add AuthorizedCallers oz 5, fix npm issues, bump to 1.6.0 - #527
Open
RensR wants to merge 14 commits into
Open
Conversation
RensR
changed the title
RensR
commented
Aug 17, 2026
| "devDependencies": { | ||
| "@changesets/cli": "^2.29.8", | ||
| "@changesets/get-github-info": "^0.7.0", | ||
| "abi-to-sol": "^0.8.0", |
Collaborator
Author
There was a problem hiding this comment.
No longer needed since Automation is largely gone
RensR
marked this pull request as ready for review
August 17, 2026 19:32
product-security-plaid-production
Bot
requested review from
ilija42,
matYang and
pavel-raykov
August 17, 2026 19:32
pavel-raykov
approved these changes
Aug 17, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Solidity contracts package by moving the “shared” OpenZeppelin v4 imports from 4.8.3 to 4.9.6, introducing a new OZ v5.3 variant of AuthorizedCallers, and updating the contracts workspace’s npm/pnpm dependencies (including security-motivated overrides) alongside a package version bump to 1.6.0.
Changes:
- Upgrade shared Solidity imports from
@openzeppelin/contracts@4.8.3to@openzeppelin/contracts@4.9.6across ERC20/ERC677 code and related tests. - Add
AuthorizedCallersOZ5.sol(OZ 5.3.0EnumerableSet) plus a new Foundry test suite for it. - Update pnpm lockfile and
contracts/package.json(security overrides, devDependency upgrades/removals) and bump package version1.5.0 -> 1.6.0.
Reviewed changes
Copilot reviewed 18 out of 19 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| contracts/src/v0.8/shared/token/ERC677/ERC677.sol | Switch OZ ERC20 import to @openzeppelin/contracts@4.9.6. |
| contracts/src/v0.8/shared/token/ERC677/BurnMintERC677.sol | Switch OZ imports (IERC20/Burnable/IERC165/EnumerableSet) to @openzeppelin/contracts@4.9.6. |
| contracts/src/v0.8/shared/token/ERC20/IBurnMintERC20.sol | Switch OZ IERC20 import to @openzeppelin/contracts@4.9.6. |
| contracts/src/v0.8/shared/token/ERC20/BurnMintERC20.sol | Switch OZ AccessControl/ERC20/Burnable/IERC165 imports to @openzeppelin/contracts@4.9.6. |
| contracts/src/v0.8/shared/test/token/ERC677/BurnMintERC677.t.sol | Update test imports to OZ 4.9.6. |
| contracts/src/v0.8/shared/test/token/ERC20/BurnMintERC20/BurnMintERC20.supportsInterface.t.sol | Update test imports to OZ 4.9.6. |
| contracts/src/v0.8/shared/test/token/ERC20/BurnMintERC20/BurnMintERC20.mint.t.sol | Update test imports to OZ 4.9.6 and update comment referencing OZ version. |
| contracts/src/v0.8/shared/test/token/ERC20/BurnMintERC20/BurnMintERC20.grantMintAndBurnRoles.t.sol | Update test import to OZ 4.9.6. |
| contracts/src/v0.8/shared/test/token/ERC20/BurnMintERC20/BurnMintERC20.burnFromAlias.t.sol | Update test import/comment to OZ 4.9.6. |
| contracts/src/v0.8/shared/test/token/ERC20/BurnMintERC20/BurnMintERC20.burnFrom.t.sol | Update test import/comment to OZ 4.9.6. |
| contracts/src/v0.8/shared/test/token/ERC20/BurnMintERC20/BurnMintERC20.burn.t.sol | Update test imports/comment to OZ 4.9.6. |
| contracts/src/v0.8/shared/test/access/AuthorizedCallersOZ5.t.sol | Add Foundry tests targeting the OZ5 variant of AuthorizedCallers. |
| contracts/src/v0.8/shared/mocks/WERC20Mock.sol | Switch OZ ERC20 import to @openzeppelin/contracts@4.9.6. |
| contracts/src/v0.8/shared/mocks/ERC20Mock.sol | Switch OZ ERC20 import to @openzeppelin/contracts@4.9.6. |
| contracts/src/v0.8/shared/access/AuthorizedCallersOZ5.sol | Add an OZ 5.3.0-EnumerableSet backed AuthorizedCallers variant. |
| contracts/src/v0.8/shared/access/AuthorizedCallers.sol | Switch OZ EnumerableSet import to @openzeppelin/contracts@4.9.6. |
| contracts/pnpm-lock.yaml | Update lockfile with dependency upgrades and security-related overrides resolution. |
| contracts/package.json | Bump package version to 1.6.0, add security overrides, update devDependencies. |
| contracts/gas-snapshots/shared.gas-snapshot | Snapshot updated but now contains duplicated AuthorizedCallers_* entries. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+8
to
+22
| contract AuthorizedCallers_setup is BaseTest { | ||
| address[] internal s_callers; | ||
|
|
||
| AuthorizedCallers internal s_authorizedCallers; | ||
|
|
||
| function setUp() public override { | ||
| super.setUp(); | ||
| s_callers.push(makeAddr("caller1")); | ||
| s_callers.push(makeAddr("caller2")); | ||
|
|
||
| s_authorizedCallers = new AuthorizedCallers(s_callers); | ||
| } | ||
| } | ||
|
|
||
| contract AuthorizedCallers_constructor is AuthorizedCallers_setup { |
Comment on lines
1
to
18
| AuthorizedCallers_applyAuthorizedCallerUpdates:test_AddAndRemove_Success() (gas: 125006) | ||
| AuthorizedCallers_applyAuthorizedCallerUpdates:test_AddAndRemove_Success() (gas: 125006) | ||
| AuthorizedCallers_applyAuthorizedCallerUpdates:test_OnlyAdd_Success() (gas: 132945) | ||
| AuthorizedCallers_applyAuthorizedCallerUpdates:test_OnlyAdd_Success() (gas: 132945) | ||
| AuthorizedCallers_applyAuthorizedCallerUpdates:test_OnlyCallableByOwner_Revert() (gas: 12276) | ||
| AuthorizedCallers_applyAuthorizedCallerUpdates:test_OnlyCallableByOwner_Revert() (gas: 12276) | ||
| AuthorizedCallers_applyAuthorizedCallerUpdates:test_OnlyRemove_Success() (gas: 44947) | ||
| AuthorizedCallers_applyAuthorizedCallerUpdates:test_OnlyRemove_Success() (gas: 44947) | ||
| AuthorizedCallers_applyAuthorizedCallerUpdates:test_RemoveThenAdd_Success() (gas: 57043) | ||
| AuthorizedCallers_applyAuthorizedCallerUpdates:test_RemoveThenAdd_Success() (gas: 57043) | ||
| AuthorizedCallers_applyAuthorizedCallerUpdates:test_SkipRemove_Success() (gas: 31986) | ||
| AuthorizedCallers_applyAuthorizedCallerUpdates:test_SkipRemove_Success() (gas: 31986) | ||
| AuthorizedCallers_applyAuthorizedCallerUpdates:test_ZeroAddressNotAllowed_Revert() (gas: 64406) | ||
| AuthorizedCallers_applyAuthorizedCallerUpdates:test_ZeroAddressNotAllowed_Revert() (gas: 64406) | ||
| AuthorizedCallers_constructor:test_ZeroAddressNotAllowed_Revert() (gas: 64383) | ||
| AuthorizedCallers_constructor:test_ZeroAddressNotAllowed_Revert() (gas: 64383) | ||
| AuthorizedCallers_constructor:test_constructor_Success() (gas: 683090) | ||
| AuthorizedCallers_constructor:test_constructor_Success() (gas: 683090) |
| import {IERC677} from "./IERC677.sol"; | ||
|
|
||
| import {ERC20} from "@openzeppelin/contracts@4.8.3/token/ERC20/ERC20.sol"; | ||
| import {ERC20} from "@openzeppelin/contracts@4.9.6/token/ERC20/ERC20.sol"; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR has zero bytecode changes, meaning it is safe.
The PR
sharedOZ version to from 4.8.3 to 4.9.6, which is mostly cosmetic, but a step towards the medium term goal of removing 4.8.3