fix: reverts nitro version to fix gas estimates (#364)

* bug: reverts nitro version to fix gas estimates

* fix: update default key in env.sample

* fix: updates nyc version and ignores undici vuln flag (#366)

* fix: upgrade's nyc version in lock to fix audit

* fix: ignores undici audit flag

.env-sample

@@ -1,7 +1,7 @@
 ARB_URL="http://localhost:8547"
 ETH_URL="http://localhost:8545"
-ARB_KEY="e887f7d17d07cc7b8004053fb8826f6657084e88904bb61590e498ca04704cf2"
-ETH_KEY=""
+ARB_KEY="b6b15c8cb491557369f3c7d2c287b053eb229daa9c22138887752191c9520659"
+ETH_KEY="b6b15c8cb491557369f3c7d2c287b053eb229daa9c22138887752191c9520659"
 
 INFURA_KEY="2323232323232323232"
 SHOULD_FORK="0"

.github/workflows/build-test.yml

@@ -110,9 +110,11 @@ jobs:
       - name: Restore node_modules
         uses: OffchainLabs/actions/node-modules/restore@main
 
-      - uses: OffchainLabs/actions/run-nitro-test-node@main
+      - name: Set up the local node
+        uses: OffchainLabs/actions/run-nitro-test-node@main
         with:
           no-token-bridge: true
+          nitro-testnode-ref: '520f2589411d76bf2ce740c65658ee81bea433df'
 
       - name: Copy .env
         run: cp ./.env-sample ./.env

audit-ci.jsonc

@@ -112,6 +112,11 @@
     // from: @arbitrum/nitro-contracts>@openzeppelin/contracts-upgradeable
     // from @arbitrum/nitro-contracts>@openzeppelin/contracts
     // We don't use ERC2771Context
-    "GHSA-g4vp-m682-qqmp"
+    "GHSA-g4vp-m682-qqmp",
+    // https://github.com/advisories/GHSA-wqq4-5wpv-mx2g
+    // Undici's cookie header not cleared on cross-origin redirect in fetch
+    // from: hardhat>undici
+    // hardhat is only used in dev
+    "GHSA-wqq4-5wpv-mx2g"
   ]
 }