Should upgrade @openzeppelin/contracts version in use

[cdsiren]

You guys mind upgrading to the latest? Issue report here:

https://security.snyk.io/vuln/SNYK-JS-OPENZEPPELINCONTRACTS-1570170

[NotCoffee418]

Is there a reason this cannot be done or is it just that nobody has done it yet?

[NotCoffee418]

Looks like it can't be done without upgrading the contracts to solidity >=0.8.0.
This repo relies on OpenZeppelin components components that no longer exist in the new version.
But the repo is already in a state it's no longer compatible or safe to rely on in any contract.
I was about to tackle it but it seems too much work without someone giving the okay on this.

[srikanth-programmer]

use this "@openzeppelin/contracts": "^3.4.2"
and compiler options as
compilers: [
{
version: "0.7.6",
settings: {
evmVersion: "istanbul",
optimizer: {
enabled: true,
runs: 1000,
},
},
},