ProjectOpenSea / seadrop
65%

DEFAULT BRANCH: main
Repo Added
Token t3xS0duxYjh8yblsYU5vgRsrPy0qT0CS5 regen
Build 252 Last
Files 24
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH main
branch: SELECT
CHANGE BRANCH
x
Sync Branches

coverage: 64.702%. Remained the same
32750728560

push

github

web-flow 
chore(deps): bundle the five open dependabot lockfile bumps (#176)

## Motivation

Five open dependabot PRs, all lockfile-only transitive bumps, all
currently red because they were branched before the Forge CI fix in
#175. They also all edit the same two lockfiles, so merging them one at
a time forces the rest to rebase and burns a CI run each time.

Bundling them means one review and one CI run instead of five.

Supersedes #168, #169, #170, #171 and #172. Dependabot's commits are
cherry-picked unchanged, so authorship and the advisory trail are
preserved.

| PR | Bump | Advisory |
| --- | --- | --- |
| #172 | brace-expansion 2.0.1 to 2.1.4 | GHSA-mh99-v99m-4gvg,
CVE-2026-13149 (ReDoS) |
| #170 | pbkdf2 3.1.2 to 3.1.6 | CVE-2025-6545, CVE-2025-6547
(predictable key material) |
| #168 | immutable 4.1.0 to 4.3.9 | GHSA-v56q-mh7h-f735,
GHSA-xvcm-6775-5m9r, CVE-2026-29063 |
| #169 | immutable 4.1.0 to 4.3.9, vendored OZ copy | as above |
| #171 | min-document 2.19.0 to 2.19.2, vendored OZ copy | transitive |

## Solution

Two files change and both are lockfiles. No `package.json`, no contract
source, no submodule.

None of these five packages appears in this repo's `dependencies` or
`devDependencies`, so every one is transitive. `yarn.lock` is not
published to npm, so no consumer of the package is affected. The
Solidity dependencies come from the git submodules in `.gitmodules`
rather than npm, so the contracts are untouched.


`src-upgradeable/lib-upgradeable/utility-contracts/lib/openzeppelin-contracts/package-lock.json`
is a vendored copy of OpenZeppelin, not a submodule, and nothing in the
build reads that lockfile. Those two entries (#169 and #171) are inert,
and are included here to close out the queue rather than because they
change behavior.

## Verification

Resolved versions after bundling:

```
yarn.lock          brace-expansion 2.1.4   pbkdf2 3.1.6   immutable 4.3.9
vendored OZ lock   immutable 4.3.9         min-document 2.19.2
```

All five c... (continued)

284 of 605 branches covered (46.94%)

Branch coverage included in aggregate %.

693 of 905 relevant lines covered (76.57%)

722.06 hits per line

Relevant lines Covered
905 RELEVANT LINES 693 COVERED LINES
722.06 HITS PER LINE
Source Files on main

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
32750728560 main chore(deps): bundle the five open dependabot lockfile bumps (#176) ## Motivation Five open dependabot PRs, all lockfile-only transitive bumps, all currently red because they were branched before the Forge CI fix in #175. They also all edit the s... push web-flow github
64.7
32750560607 chore/dependency-bumps Merge 8b9d615a6 into 454c9f8da Pull #176 web-flow github
64.7
32604884141 main fix(ci): stop pinning submodules to tags via `branch` (#175) ## Motivation Both Forge jobs in Test CI fail on the "Install forge dependencies" step, before any contract compiles: ``` Updating dependencies in /home/runner/work/seadrop/seadrop/li... push web-flow github
64.7
32604609308 fix/forge-ci-submodule-refs Merge 77f369e3d into fd6e01dfc Pull #175 web-flow github
64.7
32601947829 main docs: point security reports at Bugcrowd in the PR template (#174) ## Motivation The template already keeps its guidance inside HTML comments, so none of it leaks into contributor PR bodies. What it does not say is where to send a security repor... push web-flow github
53.43
32599153900 chore/pr-template-comment Merge dd159c5dc into 6ab8b2ce1 Pull #174 web-flow github
53.43
30667514600 dependabot/npm_and_yarn/brace-expansion-2.1.4 Merge e7636a117 into 6ab8b2ce1 Pull #172 web-flow github
53.43
30359433607 dependabot/npm_and_yarn/src-upgradeable/lib-upgradeable/utility-contracts/lib/openzeppelin-contracts/min-document-2.19.2 Merge 986abb12a into 6ab8b2ce1 Pull #171 web-flow github
53.43
30355954891 dependabot/npm_and_yarn/pbkdf2-3.1.6 Merge 7a950a17d into 6ab8b2ce1 Pull #170 web-flow github
53.43
30148255474 dependabot/npm_and_yarn/src-upgradeable/lib-upgradeable/utility-contracts/lib/openzeppelin-contracts/immutable-4.3.9 Merge 04577ccf8 into 6ab8b2ce1 Pull #169 web-flow github
53.43
See All Builds (188)

Badge your Repo: seadrop

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh