Skip to content

Dependency Health Report

Home · Top · Table of Contents

Table of Contents

Kevin K. Le (LinkedIn) — Founder, Founding Engineer, and Current Lead Engineer; Software Engineer at the Oregon Blockchain Group, University of Oregon.

Kellen Snider — Founding Engineer; Software Engineer at the Oregon Blockchain Group, University of Oregon. His vision, ideas, and dedication during TrustLedger's Ethereum development were invaluable to the codebase we build on today.

See CREDITS.md.

Date: 2026-06-10

Audit Evidence

Home · Top · Table of Contents

Approved audit commands were run against npm's audit service.

Command Result
npm audit --json 0 vulnerabilities
npm audit --omit=dev --json 0 vulnerabilities
cd src && npm audit --json 0 vulnerabilities
cd src && npm audit --omit=dev --json 0 vulnerabilities

The root Hardhat 3 migration removed the Hardhat 2 toolbox chain and direct hardhat-gas-reporter usage. Production dependencies are clean in both the root and frontend package trees.

The root override set intentionally pins micro-packed@0.7.2 and @scure/base@1.2.2 for Hardhat 3.9.0. Newer compatible-range releases triggered Node 22.22.3 ESM loader/API mismatches in Hardhat's micro-eth-signer path during Mocha tests.

Outdated Package Sweep

Home · Top · Table of Contents

Safe updates applied on 2026-06-09 and 2026-06-10:

  • Root: @types/node, typescript-eslint, hardhat, direct Hardhat 3 plugins, env-paths, and prettier.
  • Frontend: @tanstack/react-query, @types/node, @types/react, react-doctor, resend, typescript-eslint, viem, and lockfile-resolved transitive updates.

Remaining outdated direct packages are intentionally not force-upgraded in this pass:

  • Frontend eslint/@eslint/js require ESLint 10 migration.
  • Frontend wagmi requires wagmi 3 migration and wallet regression testing.
  • Exact-pinned Next/React packages remain on the repository's pinned versions until a coordinated framework bump is tested.

Vulnerability Chains

Home · Top · Table of Contents

Root package Direct? Severity Dependency path Fix availability Mitigation
N/A N/A N/A N/A N/A Root npm audit is clean after the Hardhat 3 migration.

Breaking-Change Impact

Home · Top · Table of Contents

The Hardhat 3 migration is complete using explicit plugins instead of the all-in-one toolbox. The official hardhat-gas-reporter package still peers on Hardhat 2, so gas reports should use Foundry until a compatible reporter is available.

Deprecation Findings

Home · Top · Table of Contents

Lockfile deprecation metadata and local dependency-chain inspection identified these categories:

Category Packages Chain Risk Action
Fixable Now None proven safe without package migration N/A N/A No direct dependency was safely removable in this pass.
Deferred Until Ecosystem Upgrade None currently identified in the root package tree N/A N/A Keep npm audit clean during future toolchain changes.
Deferred Until Wallet Ecosystem Upgrade MetaMask SDK analytics/provider packages, WalletConnect legacy packages, @stablelib/*, qr-image @reown/appkit -> wagmi connectors -> wallet SDKs Wallet integration compatibility risk Upgrade Reown/wagmi wallet stack only with wallet regression tests.
Mainnet Readiness Risk elliptic, wallet SDK deprecated packages Hardhat dev tooling and wallet connector transitive packages Crypto/wallet supply-chain concern Must be reviewed before mainnet; production audit is currently clean, but wallet packages still need maintainer review.

Remediation Timeline

Home · Top · Table of Contents

  • Immediate: keep production and root development audits clean.
  • Next dependency pass: evaluate a Hardhat 3-compatible gas/coverage reporter only after it avoids the removed Hardhat 2 dependency chain.
  • Before mainnet: remove or formally accept every dev-tool low, refresh wallet SDKs, rerun audit/deprecation checks, and confirm no moderate/high/critical vulnerabilities exist in any package tree.

Authors and Contributors

Home · Top · Table of Contents

  • Kevin K. Le — Founder, Founding Engineer, and Current Lead Engineer (LinkedIn)
  • Kellen Snider — Founding Engineer (LinkedIn)

See CREDITS.md for the complete acknowledgement list.

Home · Top · Table of Contents

This document is part of TrustLedger, an open-source decentralized escrow and arbitration protocol. Use of this software and documentation is subject to the Terms and Conditions, Privacy Policy, and Risk Disclosure. See LEGAL.md for the full compliance and licensing overview.