool@6.2.0, npm/ws@7.5.7, npm/yargs@17.2.1

View full report↗︎

[socket-security]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	Source
Install scripts	npm/core-js-pure@3.23.5	Install script: postinstall Source: node -e "try{require('./postinstall')}catch(e){}"	tests/integration_tests/hardhat/package-lock.json tests/integration_tests/hardhat/package.json

View full report↗︎

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore npm/core-js-pure@3.23.5