[Snyk] Upgrade @openzeppelin/contracts-upgradeable from 5.0.1 to 5.1.0 #4
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade @openzeppelin/contracts-upgradeable from 5.0.1 to 5.1.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 3 versions ahead of your current version.
The recommended version was released on 2 months ago.
Issues fixed by the recommended upgrade:
SNYK-JS-OPENZEPPELINCONTRACTSUPGRADEABLE-6346764
Release notes
Package name: @openzeppelin/contracts-upgradeable
Breaking changes
ERC1967Utils
: Removed duplicate declaration of theUpgraded
,AdminChanged
andBeaconUpgraded
events. These events are still available through theIERC1967
interface located under thecontracts/interfaces/
directory. Minimum pragma version is now 0.8.21.Governor
,GovernorCountingSimple
: The_countVote
virtual function now returns anuint256
with the total votes casted. This change allows for more flexibility for partial and fractional voting. Upgrading users may get a compilation error that can be fixed by adding a return statement to the_countVote
function.Custom error changes
This version comes with changes to the custom error identifiers. Contracts previously depending on the following errors should be replaced accordingly:
Address.FailedInnerCall
withErrors.FailedCall
Address.AddressInsufficientBalance
withErrors.InsufficientBalance
Clones.Create2InsufficientBalance
withErrors.InsufficientBalance
Clones.ERC1167FailedCreateClone
withErrors.FailedDeployment
Clones.Create2FailedDeployment
withErrors.FailedDeployment
SafeERC20
: ReplaceAddress.AddressEmptyCode
withSafeERC20FailedOperation
if there is no code at the token's address.SafeERC20
: Replace genericError(string)
withSafeERC20FailedOperation
if the returned data can't be decoded asbool
.SafeERC20
: Replace genericSafeERC20FailedOperation
with the revert message from the contract call if it fails.Changes by category
General
AccessManager
,VestingWallet
,TimelockController
andERC2771Forwarder
: Added a publicinitializer
function in their corresponding upgradeable variants. (#5008)Access
AccessControlEnumerable
: Add agetRoleMembers
method to return all accounts that haverole
. (#4546)AccessManager
: Allow theonlyAuthorized
modifier to restrict functions added to the manager. (#5014)Finance
VestingWalletCliff
: Add an extension of theVestingWallet
contract with an added cliff. (#4870)Governance
GovernorCountingFractional
: Add a governor counting module that allows distributing voting power amongst 3 options (For, Against, Abstain). (#5045)Votes
: Set_moveDelegateVotes
visibility to internal instead of private. (#5007)Proxy
Clones
: Add version ofclone
andcloneDeterministic
that support sending value at creation. (#4936)TransparentUpgradeableProxy
: Make internal_proxyAdmin()
getter haveview
visibility. (#4688)ProxyAdmin
: Fixed documentation forUPGRADE_INTERFACE_VERSION
getter. (#5031)Tokens
ERC1363
: Add implementation of the token payable standard allowing execution of contract code after transfers and approvals. (#4631)ERC20TemporaryApproval
: Add an ERC-20 extension that implements temporary approval using transient storage, based on ERC7674 (draft). (#5071)SafeERC20
: Add "relaxed" function for interacting with ERC-1363 functions in a way that is compatible with EOAs. (#4631)SafeERC20
: Document risks ofsafeIncreaseAllowance
andsafeDecreaseAllowance
when associated with ERC-7674. (#5262)ERC721Utils
andERC1155Utils
: Add reusable libraries with functions to perform acceptance checks onIERC721Receiver
andIERC1155Receiver
implementers. (#4845)ERC1363Utils
: Add helper similar to the existing ERC721Utils and ERC1155Utils. (#5133)Utils
Arrays
: add asort
functions foraddress[]
,bytes32[]
anduint256[]
memory arrays. (#4846)Arrays
: add new functionslowerBound
,upperBound
,lowerBoundMemory
andupperBoundMemory
for lookups in sorted arrays with potential duplicates. (#4842)Arrays
: deprecatefindUpperBound
in favor of the newlowerBound
. (#4842)Base64
: AddencodeURL
following section 5 of RFC4648 for URL encoding (#4822)Comparator
: A library of comparator functions, useful for customizing the behavior of the Heap structure. (#5084)Create2
: Bubbles up returndata from a deployed contract that reverted during construction. (#5052)Create2
,Clones
: MaskcomputeAddress
andcloneDeterministic
outputs to produce a clean value for anaddress
type (i.e. only use 20 bytes) (#4941)Errors
: New library of common custom errors. (#4936)Hashes
: A library with commonly used hash functions. (#3617)Packing
: Added a new utility for packing, extracting and replacing bytesXX values. (#4992)Panic
: Add a library for reverting with panic codes. (#3298)ReentrancyGuardTransient
: Added a variant ofReentrancyGuard
that uses transient storage. (#4988)Strings
: Added a utility function for converting an address to checksummed string. (#5067)SlotDerivation
: Add a library of methods for derivating common storage slots. (#4975)TransientSlot
: Add primitives for operating on the transient storage space using a typed-slot representation. (#4980)Cryptography
SignatureChecker
: refactorisValidSignatureNow
to avoid validating ECDSA signatures if there is code deployed at the signer's address. (#4951)MerkleProof
: Add variations ofverify
,processProof
,multiProofVerify
andprocessMultiProof
(and equivalent calldata version) with support for custom hashing functions. (#4887)P256
: Library for verification and public key recovery of P256 (aka secp256r1) signatures. (#4881)RSA
: Library to verify signatures according to RFC 8017 Signature Verification Operation (#4952)Math
Math
: add aninvMod
function to get the modular multiplicative inverse of a number in Z/nZ. (#4839)Math
: AddmodExp
function that exposes theEIP-198
precompile. Includesuint256
andbytes memory
versions. (#3298)Math
: Custom errors replaced with native panic codes. (#3298)Math
,SignedMath
: Add a branchlessternary
function that computescond ? a : b
in constant gas cost. (#4976)SafeCast
: AddtoUint(bool)
for operating onbool
values asuint256
. (#4878)Structures
CircularBuffer
: Add a data structure that stores the lastN
values pushed to it. (#4913)DoubleEndedQueue
: Custom errors replaced with native panic codes. (#4872)EnumerableMap
: addUintToBytes32Map
,AddressToAddressMap
,AddressToBytes32Map
andBytes32ToAddressMap
. (#4843)Heap
: A data structure that implements a heap-based priority queue. (#5084)MerkleTree
: A data structure that allows inserting elements into a merkle tree and updating its root hash. (#3617)Breaking changes
ERC1967Utils
: Removed duplicate declaration of theUpgraded
,AdminChanged
andBeaconUpgraded
events. These events are still available through theIERC1967
interface located under thecontracts/interfaces/
directory. Minimum pragma version is now 0.8.21.Governor
,GovernorCountingSimple
: The_countVotes
virtual function now returns anuint256
with the total votes casted. This change allows for more flexibility for partial and fractional voting. Upgrading users may get a compilation error that can be fixed by adding a return statement to the_countVotes
function.Custom error changes
This version comes with changes to the custom error identifiers. Contracts previously depending on the following errors should be replaced accordingly:
Address.FailedInnerCall
withErrors.FailedCall
Address.AddressInsufficientBalance
withErrors.InsufficientBalance
Clones.Create2InsufficientBalance
withErrors.InsufficientBalance
Clones.ERC1167FailedCreateClone
withErrors.FailedDeployment
Clones.Create2FailedDeployment
withErrors.FailedDeployment
SafeERC20
: ReplaceAddress.AddressEmptyCode
withSafeERC20FailedOperation
if there is no code at the token's address.SafeERC20
: Replace genericError(string)
withSafeERC20FailedOperation
if the returned data can't be decoded asbool
.SafeERC20
: Replace genericSafeERC20FailedOperation
with the revert message from the contract call if it fails.Changes by category
General
AccessManager
,VestingWallet
,TimelockController
andERC2771Forwarder
: Added a publicinitializer
function in their corresponding upgradeable variants. (#5008)Access
AccessControlEnumerable
: Add agetRoleMembers
method to return all accounts that haverole
. (#4546)AccessManager
: Allow theonlyAuthorized
modifier to restrict functions added to the manager. (#5014)Finance
VestingWalletCliff
: Add an extension of theVestingWallet
contract with an added cliff. (#4870)Governance
GovernorCountingFractional
: Add a governor counting module that allows distributing voting power amongst 3 options (For, Against, Abstain). (#5045)Votes
: Set_moveDelegateVotes
visibility to internal instead of private. (#5007)Proxy
Clones
: Add version ofclone
andcloneDeterministic
that support sending value at creation. (#4936)TransparentUpgradeableProxy
: Make internal_proxyAdmin()
getter haveview
visibility. (#4688)ProxyAdmin
: Fixed documentation forUPGRADE_INTERFACE_VERSION
getter. (#5031)Tokens
ERC1363
: Add implementation of the token payable standard allowing execution of contract code after transfers and approvals. (#4631)ERC20TemporaryApproval
: Add an ERC-20 extension that implements temporary approval using transient storage, based on ERC7674 (draft). (#5071)SafeERC20
: Add "relaxed" function for interacting with ERC-1363 functions in a way that is compatible with EOAs. (#4631)ERC721Utils
andERC1155Utils
: Add reusable libraries with functions to perform acceptance checks onIERC721Receiver
andIERC1155Receiver
implementers. (#4845)ERC1363Utils
: Add helper similar to the existing ERC721Utils and ERC1155Utils. (#5133)Utils
Arrays
: add asort
functions foraddress[]
,bytes32[]
anduint256[]
memory arrays. (#4846)Arrays
: add new functionslowerBound
,upperBound
,lowerBoundMemory
andupperBoundMemory
for lookups in sorted arrays with potential duplicates. (#4842)Arrays
: deprecatefindUpperBound
in favor of the newlowerBound
. (#4842)Base64
: AddencodeURL
following section 5 of RFC4648 for URL encoding (#4822)Comparator
: A library of comparator functions, useful for customizing the behavior of the Heap structure. (#5084)Create2
: Bubbles up returndata from a deployed contract that reverted during construction. (#5052)Create2
,Clones
: MaskcomputeAddress
andcloneDeterministic
outputs to produce a clean value for anaddress
type (i.e. only use 20 bytes) (#4941)Errors
: New library of common custom errors. (#4936)Hashes
: A library with commonly used hash functions. (#3617)Packing
: Added a new utility for packing, extracting and replacing bytesXX values. (#4992)Panic
: Add a library for reverting with panic codes. (#3298)ReentrancyGuardTransient
: Added a variant ofReentrancyGuard
that uses transient storage. (#4988)Strings
: Added a utility function for converting an address to checksummed string. (#5067)SlotDerivation
: Add a library of methods for derivating common storage slots. (#4975)StorageSlot
: Add primitives for operating on the transient storage space using a typed-slot representation. (#4980)Cryptography
SignatureChecker
: refactorisValidSignatureNow
to avoid validating ECDSA signatures if there is code deployed at the signer's address. (#4951)MerkleProof
: Add variations ofverify
,processProof
,multiProofVerify
andprocessMultiProof
(and equivalent calldata version) with support for custom hashing functions. (#4887)P256
: Library for verification and public key recovery of P256 (aka secp256r1) signatures. (#4881)RSA
: Library to verify signatures according to RFC 8017 Signature Verification Operation (#4952)Math
Math
: add aninvMod
function to get the modular multiplicative inverse of a number in Z/nZ. (#4839)Math
: AddmodExp
function that exposes theEIP-198
precompile. Includesuint256
andbytes memory
versions. (#3298)Math
: Custom errors replaced with native panic codes. (#3298)Math
,SignedMath
: Add a branchlessternary
function that computescond ? a : b
in constant gas cost. (#4976)SafeCast
: AddtoUint(bool)
for operating onbool
values asuint256
. (#4878)Structures
CircularBuffer
: Add a data structure that stores the lastN
values pushed to it. (#4913)DoubleEndedQueue
: Custom errors replaced with native panic codes. (#4872)EnumerableMap
: addUintToBytes32Map
,AddressToAddressMap
,AddressToBytes32Map
andBytes32ToAddressMap
. (#4843)Heap
: A data structure that implements a heap-based priority queue. (#5084)MerkleTree
: A data structure that allows inserting elements into a merkle tree and updating its root hash. (#3617)Base64
: Fix issue where dirty memory located just after the input buffer is affecting the result. (#4926)ERC2771Context
andContext
: Introduce a_contextPrefixLength()
getter, used to trim extra information appended tomsg.data
.Multicall
: Make aware of non-canonical context (i.e.msg.sender
is not_msgSender()
), allowing compatibility withERC2771Context
.Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information: