nightly

Co-authored-by: Michael George <michael@certora.com>
Co-authored-by: Nick Armstrong <nick@certora.com>
Co-authored-by: Michael George <mdgeorge@cs.cornell.edu>
Co-authored-by: Aleksander Kryukov <firealexkryukov@gmail.com>
Co-authored-by: Hadrien Croubois <hadrien.croubois@gmail.com>

.changeset/afraid-walls-smell.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`ERC1155Receiver`: Removed in favor of `ERC1155Holder`.

.changeset/angry-ties-switch.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`TimelockController`: Changed the role architecture to use `DEFAULT_ADMIN_ROLE` as the admin for all roles, instead of the bespoke `TIMELOCK_ADMIN_ROLE` that was used previously. This aligns with the general recommendation for `AccessControl` and makes the addition of new roles easier. Accordingly, the `admin` parameter and timelock will now be granted `DEFAULT_ADMIN_ROLE` instead of `TIMELOCK_ADMIN_ROLE`. ([#3799](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3799))

.changeset/beige-buses-drop.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': patch
+---
+
+`Initializable`: optimize `_disableInitializers` by using `!=` instead of `<`. ([#3787](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3787))

.changeset/big-plums-cover.md

@@ -1,4 +0,0 @@
----
-'openzeppelin-solidity': major
----
-Use `abi.encodeCall` in place of `abi.encodeWithSelector` and `abi.encodeWithSignature` for improved type-checking of parameters

.changeset/blue-horses-do.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`ERC2771Forwarder`: Added `deadline` for expiring transactions, batching, and more secure handling of `msg.value`.

.changeset/blue-scissors-design.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': minor
----
-
-`Math`: Make `ceilDiv` to revert on 0 division even if the numerator is 0

.changeset/brave-lobsters-punch.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`Governor`: Refactored internals to implement common queuing logic in the core module of the Governor. Added `queue` and `_queueOperations` functions that act at different levels. Modules that implement queuing via timelocks are expected to override `_queueOperations` to implement the timelock-specific logic. Added `_executeOperations` as the equivalent for execution.

.changeset/bright-tomatoes-sing.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`ERC20`, `ERC1155`: Deleted `_beforeTokenTransfer` and `_afterTokenTransfer` hooks, added a new internal `_update` function for customizations, and refactored all extensions using those hooks to use `_update` instead. ([#3838](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3838), [#3876](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3876))

.changeset/chilled-spiders-attack.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`ERC1155Supply`: add a `totalSupply()` function that returns the total amount of token circulating, this change will restrict the total tokens minted across all ids to 2\*\*256-1 .

.changeset/clever-pumas-beg.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`Ownable`: Add an `initialOwner` parameter to the constructor, making the ownership initialization explicit.

.changeset/curvy-shrimps-enjoy.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`ReentrancyGuard`: Add a `_reentrancyGuardEntered` function to expose the guard status. ([#3714](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3714))

.changeset/curvy-suns-sort.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': patch
+---
+
+`Ownable2Step`: make `acceptOwnership` public virtual to enable usecases that require overriding it. ([#3960](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3960))

.changeset/early-oranges-raise.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`ERC721Wrapper`: add a new extension of the `ERC721` token which wraps an underlying token. Deposit and withdraw guarantee that the ownership of each token is backed by a corresponding underlying token with the same identifier.

.changeset/eight-peaches-guess.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': minor
----
-
-`Proxy`: Removed redundant `receive` function.

.changeset/eighty-crabs-listen.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': patch
----
-
-Optimize `Strings.equal`

.changeset/empty-taxis-kiss.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`UUPSUpgradeable`, `TransparentUpgradeableProxy` and `ProxyAdmin`: Removed `upgradeTo` and `upgrade` functions, and made `upgradeToAndCall` and `upgradeAndCall` ignore the data argument if it is empty. It is no longer possible to invoke the receive function (or send value with empty data) along with an upgrade.

.changeset/famous-rules-burn.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`EnumerableMap`: add a `keys()` function that returns an array containing all the keys. ([#3920](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3920))

.changeset/five-ducks-develop.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': patch
+---
+
+`UUPSUpgradeable.sol`: Change visibility to the functions `upgradeTo ` and `upgradeToAndCall ` from `external` to `public`.

.changeset/five-poets-mix.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': patch
+---
+
+`TimelockController`: Add the `CallSalt` event to emit on operation schedule.

.changeset/flat-bottles-wonder.md

@@ -1,7 +0,0 @@
----
-'openzeppelin-solidity': minor
----
-
-Replace some uses of `abi.encodePacked` with clearer alternatives (e.g. `bytes.concat`, `string.concat`). (#4504)[https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4504]
-
-pr: #4296

.changeset/flat-deers-end.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`Governor`: add a public `cancel(uint256)` function.

.changeset/fluffy-countries-buy.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': minor
----
-
-`Arrays`: Optimize `findUpperBound` by removing redundant SLOAD.

.changeset/four-adults-knock.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': patch
----
-
-`ECDSA`: Use unchecked arithmetic for the `tryRecover` function that receives the `r` and `vs` short-signature fields separately.

.changeset/four-bats-sniff.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`Governor`: Enable timestamp operation for blockchains without a stable block time. This is achieved by connecting a Governor's internal clock to match a voting token's EIP-6372 interface.

.changeset/fresh-birds-kiss.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`Checkpoints`: library moved from `utils` to `utils/structs`

.changeset/funny-rockets-compete.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': patch
+---
+
+Reformatted codebase with latest version of Prettier Solidity. ([#3898](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3898))

.changeset/gold-chicken-clean.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`Strings`: add `equal` method. ([#3774](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3774))

.changeset/grumpy-bulldogs-call.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`Governor`: Optimized use of storage for proposal data

.changeset/grumpy-worms-tease.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`ERC1967Utils`: Refactor the `ERC1967Upgrade` abstract contract as a library.

.changeset/happy-falcons-walk.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`TransparentUpgradeableProxy`: Admin is now stored in an immutable variable (set during construction) to avoid unnecessary storage reads on every proxy call. This removed the ability to ever change the admin. Transfer of the upgrade capability is exclusively handled through the ownership of the `ProxyAdmin`.

.changeset/happy-socks-travel.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`IERC5313`: Add an interface for EIP-5313 that is now final.

.changeset/healthy-squids-stare.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': patch
+---
+
+`Math`: optimize `log256` rounding check. ([#3745](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3745))

.changeset/heavy-drinks-fail.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`ERC20`: Remove `Approval` event previously emitted in `transferFrom` to indicate that part of the allowance was consumed. With this change, allowances are no longer reconstructible from events. See the code for guidelines on how to re-enable this event if needed.

.changeset/hip-beds-provide.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-Move the logic to validate ERC-1822 during an upgrade from `ERC1967Utils` to `UUPSUpgradeable`.

.changeset/hot-coins-judge.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': minor
----
-
-`Arrays`: Add `unsafeMemoryAccess` helpers to read from a memory array without checking the length.

.changeset/hot-dingos-kiss.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`MessageHashUtils`: Add a new library for creating message digest to be used along with signing or recovery such as  ECDSA or ERC-1271. These functions are moved from the `ECDSA` library.

.changeset/hot-plums-approve.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': minor
----
-
-`GovernorTimelockControl`: Clean up timelock id on execution for gas refund.

.changeset/lemon-dogs-kiss.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': patch
+---
+
+`ERC20Votes`: optimize by using unchecked arithmetic. ([#3748](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3748))

.changeset/little-falcons-build.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': minor
----
-
-`EIP712`: Add internal getters for the name and version strings

.changeset/little-kiwis-ring.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': patch
+---
+
+`Multicall`: annotate `multicall` function as upgrade safe to not raise a flag for its delegatecall. ([#3961](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3961))

.changeset/loud-shrimps-play.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': minor
----
-
-`TimelockController`: Add a state getter that returns an `OperationState` enum.

.changeset/lovely-dragons-appear.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`IERC4906`: Add an interface for ERC-4906 that is now Final.

.changeset/lovely-geckos-hide.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-Replace revert strings and require statements with custom errors.

.changeset/many-panthers-hide.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`TransparentUpgradeableProxy`: support value passthrough for all ifAdmin function.

.changeset/mean-walls-watch.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`Nonces`: Added a new contract to keep track of user nonces. Used for signatures in `ERC20Permit`, `ERC20Votes`, and `ERC721Votes`. ([#3816](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3816))

.changeset/mighty-donuts-smile.md

@@ -1,6 +0,0 @@
----
-'openzeppelin-solidity': patch
----
-
-`Governor`: Add validation in ERC1155 and ERC721 receiver hooks to ensure Governor is the executor.
-

.changeset/modern-games-exist.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`StorageSlot`: Add support for `string` and `bytes`.

.changeset/new-ways-own.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': patch
+---
+
+`ERC20Pausable`, `ERC721Pausable`, `ERC1155Pausable`: Add note regarding missing public pausing functionality

.changeset/ninety-hornets-kick.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`Votes`, `ERC20Votes`, `ERC721Votes`: support timestamp checkpointing using EIP-6372.

.changeset/orange-apes-draw.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-Switched to using explicit Solidity import statements. Some previously available symbols may now have to be separately imported.

.changeset/perfect-insects-listen.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`ERC4626`: Add mitigation to the inflation attack through virtual shares and assets.

.changeset/pink-suns-mix.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': patch
----
-
-`Math`: Optimized stack operations in `mulDiv`.

.changeset/popular-deers-raise.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`Governor`: Add support for casting votes with ERC-1271 signatures by using a `bytes memory signature` instead of `r`, `s` and `v` arguments in the `castVoteBySig` and `castVoteWithReasonAndParamsBySig` functions.

.changeset/pretty-hornets-play.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`Strings`: add `toString` method for signed integers. ([#3773](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3773))

.changeset/proud-comics-deliver.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`ERC20Wrapper`: Make the `underlying` variable private and add a public accessor.

.changeset/proud-seals-complain.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': patch
----
-
-`BeaconProxy`: Use an immutable variable to store the address of the beacon. It is no longer possible for a `BeaconProxy` to upgrade by changing to another beacon.

.changeset/purple-cats-cheer.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`GovernorTimelockControl`: Add the Governor instance address as part of the TimelockController operation `salt` to avoid operation id collisions between governors using the same TimelockController.

.changeset/red-dots-fold.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-Overrides are now used internally for a number of functions that were previously hardcoded to their default implementation in certain locations: `ERC1155Supply.totalSupply`, `ERC721.ownerOf`, `ERC721.balanceOf` and `ERC721.totalSupply` in `ERC721Enumerable`, `ERC20.totalSupply` in `ERC20FlashMint`, and `ERC1967._getImplementation` in `ERC1967Proxy`.

.changeset/rotten-insects-wash.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`ProxyAdmin`: Removed `getProxyAdmin` and `getProxyImplementation` getters. ([#3820](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3820))

.changeset/serious-books-lie.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': patch
----
-
-`ERC1155`: Optimize array allocation.

.changeset/short-eels-enjoy.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-Bump minimum compiler version required to 0.8.20

.changeset/short-roses-judge.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`EIP712`: add EIP-5267 support for better domain discovery.

.changeset/silent-dancers-type.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`AccessControlDefaultAdminRules`: Add an extension of `AccessControl` with additional security rules for the `DEFAULT_ADMIN_ROLE`.

.changeset/silly-bees-beam.md

@@ -1,7 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`ERC20Votes`: Changed internal vote accounting to reusable `Votes` module previously used by `ERC721Votes`. Removed implicit `ERC20Permit` inheritance. Note that the `DOMAIN_SEPARATOR` getter was previously guaranteed to be available for `ERC20Votes` contracts, but is no longer available unless `ERC20Permit` is explicitly used; ERC-5267 support is included in `ERC20Votes` with `EIP712` and is recommended as an alternative.
-
-pr: #3816

.changeset/sixty-numbers-reply.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`Governor`: Add `voter` and `nonce` parameters in signed ballots, to avoid forging signatures for random addresses, prevent signature replay, and allow invalidating signatures. Add `voter` as a new parameter in the `castVoteBySig` and `castVoteWithReasonAndParamsBySig` functions.

.changeset/slimy-knives-hug.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`SignatureChecker`: Add `isValidERC1271SignatureNow` for checking a signature directly against a smart contract using ERC-1271.

.changeset/slimy-penguins-attack.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`TransparentUpgradeableProxy`: Removed `admin` and `implementation` getters, which were only callable by the proxy owner and thus not very useful. ([#3820](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3820))

.changeset/small-cars-appear.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': patch
+---
+
+`ECDSA`: Add a function `toDataWithIntendedValidatorHash` that encodes data with version 0x00 following EIP-191.

.changeset/small-terms-sleep.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`SafeERC20`: Add a `forceApprove` function to improve compatibility with tokens behaving like USDT.

.changeset/smooth-books-wink.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`ERC1155`: Remove check for address zero in `balanceOf`.

.changeset/spicy-sheep-eat.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`access`: Move `AccessControl` extensions to a dedicated directory.

.changeset/spotty-hotels-type.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': patch
----
-
-`ERC721Consecutive`: Add a `_firstConsecutiveId` internal function that can be overridden to change the id of the first token minted through `_mintConsecutive`.

.changeset/strong-bulldogs-buy.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`ERC1967Upgrade`: removed contract-wide `oz-upgrades-unsafe-allow delegatecall` annotation, replaced by granular annotation in `UUPSUpgradeable`.

.changeset/strong-poems-thank.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`DoubleEndedQueue`: refactor internal structure to use `uint128` instead of `int128`. This has no effect on the library interface.

.changeset/swift-bags-divide.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': patch
----
-
-`Governor`: Add a mechanism to restrict the address of the proposer using a suffix in the description.

.changeset/swift-numbers-cry.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': minor
----
-
-`Governor`, `Initializable`, and `UUPSUpgradeable`: Use internal functions in modifiers to optimize bytecode size.

.changeset/tame-ladybugs-sit.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': patch
+---
+
+`MerkleProof`: optimize by using unchecked arithmetic. ([#3745](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3745))

.changeset/tasty-tomatoes-turn.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`Strings`: Rename `toString(int256)` to `toStringSigned(int256)`.

.changeset/tender-shirts-turn.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`BeaconProxy`: Reject value in initialization unless a payable function is explicitly invoked.

.changeset/thin-camels-matter.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': minor
----
-
-`ERC1155`: Bubble errors triggered in the `onERC1155Received` and `onERC1155BatchReceived` hooks.

.changeset/thin-dragons-report.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`ECDSA`: optimize bytes32 computation by using assembly instead of `abi.encodePacked`.

.changeset/thirty-swans-exercise.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`ERC721URIStorage`: Emit ERC-4906 `MetadataUpdate` in `_setTokenURI`.

.changeset/tough-drinks-hammer.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': patch
----
-
-`ERC1155`: Optimize array accesses by skipping bounds checking when unnecessary.

.changeset/two-wasps-punch.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': minor
----
-
-`AccessControl`: Add a boolean return value to the internal `_grantRole` and `_revokeRole` functions indicating whether the role was granted or revoked.

.changeset/unlucky-beans-obey.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': patch
----
-
-`ERC2771Context`: Return the forwarder address whenever the `msg.data` of a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. `msg.data.length` is less than 20 bytes), as specified by ERC-2771.

.changeset/violet-dancers-cough.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': minor
----
-
-Remove the `override` specifier from functions that only override a single interface function.

.changeset/violet-frogs-hide.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`ShortStrings`: Added a library for handling short strings in a gas efficient way, with fallback to storage for longer strings.

.changeset/warm-guests-rule.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': patch
----
-
-`ERC2771Context`: Prevent revert in `_msgData()` when a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. `msg.data.length` is less than 20 bytes). Return the full calldata in that case.

.changeset/warm-masks-obey.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`SignatureChecker`: Allow return data length greater than 32 from EIP-1271 signers.

.changeset/wild-beds-visit.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`GovernorStorage`: Added a new governor extension that stores the proposal details in storage, with an interface that operates on `proposalId`, as well as proposal enumerability. This replaces the old `GovernorCompatibilityBravo` module.

.changeset/wild-rockets-rush.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`Math`: Renamed members of `Rounding` enum, and added a new rounding mode for "away from zero".

.changeset/wild-windows-trade.md

@@ -1,5 +0,0 @@
----
-'openzeppelin-solidity': major
----
-
-`SafeERC20`: Refactor `safeDecreaseAllowance` and `safeIncreaseAllowance` to support USDT-like tokens.

.changeset/yellow-swans-cover.md

@@ -0,0 +1,5 @@
+---
+'openzeppelin-solidity': minor
+---
+
+`UUPSUpgradeable`: added granular `oz-upgrades-unsafe-allow-reachable` annotation to improve upgrade safety checks on latest version of the Upgrades Plugins (starting with `@openzeppelin/upgrades-core@1.21.0`).

.github/workflows/checks.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - master
-      - next-v*
       - release-v*
   pull_request: {}
   workflow_dispatch: {}
@@ -13,11 +12,9 @@ concurrency:
   group: checks-${{ github.ref }}
   cancel-in-progress: true
 
-env:
-  NODE_OPTIONS: --max_old_space_size=5120
-
 jobs:
   lint:
+    if: github.repository != 'OpenZeppelin/openzeppelin-contracts-upgradeable'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -29,6 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       FORCE_COLOR: 1
+      NODE_OPTIONS: --max_old_space_size=4096
       GAS: true
     steps:
       - uses: actions/checkout@v3
@@ -39,34 +37,19 @@ jobs:
       - name: Check linearisation of the inheritance graph
         run: npm run test:inheritance
       - name: Check proceduraly generated contracts are up-to-date
+        if: github.repository != 'OpenZeppelin/openzeppelin-contracts-upgradeable'
         run: npm run test:generation
       - name: Compare gas costs
         uses: ./.github/actions/gas-compare
         with:
           token: ${{ github.token }}
-
-  tests-upgradeable:
-    runs-on: ubuntu-latest
-    env:
-      FORCE_COLOR: 1
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0 # Include history so patch conflicts are resolved automatically
-      - name: Set up environment
-        uses: ./.github/actions/setup
-      - name: Transpile to upgradeable
-        run: bash scripts/upgradeable/transpile.sh
-      - name: Run tests
-        run: npm run test
-      - name: Check linearisation of the inheritance graph
-        run: npm run test:inheritance
       - name: Check storage layout
         uses: ./.github/actions/storage-layout
         with:
           token: ${{ github.token }}
 
-  tests-foundry:
+  foundry-tests:
+    if: github.repository != 'OpenZeppelin/openzeppelin-contracts-upgradeable'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -80,17 +63,19 @@ jobs:
         run: forge test -vv
 
   coverage:
+    if: github.repository != 'OpenZeppelin/openzeppelin-contracts-upgradeable'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
       - name: Set up environment
         uses: ./.github/actions/setup
       - run: npm run coverage
+        env:
+          NODE_OPTIONS: --max_old_space_size=4096
       - uses: codecov/codecov-action@v3
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
 
   slither:
+    if: github.repository != 'OpenZeppelin/openzeppelin-contracts-upgradeable'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -98,16 +83,14 @@ jobs:
         uses: ./.github/actions/setup
       - run: rm foundry.toml
       - uses: crytic/slither-action@v0.3.0
-        with:
-          node-version: 18.15
 
   codespell:
+    if: github.repository != 'OpenZeppelin/openzeppelin-contracts-upgradeable'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
       - name: Run CodeSpell
-        uses: codespell-project/actions-codespell@v2.0
+        uses: codespell-project/actions-codespell@v1.0
         with:
-          check_hidden: true
           check_filenames: true
           skip: package-lock.json,*.pdf

.github/workflows/formal-verifiation.yml

@@ -0,0 +1,55 @@
+name: Formal verification
+
+on:
+  push:
+    branches:
+      - master
+      - release-v*
+      - formal-verification
+  pull_request: {}
+  workflow_dispatch: {}
+
+jobs:
+  list-scripts:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@v2
+      - id: set-matrix
+        run: echo ::set-output name=matrix::$(ls certora/scripts/{,**}/*.sh | grep -v '\WnoCI\W' | jq -Rsc 'split("\n")[:-1]')
+
+  verify:
+    runs-on: ubuntu-latest
+    needs: list-scripts
+    steps:
+      - uses: actions/checkout@v2
+      - name: Install python
+        uses: actions/setup-python@v2
+        with:
+          python-version: '3.10'
+          cache: 'pip'
+      - name: Install java
+        uses: actions/setup-java@v1
+        with:
+          java-version: '11'
+          java-package: 'jre'
+      - name: Install certora
+        run: pip install certora-cli
+      - name: Install solc
+        run: |
+          wget https://github.com/ethereum/solidity/releases/download/v0.8.19/solc-static-linux
+          sudo mv solc-static-linux /usr/local/bin/solc
+          chmod +x /usr/local/bin/solc
+      - name: Verify rule ${{ matrix.params }}
+        run: |
+          touch certora/applyHarness.patch
+          make -C certora munged
+          bash ${{ matrix.params }}
+        env:
+          CERTORAKEY: ${{ secrets.CERTORAKEY }}
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix:
+        params: ${{ fromJson(needs.list-scripts.outputs.matrix) }}

.github/workflows/formal-verification.yml

@@ -1,68 +0,0 @@
-name: formal verification
-
-on:
-  pull_request:
-    types:
-      - opened
-      - reopened
-      - synchronize
-      - labeled
-  workflow_dispatch: {}
-
-env:
-  PIP_VERSION: '3.10'
-  JAVA_VERSION: '11'
-  SOLC_VERSION: '0.8.20'
-
-concurrency: ${{ github.workflow }}-${{ github.ref }}
-
-jobs:
-  apply-diff:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Apply patches
-        run: make -C certora apply
-
-  verify:
-    runs-on: ubuntu-latest
-    if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'formal-verification')
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-      - name: Set up environment
-        uses: ./.github/actions/setup
-      - name: identify specs that need to be run
-        id: arguments
-        run: |
-          if [[ ${{ github.event_name }} = 'pull_request' ]];
-          then
-            RESULT=$(git diff ${{ github.event.pull_request.head.sha }}..${{ github.event.pull_request.base.sha }} --name-only certora/specs/*.spec | while IFS= read -r file; do [[ -f $file ]] && basename "${file%.spec}"; done | tr "\n" " ")
-          else
-            RESULT='--all'
-          fi
-          echo "result=$RESULT" >> "$GITHUB_OUTPUT"
-      - name: Install python
-        uses: actions/setup-python@v4
-        with:
-          python-version: ${{ env.PIP_VERSION }}
-          cache: 'pip'
-      - name: Install python packages
-        run: pip install -r requirements.txt
-      - name: Install java
-        uses: actions/setup-java@v3
-        with:
-          distribution: temurin
-          java-version: ${{ env.JAVA_VERSION }}
-      - name: Install solc
-        run: |
-          wget https://github.com/ethereum/solidity/releases/download/v${{ env.SOLC_VERSION }}/solc-static-linux
-          sudo mv solc-static-linux /usr/local/bin/solc
-          chmod +x /usr/local/bin/solc
-      - name: Verify specification
-        run: |
-          make -C certora apply
-          node certora/run.js ${{ steps.arguments.outputs.result }} >> "$GITHUB_STEP_SUMMARY"
-        env:
-          CERTORAKEY: ${{ secrets.CERTORAKEY }}

.github/workflows/release-cycle.yml

@@ -192,8 +192,6 @@ jobs:
       pull-requests: write
     if: needs.state.outputs.merge == 'true'
     runs-on: ubuntu-latest
-    env:
-      MERGE_BRANCH: merge/${{ github.ref_name }}
     steps:
       - uses: actions/checkout@v3
         with:
@@ -202,9 +200,7 @@ jobs:
         uses: ./.github/actions/setup
       - run: bash scripts/git-user-config.sh
       - name: Create branch to merge
-        run: |
-          git checkout -B "$MERGE_BRANCH" "$GITHUB_REF_NAME"
-          git push -f origin "$MERGE_BRANCH"
+        run: bash scripts/release/workflow/prepare-release-merge.sh
       - name: Create PR back to master
         uses: actions/github-script@v6
         with:
@@ -212,7 +208,7 @@ jobs:
             await github.rest.pulls.create({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              head: process.env.MERGE_BRANCH,
+              head: 'merge/${{ github.ref_name }}',
               base: 'master',
               title: '${{ format('Merge {0} branch', github.ref_name) }}'
             });

.github/workflows/upgradeable.yml

@@ -1,4 +1,4 @@
-name: transpile upgradeable
+name: Upgradeable Trigger
 
 on:
   push:
@@ -7,24 +7,17 @@ on:
       - release-v*
 
 jobs:
-  transpile:
-    environment: push-upgradeable
+  trigger:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - id: app
+        uses: getsentry/action-github-app-token@v2
         with:
-          repository: OpenZeppelin/openzeppelin-contracts-upgradeable
-          fetch-depth: 0
-          token: ${{ secrets.GH_TOKEN_UPGRADEABLE }}
-      - name: Fetch current non-upgradeable branch
-        run: |
-          git fetch "https://github.com/${{ github.repository }}.git" "$REF"
-          git checkout FETCH_HEAD
-        env:
-          REF: ${{ github.ref }}
-      - name: Set up environment
-        uses: ./.github/actions/setup
-      - run: bash scripts/git-user-config.sh
-      - name: Transpile to upgradeable
-        run: bash scripts/upgradeable/transpile-onto.sh ${{ github.ref_name }} origin/${{ github.ref_name }}
-      - run: git push origin ${{ github.ref_name }}
+          app_id: ${{ secrets.UPGRADEABLE_APP_ID }}
+          private_key: ${{ secrets.UPGRADEABLE_APP_PK }}
+      - run: |
+          curl -X POST \
+            https://api.github.com/repos/OpenZeppelin/openzeppelin-contracts-upgradeable/dispatches \
+            -H 'Accept: application/vnd.github.v3+json' \
+            -H 'Authorization: token ${{ steps.app.outputs.token }}' \
+            -d '{ "event_type": "Update", "client_payload": { "ref": "${{ github.ref }}" } }'

.gitignore

@@ -68,4 +68,4 @@ contracts-exposed
 .certora*
 .last_confs
 certora_*
-.zip-output-url.txt
+resource_errors.json

.gitmodules

@@ -1,5 +1,4 @@
 [submodule "lib/forge-std"]
-	branch = v1
 	path = lib/forge-std
 	url = https://github.com/foundry-rs/forge-std
 [submodule "lib/erc4626-tests"]