Filipe/platf 5412 pin dependencies

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    cooldown:
+      default-days: 7
+      include:
+        - "*"
+    versioning-strategy: auto

packages/eslint-config/index.js

@@ -6,7 +6,9 @@ const mochaPlugin = require('eslint-plugin-mocha')
 const typescriptEslint = require('typescript-eslint')
 const evmAddressPlugin = require('eslint-plugin-evm-address-to-checksummed')
 const jsonPlugin = require('eslint-plugin-json')
+const jsonc = require("eslint-plugin-jsonc");
 const sortKeysFix = require('eslint-plugin-sort-keys-fix')
+const jsonParser = require("jsonc-eslint-parser");
 
 
 /**
@@ -76,10 +78,14 @@ module.exports = [
     },
   },
   {
-    files: ['**/*.json'],
-    ...jsonPlugin.configs.recommended,
+    files: ["**/*.json"],
+    languageOptions: {
+      parser: jsonParser,
+    },
+    plugins: { jsonc },
     rules: {
-      'json/json': ['error', { allowComments: true }],
+      ...jsonc.configs["recommended-with-json"].rules,
+      "jsonc/no-comments": "off",
     },
   },
   {
@@ -97,4 +103,23 @@ module.exports = [
       'typechain-types',
     ],
   },
+  {
+    files: ["**/package.json"],
+    languageOptions: { parser: jsonParser },
+    plugins: {
+      "unevenlabs-policy": {
+        rules: {
+          "pinned-deps": require("./rules/pinned-deps.cjs"),
+        },
+      },
+    },
+    rules: {
+      "unevenlabs-policy/pinned-deps": ["error", {
+        internalScopes: ["@relay-vaults/"],
+        allowProtocols: ["workspace:", "^workspace:"],
+        allowProtocolsOnlyForInternal: true,
+        allowExactPrerelease: true,
+      }],
+    },
+  },
 ]

packages/eslint-config/package.json

@@ -7,6 +7,7 @@
     "eslint-config-prettier": "10.1.8",
     "eslint-plugin-evm-address-to-checksummed": "0.0.6",
     "eslint-plugin-json": "4.0.1",
+    "eslint-plugin-jsonc": "2.21.0",
     "eslint-plugin-mocha": "11.1.0",
     "eslint-plugin-prettier": "5.5.4",
     "typescript-eslint": "8.40.0"

packages/eslint-config/rules/pinned-deps.cjs

@@ -0,0 +1,144 @@
+"use strict";
+
+/**
+ * Enforce pinned deps in package.json:
+ * - allow protocols (workspace:, file:, link:, etc.) for internal packages
+ * - require exact x.y.z for everything else
+ * - no autofix
+ */
+
+const DEFAULT_DEP_FIELDS = [
+  "dependencies",
+  "devDependencies",
+  "peerDependencies",
+  "optionalDependencies",
+];
+
+function isObjectExpression(node) {
+  return node && (node.type === "ObjectExpression" || node.type === "JSONObjectExpression");
+}
+
+function getPropKeyString(prop) {
+  const k = prop.key;
+  if (!k) return null;
+  // JS parser: Literal
+  if (k.type === "Literal" && typeof k.value === "string") return k.value;
+  // jsonc-eslint-parser: JSONLiteral
+  if (k.type === "JSONLiteral" && typeof k.value === "string") return k.value;
+  return null;
+}
+
+function getLiteralString(node) {
+  if (!node) return null;
+  if (node.type === "Literal" && typeof node.value === "string") return node.value;
+  if (node.type === "JSONLiteral" && typeof node.value === "string") return node.value;
+  return null;
+}
+
+function getObjectPropertyValue(objExpr, keyName) {
+  if (!isObjectExpression(objExpr)) return null;
+  for (const p of objExpr.properties || []) {
+    if (!p || (p.type !== "Property" && p.type !== "JSONProperty")) continue;
+    const k = getPropKeyString(p);
+    if (k === keyName) return p.value;
+  }
+  return null;
+}
+
+module.exports = {
+  meta: {
+    type: "problem",
+    docs: { description: "Require pinned dependency versions in package.json" },
+    schema: [
+      {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          depFields: { type: "array", items: { type: "string" } },
+          excludeList: { type: "array", items: { type: "string" } },
+          internalScopes: { type: "array", items: { type: "string" } },
+          allowProtocols: { type: "array", items: { type: "string" } },
+          allowProtocolsOnlyForInternal: { type: "boolean" },
+          allowExactPrerelease: { type: "boolean" },
+        },
+      },
+    ],
+  },
+
+  create(context) {
+    const opt = context.options[0] || {};
+    const depFields = opt.depFields || DEFAULT_DEP_FIELDS;
+    const excludeList = opt.excludeList || [];
+    const internalScopes = opt.internalScopes || [];
+    const allowProtocols = opt.allowProtocols || ["workspace:", "file:", "link:"];
+    const allowProtocolsOnlyForInternal = opt.allowProtocolsOnlyForInternal !== false; // default true
+    const allowExactPrerelease = !!opt.allowExactPrerelease;
+
+    const exact = allowExactPrerelease
+      ? /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z-.]+)?(?:\+[0-9A-Za-z-.]+)?$/
+      : /^[0-9]+\.[0-9]+\.[0-9]+$/;
+
+    function shouldExclude(name) {
+      return excludeList.some((p) => name.startsWith(p));
+    }
+
+    function isInternal(name) {
+      return internalScopes.some((p) => name.startsWith(p));
+    }
+
+    function isAllowedProtocol(version) {
+      return allowProtocols.some((p) => version.startsWith(p));
+    }
+
+    function report(node, depName, field, version) {
+      context.report({
+        node,
+        message:
+          `Dependency "${depName}" in "${field}" must be pinned to an exact version (x.y.z). ` +
+          `Got "${version}".` +
+          (internalScopes.length ? ` Internal scopes: ${internalScopes.join(", ")}.` : "") +
+          (allowProtocols.length
+            ? ` Allowed protocols: ${allowProtocols.join(", ")}.` +
+              (allowProtocolsOnlyForInternal ? " (internal only)" : "")
+            : ""),
+      });
+    }
+
+    return {
+      "Program:exit"(program) {
+        const expr = program.body?.[0]?.expression;
+        if (!isObjectExpression(expr)) return;
+
+        for (const field of depFields) {
+          const depObj = getObjectPropertyValue(expr, field);
+          if (!isObjectExpression(depObj)) continue;
+
+          for (const p of depObj.properties || []) {
+            if (!p || (p.type !== "Property" && p.type !== "JSONProperty")) continue;
+
+            const depName = getPropKeyString(p);
+            const version = getLiteralString(p.value);
+            if (!depName || version == null) continue;
+
+            if (shouldExclude(depName)) {
+              continue;
+            }
+
+            // allow protocols
+            if (isAllowedProtocol(version)) {
+              if (allowProtocolsOnlyForInternal && !isInternal(depName)) {
+                report(p.value, depName, field, version);
+              }
+              continue;
+            }
+
+            // require exact semver
+            if (!exact.test(version)) {
+              report(p.value, depName, field, version);
+            }
+          }
+        }
+      },
+    };
+  },
+};

packages/helpers/package.json

@@ -35,8 +35,8 @@
   "devDependencies": {
     "@relay-vaults/networks": "workspace:^",
     "@relay-vaults/tsconfig": "workspace:^",
-    "@types/copyfiles": "2",
-    "@types/fs-extra": "11",
+    "@types/copyfiles": "2.4.4",
+    "@types/fs-extra": "11.0.4",
     "copyfiles": "2.4.1",
     "eslint": "9.33.0",
     "fs-extra": "11.3.1",

smart-contracts/ignition/deployments/BridgeProxy-1-0xC7273772b87860097373D91b3880fd4CC61fBa2d-arbitrumDeposit-1/deployed_addresses.json

@@ -1,3 +1,3 @@
 {
   "ArbitrumOrbitNativeDepositBridgeProxy#ArbitrumOrbitNativeDepositBridgeProxy": "0x42C580BA1001f47cf216558aeD8a6C28eb0211BF"
-}
+}

smart-contracts/ignition/deployments/BridgeProxy-1-0xC7273772b87860097373D91b3880fd4CC61fBa2d-arbitrumDeposit-42161/deployed_addresses.json

@@ -1,3 +1,3 @@
 {
   "ArbitrumOrbitNativeDepositBridgeProxy#ArbitrumOrbitNativeDepositBridgeProxy": "0x52690873b22B0949A3A2c1AaD22653218460A002"
-}
+}

smart-contracts/ignition/deployments/RelayBridgeFactory-1/deployed_addresses.json

@@ -1,3 +1,3 @@
 {
   "RelayBridgeFactory#RelayBridgeFactory": "0x3A691355348DDC549515A7b538f3e85bCCdFe0B5"
-}
+}

smart-contracts/ignition/deployments/bridges/1/0x339680db3B90f2C5aa825C6296C14A4a231391dE/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0xc005dc82818d67AF737725bD4bf75435d065D239",
   "proxyBridgeAddress": "0x42C580BA1001f47cf216558aeD8a6C28eb0211BF"
-}
+}

smart-contracts/ignition/deployments/bridges/1135/0x9551c38fA964cd0c9f753AA6FbC9f6383DB1B718/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0x2f2aFaE1139Ce54feFC03593FeE8AB2aDF4a85A7",
   "proxyBridgeAddress": "0x8F7592190a8335cf1A6E9Cd9Cf0FA73661e6B43a"
-}
+}

smart-contracts/ignition/deployments/bridges/1135/0x9fB81934541E3f39d1fd8727E05dd9b05e17F2FA/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0x2f2aFaE1139Ce54feFC03593FeE8AB2aDF4a85A7",
   "proxyBridgeAddress": "0x6339F2AEbe65A1C23B77d6CF149965feeadeB29c"
-}
+}

smart-contracts/ignition/deployments/bridges/1135/0xc5B6007B65522359Cf0F5f924559b789F6383a78/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0x2f2aFaE1139Ce54feFC03593FeE8AB2aDF4a85A7",
   "proxyBridgeAddress": "0xa59d3967653d7a5B7e4196a99D25329FBC10aD73"
-}
+}

smart-contracts/ignition/deployments/bridges/1380012617/0x1C332aBA6d34661b086856f3F63C0f31715d6e6e/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0x65dCf8F6b3f6a0ECEdf3d0bdCB036AEa47A1d615",
   "proxyBridgeAddress": "0xf98D7ADA874D53a75BbDfB05D2A96C1525d426A7"
-}
+}

smart-contracts/ignition/deployments/bridges/1380012617/0x31bb91fFb28b7b849a7e08a3fa7d31f393E78eFD/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0x65dCf8F6b3f6a0ECEdf3d0bdCB036AEa47A1d615",
   "proxyBridgeAddress": "0x679436B2c2A71d9317a9aC652d06CA2b958B6Cd4"
-}
+}

smart-contracts/ignition/deployments/bridges/1380012617/0xd1543E44d64B46944667E4465930A6B28EEA6F93/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0x65dCf8F6b3f6a0ECEdf3d0bdCB036AEa47A1d615",
   "proxyBridgeAddress": "0x67DEfE8d90c8cD013fD527669e76e0bE420F1208"
-}
+}

smart-contracts/ignition/deployments/bridges/185/0x0d6D00b4F379Fd6DB2Dff0C0BE7e2A602Aa65F9E/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0x2f2aFaE1139Ce54feFC03593FeE8AB2aDF4a85A7",
   "proxyBridgeAddress": "0xfA52054db476c897efE3d066050cefCa92dFc583"
-}
+}

smart-contracts/ignition/deployments/bridges/1868/0x4573e21aC8717B936c197755a46F984a7f2af9CF/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0x3a464f746D23Ab22155710f44dB16dcA53e0775E",
   "proxyBridgeAddress": "0x5A48e2D885480aBdd16BC9FF03e88D996D2746DA"
-}
+}

smart-contracts/ignition/deployments/bridges/1923/0xea65940bb6C3691c83b86D3b7Fa7C8bbeABDA409/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0x3a464f746D23Ab22155710f44dB16dcA53e0775E",
   "proxyBridgeAddress": "0x0E764Ff0a870bB65a0B8d4753475F9eAecB061A0"
-}
+}

smart-contracts/ignition/deployments/bridges/42170/0x0d6D00b4F379Fd6DB2Dff0C0BE7e2A602Aa65F9E/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0x3a867fCfFeC2B790970eeBDC9023E75B0a172aa7",
   "proxyBridgeAddress": "0xfA52054db476c897efE3d066050cefCa92dFc583"
-}
+}

smart-contracts/ignition/deployments/bridges/43111/0x1Ed47efb9252E6FE586C8bda9af7bc67e97D4f2D/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0x3a464f746D23Ab22155710f44dB16dcA53e0775E",
   "proxyBridgeAddress": "0x0E764Ff0a870bB65a0B8d4753475F9eAecB061A0"
-}
+}

smart-contracts/ignition/deployments/bridges/543210/0xb17F41bCb06Bf95805932a7881Bb37f1D43e3dAC/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0xd7b351D2dE3495eA259DD10ab4b9300A378Afbf3",
   "proxyBridgeAddress": "0x6a0fcA19fb7A6929feef4cF665e82Da7E6fB9196"
-}
+}

smart-contracts/ignition/deployments/bridges/60808/0x31bb91fFb28b7b849a7e08a3fa7d31f393E78eFD/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0x8358D8291e3bEDb04804975eEa0fe9fe0fAfB147",
   "proxyBridgeAddress": "0x8be9aBBd00C92eae366eD7DB10BD600c79F3C3ee"
-}
+}

smart-contracts/ignition/deployments/bridges/690/0x0d6D00b4F379Fd6DB2Dff0C0BE7e2A602Aa65F9E/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0xeA87ae93Fa0019a82A727bfd3eBd1cFCa8f64f1D",
   "proxyBridgeAddress": "0xfA52054db476c897efE3d066050cefCa92dFc583"
-}
+}

smart-contracts/ignition/deployments/bridges/7560/0x992E1FFFC52B7A828762a6f361c9088E6F1A1505/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0x2f2aFaE1139Ce54feFC03593FeE8AB2aDF4a85A7",
   "proxyBridgeAddress": "0x6339F2AEbe65A1C23B77d6CF149965feeadeB29c"
-}
+}

smart-contracts/ignition/deployments/bridges/7777777/0x04719a2c2bF08fE755297035337616662fA8d392/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0xF5da68b2577EF5C0A0D98aA2a58483a68C2f232a",
   "proxyBridgeAddress": "0x8F7592190a8335cf1A6E9Cd9Cf0FA73661e6B43a"
-}
+}

smart-contracts/ignition/deployments/bridges/7777777/0x19426e122E0988e1f6ad246Af9B6553492C6D446/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0xF5da68b2577EF5C0A0D98aA2a58483a68C2f232a",
   "proxyBridgeAddress": "0xfA52054db476c897efE3d066050cefCa92dFc583"
-}
+}

smart-contracts/ignition/deployments/bridges/7777777/0x1Ed47efb9252E6FE586C8bda9af7bc67e97D4f2D/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0xF5da68b2577EF5C0A0D98aA2a58483a68C2f232a",
   "proxyBridgeAddress": "0x0E764Ff0a870bB65a0B8d4753475F9eAecB061A0"
-}
+}

smart-contracts/ignition/deployments/bridges/81457/0x61847fb2Ff4725B8bfacb649dd9033fBc06b293E/params.json

@@ -2,4 +2,4 @@
   "assetAddress": "0x0000000000000000000000000000000000000000",
   "hyperlaneMailbox": "0x3a867fCfFeC2B790970eeBDC9023E75B0a172aa7",
   "proxyBridgeAddress": "0x5F36eDb2f100bADa046eB1310175a675DE54aA42"
-}
+}