# openzeppelin-contracts v5.6.0

- Product: openzeppelin-contracts (https://whatsnew.fyi/product/openzeppelin-contracts)
- Vendor: OpenZeppelin
- Date: 2026-02-25
- Version: v5.6.0
- Original notes: https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v5.6.0
- Permalink: https://whatsnew.fyi/product/openzeppelin-contracts/releases/v5.6.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **changed** — Strings.escapeJSON now escapes all control characters in the range U+0000 to U+001F per RFC-4627
- **changed** — ERC1155 batch transfers with exactly one id/value now call IERC1155Receiver.onERC1155BatchReceived instead of onERC1155Received
- **changed** — ERC1967Proxy and TransparentUpgradeableProxy now mandate initialization during construction and revert with ERC1967ProxyUninitialized if no initialize call is provided
- **changed** — ERC721 and ERC1155 now prevent setting an operator for address(0)
- **changed** — RLP.encode(bytes32) now encodes bytes32 as a fixed size item instead of as a scalar
- **changed** — ERC4337Utils.parseValidationData now returns a ValidationRange as the last return tuple value
- **changed** — SignerWebAuthn._rawSignatureValidation now returns false when the signature is not a valid WebAuthn authentication assertion and P256 fallback is removed
- **changed** — Memory.setFreeMemoryPointer is renamed to unsafeSetFreeMemoryPointer
- **removed** — Memory.asBytes32 and Memory.asPointer functions are removed
- **changed** — Account default version of the ERC-4337 entrypoint updated to v0.9
- **changed** — AccountERC7579 no longer reverts and performs uninstall if the onUninstall hook of a module reverts
- **added** — ERC4337Utils.paymasterSignature function to extract the signature in paymasterAndData after Entrypoint v0.9
- **added** — ERC4337Utils variants of packValidationData that receive a ValidationRange argument for timestamp or block number
- **added** — ERC1155._checkAuthorized internal virtual function to encapsulate isApprovedForAll and msg.sender checks
- **added** — ERC4626 internal virtual functions _transferIn and _transferOut to allow overriding underlying assets transfer mechanisms
- **added** — ERC721URIStorage._suffixURI internal getter for retrieving custom tokenURI without the base prefix
- **added** — ERC-165 detection for IERC6909ContentURI, IERC6909TokenSupply and IERC6909Metadata interfaces
- **added** — BridgeFungible, BridgeERC20 and BridgeERC7802 bridge contracts to handle crosschain movements of ERC-20 and ERC-7802 tokens
- **added** — CrosschainLinked helper contract to facilitate communication between a contract on one chain and counterparts on remote chains through ERC-7786 gateways

###### Breaking changes

- `Strings`: The `escapeJSON` function now escapes all control characters in the range U+0000 to U+001F per RFC-4627. Previously only backspace, tab, newline, form feed, carriage return, double quote, and backslash were escaped. Input strings containing any other control character (e.g. null `0x00`) or raw bytes in U+0001–U+001F will now produce different, longer output (e.g. `\u0000` for null). ([#6344](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/6344))
- `ERC1155`: Performing batch transfers with exactly one id/value in the batch no-longer calls `IERC1155Receiver.onERC1155Received`. `IERC1155Receiver.onERC1155BatchReceived` is called instead (with arrays of length one). ([#6170](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/6170))
- `ERC1967Proxy` and `TransparentUpgradeableProxy`: Mandate initialization during construction. Deployment now reverts with `ERC1967ProxyUninitialized` if an initialize call is not provided. Developers that rely on the previous behavior and want to disable this check can do so by overriding the internal `_unsafeAllowUninitialized` function to return true. ([#5906](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/5906))
- `ERC721` and `ERC1155`: Prevent setting an operator for `address(0)`. In the case of `ERC721` this type of operator allowance could lead to obfuscated mint permission. ([#6171](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/6171))
- `RLP`: The `encode(bytes32)` function now encodes `bytes32` as a fixed size item and not as a scalar in `encode(uint256)`. Users must replace calls to `encode(bytes32)` with `encode(uint256(bytes32))` to preserve the same behavior. ([#6167](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/6167))
- `ERC4337Utils`: The `parseValidationData` now returns a `ValidationRange` as the last return tuple value indicating whether the `validationData` is compared against a timestamp or block number. Developers must update their code to handle this new return value (e.g. `(aggregator, validAfter, validUntil) -> (aggregator, validAfter, validUntil, range)`). ([#6215](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/6215))
- `SignerWebAuthn`: The `_rawSignatureValidation` function now returns `false` when the signature is not a valid WebAuthn authentication assertion. P256 fallback is removed. Developers can add it back by overriding the function. ([#6337](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/6337))
- `Memory`: The `setFreeMemoryPointer` function is renamed to `unsafeSetFreeMemoryPointer`. Developers should use `unsafeSetFreeMemoryPointer` instead of `setFreeMemoryPointer` after v5.6.0. ([#6348](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/6348))
- `Memory`: Remove the `asBytes32` and `asPointer` function to reduce the risk of mistakes when manipulating memory pointers. ([#6340](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/6340))

###### Changes by category

###### Account

- `Account`: Update default version of the ERC-4337 entrypoint to v0.9. ([#6135](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/6135))
- `AccountERC7579`: Do not revert and perform the uninstall if the `onUninstall` hook of a module reverts. ([#6142](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/6142))
- `ERC4337Utils`: Added the `paymasterSignature` function to extract the signature in `paymasterAndData` after Entrypoint v0.9. Similarly, a variant of `paymasterData` that receives a flag to exclude the signature from the returned data. ([#6215](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/6215))
- `ERC4337Utils`: Added variants of `packValidationData(address,uint48,uint48)` and `packValidationData(bool,uint48,uint48)` that receive a `ValidationRange` argument, could be timestamp or block number. Similarly, the `parseValidationData` now returns a `ValidationRange` too. ([#6215](https://gi

_[Truncated at 4000 characters — full notes: https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v5.6.0]_