Skip to content

Update dependency @openzeppelin/contracts-upgradeable to v5.4.0 [SECURITY] - autoclosed #601

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

Update dependency @openzeppelin/contracts-upgradeable to v5.4.0 [SECURITY] - autoclosed #601

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jul 17, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@openzeppelin/contracts-upgradeable (source) 5.3.0 -> 5.4.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-54070

Impact

The lastIndexOf(bytes,byte,uint256) function of the Bytes.sol library may access uninitialized memory when the following two conditions hold: 1) the provided buffer length is empty (i.e. buffer.length == 0) and position is not 2**256 - 1 (i.e. pos != type(uint256).max).

The pos argument could be used to access arbitrary data outside of the buffer bounds. This could lead to the operation running out of gas, or returning an invalid index (outside of the empty buffer). Processing this invalid result for accessing the buffer would cause a revert under normal conditions.

When triggered, the function reads memory at offset buffer + 0x20 + pos. If memory at that location (outside the buffer) matches the search pattern, the function would return an out of bound index instead of the expected type(uint256).max. This creates unexpected behavior where callers receive a valid-looking index pointing outside buffer bounds.

Subsequent memory accesses that don't check bounds and use the returned index must carefully review the potential impact depending on their setup. Code relying on this function returning type(uint256).max for empty buffers or using the returned index without bounds checking could exhibit undefined behavior.

Patches

Upgrade to 5.4.0

Release Notes

OpenZeppelin/openzeppelin-contracts-upgradeable (@​openzeppelin/contracts-upgradeable)

v5.4.0

Compare Source

Breaking changes
  • Update minimum pragma to 0.8.24 in SignatureChecker, Governor and Governor's extensions. (#​5716).
Pragma changes
  • Reduced pragma requirement of interface files
Changes by category
Account
  • Account: Added a simple ERC-4337 account implementation with minimal logic to process user operations. (#​5657)
  • AccountERC7579: Extension of Account that implements support for ERC-7579 modules of type executor, validator, and fallback handler. (#​5657)
  • AccountERC7579Hooked: Extension of AccountERC7579 that implements support for ERC-7579 hook modules. (#​5657)
  • EIP7702Utils: Add a library for checking if an address has an EIP-7702 delegation in place. (#​5587)
  • IERC7821, ERC7821: Interface and logic for minimal batch execution. No support for additional opData is included. (#​5657)
Governance
  • GovernorNoncesKeyed: Extension of Governor that adds support for keyed nonces when voting by sig. (#​5574)
Tokens
  • ERC20Bridgeable: Implementation of ERC-7802 that makes an ERC-20 compatible with crosschain bridges. (#​5739)
Cryptography
Signers
  • AbstractSigner, SignerECDSA, SignerP256, and SignerRSA: Add an abstract contract and various implementations for contracts that deal with signature verification. (#​5657)
  • SignerERC7702: Implementation of AbstractSigner for Externally Owned Accounts (EOAs). Useful with ERC-7702. (#​5657)
  • SignerERC7913: Abstract signer that verifies signatures using the ERC-7913 workflow. (#​5659)
  • MultiSignerERC7913: Implementation of AbstractSigner that supports multiple ERC-7913 signers with a threshold-based signature verification system. (#​5659)
  • MultiSignerERC7913Weighted: Extension of MultiSignerERC7913 that supports assigning different weights to each signer, enabling more flexible governance schemes. (#​5741)
Verifiers
  • ERC7913P256Verifier and ERC7913RSAVerifier: Ready to use ERC-7913 verifiers that implement key verification for P256 (secp256r1) and RSA keys. (#​5659)
Other
  • SignatureChecker: Add support for ERC-7913 signatures alongside existing ECDSA and ERC-1271 signature verification. (#​5659)
  • ERC7739: An abstract contract to validate signatures following the rehashing scheme from ERC7739Utils. (#​5664)
  • ERC7739Utils: Add a library that implements a defensive rehashing mechanism to prevent replayability of smart contract signatures based on the ERC-7739. (#​5664)
Structures
  • EnumerableMap: Add support for BytesToBytesMap type. (#​5658)
  • EnumerableMap: Add keys(uint256,uint256) that returns a subset (slice) of the keys in the map. (#​5713)
  • EnumerableSet: Add support for StringSet and BytesSet types. (#​5658)
  • EnumerableSet: Add values(uint256,uint256) that returns a subset (slice) of the values in the set. (#​5713)
Utils
  • Arrays: Add unsafeAccess, unsafeMemoryAccess and unsafeSetLength for bytes[] and string[]. (#​5568)
  • Blockhash: Add a library that provides access to historical block hashes using EIP-2935's history storage, extending the standard 256-block limit to 8191 blocks. (#​5642)
  • Bytes: Fix lastIndexOf(bytes,byte,uint256) with empty buffers and finite position to correctly return type(uint256).max instead of accessing uninitialized memory sections. (#​5797)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@socket-security Socket Security
Copy link

socket-security bot commented Jul 17, 2025 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​pkgr/​core@​0.2.2 ⏵ 0.2.91001006291100
Added@​nomicfoundation/​hardhat-toolbox@​6.0.0981007588100
Updatedhardhat@​2.26.1 ⏵ 2.22.199410089100 +180
Updated@​openzeppelin/​contracts@​5.4.0 ⏵ 5.3.010096 -410094100

View full report

@renovate renovate bot force-pushed the renovate/npm-openzeppelin-contracts-upgradeable-vulnerability branch 2 times, most recently from 8ac53d0 to e234f65 Compare July 21, 2025 20:43
@socket-security Socket Security
Copy link

socket-security bot commented Jul 21, 2025 •
edited
Loading

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Block Critical
[email protected] has a Critical CVE.

CVE: GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) (CRITICAL)

Affected versions: < 6.6.1

Patched version: 6.6.1

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
[email protected] has a Critical CVE.

CVE: GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL)

Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4

Patched version: 4.0.4

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
[email protected] has a Critical CVE.

CVE: GHSA-h7cp-r72f-jxh6 pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos (CRITICAL)

Affected versions: >= 3.0.10 < 3.1.3

Patched version: 3.1.3

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Critical
[email protected] has a Critical CVE.

CVE: GHSA-v62p-rq8g-8h59 pbkdf2 silently disregards Uint8Array input, returning static keys (CRITICAL)

Affected versions: < 3.1.3

Patched version: 3.1.3

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
[email protected] has a High CVE.

CVE: GHSA-xq7p-g2vc-g82p Homograph attack allows Unicode lookalike characters to bypass validation. (HIGH)

Affected versions: = 5.0.0, 4.0.0; >= 5.0.0 < 5.0.1; >= 4.0.0 < 4.0.1; < 3.0.11

Patched version: 3.0.11

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-49q7-c7j4-3p7m Elliptic allows BER-encoded signatures (LOW)

Affected versions: >= 5.2.1 < 6.5.7

Patched version: 6.5.7

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-f7q4-pwc6-w24p Elliptic's EDDSA missing signature length check (LOW)

Affected versions: >= 4.0.0 < 6.5.7

Patched version: 6.5.7

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-977x-g7h5-7qgw Elliptic's ECDSA missing check for whether leading bit of r and s is zero (LOW)

Affected versions: >= 2.0.0 < 6.5.7

Patched version: 6.5.7

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-434g-2637-qmqr Elliptic's verify function omits uniqueness validation (LOW)

Affected versions: < 6.5.6

Patched version: 6.5.6

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-fc9h-whq2-v747 Valid ECDSA signatures erroneously rejected in Elliptic (LOW)

Affected versions: < 6.6.0

Patched version: 6.6.0

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
[email protected] has a Low CVE.

CVE: GHSA-cxrh-j4jr-qwg3 undici Denial of Service attack via bad certificate data (LOW)

Affected versions: < 5.29.0; >= 6.0.0 < 6.21.2; >= 7.0.0 < 7.5.0

Patched version: 5.29.0

From: packages/core/solidity/src/environments/hardhat/package-lock.json → npm/[email protected] → npm/@nomicfoundation/[email protected] → npm/[email protected]

ℹ Read more on: This package | This alert | What is a mild CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate renovate bot force-pushed the renovate/npm-openzeppelin-contracts-upgradeable-vulnerability branch 10 times, most recently from abbbc24 to f696bcc Compare July 28, 2025 13:26
@renovate renovate bot force-pushed the renovate/npm-openzeppelin-contracts-upgradeable-vulnerability branch 4 times, most recently from bb960bf to f0ffcd0 Compare July 31, 2025 13:20
@renovate renovate bot requested review from a team as code owners July 31, 2025 13:20
@renovate renovate bot force-pushed the renovate/npm-openzeppelin-contracts-upgradeable-vulnerability branch 2 times, most recently from e64f0c1 to 9e81e94 Compare August 4, 2025 13:47
@renovate renovate bot force-pushed the renovate/npm-openzeppelin-contracts-upgradeable-vulnerability branch from 9e81e94 to 7832736 Compare August 11, 2025 15:22
@renovate renovate bot changed the title Update dependency @openzeppelin/contracts-upgradeable to v5.4.0 [SECURITY] Update dependency @openzeppelin/contracts-upgradeable to v5.4.0 [SECURITY] - autoclosed Aug 12, 2025
@renovate renovate bot closed this Aug 12, 2025
@renovate renovate bot deleted the renovate/npm-openzeppelin-contracts-upgradeable-vulnerability branch August 12, 2025 12:35
@github-actions github-actions bot locked and limited conversation to collaborators Aug 12, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants