[Snyk] Upgrade @openzeppelin/contracts from 4.4.1 to 4.9.3 #13

metatrust-v · 2023-11-23T15:34:22Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade @openzeppelin/contracts from 4.4.1 to 4.9.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 23 versions ahead of your current version.
The recommended version was released 4 months ago, on 2023-07-28.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Information Exposure SNYK-JS-OPENZEPPELINCONTRACTS-2958047	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Information Exposure SNYK-JS-OPENZEPPELINCONTRACTS-2958050	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Incorrect Calculation SNYK-JS-OPENZEPPELINCONTRACTS-2964946	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Improper Verification of Cryptographic Signature SNYK-JS-OPENZEPPELINCONTRACTS-2980279	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Function Call With Incorrect Argument SNYK-JS-OPENZEPPELINCONTRACTS-2336323	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Denial of Service (DoS) SNYK-JS-OPENZEPPELINCONTRACTS-2965798	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Improper Input Validation SNYK-JS-OPENZEPPELINCONTRACTS-5425051	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Improper Encoding or Escaping of Output SNYK-JS-OPENZEPPELINCONTRACTS-5838352	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Denial of Service (DoS) SNYK-JS-OPENZEPPELINCONTRACTS-5425827	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit
Missing Authorization SNYK-JS-OPENZEPPELINCONTRACTS-5672116	589/1000 Why? Has a fix available, CVSS 7.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: @openzeppelin/contracts

4.9.3 - 2023-07-28

Note
This release contains a fix for GHSA-g4vp-m682-qqmp.
- ERC2771Context: Return the forwarder address whenever the msg.data of a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. msg.data.length is less than 20 bytes), as specified by ERC-2771. (#4481)
- ERC2771Context: Prevent revert in _msgData() when a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. msg.data.length is less than 20 bytes). Return the full calldata in that case. (#4484)
4.9.2 - 2023-06-16

Note
This release contains a fix for GHSA-wprv-93r4-jj2p.
- MerkleProof: Fix a bug in processMultiProof and processMultiProofCalldata that allows proving arbitrary leaves if the tree contains a node with value 0 at depth 1.
4.9.1 - 2023-06-07

Note
This release contains a fix for GHSA-5h3x-9wvq-w4m2.
- Governor: Add a mechanism to restrict the address of the proposer using a suffix in the description.
4.9.0 - 2023-05-23
- ReentrancyGuard: Add a _reentrancyGuardEntered function to expose the guard status. (#3714)
- ERC721Wrapper: add a new extension of the ERC721 token which wraps an underlying token. Deposit and withdraw guarantee that the ownership of each token is backed by a corresponding underlying token with the same identifier. (#3863)
- EnumerableMap: add a keys() function that returns an array containing all the keys. (#3920)
- Governor: add a public cancel(uint256) function. (#3983)
- Governor: Enable timestamp operation for blockchains without a stable block time. This is achieved by connecting a Governor's internal clock to match a voting token's EIP-6372 interface. (#3934)
- Strings: add equal method. (#3774)
- IERC5313: Add an interface for EIP-5313 that is now final. (#4013)
- IERC4906: Add an interface for ERC-4906 that is now Final. (#4012)
- StorageSlot: Add support for string and bytes. (#4008)
- Votes, ERC20Votes, ERC721Votes: support timestamp checkpointing using EIP-6372. (#3934)
- ERC4626: Add mitigation to the inflation attack through virtual shares and assets. (#3979)
- Strings: add toString method for signed integers. (#3773)
- ERC20Wrapper: Make the underlying variable private and add a public accessor. (#4029)
- EIP712: add EIP-5267 support for better domain discovery. (#3969)
- AccessControlDefaultAdminRules: Add an extension of AccessControl with additional security rules for the DEFAULT_ADMIN_ROLE. (#4009)
- SignatureChecker: Add isValidERC1271SignatureNow for checking a signature directly against a smart contract using ERC-1271. (#3932)
- SafeERC20: Add a forceApprove function to improve compatibility with tokens behaving like USDT. (#4067)
- ERC1967Upgrade: removed contract-wide oz-upgrades-unsafe-allow delegatecall annotation, replaced by granular annotation in UUPSUpgradeable. (#3971)
- ERC20Wrapper: self wrapping and deposit by the wrapper itself are now explicitly forbidden. (#4100)
- ECDSA: optimize bytes32 computation by using assembly instead of abi.encodePacked. (#3853)
- ERC721URIStorage: Emit ERC-4906 MetadataUpdate in _setTokenURI. (#4012)
- ShortStrings: Added a library for handling short strings in a gas efficient way, with fallback to storage for longer strings. (#4023)
- SignatureChecker: Allow return data length greater than 32 from EIP-1271 signers. (#4038)
- UUPSUpgradeable: added granular oz-upgrades-unsafe-allow-reachable annotation to improve upgrade safety checks on latest version of the Upgrades Plugins (starting with @ openzeppelin/upgrades-core@1.21.0). (#3971)
- Initializable: optimize _disableInitializers by using != instead of <. (#3787)
- Ownable2Step: make acceptOwnership public virtual to enable usecases that require overriding it. (#3960)
- UUPSUpgradeable.sol: Change visibility to the functions upgradeTo and upgradeToAndCall from external to public. (#3959)
- TimelockController: Add the CallSalt event to emit on operation schedule. (#4001)
- Reformatted codebase with latest version of Prettier Solidity. (#3898)
- Math: optimize log256 rounding check. (#3745)
- ERC20Votes: optimize by using unchecked arithmetic. (#3748)
- Multicall: annotate multicall function as upgrade safe to not raise a flag for its delegatecall. (#3961)
- ERC20Pausable, ERC721Pausable, ERC1155Pausable: Add note regarding missing public pausing functionality (#4007)
- ECDSA: Add a function toDataWithIntendedValidatorHash that encodes data with version 0x00 following EIP-191. (#4063)
- MerkleProof: optimize by using unchecked arithmetic. (#3745)
Breaking changes
- EIP712: Addition of ERC5267 support requires support for user defined value types, which was released in Solidity version 0.8.8. This requires a pragma change from ^0.8.0 to ^0.8.8.
- EIP712: Optimization of the cache for the upgradeable version affects the way name and version are set. This is no longer done through an initializer, and is instead part of the implementation's constructor. As a consequence, all proxies using the same implementation will necessarily share the same name and version. Additionally, an implementation upgrade risks changing the EIP712 domain unless the same name and version are used when deploying the new implementation contract.
Deprecations
- ERC20Permit: Added the file IERC20Permit.sol and ERC20Permit.sol and deprecated draft-IERC20Permit.sol and draft-ERC20Permit.sol since EIP-2612 is no longer a Draft. Developers are encouraged to update their imports. (#3793)
- Timers: The Timers library is now deprecated and will be removed in the next major release. (#4062)
- ERC777: The ERC777 token standard is no longer supported by OpenZeppelin. Our implementation is now deprecated and will be removed in the next major release. The corresponding standard interfaces remain available. (#4066)
- ERC1820Implementer: The ERC1820 pseudo-introspection mechanism is no longer supported by OpenZeppelin. Our implementation is now deprecated and will be removed in the next major release. The corresponding standard interfaces remain available. (#4066)
4.9.0-rc.1 - 2023-05-17
- AccessControlDefaultAdminRules: Clean up pending admin schedule on renounce. (#4243)
4.9.0-rc.0 - 2023-05-09
Read more
4.8.3 - 2023-04-13

Note
This release contains fixes for GHSA-mx2q-35m2-x2rh and GHSA-93hq-5wgc-jc82.
- GovernorCompatibilityBravo: Fix encoding of proposal data when signatures are missing.
- TransparentUpgradeableProxy: Fix transparency in case of selector clash with non-decodable calldata or payable mutability. (#4154)
4.8.2 - 2023-03-02

Note
This release contains a fix for GHSA-878m-3g6q-594q.
- ERC721Consecutive: Fixed a bug when _mintConsecutive is used for batches of size 1 that could lead to balance overflow. Refer to the breaking changes section in the changelog for a note on the behavior of ERC721._beforeTokenTransfer.
Breaking changes
- ERC721: The internal function _beforeTokenTransfer no longer updates balances, which it previously did when batchSize was greater than 1. This change has no consequence unless a custom ERC721 extension is explicitly invoking _beforeTokenTransfer. Balance updates in extensions must now be done explicitly using __unsafe_increaseBalance, with a name that indicates that there is an invariant that has to be manually verified.
4.8.1 - 2023-01-13
- ERC4626: Use staticcall instead of call when fetching underlying ERC-20 decimals. (#3943)
4.8.0 - 2022-11-08
Read more
4.8.0-rc.2 - 2022-10-17
4.8.0-rc.1 - 2022-09-23
4.8.0-rc.0 - 2022-09-07
4.7.3 - 2022-08-10
4.7.2 - 2022-07-27
4.7.1 - 2022-07-20
4.7.0 - 2022-06-29
4.7.0-rc.0 - 2022-06-07
4.6.0 - 2022-04-26
4.6.0-rc.0 - 2022-03-31
4.5.0 - 2022-02-09
4.5.0-rc.0 - 2022-01-13
4.4.2 - 2022-01-11
4.4.1 - 2021-12-14