• Allow non-canonical S values in Signatures moving errors to access-time (#5013; 9944ec9).

• Fixed serialization of EIP-7702 transactions with leading 0-bytes (#4916; 389dc03).

• Fixed non-normalized yParity on EIP-7702 JSON-RPC responses (#4985; a8803ca).

• Fixed call stack overflow in makeError stringify for recursive structures (#4977, #4978; 52a0522).
• Explicitly throw error on gunzip failure to prevent uncaught exception (#4873, #4874; fe98f98).
• Skip additional receipt fetch for single confirmation requests (#4972; 243cb02).
• Update EtherscanProvider to use their v2 API (#4975; 5e09aa1).

• Fix JSON-RPC authorizationList signature entries encoded as DATA instead of QUANTITY values (#4916; 135db72).

• Remove BlockscoutProvider temporarily until custom error issues are fixed (805a8b3).
• EIP-7702 support (#4916; db490e1, e7c1bdf).
• Added support for to override fetch init options in the Browser (#3895; 844ae68).
• Added EIP-6963 discovery to BrowserProvider (f5469dd).
• Accept modern KZG library API while exposing legacy API (#4841; e5036e7).
• Added BlockscoutProvider (#4790, b59b5a4).
• Added CommunityResourcable to exports (#4776; bca8d1b).

• Fix FallbackProvider coalescing call exceptions when backends return slightly different error message (268a0ac).
• Fixed Infura BSC network URLs (#4951; d01b4cb).

This is a security update for the legacy Ethers v5 branch, addressing two security fixes.

• A bug in elliptic, which does not affect ethers but triggers a critical security warning during nom audit [see: missing signature length check, missing check for leading bit, allow BER-encoded signatures, false negative verification, signing malformed input]
• A bug in ws which can be used as DoS vector when communicating with malicious WebSocket service providers, triggering a high security warning during nom audit [see: too many HTTP headers]

For those that wish to audit the specific changes in the the bundled version between v5.7 and v5.8, see this gist.

Changes

• Updated to latest elliptic library to fix audit warnings. (f8deaae)
• Added ENS to Sepolia. (0065547)
• Bump ws package version to address DoS security concern. (#4791; f345816)
• Added modern networks, updated third-party backend URLs and added QuickNode. (#3935, #4010; f7c813d)

Embedding UMD with SRI:

<script type="text/javascript"
  integrity="sha384-KpyAXoFibPIUEi79EsnN1EtEWCCrOQ8MtGsa4IrVxeZo514PYarFXujnjyu0DzgC"
  crossorigin="anonymous"
  src="https://cdnjs.cloudflare.com/ajax/libs/ethers/5.8.0/ethers.umd.min.js">
</script>

• Use local dev net for testing Typed API to prevent tests getting throttled (7654ee3).
• Fixed bad logic for searching prefetched transactions by hash (#4868; ef3c9bc).
• Add newline delimiter to IPC providers for broader support (#4847; 474a8de).

• Updated dependencies (1d717ef).
• Fixed bug in JSON-RPC error checking (#4827, #4837, #4851; be3e6b1).