[ChristopherDedominici]

Notes for the reviewer

• File packages/example-project/scripts/ledger-2.ts is TMP one, it will be removed before merging. It can be used to run manual tests. See comment for more info: https://github.com/NomicFoundation/hardhat/pull/8706/changes#r4262110249

Double check needed

• The Socket warning is about a license not in our approved list: "HIDAPI", used by the hidapi C library bundled in node-hid. It's a permissive open-source license, and main already ships it via node-hid@2.1.2, so I think it can be ignored

[changeset-bot]

🦋 Changeset detected

Latest commit: 3fba5e6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@nomicfoundation/hardhat-ignition	Patch
@nomicfoundation/hardhat-ledger	Major
@nomicfoundation/hardhat-errors	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​ledgerhq/​device-transport-kit-node-hid@​1.0.1
	@​ledgerhq/​device-management-kit@​1.10.0
	@​ledgerhq/​device-signer-kit-ethereum@​1.18.1
	@​ledgerhq/​context-module@​2.6.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm node-hid under HIDAPI License: HIDAPI - The applicable license policy does not permit this license (5) (package/hidapi/LICENSE-orig.txt) From: pnpm-lock.yaml → npm/@ledgerhq/device-transport-kit-node-hid@1.0.1 → npm/node-hid@3.4.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/node-hid@3.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[github-actions]

hardhat

Total size of the bundle: 41M
Total number of dependencies (including transitive): 38

List of dependencies (sorted by size)

33M	total
7.3M	@sentry/core
5.2M	zod
3.8M	micro-eth-signer
2.2M	undici
2.2M	@noble/curves
1.8M	@noble/hashes
1.4M	@nomicfoundation/hardhat-utils
1.1M	@noble/ciphers
884K	@nomicfoundation/hardhat-vendored
792K	@streamparser/json
684K	@nomicfoundation/hardhat-errors
536K	@scure/bip39
508K	ethereum-cryptography
504K	tsx
468K	micro-packed
408K	json-stream-stringify
320K	enquirer
320K	@nomicfoundation/hardhat-zod-utils
292K	semver
216K	adm-zip
208K	@scure/base
204K	ws
188K	@streamparser/json-node
168K	esbuild
156K	@nomicfoundation/edr
152K	fast-equals
108K	@scure/bip32
100K	chokidar
72K	@nomicfoundation/solidity-analyzer
56K	rfdc
48K	ansi-colors
44K	resolve.exports
44K	readdirp
40K	p-map
24K	strip-ansi
24K	is-safe-filename
24K	env-paths
24K	ansi-regex

[ChristopherDedominici]

This file will be removed before merging. It can be used to run manual tests.
Uncomment the test that you wanna run, see first test TEST NR 1.
Tests are divided in priorities, tests under PRIORITY 1 are the most important ones.

[Copilot]

🟡 Changes recommended

DMK error classification, cross-connection concurrency, verification cleanup, and the temporary QA file remain unresolved.

4 open findings

• Per-handler mutex fails to serialize shared device access · New
• Default verification leaks a network connection per contract · New
• DMK-tagged errors bypass device error classification and retries · New
• Remove temporary manual-QA script before merging · New

What changed in this PR

Migrates Hardhat Ledger to Ledger’s Device Management Kit, adding EIP-7702 support, safer typed-data handling, and explicit connection lifecycle management.

Changes:

• Replaces legacy Ledger transport/signing libraries with DMK.
• Adds device discovery, retries, error normalization, concurrency handling, and tests.
• Ensures Ignition tasks close network connections.

File	Description
.changeset/​ignition-close-network-connection.md	Documents Ignition cleanup.
.changeset/​ledger-device-management-kit.md	Documents the DMK migration.
.github/​actions/​setup-env/​action.yml	Updates node-hid dependency notes.
packages/​example-project/​scripts/​ledger-2.ts	Adds temporary manual QA scenarios.
packages/​example-project/​scripts/​ledger.ts	Closes the Ledger connection.
packages/​hardhat-errors/​src/​descriptors.ts	Adds Ledger lifecycle and signing errors.
packages/​hardhat-ignition/​src/​internal/​tasks/​deploy.ts	Closes deployment connections.
packages/​hardhat-ignition/​src/​internal/​tasks/​track-tx.ts	Closes tracking connections.
packages/​hardhat-ignition/​src/​internal/​tasks/​verify.ts	Adds verification connection cleanup.
packages/​hardhat-ledger/​README.md	Documents telemetry and connection closure.
packages/​hardhat-ledger/​package.json	Replaces legacy Ledger dependencies.
packages/​hardhat-ledger/​src/​internal/​cjs-imports.ts	Removes legacy import workaround.
packages/​hardhat-ledger/​src/​internal/​connect-device.ts	Adds DMK session creation.
packages/​hardhat-ledger/​src/​internal/​create-tx.ts	Enables EIP-7702 transactions.
packages/​hardhat-ledger/​src/​internal/​discover-device.ts	Adds polling-based discovery.
packages/​hardhat-ledger/​src/​internal/​dmk-errors.ts	Adds DMK error normalization.
packages/​hardhat-ledger/​src/​internal/​dmk-imports.ts	Centralizes DMK CommonJS imports.
packages/​hardhat-ledger/​src/​internal/​get-y-parity.ts	Rejects unsafe signature values.
packages/​hardhat-ledger/​src/​internal/​handler.ts	Migrates signing and lifecycle logic.
packages/​hardhat-ledger/​src/​internal/​hook-handlers/​network.ts	Closes handlers with connections.
packages/​hardhat-ledger/​src/​internal/​run-device-action.ts	Converts DMK actions into promises.
packages/​hardhat-ledger/​src/​internal/​typed-data.ts	Validates and normalizes typed data.
packages/​hardhat-ledger/​src/​internal/​types.ts	Defines DMK device abstractions.
packages/​hardhat-ledger/​test/​helpers/​dmk-error-classes.ts	Loads real DMK error classes.
packages/​hardhat-ledger/​test/​helpers/​eth-mocked.ts	Removes legacy signer mock.
packages/​hardhat-ledger/​test/​helpers/​ledger-device-mock.ts	Adds configurable DMK device mocks.
packages/​hardhat-ledger/​test/​helpers/​tests-cjs-imports.ts	Removes obsolete test imports.
packages/​hardhat-ledger/​test/​helpers/​transport-node-hid-mock.ts	Removes legacy transport mock.
packages/​hardhat-ledger/​test/​integration.ts	Tests connection closure behavior.
packages/​hardhat-ledger/​test/​internal/​connect-device.ts	Tests DMK lifecycle setup.
packages/​hardhat-ledger/​test/​internal/​discover-device.ts	Tests discovery and timeout behavior.
packages/​hardhat-ledger/​test/​internal/​dmk-errors.ts	Tests DMK error classification.
packages/​hardhat-ledger/​test/​internal/​run-device-action.ts	Tests action-state handling.
packages/​hardhat-ledger/​test/​internal/​typed-data.ts	Tests typed-data validation.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Lifecycle, typed-data, transaction-type, and verification cleanup issues remain, and the temporary QA script must be removed.

5 open findings

• Validate transaction type against EIP-7702 authorization list · New
• Per-handler mutex fails to serialize shared device access
• DMK-tagged errors bypass device error classification and retries
• Default verification leaks a network connection per contract
• Remove temporary manual-QA script before merging

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Previously missed (3)

In code that hasn't changed since last review

Await in-progress device initialization before completing close

packages/​hardhat-ledger/​src/​internal/​handler.ts:625

close() can return while #deviceFactory is still opening a session. At that point #device is undefined, so this reset does nothing; the opening request later assigns and closes the device in #initExclusive, but callers that already awaited close() can still have live discovery/session resources and a process that has not exited. Synchronize closure with in-progress initialization (while still waking retry waits first) so close() resolves only after any late session has been released.

Validate surrogate pairs in EIP-712 keys and type metadata

packages/​hardhat-ledger/​src/​internal/​typed-data.ts:42

The surrogate check only walks domain and message values. It never checks their property names, primaryType, type names, or the name/type strings in types, so malformed UTF-16 can still reach signing through an EIP-712 field/type name even though this validator is intended to reject text that cannot be encoded losslessly. Include keys and all type metadata in the traversal before signing.

Update guidance to reflect the new DMK connection flow

packages/​hardhat-errors/​src/​descriptors.ts:3378

This guidance is stale with the new DMK flow: the signer opens the Ethereum app itself, and connection setup only requires finding an unlocked device. Telling users to open the app conflicts with the updated retry messaging and can send them troubleshooting the wrong condition.

🧠 Review effort: Balanced