ethers/v5.8.0 (2025-02-25 19:15) [legacy version]

This is a security update for the legacy Ethers v5 branch, addressing two security fixes.

• A bug in elliptic, which does not affect ethers but triggers a critical security warning during nom audit [see: missing signature length check, missing check for leading bit, allow BER-encoded signatures, false negative verification, signing malformed input]
• A bug in ws which can be used as DoS vector when communicating with malicious WebSocket service providers, triggering a high security warning during nom audit [see: too many HTTP headers]

For those that wish to audit the specific changes in the the bundled version between v5.7 and v5.8, see this gist.

Changes

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

---

Embedding UMD with SRI:

<script type="text/javascript"
  integrity="sha384-KpyAXoFibPIUEi79EsnN1EtEWCCrOQ8MtGsa4IrVxeZo514PYarFXujnjyu0DzgC"
  crossorigin="anonymous"
  src="https://cdnjs.cloudflare.com/ajax/libs/ethers/5.8.0/ethers.umd.min.js">
</script>

ethers/v6.13.5 (2025-01-04 15:26)

• Use local dev net for testing Typed API to prevent tests getting throttled (7654ee3).
• Fixed bad logic for searching prefetched transactions by hash (#4868; ef3c9bc).
• Add newline delimiter to IPC providers for broader support (#4847; 474a8de).

ethers/v6.13.4 (2024-10-10 18:01)

• Updated dependencies (1d717ef).
• Fixed bug in JSON-RPC error checking (#4827, #4837, #4851; be3e6b1).

ethers/v6.13.3 (2024-09-30 22:08)

• Allow CCIP-read to continue during low-level fetch failures (#4842; 1c31f95).

ethers/v6.13.2 (2024-07-25 18:20)

• Prevent mutating transactions when signing (#4789; 1a51af8).

ethers/v6.13.1 (2024-06-18 02:37)

• Update ws package to address possible DoS vulnerability (a4b1d1f).

ethers/v6.13.0 (2024-06-04 01:38)

• Added Options for BrowserProvider (#4707; 33bb0bf).
• Fix Result deep toObject when a parent is an Array (#4681; d8cb849).
• Added consistent timeout and cancel behaviour to FetchRequest (#4122; a12a739).

ethers/v6.12.2 (2024-05-30 17:24)

• Copy EIP-4844 properties during estimateGas and call (#4728; cebe5ee).
• Use non-capturing regex for data to prevent memory exhaustion for long strings (#4741; 5463aa0).
• Added Base endpointsto EtherscanProvider (#4729; 7e1dc95).

ethers/v6.12.1 (2024-04-30 23:23)

• Prevent bad Interface clone when using two different versions of v6 (#4689; 4d2d90f).
• Fixed typo in error message for invalid quorum weight (#4149; 45b9b9c).
• Added matic-amoy to EtherescanProvider (#4711; 5c8d17a).
• Fix JsonRpcProvider ignoring pollingInterval in options (#4644; 7b7be0d).

ethers/v6.12.0 (2024-04-17 02:09)

• Added Linea Sepolia network and Infura endpoint (#4655; b4aaab8).
• Do not send unsubscribe messages to destroyed Providers (#4678; c45935e).
• Get definitive network from InfuraProvider when using InfuraWebSocketProvider (38e32d8).
• Better error messages for transaction field mismatch (#4659; 9230aa0).
• Added prevRandao to block (#3372; ec6a754).
• Added Polygon Amoy testnet (#4645; 1717abb).
• Added Chainstack provider (#2741; 014004d).
• Added deep convertion to Result for toObject and toArray (#4681; 03bfe2a).
• Added EIP-4844 broadcast support (92bad88).
• Fix ignored throttle parameters (#4663; 12772e9).