build(deps): OpenZeppelin v5.1.0 → v5.6.1

CHANGELOG.md

@@ -27,6 +27,17 @@ All notable changes to this project are documented here. The format follows
 
 ### Changed
 
+- OpenZeppelin moved from v5.1.0 to v5.6.1 -- both submodules and the npm
+  canary together, as the procedure in CONTRIBUTING.md says. No source
+  change was needed; the storage-slot and upgrade tests pass unchanged, and
+  every preset's runtime shrank by roughly 0.3 KB. No published advisory
+  affected v5.1.0; this is a currency move, made while the release line was
+  being cut. Two things it carries: `ERC1967Proxy` now refuses construction
+  with empty init data (the kit always passes `initializeToken`), and its
+  creation code changed, so proxy addresses move along with the presets'.
+  `Initializable` and `UUPSUpgradeable` are imported from
+  `@openzeppelin/contracts` directly; the upgradeable package's copies are
+  aliases slated for removal in v6.
 - **Every CREATE2 address differs from v0.1.0.** The presets' creation code
   changed (EIP-3009 entry points, the MinterControl and UpgradeControl
   checks), and the address is a function of it. `docs/deploying.md` now says

README.md

@@ -161,19 +161,19 @@ Immutable — no proxy, no upgrade path, no admin upgrade key:
 
 | Preset | Payment | Issuance | Compliance | Runtime size |
 |---|---|---|---|---|
-| `MinimalToken` | — | SimpleMinter | — | 6.5 KB |
-| `PermitToken` | EIP-2612 | MinterControl | Blacklist, Pause | 13.3 KB |
-| `Eip3009Token` | EIP-3009, EIP-2612 | MinterControl | Blacklist, Pause | 14.9 KB |
-| `FullToken` | EIP-3009, EIP-2612 | MinterControl | Blacklist, Pause, Seize | 16.4 KB |
+| `MinimalToken` | — | SimpleMinter | — | 6.2 KB |
+| `PermitToken` | EIP-2612 | MinterControl | Blacklist, Pause | 13.0 KB |
+| `Eip3009Token` | EIP-3009, EIP-2612 | MinterControl | Blacklist, Pause | 14.7 KB |
+| `FullToken` | EIP-3009, EIP-2612 | MinterControl | Blacklist, Pause, Seize | 16.2 KB |
 
 Upgradeable — implementations for an ERC-1967 proxy, adding `UpgradeControl` to
 the same composition:
 
 | Preset | Same modules as | Runtime size |
 |---|---|---|
-| `UpgradeablePermitToken` | `PermitToken` | 16.1 KB |
-| `UpgradeableEip3009Token` | `Eip3009Token` | 17.9 KB |
-| `UpgradeableFullToken` | `FullToken` | 19.4 KB |
+| `UpgradeablePermitToken` | `PermitToken` | 15.9 KB |
+| `UpgradeableEip3009Token` | `Eip3009Token` | 17.7 KB |
+| `UpgradeableFullToken` | `FullToken` | 19.2 KB |
 
 ### What each one can do
 

contracts/foundry.lock

@@ -4,14 +4,14 @@
   },
   "lib/openzeppelin-contracts": {
     "tag": {
-      "name": "v5.1.0",
-      "rev": "69c8def5f222ff96f2b5beff05dfba996368aa79"
+      "name": "v5.6.1",
+      "rev": "5fd1781b1454fd1ef8e722282f86f9293cacf256"
     }
   },
   "lib/openzeppelin-contracts-upgradeable": {
     "tag": {
-      "name": "v5.1.0",
-      "rev": "fa525310e45f91eb20a6d3baa2644be8e0adba31"
+      "name": "v5.6.1",
+      "rev": "7bf4727aacdbfaa0f36cbd664654d0c9e1dc52bf"
     }
   }
 }

contracts/src/core/TokenBase.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity 0.8.24;
 
-import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
+import {Initializable} from "@openzeppelin/contracts/proxy/utils/Initializable.sol";
 import {
     ERC20Upgradeable
 } from "@openzeppelin/contracts-upgradeable/token/ERC20/ERC20Upgradeable.sol";

contracts/src/modules/UpgradeControl.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity 0.8.24;
 
-import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
+import {UUPSUpgradeable} from "@openzeppelin/contracts/proxy/utils/UUPSUpgradeable.sol";
 import {SafeCast} from "@openzeppelin/contracts/utils/math/SafeCast.sol";
 import {TokenBase} from "../core/TokenBase.sol";
 import {Guardian} from "./Guardian.sol";

contracts/test/presets/Upgradeable.t.sol

@@ -10,7 +10,7 @@ import {UpgradeControl} from "../../src/modules/UpgradeControl.sol";
 import {TokenBase} from "../../src/core/TokenBase.sol";
 import {MinterControl} from "../../src/modules/issuance/MinterControl.sol";
 import {IAccessControl} from "@openzeppelin/contracts/access/IAccessControl.sol";
-import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
+import {Initializable} from "@openzeppelin/contracts/proxy/utils/Initializable.sol";
 
 /// @dev A stand-in for a later version. Adds a function the first one lacks so
 ///      an upgrade is observable, and changes nothing about storage.

contracts/test/script/Deploy.t.sol

@@ -4,8 +4,8 @@ pragma solidity 0.8.24;
 import {Test} from "forge-std/Test.sol";
 import {ERC1967Proxy} from "@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol";
 import {ERC1967Utils} from "@openzeppelin/contracts/proxy/ERC1967/ERC1967Utils.sol";
-import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
-import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
+import {UUPSUpgradeable} from "@openzeppelin/contracts/proxy/utils/UUPSUpgradeable.sol";
+import {Initializable} from "@openzeppelin/contracts/proxy/utils/Initializable.sol";
 import {Deploy} from "../../script/Deploy.s.sol";
 import {TokenBase} from "../../src/core/TokenBase.sol";
 import {MinimalToken} from "../../src/presets/MinimalToken.sol";

docs/gas.md

@@ -13,7 +13,7 @@ cd contracts
 forge test --gas-report
 ```
 
-solc 0.8.24, optimizer on at 200 runs, OpenZeppelin v5.1.0 -- the settings in
+solc 0.8.24, optimizer on at 200 runs, OpenZeppelin v5.6.1 -- the settings in
 `foundry.toml`. Expect drift when any of those change; the table is a
 snapshot, not a promise. Re-run the command above after touching a module and
 compare.
@@ -59,13 +59,13 @@ where the money goes).
 | `transfer` | ~29,000 | ~58,500 |
 | `transferFrom` (allowance already set) | ~25,000 | -- |
 | `approve` | ~31,000 | ~54,300 |
-| `transferWithAuthorization` (bytes) | ~65,000 | ~103,700 |
-| `transferWithAuthorization` (v,r,s) | -- | ~98,800 |
-| `receiveWithAuthorization` | ~41,000 | ~99,200 |
-| `permit` (v,r,s) | ~58,000 | ~91,400 |
-| `permit` (bytes) | -- | ~96,400 |
-| `cancelAuthorization` (bytes) | ~61,500 | -- |
-| `cancelAuthorization` (v,r,s) | ~61,200 | -- |
+| `transferWithAuthorization` (bytes) | ~65,000 | ~102,000 |
+| `transferWithAuthorization` (v,r,s) | -- | ~98,600 |
+| `receiveWithAuthorization` | ~41,000 | ~99,000 |
+| `permit` (v,r,s) | ~58,000 | ~91,300 |
+| `permit` (bytes) | -- | ~94,800 |
+| `cancelAuthorization` (bytes) | ~61,300 | -- |
+| `cancelAuthorization` (v,r,s) | ~61,000 | -- |
 
 What the signature paths buy and cost: an EIP-3009 transfer is a plain
 transfer plus signature recovery (~3,000), the EIP-712 digest, and one cold

package.json

@@ -5,8 +5,8 @@
   "description": "A modular kit for ERC-20 payment tokens — controlled issuance, compliance switches, signature-based transfers; immutable or upgradeable",
   "license": "Apache-2.0",
   "devDependencies": {
-    "@openzeppelin/contracts": "5.1.0",
-    "@openzeppelin/contracts-upgradeable": "5.1.0",
+    "@openzeppelin/contracts": "5.6.1",
+    "@openzeppelin/contracts-upgradeable": "5.6.1",
     "solhint": "^6.2.4"
   },
   "scripts": {