Skip to content

[AUD-021] [INFO] Dependency pins behind registry: forge-std 1.16.1 to 1.16.2, openzeppelin-contracts 5.6.1 to 5.7.0 (prompts, not mandates) #91

Description

@thedavidmeister

Whole-repo audit 2026-08-24 at commit 3e76bab (audit skill 0.35.0). Pass 2 status: ledgered (audit/mutation-test-scans.json, scan of 2026-08-24T08:55:39Z at 35496d8).

foundry.toml:11

forge-std is pinned at 1.16.1; soldeer registry has 1.16.2 (published 2026-07-03, 49k downloads). Prompt only, not a mandate.

Proposed fix

Bump foundry.toml [dependencies] forge-std to "1.16.2", run nix develop -c forge soldeer update (update, not install), and rewrite the versioned import prefixes forge-std-1.16.1/ -> forge-std-1.16.2/ in the test files (part of the 9 versioned-import lines across test/) plus remappings.txt.

foundry.toml:12

@OpenZeppelin-Contracts is pinned at 5.6.1; soldeer registry has 5.7.0 (published 2026-07-29). Only test files import it (Strings.sol reference oracle). Prompt only, not a mandate.

Proposed fix

Bump foundry.toml [dependencies] "@OpenZeppelin-Contracts" to "5.7.0", run nix develop -c forge soldeer update, and rewrite import prefixes @openzeppelin-contracts-5.6.1/ -> @openzeppelin-contracts-5.7.0/ in test/src/lib/parse/LibParseDecimal.unsafeDecimalStringToInt.t.sol and LibParseDecimal.unsafeDecimalStringToSignedInt.t.sol plus remappings.txt.

Metadata

Metadata

Labels

auditAudit findinginfoAudit findingpass4Audit finding

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions