build(deps): OpenZeppelin v5.1.0 → v5.6.1 - #21
Merged
Merged
Conversation
Both submodules, foundry.lock and the npm canary move together to the same release tag, per CONTRIBUTING.md. No kit source changed beyond two import paths: Initializable and UUPSUpgradeable now come from @openzeppelin/contracts, since the upgradeable package keeps only aliases that v6 removes. Checked before moving: no ERC-7201 namespace or struct layout changed in ERC20, AccessControl, Pausable, Nonces, EIP712, Initializable; UUPS is stateless; SignatureChecker's address overload keeps its semantics; the kit relies on neither the removed EIP712 legacy-hash fallback nor on __Pausable_init writing paused=false. No published advisory affected v5.1.0. ERC1967Proxy now refuses empty init data -- the kit always passes initializeToken -- and its creation code changed, so proxy addresses move along with the presets'. 140 tests, Slither 0; runtime sizes shrink ~0.3 KB per preset. README sizes and docs/gas.md updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Currency move ahead of cutting v0.1.1. No published OpenZeppelin advisory affected v5.1.0 — this is not a security fix. Done as CONTRIBUTING.md prescribes: both submodules,
foundry.lockand the npm canary to the same tag in one PR.What changed upstream that touches the kit (reviewed 5.2 → 5.6.1)
test/StorageSlots.t.solandtest/presets/Upgradeable.t.solpass unchanged._hashedNamefallback and the"EIP712: Uninitialized"guard removed. The kit overrides_EIP712Name()with the token name, so the domain is unaffected.__Pausable_initno longer writespaused = false. The kit never re-runs it.addressoverload keeps its semantics (ERC-1271 path rewritten in assembly,mcopy→ needs cancun, whichfoundry.tomlpins). New ERC-7913 overloads are not used.initializeToken); its creation code changed, so proxy addresses move — consistent with the "addresses are bound to a revision" note already indocs/deploying.md. Noted in CHANGELOG.@openzeppelin/contracts/proxy/utils/...— the only source change.proxiableUUID()is no longervirtual— the kit does not override it.Checks
npm run check— fmt · lint · lock:check · 140 tests · Slither 0 · Halmos in CI. Runtime sizes −~0.3 KB per preset (README updated);docs/gas.mdrefreshed.🤖 Generated with Claude Code