Merge branch 'release-v4.9' into master (#4373)

OpenZeppelin · Jun 20, 2023 · b66c77a · b66c77a
1 parent 9fa550c
commit b66c77a
Show file tree

Hide file tree

Showing 6 changed files with 9 additions and 10 deletions.
diff --git a/.changeset/shy-crews-teach.md b/.changeset/shy-crews-teach.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -59,6 +59,10 @@ function supportsInterface(bytes4 interfaceId) public view virtual override retu
 }
 ```
 
+## 4.9.2 (2023-06-16)
+
+- `MerkleProof`: Fix a bug in `processMultiProof` and `processMultiProofCalldata` that allows proving arbitrary leaves if the tree contains a node with value 0 at depth 1.
+
 ## 4.9.1 (2023-06-07)
 
 - `Governor`: Add a mechanism to restrict the address of the proposer using a suffix in the description.

diff --git a/contracts/package.json b/contracts/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@openzeppelin/contracts",
   "description": "Secure Smart Contract library for Solidity",
-  "version": "4.9.1",
+  "version": "4.9.2",
   "files": [
     "**/*.sol",
     "/build/contracts/*.json",

diff --git a/contracts/utils/cryptography/MerkleProof.sol b/contracts/utils/cryptography/MerkleProof.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Contracts (last updated v4.9.0) (utils/cryptography/MerkleProof.sol)
+// OpenZeppelin Contracts (last updated v4.9.2) (utils/cryptography/MerkleProof.sol)
 
 pragma solidity ^0.8.19;
 

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "openzeppelin-solidity",
   "description": "Secure Smart Contract library for Solidity",
-  "version": "4.9.1",
+  "version": "4.9.2",
   "files": [
     "/contracts/**/*.sol",
     "/build/contracts/*.json",