renovate: ledger deps by kanej · Pull Request #8587 · NomicFoundation/hardhat

kanej · 2026-08-28T16:24:03Z

This updates @ledgerhq/hw-app-eth to version 7 in hardhat-ledger. There are no source changes —
every method the handler drives is unchanged in 7 — so this is a manifest and lockfile change.

It also shifts @ledgerhq/hw-transport to ^6.35.7, to avoid a duplicate install version 7 would otherwise leave behind.

Manual testing

This needs a check with an actual ledger:

packages/example-project/scripts/ledger.ts drives all four signing paths against a forked Optimism
node. With a Ledger connected and the Ethereum app open:

Put the device's address into ledgerAccounts on the edrOp network in
packages/example-project/hardhat.config.ts
Run the script. It calls ethSendTransaction() and leaves the other three commented out, so
uncomment one at a time and re-run.

pnpm install && pnpm build
cd packages/example-project
pnpm hardhat run scripts/ledger.ts

changeset-bot · 2026-08-28T16:24:08Z

🦋 Changeset detected

Latest commit: e01249a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@nomicfoundation/hardhat-ledger	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

socket-security · 2026-08-28T16:24:57Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@ledgerhq/hw-transport@6.31.11 ⏵ 6.35.7				^-1

View full report

github-actions · 2026-08-28T16:25:33Z

hardhat

Total size of the bundle: 41M
Total number of dependencies (including transitive): 38

List of dependencies (sorted by size)

33M	total
7.3M	@sentry/core
5.2M	zod
3.8M	micro-eth-signer
2.2M	undici
2.2M	@noble/curves
1.8M	@noble/hashes
1.3M	@nomicfoundation/hardhat-utils
1.1M	@noble/ciphers
884K	@nomicfoundation/hardhat-vendored
864K	@streamparser/json
692K	tsx
656K	@nomicfoundation/hardhat-errors
536K	@scure/bip39
508K	ethereum-cryptography
468K	micro-packed
408K	json-stream-stringify
332K	@streamparser/json-node
320K	enquirer
320K	@nomicfoundation/hardhat-zod-utils
292K	semver
208K	@scure/base
204K	ws
204K	adm-zip
168K	esbuild
152K	@nomicfoundation/edr
136K	fast-equals
108K	@scure/bip32
100K	chokidar
72K	@nomicfoundation/solidity-analyzer
56K	rfdc
48K	ansi-colors
44K	resolve.exports
44K	readdirp
36K	p-map
24K	strip-ansi
24K	is-safe-filename
24K	env-paths
24K	ansi-regex

Copilot

Pull request overview

Updates hardhat-ledger’s Ledger dependency set to support @ledgerhq/hw-app-eth v7, along with the associated lockfile and release metadata changes.

Changes:

Bump @ledgerhq/hw-app-eth to ^7.0.0 and @ledgerhq/hw-transport to ^6.35.7 in hardhat-ledger.
Refresh pnpm-lock.yaml to reflect the new Ledger dependency graph.
Add a changeset publishing @nomicfoundation/hardhat-ledger as a minor release.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
`pnpm-lock.yaml`	Updates the resolved dependency graph for the workspace after the Ledger package upgrades.
`packages/hardhat-ledger/package.json`	Bumps the Ledger dependencies used by the `hardhat-ledger` package.
`.changeset/update-hardhat-ledger-hw-app-eth.md`	Declares a minor release for `@nomicfoundation/hardhat-ledger` due to the dependency major upgrade.

Files not reviewed (1)

pnpm-lock.yaml: Generated file

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

  "dependencies": {
    "@ledgerhq/errors": "^6.25.0",
    "@ledgerhq/evm-tools": "^1.7.7",
-    "@ledgerhq/hw-app-eth": "^6.45.19",
-    "@ledgerhq/hw-transport": "^6.31.11",
+    "@ledgerhq/hw-app-eth": "^7.0.0",
+    "@ledgerhq/hw-transport": "^6.35.7",
    "@ledgerhq/hw-transport-node-hid": "^6.29.12",
    "@ledgerhq/types-live": "^6.85.0",


kanej · 2026-08-31T10:03:48Z

    // Shared properties
    to: hardhatAddress,
    value: 10000000n,
-    gas: 310000n,


This was an old bug. You should be able to use the script cleanly now.

Copilot

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

pnpm-lock.yaml: Generated file

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

.changeset/update-hardhat-ledger-hw-app-eth.md:5

This changeset mentions only @ledgerhq/hw-app-eth, but the PR also bumps @ledgerhq/hw-transport. It’s worth including that in the release note so consumers understand the full dependency upgrade.

Update the `@ledgerhq/hw-app-eth` dependency to its latest major version.

packages/hardhat-ledger/package.json:65

@ledgerhq/hw-transport@^6.35.7 pulls in @ledgerhq/errors@7 (see pnpm-lock.yaml snapshots), but this package still pins @ledgerhq/errors@^6.25.0. Since src/internal/handler.ts relies on instanceof checks against these error classes, having multiple major versions can make those checks fail and break retry/diagnostic logic. Consider aligning @ledgerhq/errors (and ideally the other Ledger deps) to the same major used by the transport/app packages, or switching the code to a version-agnostic check (e.g. by name/properties) if deduping isn’t possible.

    "@ledgerhq/errors": "^6.25.0",
    "@ledgerhq/evm-tools": "^1.7.7",
    "@ledgerhq/hw-app-eth": "^7.0.0",
    "@ledgerhq/hw-transport": "^6.35.7",
    "@ledgerhq/hw-transport-node-hid": "^6.29.12",

    // Shared properties
    to: hardhatAddress,
    value: 10000000n,
-    gas: 310000n,
+    gasLimit: 310000n,



Copilot

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Files not reviewed (1)

pnpm-lock.yaml: Generated file

Suppressed comments (2)

packages/hardhat-ledger/package.json:64

@ledgerhq/hw-transport@6.35.7 brings in @ledgerhq/errors@7, but this package still pins @ledgerhq/errors@^6.25.0. Since the handler relies on instanceof checks against Ledger error classes (e.g. DisconnectedDevice, TransportStatusError), having two different @ledgerhq/errors copies will cause those checks to fail when the thrown error comes from v7, breaking the retry/diagnostic logic. Align the direct dependency to v7 (and regenerate the lockfile) so all Ledger packages share the same error class instances.

    "@ledgerhq/errors": "^6.25.0",
    "@ledgerhq/evm-tools": "^1.7.7",
    "@ledgerhq/hw-app-eth": "^7.0.0",
    "@ledgerhq/hw-transport": "^6.35.7",

packages/example-project/scripts/ledger.ts:38

The PR description says this is “a manifest and lockfile change” with “no source changes”, but this PR also changes packages/example-project/scripts/ledger.ts (renaming gas to gasLimit). Consider updating the PR description to reflect the additional source change so reviewers know to include it in verification/testing.

    // Shared properties
    to: hardhatAddress,
    value: 10000000n,
    gasLimit: 310000n,

This is a pure dependency bump. No code changes were required. `hw-transport` is bumped to match hw-app-eth's used version.

The script was using `gas` rather than `gasLimit`, this mistake was hidden until a recent change.

Copilot

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Files not reviewed (1)

pnpm-lock.yaml: Generated file

Suppressed comments (3)

packages/hardhat-ledger/package.json:64

@ledgerhq/hw-transport@6.35.7 pulls in @ledgerhq/errors@7.0.0 (see pnpm-lock), but this package still pins @ledgerhq/errors to ^6.25.0. Since LedgerHandler does multiple error instanceof TransportError/TransportStatusError/... checks, having two @ledgerhq/errors copies will make those checks unreliable and can break retry / error classification at runtime. Align @ledgerhq/errors (and the directly used Ledger libs) with the versions used by the upgraded transport/app packages to ensure a single error class identity.

    "@ledgerhq/errors": "^6.25.0",
    "@ledgerhq/evm-tools": "^1.7.7",
    "@ledgerhq/hw-app-eth": "^7.0.0",
    "@ledgerhq/hw-transport": "^6.35.7",

packages/example-project/scripts/ledger.ts:37

PR description says there are no source changes beyond manifest/lockfile updates, but this PR also changes the example script transaction params (gas -> gasLimit). Please update the PR description (or the change) so the stated scope matches the diff.

    // Shared properties
    to: hardhatAddress,
    value: 10000000n,
    gasLimit: 310000n,

packages/hardhat-ledger/package.json:66

This package still pins @ledgerhq/types-live to ^6.85.0, but the upgraded Ledger dependency chain now brings in @ledgerhq/types-live@6.120.0 as well (see pnpm-lock), increasing duplication and the chance of mismatched exported types across the Ledger stack. Consider aligning to the newer version used transitively.

    "@ledgerhq/hw-transport-node-hid": "^6.29.12",
    "@ledgerhq/types-live": "^6.85.0",

Copilot AI lite review requested due to automatic review settings August 28, 2026 16:24

kanej added no docs needed This PR doesn't require links to documentation no peer bump needed labels Aug 28, 2026

Copilot started reviewing on behalf of kanej August 28, 2026 16:24 View session

Copilot AI reviewed Aug 28, 2026

View reviewed changes

kanej requested review from alcuadrado and Copilot August 28, 2026 19:17

Copilot started reviewing on behalf of kanej August 31, 2026 10:01 View session

kanej force-pushed the renovate-9-ledger-deps branch from d6b8279 to 83356a2 Compare August 31, 2026 10:03

kanej requested a review from ChristopherDedominici August 31, 2026 10:03

kanej commented Aug 31, 2026

View reviewed changes

kanej marked this pull request as ready for review August 31, 2026 10:03

Copilot AI reviewed Aug 31, 2026

View reviewed changes

Comment thread packages/example-project/scripts/ledger.ts

Comment on lines 34 to 38

// Shared properties

to: hardhatAddress,

value: 10000000n,

gas: 310000n,

gasLimit: 310000n,

Copilot AI review requested due to automatic review settings August 31, 2026 10:04

Copilot started reviewing on behalf of kanej August 31, 2026 10:04 View session

Copilot AI reviewed Aug 31, 2026

View reviewed changes

kanej added 3 commits August 31, 2026 11:17

chore: bump @ledgerhq/hw-app-eth 6 → 7 in hardhat-ledger

3e169e1

This is a pure dependency bump. No code changes were required. `hw-transport` is bumped to match hw-app-eth's used version.

chore: fixup example project script

df8ac04

The script was using `gas` rather than `gasLimit`, this mistake was hidden until a recent change.

chore: add changeset for the hardhat-ledger dependency update

e01249a

Copilot AI review requested due to automatic review settings August 31, 2026 10:17

kanej force-pushed the renovate-9-ledger-deps branch from 83356a2 to e01249a Compare August 31, 2026 10:17

Copilot started reviewing on behalf of kanej August 31, 2026 10:17 View session

Copilot AI reviewed Aug 31, 2026

View reviewed changes

Navigation Menu

Uh oh!

renovate: ledger deps - #8587

renovate: ledger deps#8587
kanej wants to merge 3 commits into
renovate-8-noble-cryptofrom
renovate-9-ledger-deps

kanej commented Aug 28, 2026

Uh oh!

changeset-bot Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

kanej Aug 31, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

kanej commented Aug 28, 2026

Manual testing

Uh oh!

changeset-bot Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

socket-security Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026

hardhat

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

kanej Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

changeset-bot Bot commented Aug 28, 2026 •

edited

Loading

socket-security Bot commented Aug 28, 2026 •

edited

Loading