Add cross-chain options for ERC721, ERC1155, and Governor (Contracts 5.7)

[ericglau]

Adds Wizard support for the new cross-chain contracts in OpenZeppelin Contracts 5.7.

Note

Draft until Contracts 5.7 final is released. Currently built against 5.7.0-rc.0.

New options

• ERC721 / ERC1155: crossChainBridging (ERC-7786 Native) embeds a bridge directly in the token via ERC721Crosschain/ERC1155Crosschain — outbound transfers burn, inbound transfers mint. Adds a CrosschainLinked.Link[] constructor argument and an access-controlled setLink function, with the crossChainLinkAllowOverride sub-option. Mirrors the existing ERC20 erc7786native option.
• Governor: crossChainExecution adds the GovernorCrosschain extension, letting passed proposals relay execution to other chains through ERC-7786 gateways. The CrosschainRemoteExecutor on target chains is deployed by the user (not generated); gateway and executor are per-proposal arguments to relayCrosschain.

Combining ERC721 auto-increment IDs with bridging is allowed but shows a warning (IDs increment independently per chain; mint on a single chain and link non-minting counterparts to avoid collisions that strand bridged tokens).

Covers core codegen, UI, AI assistant descriptions/schemas/function definitions, MCP tools, and CLI.

Fixes

Upgradeable crossChainBridging combinations were previously excluded from the exhaustive compile matrix; they are now covered via reduced blueprints, which surfaced two existing compile errors in upgradeable ERC20 bridging variants (fixed here):

• erc7786native referenced the untranspiled CrosschainLinked.Link[] in the initializer.
• custom with managed access transpiled the AuthorityUtils library import to a nonexistent file.

Additionally, downloaded Foundry and Hardhat projects now compile when constructors have non-address arguments (e.g. cross-chain links, or Governor's token and timelock): the generated test and script files declare typed placeholders and comment out the deployment with a TODO, instead of calling the constructor with missing arguments.

Before merging

• Contracts 5.7.0 final released
• Re-pin @openzeppelin/contracts and @openzeppelin/contracts-upgradeable to ^5.7.0 (core devDependencies and both Hardhat environments) and regenerate lockfiles/snapshot via prepare and update-env
• Update compatibleContractsSemver to ^5.7.0
• Confirm API docs anchors for ERC721Crosschain, ERC1155Crosschain, and GovernorCrosschain resolve

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 0e083004-ad66-4467-a68c-4ec25b537a2e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	ethers@​6.16.0 ⏵ 6.17.0	+5
	@​nomicfoundation/​hardhat-ignition@​3.1.7 ⏵ 3.1.8				+1
	tsx@​4.22.4 ⏵ 4.23.1	+1		+1	+1
	hardhat@​3.8.0 ⏵ 3.10.0	+1		+1
	@​openzeppelin/​contracts-upgradeable@​5.6.0 ⏵ 5.7.0-rc.0			+1	-6
	@​openzeppelin/​contracts@​5.6.1 ⏵ 5.7.0-rc.0				+5
	@​nomicfoundation/​hardhat-ethers@​4.0.13 ⏵ 4.0.15				+2

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Potential security risk (AI signal): npm @nomicfoundation/hardhat-ignition is 75.0% likely risky Notes: This module is not overtly malicious, but it creates a high-impact security risk by using execSync with a shell command string that directly interpolates a caller-provided filePath without sanitization or safe argument handling. If filePath can be influenced by an attacker, this can enable arbitrary command execution (command injection). Refactor to use non-shell execution (e.g., spawn with args) and validate/quote inputs appropriately. Confidence: 0.75 Severity: 0.70 From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/hardhat-ignition@3.1.8 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@nomicfoundation/hardhat-ignition@3.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential security risk (AI signal): npm hardhat is 85.0% likely risky Notes: This module is straightforward telemetry logic but presents notable supply-chain/privacy risk: it takes arbitrary JSON from the command line and transmits it to a third-party analytics endpoint, while also embedding a hardcoded analytics API secret. In test/subprocess mode it avoids network exfiltration but still writes the untrusted payload to an environment-controlled file path. There is no clear evidence of covert malware (e.g., backdoor, reverse shell), but the embedded secret and unconditional handling of arbitrary payload content make it suspicious and should be reviewed for data minimization and secret management. Confidence: 0.85 Severity: 0.72 From: packages/core/solidity/src/environments/hardhat/upgradeable/package-lock.json → npm/hardhat@3.10.0 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/hardhat@3.10.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm @nomicfoundation/edr is 62.0% likely to have a medium risk anomaly Notes: This file is primarily a native-addon loader wrapper. The standout security concern is the environment-variable-driven dynamic require (NAPI_RS_NATIVE_LIBRARY_PATH), which can enable arbitrary module loading if an attacker can influence the process environment. Aside from that, the code performs musl detection via reading /usr/bin/ldd, inspecting process.report, and running execSync('ldd --version'); it delegates all substantive behavior to the loaded native binding and optionally enforces a version string but lacks cryptographic integrity checks. No explicit malicious actions (exfiltration, persistence, eval/Function, reverse shell) are evident in this JS wrapper alone; the malware risk depends heavily on the integrity of the native binaries/packages it loads. Confidence: 0.62 Severity: 0.56 From: packages/core/solidity/src/environments/hardhat/upgradeable/package-lock.json → npm/hardhat@3.10.0 → npm/@nomicfoundation/edr@0.14.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@nomicfoundation/edr@0.14.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm @smithy/core is 65.0% likely to have a medium risk anomaly Notes: The code implements a conventional, well-structured event-stream unmarshalling pipeline with explicit handling for error, exception, and event message types. The primary security considerations are: potential exposure of header/body content through thrown errors, reliance on the deserializer contract (notably the $unknown flag), and ensuring that downstream consumers appropriately trust the deserialized payloads. In a supply-chain context, ensure that eventStreamCodec, deserializer implementations, and error handling are trusted and audited to avoid leaking sensitive metadata, and consider sanitizing error messages in production. Confidence: 0.65 Severity: 0.60 From: packages/core/solidity/src/environments/hardhat/upgradeable/package-lock.json → npm/@openzeppelin/hardhat-upgrades@4.0.2 → npm/@smithy/core@3.29.5 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/core@3.29.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm esbuild is 90.0% likely to have a medium risk anomaly Notes: The esbuild package uses a postinstall install.js script to download platform-specific binaries from registry sources and verify them via hashes. While hash verification reduces risk, the elevated postinstall action creates a potential code-execution surface if the script is tampered with. Audit install.js and its endpoints, ensure artifacts are strictly verified against known hashes, and test in controlled environments before deployment. Confidence: 0.90 Severity: 0.60 From: packages/core/solidity/src/environments/hardhat/upgradeable/package-lock.json → npm/tsx@4.23.1 → npm/esbuild@0.28.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/esbuild@0.28.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm js-yaml is 65.0% likely to have a medium risk anomaly Notes: The script functions as a straightforward JSON↔YAML translator CLI with standard error handling. The primary security concern is the use of yaml.loadAll without a safeLoad alternative, which could enable YAML deserialization risks if inputs contain crafted tags. To improve security, switch to a safe loader (e.g., yaml.safeLoadAll or equivalent) or ensure the library is configured to restrict risky constructors. Overall, no malware indicators were observed; the risk is confined to YAML deserialization semantics. Confidence: 0.65 Severity: 0.60 From: packages/core/solidity/src/environments/hardhat/upgradeable/package-lock.json → npm/ava@6.4.1 → npm/js-yaml@3.15.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-yaml@3.15.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm tar is 66.0% likely to have a medium risk anomaly Notes: This module acts as a standard tar extraction wrapper using synchronous and asynchronous code paths. There is no evident malicious activity within this fragment. Security risk hinges on the behavior of the Unpack/UnpackSync implementation and how tar entries are written to disk (e.g., path traversal). No hardcoded secrets or network calls are present here. Recommend ensuring tar extraction handles path traversal and destination path sanitization in Unpack, and consider validating opt.file presence and type before streaming. Confidence: 0.66 Severity: 0.56 From: packages/core/solidity/src/environments/hardhat/upgradeable/package-lock.json → npm/ava@6.4.1 → npm/tar@7.5.20 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tar@7.5.20. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm undici is 75.0% likely to have a medium risk anomaly Notes: The analyzed code appears to implement a standard in-memory cache batch operation flow (put/delete) with careful handling of response bodies by buffering and storing bytes for caching. No signs of malware, data exfiltration, backdoors, or obfuscated behavior were found. The primary security considerations relate to memory usage from buffering potentially large response bodies and ensuring robust validation within batch operations to prevent cache state corruption. Overall risk is moderate, driven by in-memory data handling rather than external communication. Confidence: 0.75 Severity: 0.60 From: packages/core/solidity/src/environments/hardhat/upgradeable/package-lock.json → npm/@nomicfoundation/hardhat-ignition-ethers@3.1.6 → npm/@nomicfoundation/hardhat-ignition@3.1.8 → npm/@nomicfoundation/hardhat-ethers@4.0.15 → npm/hardhat@3.10.0 → npm/undici@6.27.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@6.27.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm undici is 68.0% likely to have a medium risk anomaly Notes: The analyzed code implements a conventional HTTP/WebSocket-like upgrade handler with proper input validation, abort signal integration, and asynchronous callback management. It does not exhibit malicious activity such as data exfiltration or backdoors. The deliberate onHeaders error path is consistent with protocol expectations to reject non-upgrade responses. Overall security risk remains low to moderate, contingent on integration context, but no indicators of malware or obfuscation are detected in this fragment. Confidence: 0.68 Severity: 0.50 From: packages/core/solidity/src/environments/hardhat/upgradeable/package-lock.json → npm/@nomicfoundation/hardhat-ignition-ethers@3.1.6 → npm/@nomicfoundation/hardhat-ignition@3.1.8 → npm/@nomicfoundation/hardhat-ethers@4.0.15 → npm/hardhat@3.10.0 → npm/undici@6.27.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@6.27.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm undici is 65.0% likely to have a medium risk anomaly Notes: The code is a focused error-handling helper for HTTP responses that safely parses small payloads to include in an error object. It includes protective measures (chunk limits, controlled parsing, microtask-based callbacks) but uses unusual, brittle content-type checks and suppresses stack traces for debugging concealment. There is no evidence of malicious activity, data exfiltration, or backdoors within this fragment. The main risk is potential silent data loss if payloads exceed the chunk limit or mismatched content-type handling leads to missing payloads, but this is a functional trade-off rather than malicious. Suggested improvements include robust content-type parsing, clearer error signaling when payload is truncated, and optional logging to aid debugging without exposing stack traces in production. Confidence: 0.65 Severity: 0.58 From: packages/core/solidity/src/environments/hardhat/upgradeable/package-lock.json → npm/@nomicfoundation/hardhat-ignition-ethers@3.1.6 → npm/@nomicfoundation/hardhat-ignition@3.1.8 → npm/@nomicfoundation/hardhat-ethers@4.0.15 → npm/hardhat@3.10.0 → npm/undici@6.27.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@6.27.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm undici is 77.0% likely to have a medium risk anomaly Notes: The script performs an in-place, lossy re-encoding of a local file from UTF-8 to Latin-1 and rewrites it without backups or validation. This is unsafe due to potential data loss and code corruption, and could be exploited to tamper with source files in a supply chain. It does not exhibit active malware behavior, but its destructive nature warrants removal or strict safeguards (backups, explicit intent, error handling). Confidence: 0.77 Severity: 0.65 From: packages/core/solidity/src/environments/hardhat/upgradeable/package-lock.json → npm/@nomicfoundation/hardhat-ignition-ethers@3.1.6 → npm/@nomicfoundation/hardhat-ignition@3.1.8 → npm/@nomicfoundation/hardhat-ethers@4.0.15 → npm/hardhat@3.10.0 → npm/undici@6.27.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@6.27.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm undici is 63.0% likely to have a medium risk anomaly Notes: The file package/lib/llhttp/llhttp-wasm.js functions as a wrapper around an embedded WASM payload responsible for HTTP parsing, with obfuscated/low-level operations and lazy decoding that defers real behavior to the embedded binary. The lack of integrity checks and the embedded executable raise risk, and the true malicious intent cannot be confirmed without extracting and inspecting the WASM payload and how downstream code instantiates it. Confidence: 0.63 Severity: 0.55 From: packages/core/solidity/src/environments/hardhat/upgradeable/package-lock.json → npm/@openzeppelin/hardhat-upgrades@4.0.2 → npm/undici@8.7.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@8.7.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm undici is 68.0% likely to have a medium risk anomaly Notes: The code performs an in-place re-encoding of a local file (undici-fetch.js) and overwrites it with latin1-encoded data. There is no evidence of exfiltration, backdoors, or network activity. However, the lack of validation, error handling, and the fact that it can corrupt or permanently alter a source file constitutes a nontrivial risk. In a supply-chain or extension context, such a script could be misused to tamper with code. It is not inherently malicious by itself but is risky and should be restricted or audited before typical usage in a build or runtime environment. Confidence: 0.68 Severity: 0.60 From: packages/core/solidity/src/environments/hardhat/upgradeable/package-lock.json → npm/@openzeppelin/hardhat-upgrades@4.0.2 → npm/undici@8.7.0 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/undici@8.7.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm yargs is 65.0% likely to have a medium risk anomaly Notes: The code fragment serves as a standard CLI command-definition utility with a notable security consideration: if an untrusted builder function is supplied, it can execute arbitrary code via the builder callback. There is no evidence of malware, exfiltration, or obfuscated techniques in this fragment. In trusted use, risk remains low; in contexts allowing untrusted inputs, this fragment requires strict input validation or sandboxing to mitigate arbitrary code execution. The recommended security posture is to avoid invoking untrusted builder callbacks or to constrain them to benign shapes and to sanitize or restrict what those builders can access. Confidence: 0.65 Severity: 0.60 From: packages/core/solidity/src/environments/hardhat/upgradeable/package-lock.json → npm/ava@6.4.1 → npm/yargs@17.7.3 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm yargs is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: packages/core/solidity/src/environments/hardhat/upgradeable/package-lock.json → npm/ava@6.4.1 → npm/yargs@17.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report