Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump minimum version of truffle #731

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Bump minimum version of truffle #731

wants to merge 2 commits into from

Conversation

wbt
Copy link
Contributor

@wbt wbt commented Jun 24, 2022

This PR updates the Truffle dependency to use a minimum version of what is now the latest one out, which uses a later version of pouchdb incorporating a fix for a high severity vulnerability in node-fetch.

Simply relying on the caret notation and running npm audit fix will not necessarily work, because that will lead to updating the version of web3 used in Truffle to its latest version, which included a breaking change on the patch release number which has not yet been resolved to again bring Truffle's types back into consistency with web3's changed typings; Typescript compilation fails.

Increasing this minimum version, in this case, enhances security.

@changeset-bot
Copy link

changeset-bot bot commented Jun 24, 2022

🦋 Changeset detected

Latest commit: 43b8ee0

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages
Name Type
@typechain/truffle-v5 Patch
example-truffle-v5 Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant