[Snyk] Upgrade web3 from 1.10.3 to 4.3.0

[Woodpile37]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade web3 from 1.10.3 to 4.3.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

Warning: This is a major version upgrade, and may be a breaking change.

• The recommended version is 138 versions ahead of your current version.
• The recommended version was released 2 months ago, on 2023-12-04.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-WS-1296835	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: web3

• 4.3.0 - 2023-12-04
  

  [4.3.0]

  Changed

  web3-core

  • Web3config contractDataInputFill has been defaulted to data, istead of input. (#6622)

  web3-eth-contracts

  • By default, contracts will fill data instead of input within method calls (#6622)

  Added

  web3-utils

  • SocketProvider now contains public function getPendingRequestQueueSize, getSentRequestsQueueSize and clearQueues (#6479)
  • Added safeDisconnect as a SocketProvider method to disconnect only when request queue size and send request queue size is 0 (#6479)
  • Add isContractInitOptions method (#6555)

  web3

  • Added methods (privateKeyToAddress, parseAndValidatePrivateKey, and privateKeyToPublicKey) to web3.eth.accounts (#6620)

  Fixed

  web3-rpc-methods

  • Fix web3-types import #6590 (#6589)

  web3-utils

  • Fix unecessary array copy when pack encoding (#6553)
• 4.2.3-dev.f8d8774.0 - 2023-11-23
• 4.2.3-dev.ef6f04e.0 - 2023-11-20
• 4.2.3-dev.e6d8c14.0 - 2023-11-28
• 4.2.3-dev.d8b8e18.0 - 2023-11-20
• 4.2.3-dev.be86e25.0 - 2023-11-20
• 4.2.3-dev.bcd0706.0 - 2023-11-20
• 4.2.3-dev.b9da5a5.0 - 2023-11-20
• 4.2.3-dev.b3ccd5c.0 - 2023-11-28
• 4.2.3-dev.af91519.0 - 2023-11-20
• 4.2.3-dev.8e3e676.0 - 2023-11-10
• 4.2.3-dev.7461c8e.0 - 2023-12-01
• 4.2.3-dev.72e9bbd.0 - 2023-11-03
• 4.2.3-dev.6cc86b3.0 - 2023-11-20
• 4.2.3-dev.4778a0c.0 - 2023-11-06
• 4.2.3-dev.41dbf2a.0 - 2023-11-06
• 4.2.3-dev.3bda14d.0 - 2023-11-27
• 4.2.3-dev.332c18c.0 - 2023-11-06
• 4.2.3-dev.2c60685.0 - 2023-11-20
• 4.2.3-dev.2c132c5.0 - 2023-11-16
• 4.2.3-dev.20cc5da.0 - 2023-11-23
• 4.2.3-dev.11f20b2.0 - 2023-11-06
• 4.2.3-dev.119dfa5.0 - 2023-12-04
• 4.2.3-dev.0dec262.0 - 2023-11-17
• 4.2.3-dev.09c8ad0.0 - 2023-11-07
• 4.2.3-dev.2785782.0 - 2023-11-20
• 4.2.2 - 2023-11-03
  

  Added

  web3-core

  • Added isMetaMaskProvider function to check if provider is metamask (#6534)

  web3-types

  • Interface MetaMaskProvider added and is part of SupportedProviders (#6534)
  • gasPrice was added to Transaction1559UnsignedAPI type. (#6539)

  Changed

  web3

  • Dependencies updated

  Fixed

  web3-errors

  • Fixed grammar and spelling in transactionTimeoutHint (#6559)

  web3-eth-contract

  • Will populate data for transactions in contract for metamask provider instead of input (#6534)
• 4.2.2-dev.f9bcac9.0 - 2023-11-02
• 4.2.2-dev.f6c7fca.0 - 2023-10-31
• 4.2.2-dev.b05345b.0 - 2023-11-01
• 4.2.2-dev.8c643c2.0 - 2023-10-25
• 4.2.2-dev.41f39c0.0 - 2023-10-26
• 4.2.2-dev.116b7bb.0 - 2023-10-31
• 4.2.1 - 2023-10-25
  

  Fixed

  web3-eth-abi

  • Bug fix of ERR_UNSUPPORTED_DIR_IMPORT in ABI (#6535)

  Changed

  web3-eth-contract

  • Dependencies updated

  web3-eth

  • Dependencies updated

  web3-eth-ens

  • Dependencies updated

  web3-eth-personal

  • Dependencies updated

  web3

  • Dependencies updated
• 4.2.1-dev.f860b04.0 - 2023-10-23
• 4.2.1-dev.bd3b9a0.0 - 2023-10-18
• 4.2.1-dev.a0d6730.0 - 2023-10-23
• 4.2.1-dev.90b8581.0 - 2023-10-23
• 4.2.1-dev.7bee9bc.0 - 2023-10-18
• 4.2.1-dev.6791e60.0 - 2023-10-23
• 4.2.0 - 2023-10-18
  

  Added

  web3

  • Various web3 sub packages has new functions details are in root changelog

  web3-eth

  • Added ALL_EVENTS and ALL_EVENTS_ABI constants, SendTransactionEventsBase type, decodeEventABI method (#6410)

  web3-eth-accounts

  • Added public function privateKeyToPublicKey
  • Added exporting BaseTransaction from the package (#6493)
  • Added exporting txUtils from the package (#6493)

  web3-types

  • Interface EventLog was added. (#6410)

  web3-utils

  • As a replacment of the node EventEmitter, a custom EventEmitter has been implemented and exported. (#6398)

  Fixed

  web3-core

  • Fix the issue: "Uncaught TypeError: Class extends value undefined is not a constructor or null #6371". (#6398)

  web3-errors

  • Added new SchemaFormatError (#6434)

  web3-eth

  • Ensure provider.supportsSubscriptions exists before watching by subscription (#6440)
  • Fixed param sent to checkRevertBeforeSending in sendSignedTransaction
  • Fixed defaultTransactionBuilder for value issue (#6509)

  web3-eth-abi

  • Fix issue with default config with babel (and React): "TypeError: Cannot convert a BigInt value to a number #6187" (#6506)

  web3-eth-accounts

  • Fixed recover function, v will be normalized to value 0,1 (#6344)

  web3-providers-http

  • Fix issue lquixada/cross-fetch#78, enabling to run web3.js in service worker (#6463)

  web3-providers-ipc

  • Fixed bug in chunks processing logic (#6496)

  web3-providers-ws

  • Fixed bug in chunks processing logic (#6496)

  web3-utils

  • Fix issue with default config with babel (and React): "TypeError: Cannot convert a BigInt value to a number #6187" (#6506)
  • Fixed bug in chunks processing logic (#6496)

  web3-validator

  • Multi-dimensional arrays are now handled properly when parsing ABIs (#6435)
  • Fix issue with default config with babel (and React): "TypeError: Cannot convert a BigInt value to a number #6187" (#6506)
  • Validator will now properly handle all valid numeric type sizes: intN / uintN where 8 <= N <= 256 and N % 8 == 0 (#6434)
  • Will now throw SchemaFormatError when unsupported format is passed to convertToZod method (#6434)

  Changed

  web3

  • Dependencies updated

  web3-core

  • defaultTransactionType is now type 0x2 instead of 0x0 (#6282)
  • Allows formatter to parse large base fee (#6456)
  • The package now uses EventEmitter from web3-utils that works in node envrioment as well as in the browser. (#6398)

  web3-eth

  • Transactions will now default to type 2 transactions instead of type 0, similar to 1.x version. (#6282)

  web3-eth-contract

  • The events property was added to the receipt object (#6410)

  web3-eth-ens

  • Dependencies updated

  web3-eth-iban

  • Dependencies updated

  web3-eth-personal

  • Dependencies updated

  web3-net

  • Dependencies updated

  web3-providers-http

  • Bump cross-fetch to version 4 (#6463).

  web3-rpc-methods

  • Dependencies updated
• 4.1.3-dev.e760667.0 - 2023-10-13
• 4.1.3-dev.d036166.0 - 2023-09-22
• 4.1.3-dev.c490c18.0 - 2023-09-28
• 4.1.3-dev.bfcbea8.0 - 2023-10-02
• 4.1.3-dev.b8fa712.0 - 2023-09-27
• 4.1.3-dev.b38f00d.0 - 2023-10-12
• 4.1.3-dev.ae98628.0 - 2023-10-09
• 4.1.3-dev.9b03f9d.0 - 2023-10-04
• 4.1.3-dev.9a5fd87.0 - 2023-10-10
• 4.1.3-dev.90d78c1.0 - 2023-10-02
• 4.1.3-dev.80adabe.0 - 2023-09-23
• 4.1.3-dev.80986bb.0 - 2023-10-04
• 4.1.3-dev.70d1957.0 - 2023-10-17
• 4.1.3-dev.6e43d1b.0 - 2023-10-12
• 4.1.3-dev.66ddb7e.0 - 2023-09-21
• 4.1.3-dev.54c5ed0.0 - 2023-09-19
• 4.1.3-dev.4b445ae.0 - 2023-09-29
• 4.1.3-dev.42502b6.0 - 2023-10-16
• 4.1.3-dev.2b445bf.0 - 2023-09-19
• 4.1.3-dev.226b3ba.0 - 2023-10-17
• 4.1.3-dev.171b413.0 - 2023-09-21
• 4.1.3-dev.10d1f12.0 - 2023-10-16
• 4.1.3-dev.0e78235.0 - 2023-10-05
• 4.1.3-dev.09f4c8b.0 - 2023-10-17
• 4.1.3-dev.4879326.0 - 2023-10-09
• 4.1.3-dev.3060994.0 - 2023-09-28
• 4.1.2 - 2023-09-19
  Read more
• 4.1.2-dev.e4ba45c.0 - 2023-09-15
• 4.1.2-dev.da3e2f5.0 - 2023-09-12
• 4.1.2-dev.a325689.0 - 2023-08-21
• 4.1.2-dev.9ad39bd.0 - 2023-08-21
• 4.1.2-dev.8010a6d.0 - 2023-09-18
• 4.1.2-dev.3ab3b39.0 - 2023-09-12
• 4.1.2-dev.054033f.0 - 2023-09-15
• 4.1.1 - 2023-08-21
• 4.1.1-dev.f4fd498.0 - 2023-08-15
• 4.1.1-dev.ec6e117.0 - 2023-08-17
• 4.1.1-dev.d41a49e.0 - 2023-08-17
• 4.1.1-dev.c41d356.0 - 2023-08-15
• 4.1.1-dev.a4cae6f.0 - 2023-08-15
• 4.1.1-dev.86f0cdb.0 - 2023-08-18
• 4.1.1-dev.7a38fee.0 - 2023-08-17
• 4.1.1-dev.622174c.0 - 2023-08-15
• 4.1.1-dev.1cdc86c.0 - 2023-08-18
• 4.1.0 - 2023-08-15
• 4.1.0-rc.0 - 2023-08-09
• 4.0.4-dev.f5b4d7d.0 - 2023-07-20
• 4.0.4-dev.ed2770c.0 - 2023-07-24
• 4.0.4-dev.ebd0c57.0 - 2023-07-11
• 4.0.4-dev.e143157.0 - 2023-07-14
• 4.0.4-dev.b93934a.0 - 2023-07-17
• 4.0.4-dev.b771112.0 - 2023-08-01
• 4.0.4-dev.ad377d1.0 - 2023-07-14
• 4.0.4-dev.933ef51.0 - 2023-07-20
• 4.0.4-dev.7d0a91d.0 - 2023-07-19
• 4.0.4-dev.6da17e1.0 - 2023-07-24
• 4.0.4-dev.51d087e.0 - 2023-08-03
• 4.0.4-dev.51bc03d.0 - 2023-07-12
• 4.0.4-dev.0ee9bb4.0 - 2023-07-25
• 4.0.4-dev.0e5c53c.0 - 2023-08-02
• 4.0.4-dev.8958413.0 - 2023-07-14
• 4.0.4-dev.4310419.0 - 2023-08-01
• 4.0.4-dev.1361787.0 - 2023-07-18
• 4.0.3 - 2023-07-11
• 4.0.3-dev.d12dc7e.0 - 2023-06-27
• 4.0.3-dev.a26a888.0 - 2023-06-27
• 4.0.3-dev.602dada.0 - 2023-07-03
• 4.0.2 - 2023-06-27
• 4.0.2-dev.f8a2533.0 - 2023-06-10
• 4.0.2-dev.e8d579c.0 - 2023-06-24
• 4.0.2-dev.af57eae.0 - 2023-06-09
• 4.0.2-dev.ab0f4cb.0 - 2023-06-20
• 4.0.2-dev.a2a232f.0 - 2023-06-21
• 4.0.2-dev.60b8ba9.0 - 2023-06-27
• 4.0.2-dev.51a59f9.0 - 2023-06-21
• 4.0.2-dev.3f49e18.0 - 2023-06-24
• 4.0.2-dev.2130d22.0 - 2023-06-15
• 4.0.2-dev.023f02d.0 - 2023-06-20
• 4.0.1 - 2023-06-07
• 4.0.1-rc.2 - 2023-06-05
• 4.0.1-rc.1 - 2023-04-20
• 4.0.1-rc.0 - 2023-03-10
• 4.0.1-alpha.5 - 2023-01-14
• 4.0.1-alpha.4 - 2023-01-12
• 4.0.1-alpha.3 - 2023-01-05
• 4.0.1-alpha.2 - 2022-12-09
• 4.0.1-alpha.1 - 2022-11-03
• 4.0.1-alpha.0 - 2022-08-25
• 4.0.0-alpha.0 - 2022-08-24
• 3.0.0-rc.5 - 2021-07-02
• 3.0.0-rc.4 - 2021-04-27
• 3.0.0-rc.1 - 2021-04-23
• 3.0.0-rc.0 - 2021-04-09
• 2.0.0-alpha.1 - 2019-08-06
• 2.0.0-alpha - 2019-07-13
• 1.10.4 - 2024-02-05
  

  Security

  • Updated dependencies (#6731)

  ---

  Maintenance Countdown:

  Commencing from January 1, 2024, a 90-day countdown has been initiated, signaling the transition of Web3.js version 1.x into an end-of-maintenance phase.

  Timeline of Changes:

  90-Day Countdown (1/1/24 - 3/31/24): During this period, we strongly encourage users to plan accordingly and initiate the upgrade to Web3.js version 4.x

  No New Bug Fixes (4/1/24 onwards):

  Starting April 1, 2024, new bug fixes for Web3.js version 1.x will no longer be provided. To benefit from continued support and access to new features, we recommend upgrading to Web3.js version 4.x

  End of Security Fixes (7/1/24):

  Security fixes for Web3.js version 1.x will be discontinued from July 1, 2024. Upgrading to Web3.js version 4.x is crucial to ensure the security of your applications.

• 1.10.4-dev.0 - 2024-01-31
  

  Security

  • Updated dependencies (#6731)
• 1.10.3 - 2023-10-18
  

  Security

  • web3-eth-accounts: Bumped @ ethereumjs dependencies (#6457)

  • Updated dependencies (#6491)

from web3 GitHub release notes

Commit messages

Package name: web3

• b9b5fe0 update test
• 33c068d fix getproof error
• 7e2b4e7 add missing package
• 84242da update changelog
• 8c75060 update changelog
• 8e87ef9 update packages
• 4163ad1 revert some package bumps
• 9ccb2fb update vers
• 4dffacc fix versioning
• 3301287 update changelog
• ee5e81d update changelog and run lerna
• b3ccd5c change default to data (Apply fix to tracer.js blockscout/blockscout#6622)
• e6d8c14 Stress Tests 1 - QA Tests ([L2 MAIN] Scroll: <ICONNECTION ISSUEssue Title> blockscout/blockscout#6595)
• 3bda14d added methods (privateKeyToAddress, parseAndValidatePrivateKey,and privateKeyToPublicKey) to web3.eth.accounts (PG events errors with several Blockscout instances blockscout/blockscout#6621)
• 20cc5da Proposal: Expose plugin functionality to plugins so it's easier to discover what plugins could do (Crossbell: <Issue Title> blockscout/blockscout#6538)
• f8d8774 update socket provider test (Ethereum: <Issue Title> blockscout/blockscout#6614)
• 2785782 Stress Tests 3 - create long duration ws tests (Add latest image for frontend-main blockscout/blockscout#6588)
• af91519 fix: unnecessary array copy when pack encoding (ETH Mainnet: bring the storage of ERC-721 token balances as at master branch blockscout/blockscout#6553)
• 2c60685 Stress Tests 2 - QA Tests (Missing ranges collector blockscout/blockscout#6583)
• d8b8e18 fix: faster hex to byte implementation (EVM Sidechain: Tomyleexrp blockscout/blockscout#6596)
• be86e25 Write a migration guide from ethers to web3.js (Add to MM button explorer URL fix blockscout/blockscout#6603)
• ef6f04e add websocket methods (Bump ecto_sql from 3.9.0 to 3.9.1 blockscout/blockscout#6479)
• 6cc86b3 4x clean docs (Transaction actions indexer blockscout/blockscout#6582)
• b9da5a5 chore: reference hardhat plugin for typescript artifacts (Migrate Phoenix 1.5 -> 1.6 blockscout/blockscout#6586)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[changeset-bot]

⚠️ No Changeset found

Latest commit: 05a9cef

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codeautopilot]

Your organization has reached the subscribed usage limit. You can upgrade your plan at https://www.codeautopilot.com/#pricing

Disclaimer: This comment was entirely generated using AI. Be aware that the information provided may be incorrect.

Current plan usage: 100.83%

Have feedback or need help?
Discord
Documentation
support@codeautopilot.com

[sonarcloud]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud