OpenZeppelin Contracts v5.7.0-rc.0

Release notes

Breaking changes

• Governor and IGovernor: Replace GovernorQueueNotImplemented with GovernorProposalQueueingNotRequired and GovernorProposalQueueingFailed. (#6582)

Deprecations

• Checkpoints, DoubleEndedQueue, EnumerableMap and EnumerableSet: Deprecate the at function for accessing a specific index of the structure. We introduce new pos functions to replace them. (#6494)

Changes by category

Utils

Additions

• BlockHeader: Add a new library for verifying and parsing block headers. (#6395)

• Create3: Add a library to deploy contracts using the CREATE3 mechanism, allowing the deployment address to depend only on the salt and the deployer, independently of the deployed bytecode. (#6402)

• ERC1967Clones: Add a library to deploy minimal ERC-1967 proxies via CREATE or CREATE2. (#6405)

• ERC6372Utils: Add utility library for ERC-6372 clock mode validation, supporting block number and timestamp modes with consistency checks. (#6483)

• RateLimiter: Add a library that provides primitives for limiting the rate at which an action can be performed, with two complementary strategies: a refilling token bucket and a sliding window counter. (#6490)

• SimulateCall: Add a new call simulation utilities that allow inspecting return data from contract calls by executing them in a non-mutating, revert-based context. (#6290)

Other

• Arrays: Reduce reliance on recursion to prevent stack overflow and support larger arrays. (#6324)

• ERC2771Forwarder: Revert the entire atomic batch if a call with value fails. (#6391)

• InteroperableAddress: Fix overflow in the parsing functions that caused silent misparse of large interoperable addresses. (#6372)

• InteroperableAddress: Reject inputs with both chain reference and addresses empty. (#6331)

• Memory: Add a isReserved(Slice) function that checks if the memory occupied by the slice is reserved (i.e. before the free memory pointer). (#6302)

• Memory: Remove the asBytes32 and asPointer function to reduce the risk of mistakes when manipulating memory pointers. (#6348)

• RLP: Perform a memory copy when decoding bytes objects containing a single byte instead of returning a reference to the input. (#6303)

Access

• AccessManager: Treat setAuthority differently in canCall to prevent bypassing the updateAuthority security using an execute. (#6388)

Account

• AccountERC7579Hooked: Do not revert if hook checks fail during the hook module uninstallation. (#6390)

• ERC4337Utils, IERC4337: Drop the draft- prefix from the file names now that ERC-4337 is finalized. Imports must be updated from account/utils/draft-ERC4337Utils.sol to account/utils/ERC4337Utils.sol and from interfaces/draft-IERC4337.sol to interfaces/IERC4337.sol. (#6581)

• Paymaster: Add a simple ERC-4337 paymaster implementation with minimal logic. (#6576)

• PaymasterERC20: Add extension of Paymaster that sponsors user operations against payment in ERC-20 tokens. (#6576)

• PaymasterERC20Guarantor: Add extension of PaymasterERC20 that enables third parties to guarantee user operations by prefunding gas costs upfront, with repayment handling for successful operations. (#6576)

• PaymasterERC721Owner: Add extension of Paymaster that approves sponsoring of user operation based on ownership of an ERC-721 NFT. (#6576)

• PaymasterSigner: Add extension of Paymaster that approves sponsoring of user operation based on a cryptographic signature verified by the paymaster. (#6576)

Cryptography

• ERC7913WebAuthnVerifier: Add an internal _requireUV function that can be overridden to disable the UV check. (#6596)

• WebAuthn: Verification now returns false instead of reverting when client data contains an out-of-bounds challengeIndex. (#6329)

Cross-chain

• BridgeERC20: Rename BridgeERC20 to BridgeFungible. (#6328)

• BridgeNonFungible and BridgeERC721: Add bridge contracts to handle crosschain movements of ERC-721 tokens. (#6259)

• BridgeMultiToken and BridgeERC1155: Add bridge contracts to handle crosschain movements of ERC-1155 tokens…