chore(deps-dev): bump @openzeppelin/contracts-upgradeable from 3.4.2 to 4.9.6 in /packages/contracts-test

[dependabot]

Bumps @openzeppelin/contracts-upgradeable from 3.4.2 to 4.9.6.

Release notes

Sourced from @​openzeppelin/contracts-upgradeable's releases.

v4.9.6

• Base64: Fix issue where dirty memory located just after the input buffer is affecting the result. (#4926)

v4.9.5

• Multicall: Patch duplicated Address.functionDelegateCall.

v4.9.4

• ERC2771Context and Context: Introduce a _contextPrefixLength() getter, used to trim extra information appended to msg.data.
• Multicall: Make aware of non-canonical context (i.e. msg.sender is not _msgSender()), allowing compatibility with ERC2771Context.

v4.9.3

Note This release contains a fix for GHSA-g4vp-m682-qqmp.

• ERC2771Context: Return the forwarder address whenever the msg.data of a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. msg.data.length is less than 20 bytes), as specified by ERC-2771. (#4481)
• ERC2771Context: Prevent revert in _msgData() when a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. msg.data.length is less than 20 bytes). Return the full calldata in that case. (#4484)

v4.9.2

Note This release contains a fix for GHSA-wprv-93r4-jj2p.

• MerkleProof: Fix a bug in processMultiProof and processMultiProofCalldata that allows proving arbitrary leaves if the tree contains a node with value 0 at depth 1.

v4.9.1

Note This release contains a fix for GHSA-5h3x-9wvq-w4m2.

• Governor: Add a mechanism to restrict the address of the proposer using a suffix in the description.

v4.9.0

• ReentrancyGuard: Add a _reentrancyGuardEntered function to expose the guard status. (#3714)
• ERC721Wrapper: add a new extension of the ERC721 token which wraps an underlying token. Deposit and withdraw guarantee that the ownership of each token is backed by a corresponding underlying token with the same identifier. (#3863)
• EnumerableMap: add a keys() function that returns an array containing all the keys. (#3920)
• Governor: add a public cancel(uint256) function. (#3983)
• Governor: Enable timestamp operation for blockchains without a stable block time. This is achieved by connecting a Governor's internal clock to match a voting token's EIP-6372 interface. (#3934)
• Strings: add equal method. (#3774)
• IERC5313: Add an interface for EIP-5313 that is now final. (#4013)
• IERC4906: Add an interface for ERC-4906 that is now Final. (#4012)
• StorageSlot: Add support for string and bytes. (#4008)
• Votes, ERC20Votes, ERC721Votes: support timestamp checkpointing using EIP-6372. (#3934)
• ERC4626: Add mitigation to the inflation attack through virtual shares and assets. (#3979)
• Strings: add toString method for signed integers. (#3773)
• ERC20Wrapper: Make the underlying variable private and add a public accessor. (#4029)
• EIP712: add EIP-5267 support for better domain discovery. (#3969)
• AccessControlDefaultAdminRules: Add an extension of AccessControl with additional security rules for the DEFAULT_ADMIN_ROLE. (#4009)
• SignatureChecker: Add isValidERC1271SignatureNow for checking a signature directly against a smart contract using ERC-1271. (#3932)

... (truncated)

Changelog

Sourced from @​openzeppelin/contracts-upgradeable's changelog.

4.9.6 (2024-02-29)

• Base64: Fix issue where dirty memory located just after the input buffer is affecting the result. (#4929)

4.9.5 (2023-12-08)

• Multicall: Make aware of non-canonical context (i.e. msg.sender is not _msgSender()), allowing compatibility with ERC2771Context. Patch duplicated Address.functionDelegateCall in v4.9.4 (removed).

4.9.3 (2023-07-28)

• ERC2771Context: Return the forwarder address whenever the msg.data of a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. msg.data.length is less than 20 bytes), as specified by ERC-2771. (#4481)
• ERC2771Context: Prevent revert in _msgData() when a call originating from a trusted forwarder is not long enough to contain the request signer address (i.e. msg.data.length is less than 20 bytes). Return the full calldata in that case. (#4484)

4.9.2 (2023-06-16)

• MerkleProof: Fix a bug in processMultiProof and processMultiProofCalldata that allows proving arbitrary leaves if the tree contains a node with value 0 at depth 1.

4.9.1 (2023-06-07)

• Governor: Add a mechanism to restrict the address of the proposer using a suffix in the description.

4.9.0 (2023-05-23)

• ReentrancyGuard: Add a _reentrancyGuardEntered function to expose the guard status. (#3714)
• ERC721Wrapper: add a new extension of the ERC721 token which wraps an underlying token. Deposit and withdraw guarantee that the ownership of each token is backed by a corresponding underlying token with the same identifier. (#3863)
• EnumerableMap: add a keys() function that returns an array containing all the keys. (#3920)
• Governor: add a public cancel(uint256) function. (#3983)
• Governor: Enable timestamp operation for blockchains without a stable block time. This is achieved by connecting a Governor's internal clock to match a voting token's EIP-6372 interface. (#3934)
• Strings: add equal method. (#3774)
• IERC5313: Add an interface for EIP-5313 that is now final. (#4013)
• IERC4906: Add an interface for ERC-4906 that is now Final. (#4012)
• StorageSlot: Add support for string and bytes. (#4008)
• Votes, ERC20Votes, ERC721Votes: support timestamp checkpointing using EIP-6372. (#3934)
• ERC4626: Add mitigation to the inflation attack through virtual shares and assets. (#3979)
• Strings: add toString method for signed integers. (#3773)
• ERC20Wrapper: Make the underlying variable private and add a public accessor. (#4029)
• EIP712: add EIP-5267 support for better domain discovery. (#3969)
• AccessControlDefaultAdminRules: Add an extension of AccessControl with additional security rules for the DEFAULT_ADMIN_ROLE. (#4009)
• SignatureChecker: Add isValidERC1271SignatureNow for checking a signature directly against a smart contract using ERC-1271. (#3932)
• SafeERC20: Add a forceApprove function to improve compatibility with tokens behaving like USDT. (#4067)
• ERC1967Upgrade: removed contract-wide oz-upgrades-unsafe-allow delegatecall annotation, replaced by granular annotation in UUPSUpgradeable. (#3971)
• ERC20Wrapper: self wrapping and deposit by the wrapper itself are now explicitly forbidden. (#4100)
• ECDSA: optimize bytes32 computation by using assembly instead of abi.encodePacked. (#3853)
• ERC721URIStorage: Emit ERC-4906 MetadataUpdate in _setTokenURI. (#4012)
• ShortStrings: Added a library for handling short strings in a gas efficient way, with fallback to storage for longer strings. (#4023)
• SignatureChecker: Allow return data length greater than 32 from EIP-1271 signers. (#4038)
• UUPSUpgradeable: added granular oz-upgrades-unsafe-allow-reachable annotation to improve upgrade safety checks on latest version of the Upgrades Plugins (starting with @openzeppelin/upgrades-core@1.21.0). (#3971)
• Initializable: optimize _disableInitializers by using != instead of <. (#3787)
• Ownable2Step: make acceptOwnership public virtual to enable usecases that require overriding it. (#3960)
• UUPSUpgradeable.sol: Change visibility to the functions upgradeTo and upgradeToAndCall from external to public. (#3959)

... (truncated)

Commits

• 2d081f2 Transpile dc44c9f1
• 2492017 Transpile a6286d0f
• a40cb0b Transpile bd325d56
• 4c73bfa Transpile ad6a5b68
• 31f9fb9 Transpile 88ac712e
• f55babc Transpile a83918df
• 5bc5999 Transpile 98c7a4cf
• 152b820 Transpile 0ed435b7
• f34a3a7 Transpile 17c1a3a4
• 3d4c0d5 Transpile fd81a96f
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by amxx, a new releaser for @​openzeppelin/contracts-upgradeable since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	typescript@​5.9.3

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm entities is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: pnpm-lock.yaml → npm/entities@4.5.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@4.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report