DEVSVCS-1213: replace Ganache with Anvil and upgrade webpack and remove esmify #81
Conversation
FelixFan1992
requested review from
justinkaseman,
timothyF95 and
anirudhwarrier
FelixFan1992
changed the title
FelixFan1992
changed the title
DEVSVCS-1213: remove esmify
FelixFan1992
changed the title
|
There was a problem hiding this comment.
LGTM with Thanks!
Noting that comment [1] has been resolved but no plan to handle the sunsetting of anvil-js has been formulated? We are moving from ganache (deprecated) to anvil-js(deprecated) rather than prool.
[1] https://github.com/smartcontractkit/functions-toolkit/pull/81/files#r1970384785
| @@ -593,14 +596,16 @@ return Functions.encodeString(escape("$hello*world?")); | |||
|
|
|||
| ### Local Functions Testnet | |||
|
|
|||
| > **Note** | |||
| > For version 0.3.2 and above of this functions-toolkit package, Anvil is REQUIRED to use `localFunctionsTestnet`. Please run `make install` to install Anvil and all the necessary dependencies. If you already have anvil and/or foundry (the Foundry toolchain) installed, you would not need to run this. But you may want to run `foundryup` to update your version and `npm install` to install packages. | |||
There was a problem hiding this comment.
Let's apply DRY here. Perhaps we ensure this content is complete in the Prereqs section and here simply remind them to double check the Prereqs
Eg: "To use localFunctionsTestnet please make sure your environment is set up as per the #prerequesites, especially in regard to the installation of Foundry/Anvil"
And we can add the make commands to the prereqs?
this way we can update commands/prereqs in the one spot but the user is reminded at the relevant spot.
This PR replaces Ganache with Anvil and upgrades webpack and removes esmify. This resolves all 5 critical vulnerabilities.
But 2 weeks ago, there is a new critical level vulnerability discovered and published.
GHSA-vjh7-7g9h-fjfh
so now it has 4 new critical vulnerabilities. not because its direct dependencies but bc many packages have dependencies on other packages which are using
elliptic<= 6.6.0 . Some of them don't have a recent release so we cannot simply upgrade to a newer version.