ProjectOpenSea / seadrop
65%

DEFAULT BRANCH: main
Repo Added
Token t3xS0duxYjh8yblsYU5vgRsrPy0qT0CS5 regen
Build 256 Last
Files 22
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH main
branch: main
CHANGE BRANCH
x
Sync Branches

coverage: 64.702%. Remained the same
32750728560

push

github

web-flow 
chore(deps): bundle the five open dependabot lockfile bumps (#176)

## Motivation

Five open dependabot PRs, all lockfile-only transitive bumps, all
currently red because they were branched before the Forge CI fix in
#175. They also all edit the same two lockfiles, so merging them one at
a time forces the rest to rebase and burns a CI run each time.

Bundling them means one review and one CI run instead of five.

Supersedes #168, #169, #170, #171 and #172. Dependabot's commits are
cherry-picked unchanged, so authorship and the advisory trail are
preserved.

| PR | Bump | Advisory |
| --- | --- | --- |
| #172 | brace-expansion 2.0.1 to 2.1.4 | GHSA-mh99-v99m-4gvg,
CVE-2026-13149 (ReDoS) |
| #170 | pbkdf2 3.1.2 to 3.1.6 | CVE-2025-6545, CVE-2025-6547
(predictable key material) |
| #168 | immutable 4.1.0 to 4.3.9 | GHSA-v56q-mh7h-f735,
GHSA-xvcm-6775-5m9r, CVE-2026-29063 |
| #169 | immutable 4.1.0 to 4.3.9, vendored OZ copy | as above |
| #171 | min-document 2.19.0 to 2.19.2, vendored OZ copy | transitive |

## Solution

Two files change and both are lockfiles. No `package.json`, no contract
source, no submodule.

None of these five packages appears in this repo's `dependencies` or
`devDependencies`, so every one is transitive. `yarn.lock` is not
published to npm, so no consumer of the package is affected. The
Solidity dependencies come from the git submodules in `.gitmodules`
rather than npm, so the contracts are untouched.


`src-upgradeable/lib-upgradeable/utility-contracts/lib/openzeppelin-contracts/package-lock.json`
is a vendored copy of OpenZeppelin, not a submodule, and nothing in the
build reads that lockfile. Those two entries (#169 and #171) are inert,
and are included here to close out the queue rather than because they
change behavior.

## Verification

Resolved versions after bundling:

```
yarn.lock          brace-expansion 2.1.4   pbkdf2 3.1.6   immutable 4.3.9
vendored OZ lock   immutable 4.3.9         min-document 2.19.2
```

All five c... (continued)

284 of 605 branches covered (46.94%)

Branch coverage included in aggregate %.

693 of 905 relevant lines covered (76.57%)

722.06 hits per line

Relevant lines Covered
905 RELEVANT LINES 693 COVERED LINES
722.06 HITS PER LINE
Source Files on main

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
32750728560 main chore(deps): bundle the five open dependabot lockfile bumps (#176) ## Motivation Five open dependabot PRs, all lockfile-only transitive bumps, all currently red because they were branched before the Forge CI fix in #175. They also all edit the s... push web-flow github
64.7
32604884141 main fix(ci): stop pinning submodules to tags via `branch` (#175) ## Motivation Both Forge jobs in Test CI fail on the "Install forge dependencies" step, before any contract compiles: ``` Updating dependencies in /home/runner/work/seadrop/seadrop/li... push web-flow github
64.7
32601947829 main docs: point security reports at Bugcrowd in the PR template (#174) ## Motivation The template already keeps its guidance inside HTML comments, so none of it leaks into contributor PR bodies. What it does not say is where to send a security repor... push web-flow github
53.43
12894722482 main fix push ryanio github
64.67
12894634986 main update tests to latest forge-std, lint push ryanio github
64.6
8757065686 main fix upgradeable (#125) closes #124 push web-flow github
59.38
8624225376 main add stale workflow push ryanio github
59.32
8582898819 main fix test push ryanio github
59.32
8582848187 main update new max supply check to check totalMinted instead push ryanio github
59.19
8573469326 main update README to add Base (#121) Updating README to include Base in the Deployments table --------- Co-authored-by: Ryan Ghods <ryan@ryanio.com> push web-flow github
59.19
See All Builds (192)

Badge your Repo: seadrop

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh