Bump ethers from 5.8.0 to 6.15.0 in /packages/admin

[dependabot]

Bumps ethers from 5.8.0 to 6.15.0.

Release notes

Sourced from ethers's releases.

ethers/v6.15.0 (2025-07-01 11:24)

• Allow non-canonical S values in Signatures moving errors to access-time (#5013; 9944ec9).

ethers/v6.14.4 (2025-06-12 23:16)

• Fixed serialization of EIP-7702 transactions with leading 0-bytes (#4916; 389dc03).

ethers/v6.14.3 (2025-05-26 18:55)

• Fixed non-normalized yParity on EIP-7702 JSON-RPC responses (#4985; a8803ca).

ethers/v6.14.2 (2025-05-26 18:31)

• Fixed call stack overflow in makeError stringify for recursive structures (#4977, #4978; 52a0522).
• Explicitly throw error on gunzip failure to prevent uncaught exception (#4873, #4874; fe98f98).
• Skip additional receipt fetch for single confirmation requests (#4972; 243cb02).
• Update EtherscanProvider to use their v2 API (#4975; 5e09aa1).

ethers/v6.14.1 (2025-05-15 14:17)

• Fix JSON-RPC authorizationList signature entries encoded as DATA instead of QUANTITY values (#4916; 135db72).

ethers/v6.14.0 (2025-05-06 22:02)

• Remove BlockscoutProvider temporarily until custom error issues are fixed (805a8b3).
• EIP-7702 support (#4916; db490e1, e7c1bdf).
• Added support for to override fetch init options in the Browser (#3895; 844ae68).
• Added EIP-6963 discovery to BrowserProvider (f5469dd).
• Accept modern KZG library API while exposing legacy API (#4841; e5036e7).
• Added BlockscoutProvider (#4790, b59b5a4).
• Added CommunityResourcable to exports (#4776; bca8d1b).

ethers/v6.13.7 (2025-04-25 21:50)

• Fix FallbackProvider coalescing call exceptions when backends return slightly different error message (268a0ac).
• Fixed Infura BSC network URLs (#4951; d01b4cb).

ethers/v6.13.5 (2025-01-04 15:26)

• Use local dev net for testing Typed API to prevent tests getting throttled (7654ee3).
• Fixed bad logic for searching prefetched transactions by hash (#4868; ef3c9bc).
• Add newline delimiter to IPC providers for broader support (#4847; 474a8de).

ethers/v6.13.4 (2024-10-10 18:01)

• Updated dependencies (1d717ef).
• Fixed bug in JSON-RPC error checking (#4827, #4837, #4851; be3e6b1).

ethers/v6.13.3 (2024-09-30 22:08)

• Allow CCIP-read to continue during low-level fetch failures (#4842; 1c31f95).

ethers/v6.13.2 (2024-07-25 18:20)

• Prevent mutating transactions when signing (#4789; 1a51af8).

ethers/v6.13.1 (2024-06-18 02:37)

• Update ws package to address possible DoS vulnerability (a4b1d1f).

ethers/v6.13.0 (2024-06-04 01:38)

... (truncated)

Changelog

Sourced from ethers's changelog.

ethers/v6.15.0 (2025-07-01 11:24)

• Allow non-canonical S values in Signatures moving errors to access-time (#5013; 9944ec9).

ethers/v6.14.4 (2025-06-12 23:16)

• Fixed serialization of EIP-7702 transactions with leading 0-bytes (#4916; 389dc03).

ethers/v6.14.3 (2025-05-26 18:55)

• Fixed non-normalized yParity on EIP-7702 JSON-RPC responses (#4985; a8803ca).

ethers/v6.14.2 (2025-05-26 18:03)

• Fixed call stack overflow in makeError stringify for recursive structures (#4977, #4978; 52a0522).
• Explicitly throw error on gunzip failure to prevent uncaught exception (#4873, #4874; fe98f98).
• Skip additional receipt fetch for single confirmation requests (#4972; 243cb02).
• Update EtherscanProvider to use their v2 API (#4975; 5e09aa1).

ethers/v6.14.1 (2025-05-15 14:17)

• Fix JSON-RPC authorizationList signature entries encoded as DATA instead of QUANTITY values (#4916; 135db72).

ethers/v6.14.0 (2025-05-06 22:02)

• Remove BlockscoutProvider temporarily until custom error issues are fixed (805a8b3).
• EIP-7702 support (#4916; db490e1, e7c1bdf).
• Added support for to override fetch init options in the Browser (#3895; 844ae68).
• Added EIP-6963 discovery to BrowserProvider (f5469dd).
• Accept modern KZG library API while exposing legacy API (#4841; e5036e7).
• Added CommunityResourcable to exports (#4776; bca8d1b).

ethers/v6.13.7 (2025-04-25 21:50)

• Fix FallbackProvider coalescing call exceptions when backends return slightly different error message (268a0ac).
• Fixed Infura BSC network URLs (#4951; d01b4cb).

ethers/v6.13.6 (2025-03-21 18:21)

• Implicitly use EIP-7702 if authorizationList is given and non-empty (#4961; e7c1bdf).
• Initial EIP-7702 support (#4916; db490e1).
• Added support for to override fetch init options in the Browser (#3895; 844ae68).

... (truncated)

Commits

• 9fd9d41 admin: updated dist files
• 1405d74 docs: added EIP-2 to specs.txt
• 9944ec9 Allow non-canonical S values in Signatures moving errors to access-time (#5013).
• 4eada38 admin: updated dist files
• 389dc03 Fixed serialization of EIP-7702 transactions with leading 0-bytes (#4916).
• d31f5a7 admin: updated dist files
• a8803ca Fixed non-normalized yParity on EIP-7702 JSON-RPC responses (#4985).
• ac6022b admin: updated dist files
• 52a0522 Fixed call stack overflow in makeError stringify for recursive structures (#4...
• fe98f98 Explicitly throw error on gunzip failure to prevent uncaught exception (#4873...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	form-data@​4.0.0
	elliptic@​6.5.4
	@​openzeppelin/​defender-base-client@​1.54.0-rc.0
	isarray@​1.0.0
	@​openzeppelin/​defender-relay-client@​1.54.0-rc.0
	tr46@​0.0.3
	@​openzeppelin/​defender-base-client@​1.48.0
	@​ethersproject/​keccak256@​5.7.0
	@​aws-sdk/​types@​3.465.0
	@​aws-sdk/​types@​3.418.0
	@​openzeppelin/​defender-sentinel-client@​1.48.0
	inherits@​2.0.4
	@​ethersproject/​base64@​5.7.0
	asynckit@​0.4.0
	@​ethersproject/​rlp@​5.7.0
	proxy-from-env@​1.1.0
	base64-js@​1.5.1
	ieee754@​1.2.1
	axios@​1.6.1
	axios@​1.6.2
	@​ethersproject/​constants@​5.7.0
	@​ethersproject/​logger@​5.7.0
	@​ethersproject/​address@​5.7.0
	@​ethersproject/​strings@​5.7.0
	@​ethersproject/​signing-key@​5.7.0
	@​ethersproject/​transactions@​5.7.0
	@​ethersproject/​bytes@​5.7.0
	@​ethersproject/​hash@​5.7.0
	@​ethersproject/​abstract-provider@​5.7.0
	@​ethersproject/​networks@​5.7.1
	@​ethersproject/​bignumber@​5.7.0
	@​ethersproject/​properties@​5.7.0
	@​ethersproject/​abstract-signer@​5.7.0
See 16 more rows in the dashboard

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		elliptic@6.5.4 has a Critical CVE. CVE: GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) (CRITICAL) Affected versions: < 6.6.1 Patched version: 6.6.1 From: examples/create-sentinel/package-lock.json → npm/elliptic@6.5.4 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/elliptic@6.5.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		form-data@4.0.0 has a Critical CVE. CVE: GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL) Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4 Patched version: 4.0.4 From: examples/create-sentinel/package-lock.json → npm/form-data@4.0.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/form-data@4.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		axios@1.6.1 has a High CVE. CVE: GHSA-8hc4-vh64-cxmj Server-Side Request Forgery in axios (HIGH) Affected versions: >= 1.3.2 < 1.7.4 Patched version: 1.7.4 From: examples/create-sentinel/package-lock.json → npm/axios@1.6.1 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/axios@1.6.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		axios@1.6.2 has a High CVE. CVE: GHSA-8hc4-vh64-cxmj Server-Side Request Forgery in axios (HIGH) Affected versions: >= 1.3.2 < 1.7.4 Patched version: 1.7.4 From: packages/account/package.json → npm/axios@1.6.2 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/axios@1.6.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		elliptic@6.5.4 has a Low CVE. CVE: GHSA-49q7-c7j4-3p7m Elliptic allows BER-encoded signatures (LOW) Affected versions: >= 5.2.1 < 6.5.7 Patched version: 6.5.7 From: examples/create-sentinel/package-lock.json → npm/elliptic@6.5.4 ℹ Read more on: This package | This alert | What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/elliptic@6.5.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		elliptic@6.5.4 has a Low CVE. CVE: GHSA-f7q4-pwc6-w24p Elliptic's EDDSA missing signature length check (LOW) Affected versions: >= 4.0.0 < 6.5.7 Patched version: 6.5.7 From: examples/create-sentinel/package-lock.json → npm/elliptic@6.5.4 ℹ Read more on: This package | This alert | What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/elliptic@6.5.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		elliptic@6.5.4 has a Low CVE. CVE: GHSA-977x-g7h5-7qgw Elliptic's ECDSA missing check for whether leading bit of r and s is zero (LOW) Affected versions: >= 2.0.0 < 6.5.7 Patched version: 6.5.7 From: examples/create-sentinel/package-lock.json → npm/elliptic@6.5.4 ℹ Read more on: This package | This alert | What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/elliptic@6.5.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		elliptic@6.5.4 has a Low CVE. CVE: GHSA-434g-2637-qmqr Elliptic's verify function omits uniqueness validation (LOW) Affected versions: < 6.5.6 Patched version: 6.5.6 From: examples/create-sentinel/package-lock.json → npm/elliptic@6.5.4 ℹ Read more on: This package | This alert | What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/elliptic@6.5.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		elliptic@6.5.4 has a Low CVE. CVE: GHSA-fc9h-whq2-v747 Valid ECDSA signatures erroneously rejected in Elliptic (LOW) Affected versions: < 6.6.0 Patched version: 6.6.0 From: examples/create-sentinel/package-lock.json → npm/elliptic@6.5.4 ℹ Read more on: This package | This alert | What is a mild CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known low severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/elliptic@6.5.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report