[dependabot]

Bumps forge-std from v1.9.4 to v1.17.0.

Release notes

Sourced from forge-std's releases.

v1.17.0

Featured Changes

• New StdSecp256k1 library: curve constants, affine and projective identities, scalar validation, parity encodings, and Ethereum address derivation. Includes dedicated unit and fuzz coverage. (#912, #923)
• Expanded cheatcode interface: elliptic-curve operations, slot-number access, eth_getProof, and additional JSON and FFI helpers.
• More reliable stdStorage: discover short string/bytes slots, handle signed fields narrower than 256 bits, and stop access recording after discovery. (#894, #904, #906)
• Config-only chains: load chain configuration without an RPC endpoint; an endpoint is required only when requested. (#903)
• State-gas reporting: Vm.Gas now includes gasStateUsed, with documentation explaining execution gas, state gas, and refunds. (#907)

Compatibility: Vm.Gas gains a field, so explicit struct initializers need updating. Older Foundry versions returning the previous tuple layout may fail decoding; use Foundry v1.8.3 or newer.

All Changes

• chore(deps): bump the ci-weekly group with 3 updates by @​dependabot[bot] in foundry-rs/forge-std#889
• chore: update Vm interface cheatcodes by @​mablr in foundry-rs/forge-std#890
• chore(deps): bump the ci-weekly group with 2 updates by @​dependabot[bot] in foundry-rs/forge-std#891
• chore(deps): bump the ci-weekly group with 3 updates by @​dependabot[bot] in foundry-rs/forge-std#892
• chore(deps): bump the ci-weekly group with 3 updates by @​dependabot[bot] in foundry-rs/forge-std#893
• fix(StdStorage): find short string and bytes slots by @​stevencartavia in foundry-rs/forge-std#894
• chore(deps): bump the ci-weekly group with 2 updates by @​dependabot[bot] in foundry-rs/forge-std#895
• chore(deps): bump the ci-weekly group with 2 updates by @​dependabot[bot] in foundry-rs/forge-std#896
• docs: add NatSpec to Script and Test base contracts by @​daixihegu in foundry-rs/forge-std#880
• chore(deps): bump the ci-weekly group with 2 updates by @​dependabot[bot] in foundry-rs/forge-std#899
• chore: update Vm interface cheatcodes by @​mablr in foundry-rs/forge-std#897
• fix: sync Vm interface IDs by @​decofe in foundry-rs/forge-std#901
• chore(deps): bump the ci-weekly group with 2 updates by @​dependabot[bot] in foundry-rs/forge-std#905
• chore: sync Vm interface cheatcodes by @​mablr in foundry-rs/forge-std#902
• fix: stop stdStorage access recording by @​decofe in foundry-rs/forge-std#906
• chore: sync state gas field by @​figtracer in foundry-rs/forge-std#907
• chore(deps): bump the ci-weekly group with 3 updates by @​dependabot[bot] in foundry-rs/forge-std#908
• fix(StdStorage): handle signed fields narrower than 256 bits by @​pucedoteth in foundry-rs/forge-std#904
• fix(config): let config-only chains load without an RPC endpoint by @​zexoverz in foundry-rs/forge-std#903
• chore(deps): bump the ci-weekly group with 2 updates by @​dependabot[bot] in foundry-rs/forge-std#909
• chore(vm): regenerate cheatcode bindings by @​mattsse in foundry-rs/forge-std#911
• test(StdJson): cover readBytes at parseRaw's inferred-type lengths by @​developer3516 in foundry-rs/forge-std#900
• chore(ci): add secure runner across workflows by @​decofe in foundry-rs/forge-std#914
• chore(deps): bump the ci-weekly group with 2 updates by @​dependabot[bot] in foundry-rs/forge-std#915
• feat: add StdSecp256k1 library by @​StackOverflowExcept1on in foundry-rs/forge-std#912
• chore(ci): update gh-actions pins by @​decofe in foundry-rs/forge-std#916
• chore(ci): scan GitHub Actions workflows by @​decofe in foundry-rs/forge-std#917
• chore: update gh-actions to ee2960a6 by @​decofe in foundry-rs/forge-std#918
• chore(deps): bump the ci-weekly group with 2 updates by @​dependabot[bot] in foundry-rs/forge-std#919
• chore: bump gh-actions to d5402286 by @​decofe in foundry-rs/forge-std#920
• chore: sync Vm interface cheatcodes by @​decofe in foundry-rs/forge-std#921
• test: cover StdSecp256k1 helpers by @​mablr in foundry-rs/forge-std#923
• chore: bump package version to 1.17.0 by @​decofe in foundry-rs/forge-std#922

New Contributors

• @​stevencartavia made their first contribution in foundry-rs/forge-std#894
• @​daixihegu made their first contribution in foundry-rs/forge-std#880

... (truncated)

Changelog

Sourced from forge-std's changelog.

Release checklist

This checklist is meant to be used as a guide for the forge-std release process.

Steps

• Update the version number in package.json
• Open and merge a PR with the version bump
• Tag the merged commit with the version number: git tag v<X.Y.Z>
• Push the tag to the repository: git push --tags
• Create a new GitHub release with the automatically generated changelog and the name set to v<X.Y.Z>
• Add ## Featured Changes section to the top of the release notes

Commits

• f3dae6e chore: bump package version to 1.17.0 (#922)
• 6439066 test: cover StdSecp256k1 helpers (#923)
• dcd750c chore: sync Vm interface cheatcodes (#921)
• 6764d4a chore: bump gh-actions to d5402286 (#920)
• 6b72d0f chore(deps): bump the ci-weekly group with 2 updates (#919)
• 3e2295d chore: update gh-actions to ee2960a6 (#918)
• ba4733c chore(ci): scan GitHub Actions workflows (#917)
• 972a5cf chore(ci): update gh-actions pins (#916)
• 7239323 feat: add StdSecp256k1 library (#912)
• 5e38549 chore(deps): bump the ci-weekly group with 2 updates (#915)
• Additional commits viewable in compare view

[strix-security]

Strix Security Review

Warning

This pull request has 2 commits after the last Strix review (459f1aa). Strix has not reviewed these changes.
Automatic review on push is off for this repository. To review the latest changes, tag @strix-security in a comment, or turn on re-review on push.

No security issues found.

Review summary

PR #56 is a dependabot dev-dependency bump of forge-std from v1.9.4 to v1.17.0 across packages/contracts/package.json and package-lock.json. The change is version-only: no application or contract code is modified, and forge-std is a dev-only Foundry testing library with no runtime exposure. The lock file pins a specific commit hash and adds an integrity hash, which is a supply-chain hardening improvement. No security vulnerabilities were identified in the changed code, and none of the changed lines introduce new attack surface.

_{Updated for 459f1aa.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}