Governor: add a relay function to help recover assets sent to a governor that is not its own executor (e.g. when using a timelock). (#2926)
GovernorPreventLateQuorum: add new module to ensure a minimum voting duration is available after the quorum is reached. (#2973)
ERC721: improved revert reason when transferring from wrong owner. (#2975)
Votes: Added a base contract for vote tracking with delegation. (#2944)
ERC721Votes: Added an extension of ERC721 enabled with vote tracking and delegation. (#2944)
ERC2771Context: use immutable storage to store the forwarder address, no longer an issue since Solidity >=0.8.8 allows reading immutable variables in the constructor. (#2917)
Base64: add a library to parse bytes into base64 strings using encode(bytes memory) function, and provide examples to show how to use to build URL-safe tokenURIs. (#2884)
ERC20: reduce allowance before triggering transfer. (#3056)
ERC20: do not update allowance on transferFrom when allowance is type(uint256).max. (#3085)
ERC20: add a _spendAllowance internal function. (#3170)
ERC20Burnable: do not update allowance on burnFrom when allowance is type(uint256).max. (#3170)
ERC777: do not update allowance on transferFrom when allowance is type(uint256).max. (#3085)
ERC777: add a _spendAllowance internal function. (#3170)
SignedMath: a new signed version of the Math library with max, min, and average. (#2686)
SignedMath: add a abs(int256) method that returns the unsigned absolute value of a signed value. (#2984)
ERC1967Upgrade: Refactor the secure upgrade to use ERC1822 instead of the previous rollback mechanism. This reduces code complexity and attack surface with similar security guarantees. (#3021)
UUPSUpgradeable: Add ERC1822 compliance to support the updated secure upgrade mechanism. (#3021)
Some more functions have been made virtual to customize them via overrides. In many cases this will not imply that other functions in the contract will automatically adapt to the overridden definitions. People who wish to override should consult the source code to understand the impact and if they need to override any additional functions to achieve the desired behavior.
Breaking changes
ERC1967Upgrade: The function _upgradeToAndCallSecure was renamed to _upgradeToAndCallUUPS, along with the change in security mechanism described above.
Address: The Solidity pragma is increased from ^0.8.0 to ^0.8.1. This is required by the account.code.length syntax that replaces inline assembly. This may require users to bump their compiler version from 0.8.0 to 0.8.1 or later. Note that other parts of the code already include stricter requirements.
GovernorCompatibilityBravo: Fix error in the encoding of calldata for proposals submitted through the compatibility interface with explicit signatures. (#3100)
v4.4.1
:warning: This is a patch for a low severity vulnerability. For more information visit the security advisory.
Initializable: change the existing initializer modifier and add a new onlyInitializing modifier to prevent reentrancy risk. (#3006)
Breaking change
It is no longer possible to call an initializer-protected function from within another initializer function outside the context of a constructor. Projects using OpenZeppelin upgradeable proxies should continue to work as is, since in the common case the initializer is invoked in the constructor directly. If this is not the case for you, the suggested change is to use the new onlyInitializing modifier in the following way:
contract A {
- function initialize() public initializer { ... }
+ function initialize() internal onlyInitializing { ... }
}
contract B is A {
function initialize() public initializer {
A.initialize();
</tr></table>
Governor: add a relay function to help recover assets sent to a governor that is not its own executor (e.g. when using a timelock). (#2926)
GovernorPreventLateQuorum: add new module to ensure a minimum voting duration is available after the quorum is reached. (#2973)
ERC721: improved revert reason when transferring from wrong owner. (#2975)
Votes: Added a base contract for vote tracking with delegation. (#2944)
ERC721Votes: Added an extension of ERC721 enabled with vote tracking and delegation. (#2944)
ERC2771Context: use immutable storage to store the forwarder address, no longer an issue since Solidity >=0.8.8 allows reading immutable variables in the constructor. (#2917)
Base64: add a library to parse bytes into base64 strings using encode(bytes memory) function, and provide examples to show how to use to build URL-safe tokenURIs. (#2884)
ERC20: reduce allowance before triggering transfer. (#3056)
ERC20: do not update allowance on transferFrom when allowance is type(uint256).max. (#3085)
ERC20: add a _spendAllowance internal function. (#3170)
ERC20Burnable: do not update allowance on burnFrom when allowance is type(uint256).max. (#3170)
ERC777: do not update allowance on transferFrom when allowance is type(uint256).max. (#3085)
ERC777: add a _spendAllowance internal function. (#3170)
SignedMath: a new signed version of the Math library with max, min, and average. (#2686)
SignedMath: add a abs(int256) method that returns the unsigned absolute value of a signed value. (#2984)
ERC1967Upgrade: Refactor the secure upgrade to use ERC1822 instead of the previous rollback mechanism. This reduces code complexity and attack surface with similar security guarantees. (#3021)
UUPSUpgradeable: Add ERC1822 compliance to support the updated secure upgrade mechanism. (#3021)
Some more functions have been made virtual to customize them via overrides. In many cases this will not imply that other functions in the contract will automatically adapt to the overridden definitions. People who wish to override should consult the source code to understand the impact and if they need to override any additional functions to achieve the desired behavior.
Breaking changes
ERC1967Upgrade: The function _upgradeToAndCallSecure was renamed to _upgradeToAndCallUUPS, along with the change in security mechanism described above.
Address: The Solidity pragma is increased from ^0.8.0 to ^0.8.1. This is required by the account.code.length syntax that replaces inline assembly. This may require users to bump their compiler version from 0.8.0 to 0.8.1 or later. Note that other parts of the code already include stricter requirements.
4.4.2 (2022-01-11)
Bugfixes
GovernorCompatibilityBravo: Fix error in the encoding of calldata for proposals submitted through the compatibility interface with explicit signatures. (#3100)
4.4.1 (2021-12-14)
Initializable: change the existing initializer modifier and add a new onlyInitializing modifier to prevent reentrancy risk. (#3006)
Breaking change
It is no longer possible to call an initializer-protected function from within another initializer function outside the context of a constructor. Projects using OpenZeppelin upgradeable proxies should continue to work as is, since in the common case the initializer is invoked in the constructor directly. If this is not the case for you, the suggested change is to use the new onlyInitializing modifier in the following way:
contract A {
- function initialize() public initializer { ... }
+ function initialize() internal onlyInitializing { ... }
</tr></table>
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot]
commented
2 years ago
Bumps @openzeppelin/contracts-upgradeable from 4.4.0 to 4.5.1.
Release notes
Sourced from
@openzeppelin/contracts-upgradeable's releases.... (truncated)
Changelog
Sourced from
@openzeppelin/contracts-upgradeable's changelog.... (truncated)
Commits
0d96e3d4.5.14bb39bdTranspile 07173205ac9661aTranspile 071732059430a65Transpile e65e8442584a6c7Transpile 5a08147547de4b8Transpile e170b59f6f7d517Transpile 28353cb74c37e74Transpile 8d49008034372caTranspile 783c169f45a0351Transpile 2d97b6b4Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)