Vulnerabilities reported in dependency

[sebastiantf]

Describe the bug Dependabot reported vulnerability in dependency:

• async@2.6.2: https://github.com/advisories/GHSA-fwr7-v2mv-hh25

  // yarn why async --recursive
  // ...
     ├─ ethereum-waffle@npm:3.4.4 (via npm:^3.4.4)
  │  ├─ @ethereum-waffle/chai@npm:3.4.4 (via npm:^3.4.4)
  │  │  └─ @ethereum-waffle/provider@npm:3.4.4 (via npm:^3.4.4)
  │  │     └─ ganache-core@npm:2.13.2 (via npm:^2.13.2)
  │  │        ├─ async@npm:2.6.2 (via npm:2.6.2)

• node-fetch@1.7.3:
  • https://github.com/advisories/GHSA-r683-j2x4-v87g
  • https://github.com/advisories/GHSA-w7rc-rwvf-8q5r

    // yarn why node-fetch --recursive
    // ...
      ├─ ethereum-waffle@npm:3.4.4 (via npm:^3.4.4)
    │  ├─ @ethereum-waffle/chai@npm:3.4.4 (via npm:^3.4.4)
    │  │  └─ @ethereum-waffle/provider@npm:3.4.4 (via npm:^3.4.4)
    │  │     └─ ganache-core@npm:2.13.2 (via npm:^2.13.2)
    │  │        └─ web3-provider-engine@npm:14.2.1 (via npm:14.2.1)
    │  │           ├─ cross-fetch@npm:2.2.6 (via npm:^2.1.0)
    │  │           │  └─ node-fetch@npm:2.6.7 [6ad6d] (via npm:^2.6.7 [6ad6d])
    │  │           └─ eth-json-rpc-infura@npm:3.2.1 (via npm:^3.1.0)
    │  │              ├─ cross-fetch@npm:2.2.6 (via npm:^2.1.1)
    │  │              └─ eth-json-rpc-middleware@npm:1.6.0 (via npm:^1.5.0)
    │  │                 └─ fetch-ponyfill@npm:4.1.0 (via npm:^4.0.0)
    │  │                    └─ node-fetch@npm:1.7.3 (via npm:~1.7.1)

To Reproduce

1. Install ethereum-waffle
2. Push to GitHub
3. Enable Dependabot and wait for its reports

Software versions

• ethereum-waffle v3.4.4
• @nomiclabs/hardhat-waffle v2.0.2
• @nomiclabs/hardhat-ethers v2.0.5
• hardhat v2.8.4
  • yarn v3.1.0
  • Node v16.17.0

[ee99ee]

+1 for this

[rzadp]

Waffle 4 is out, which got rid of deprecated ganache-core - that alone should have fixed most of the vulnerabilities :) We now depend on ganache package.

We also updated a lot of other dependencies.