• 9b77436 6.6.1
• 04cb6f5 Merge commit from fork
• b8a7edd 6.6.0
• 34c8534 fix: signature verification due to leading zeros
• 3e46a48 6.5.7
• accb61e lib: DER signature decoding correction
• 03e06e1 6.5.6
• 7ac5360 Merge commit from fork
• 7570078 6.5.5
• 206da2e lib: lint
• Additional commits viewable in compare view

Sourced from ethers's releases.

ethers/v5.8.0 (2025-02-25 19:15) [legacy version]

This is a security update for the legacy Ethers v5 branch, addressing two security fixes.

• A bug in elliptic, which does not affect ethers but triggers a critical security warning during nom audit [see: missing signature length check, missing check for leading bit, allow BER-encoded signatures, false negative verification, signing malformed input]
• A bug in ws which can be used as DoS vector when communicating with malicious WebSocket service providers, triggering a high security warning during nom audit [see: too many HTTP headers]

For those that wish to audit the specific changes in the the bundled version between v5.7 and v5.8, see this gist.

Changes

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

---

Embedding UMD with SRI:

<script type="text/javascript"
  integrity="sha384-KpyAXoFibPIUEi79EsnN1EtEWCCrOQ8MtGsa4IrVxeZo514PYarFXujnjyu0DzgC"
  crossorigin="anonymous"
  src="https://cdnjs.cloudflare.com/ajax/libs/ethers/5.8.0/ethers.umd.min.js">
</script>

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

---

Embedding UMD with SRI:

<script type="text/javascript"
        integrity="sha384-Htz1SE4Sl5aitpvFgr2j0sfsGUIuSXI6t8hEyrlQ93zflEF3a29bH2AvkUROUw7J"
        crossorigin="anonymous"
        src="https://cdn-cors.ethers.io/lib/ethers-5.7.2.umd.min.js">
</script>

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

---

... (truncated)

Sourced from ethers's changelog.

ethers/v5.8.0 (2025-02-25 19:15)

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

ethers/v5.7.2 (2022-10-19 04:19)

• Updated tests to use goerli instead of ropsten. (1392803, 706d3ca)
• Added new error strings Pocket returns. (9f990c5)
• Fixed Alchemy goerli URL. (#3320, #3323, #3340, #3358, #3423; 74e3d98)
• Update testnets for third-party providers. (#3320, #3323, #3340, #3358, #3423; 2a3a2e1)

ethers/v5.7.1 (2022-09-13 21:28)

• Fixed message signing errors that clobbered critical Error properties. (#3356; b14cb0f)
• Add support for all data URL formats. (#3341; 4c86dc9)
• Added Sepolia network. (#3325; d083522)

ethers/v5.7.0 (2022-08-18 16:17)

• Update PocketProvider to newer URL format. (#2980; 10d07ca)
• Add new ENS normalization specification for wider UTF-8 support. (#42, #2376, #2754; 14bf407, fce9aaa, f274104)
• Added ACTION_REJECTED error for UI-based Signers. (d9897e0)
• Include current baseFee in feeData for easier custom fee calculation. (8314236)
• Add restrictions for new UTF-8 specification ENS names. (#42, #2376, #2754; e52fbfb)
• Expand the definition of a WebSocketLike. (#2843; 00114d7)
• Expanded type for queryFitler to allow string. (#2882; 60da870)
• Added finalized and safe blockTags. (#3091; 549168c)
• Added arbitrum-goerli to Networks and AlchemyProvider. (#3246; e72d13e)
• Add EIP-712 type exports. (#221; 7ce41cd)
• Added optimism-goerli to AlchemyProvider. (#3246; f1cb0d2)
• Updated EtherscanProvider for new CommunityResource API throttling. (6bd13c3)
• Fix old events from being emitted at the beginning of a filter. (#3069, #3094; ea2d245)
• Fixed Interface signautres missing strings as eventFragments. (#3157; c004ae5)
• Fix bug in EIP1193Bridge forwarding to the wrong method. (#3166; 17676e9)
• Use updated Web3 Secret Storage format for JSON wallets. (#3075; 6f57e8b)
• Relaxed nameprep length requirement dropping RFC-5891 section 4.2.4. (#3161; abdf2e3)
• Switch to hash.js for ripemd160 on node as it was removed from the default crypto provider in node 17. (#3082; 450694e)
• Add optimism-kovan to EtherscanProvider. (#3135; 4d3e586)
• Forward any blockTag along in the FallbackProvider during call. (#3168; ab43e7d)
• Allow browser fetch option overrides. (#3096; c309df8)

ethers/v5.6.9 (2022-06-17 14:44)

... (truncated)

• 5ff3dc9 admin: updated dist files with update-versions
• 808153e admin: updated sort issue in package.json
• f8deaae Updated to latest elliptic library to fix audit warnings.
• c6a1b15 Updated browser tests; but karma is still defunct
• c7c07f5 admin: update dist files
• 01dccc7 tests: swapped goerli for sepolia; contracts re-deployed
• 0065547 Added ENS to Sepolia.
• d7e8ad1 admin: updated dist files
• f345816 Bump ws package version to address DoS security concern (#4791).
• 9f42637 tests: updates test details
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.