[ryanio]

Stacked on #1430. It retargets to main once the earlier PRs merge.

Bumps the dependencies that can move without touching deployed bytecode.

• murky and solarray move to their latest commits. Neither is compiled into a deployed contract; the optimized build's sources include no files from either.
• The three open dependabot fixes (Bump handlebars from 4.7.7 to 4.7.10 #1425 handlebars 4.7.10, Bump pbkdf2 from 3.1.2 to 3.1.7 #1423 pbkdf2 3.1.7, Bump brace-expansion from 2.1.4 to 2.1.7 #1422 brace-expansion 2.1.7) are applied as the exact lockfile entries dependabot generated. Merging this closes those PRs.

Deliberately not bumped

• solady, solmate, OpenZeppelin, and seaport-sol stay pinned. The deployed SeaportValidator, SeaportNavigator, and PausableZone compile them in. solady, for example, reaches the navigator through seaport-sol's fulfillment library, so bumping it would change helper bytecode that's deployed at canonical addresses.
• Hardhat stays at 2.21. Even the latest 2.x (2.29.1) doesn't list Node 26 as supported, and a full in-range yarn upgrade would pull 16 transitive packages published in the last two weeks, which Socket blocks. The Hardhat toolchain leaves the repo as its tests move to Foundry, which removes most of the npm tree and its alerts.

Verification

• Foundry with murky and solarray bumped: test profile 484/484, reference profile 484/484.
• Hardhat with the updated lockfile: yarn build, then yarn test with 402 passing. yarn install --frozen-lockfile is clean.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

The lockfile is missing matching selectors and dependency entries for the Handlebars and PBKDF2 upgrades, forcing clean installs to resolve uncommitted dependencies and preventing reproducible installation.

No open issues 🎉

What changed in this PR

Updates development-tool dependencies to incorporate the Dependabot security fixes while preserving deployed contract bytecode.

Changes:

• Bumps Handlebars to 4.7.10, PBKDF2 to 3.1.7, and brace-expansion to 2.1.7.
• Updates the dependency requirements recorded for Handlebars and PBKDF2.

File	Description
yarn.lock	Updates three dependency versions, integrity hashes, and associated dependency requirements.

_{Review effort: Balanced}

[ryanio]

Copilot's body-only finding was right, and it's fixed in 49aaec9. The copied lockfile entries for handlebars 4.7.10 and pbkdf2 3.1.7 declared six dependency ranges with no entry of their own (minimist@^1.2.8, neo-async@^2.6.2, ripemd160@^2.0.3, safe-buffer@^5.2.1, sha.js@^2.4.12, to-buffer@^1.2.2). yarn v1's --frozen-lockfile doesn't catch that. yarn install now records them, every added version is more than two weeks old, and yarn test still passes (402).

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the legacy Hardhat tooling dependency updates.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the test-tooling dependency and lockfile updates.

No open issues 🎉

_{Review effort: Balanced}

[ryanio]

Thanks @tomhirst. On your two notes from Slack:

Extending DeployedBytecode.t.sol to the conduit contracts. I tried it. The deployed ConduitController can't be rebuilt from this repo's source. contracts/conduit/ now wraps seaport-core, whose Conduit has changed since 1.1: it reverts with InvalidERC721TransferAmount(item.amount) where 1.1 had InvalidERC721TransferAmount(). The controller embeds the Conduit's creation code, so its bytecode changes too. With the deployment's settings (solc 0.8.14, via_ir, 1,000,000 runs, london), the current source builds 8,660 bytes of runtime code against 8,820 onchain. The 1.1 tag's own source does reproduce it exactly, metadata included, after the two immutables are filled in. So a test against the repo would fail by design, and one against the tag would never see a repo change.

It also wouldn't have caught the #1429 hook issue. The optimized profile sets bytecode_hash = "none", so a whitespace-only reformat leaves the bytecode unchanged. scripts/frozen-contracts.sha256 catches that case: it pins the source of Seaport.sol, conduit/, helpers/, interfaces/ and zones/, and CI fails on any change.

Dependabot. The handlebars, pbkdf2 and brace-expansion bumps are in this PR's lockfile, so they land with this PR whatever happens to the rest of the stack. #1433 then deletes package.json and yarn.lock, which retires those alerts for good.