[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

ox@1.8.16

Patch Changes

• #611 27bac43 Thanks @jxom! - Fixed AbiParameters.decode to limit the total number of bytes read to 32 times the size of the data plus the repeated-read allowance, and to throw when dynamic values with overlapping data exceed it.

• #613 af4199b Thanks @jxom! - Fixed AbiFunction.decodeData and AbiError.decode to throw SelectorMismatchError when the selector in data does not match the item or one of its overloads.

• #615 a45444a Thanks @jxom! - Fixed AbiParameters.decode to throw when the 32-byte slot of a fixed-size bytesN value is cut short, as it does for other static types.

• #617 8f4da51 Thanks @jxom! - Fixed AbiParameters.encode to reject bytes and bytesN values with an odd number of hex digits, and TypedData.assert to reject such bytesN values, instead of encoding them with a trailing zero nibble.

• #619 2f8ee9c Thanks @jxom! - Fixed AbiEvent.decode to resolve overloaded events by the selector in topics[0] instead of always decoding with the overload picked by name.

• #621 32f10f7 Thanks @jxom! - Fixed AbiEvent.extractLogs to return keyed args for events with both named and unnamed inputs, matching AbiEvent.decode, and fixed AbiEvent.assertArgs and the args filter to reject positional arguments compared against keyed arguments.

• #623 9b5aefe Thanks @jxom! - Fixed AbiEvent.decode, AbiEvent.decodeLog and AbiEvent.extractLogs to reject indexed address, bool, intN and uintN topics that are not canonical 32-byte ABI words, as AbiParameters.decode does.

• #624 9e7197b Thanks @jxom! - Fixed Address.fromPublicKey to throw PublicKey.InvalidError for a compressed public key instead of deriving an address from the x coordinate alone.

• #626 8fd15ed Thanks @jxom! - Fixed Authorization.fromTuple and Authorization.fromRpc to throw Hex.IntegerOutOfRangeError for a chain ID that is not a safe integer instead of returning a rounded or NaN chain ID.

• #628 ac62b90 Thanks @jxom! - Fixed Authorization.fromTuple to throw Authorization.InvalidError unless the tuple has three or six elements, and TxEnvelopeEip7702.deserialize to require six-element authorization tuples.

• #630 d472e23 Thanks @jxom! - Fixed UserOperation.hash for EntryPoint 0.7 in ox/erc4337 to hash the same initCode as UserOperation.toPacked, so a factory without factoryData is included in the hash.

• #632 3627f73 Thanks @jxom! - Fixed Execute.decodeData and Execute.decodeBatchOfBatchesData in ox/erc7821 to decode only calldata in their own execution modes and throw Execute.UnsupportedModeError for any other mode.

• #634 24fb8d1 Thanks @jxom! - Fixed Keystore.encrypt and Keystore.decrypt to throw Keystore.InvalidKeySizeError when the key is shorter than 32 bytes.

• #636 89c70df Thanks @jxom! - Fixed Secp256k1.verify to hash the payload with sha256 when hash: true is used with address, matching the publicKey form.

• #638 19c3335 Thanks @jxom! - Fixed Signature.assert to reject a yParity that is not exactly 0 or 1, and Signature.toTuple to throw on an invalid or missing yParity instead of encoding it by truthiness.

• #640 7a1a915 Thanks @jxom! - Fixed Siwe.parseMessage to return an empty object when a message has text that is not part of the EIP-4361 prefix or suffix, such as Expiration Time and Not Before lines that are out of order, and to parse in linear time.

• #642 f620088 Thanks @jxom! - Fixed Siwe.createMessage to throw InvalidMessageFieldError when requestId contains a line feed or carriage return.

• #644 f3a6299 Thanks @jxom! - Fixed TxEnvelopeTempo.assert, TxEnvelopeTempo.serialize, and Tempo TransactionRequest.fromRpc to throw for a fee payer signature whose yParity is not 0 or 1, instead of encoding it as 1.

• #646 1081276 Thanks @jxom! - Fixed KeyAuthorization.from, toTuple, and toRpc (and the ox/zod/tempo Scope schema) to reject a scope with recipients and no selector.

• #648 3417895 Thanks @jxom! - Fixed SignatureEnvelope.assert, deserialize, fromRpc, and toRpc to reject a keychain signature whose inner signature is itself a keychain signature.

• #650 2b48062 Thanks @jxom! - Fixed SignatureEnvelope.assert and SignatureEnvelope.validate to reject an envelope with an unsupported type.

• #652 a15cab8 Thanks @jxom! - Fixed TxEnvelopeTempo.assert to throw InvalidValidityBoundError when validBefore or validAfter is not a non-negative safe integer number, instead of serializing a bigint or hex bound as unset.

• #654 40f9fac Thanks @jxom! - Fixed SignatureEnvelope.deserialize and SignatureEnvelope.fromRpc to reject WebAuthn signatures larger than the 2048-byte protocol maximum.

• #656 f14c9be Thanks @jxom! - Fixed TxEnvelopeLegacy.assert, TxEnvelopeEip2930.assert, TxEnvelopeEip1559.assert and TxEnvelopeTempo.assert to throw InvalidChainIdError for a chainId that is not a positive safe integer.

• #658 b06a125 Thanks @jxom! - Fixed TxEnvelopeLegacy.deserialize to validate unsigned transactions and to reject nested lists, a v above the safe integer range, and gasPrice, r or s values longer than 32 bytes.

• #660 f6d2f2b Thanks @jxom! - Fixed TxEnvelopeLegacy.hash (with presign) and TxEnvelopeLegacy.getSignPayload to derive the chain ID from an EIP-155 v when the envelope has no chainId.

• #662 bf4a8da Thanks @jxom! - Fixed TxEnvelopeLegacy.serialize to throw when an envelope's v does not match its chainId, and to throw Signature.InvalidVError when v is not a valid parity for the given chainId.

• #664 b1cb7ba Thanks @jxom! - Fixed TypedData.extractEip712DomainTypes to include every domain field that is present, so a string chainId is hashed instead of left out of the derived domain.

• #666 07e1148 Thanks @jxom! - Fixed Value.from and Value.format to trim trailing zeros in time linear in the length of the fraction.

• #668 fa5a1f1 Thanks @jxom! - Fixed Registration.verify in ox/webauthn to derive deviceType from the backup eligibility (BE) flag and to always return backedUp from the backup state (BS) flag.

• #670 90af78b Thanks @jxom! - Fixed ox/zod/tempo SignatureEnvelope to derive yParity from v values above Number.MAX_SAFE_INTEGER exactly and to reject a secp256k1 RPC signature that has neither yParity nor a supported v.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ox	Error		Nov 11, 2026 5:20am UTC