Fixing vulnerabilities in HardHat Toolbox

[bthens]

Hey All, the latest version of HardHat Toolbox is 2.0.2 (https://www.npmjs.com/package/@nomicfoundation/hardhat-toolbox), while the latest version of HardHat is 2.14.0 (https://www.npmjs.com/package/hardhat).
While running the npm audit there are vulnerabilities identified for this package, but no way to fix it since it's the latest version released.
Does anyone know when the newer package will be published to NPM registry?

[fvictorio]

Hi @bthens, I think you are mixing up two different things.

• hardhat is, well, Hardhat, the main tool. That one is at v2.14.0
• @nomicfoundation/hardhat-toolbox is a plugin that includes several other plugins and helps get a useful setup with minimal configuration.

AFAIK both are up to date in npm.

[bthens]

Thanks for reaching out. @fvictorio Do you know when the npm audit findings will be addressed in the HardHat Toolbox package, and when the newer version will be released? It's been listed as one of the audit findings to be fixed, so wondering what we can do about it. Thank you in advance.

[fvictorio]

Please read this, it explains well why those results are bogus most of the time: https://overreacted.io/npm-audit-broken-by-design/

Reducing the number of warnings like those is valuable, mainly because they confuse people, but not a top priority for us right now.