Dependency manifest uses unpinned versions
Chainlink CCIP's assessment for RD-F-133 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
ccip-owner-contracts: forge-std pinned to commit 74cfb77 and openzeppelin-contracts pinned to commit e50c24f (= OZ v4.9.2) per .gitmodules — both exact commit pins, green for this repo. The chainlink monorepo (primary Solidity contracts) uses both OZ v4.8.3 and OZ v5.0.2 per npm @chainlink/contracts-ccip package documentation. Exact commit pinning in the monorepo's dependency manifest was not verifiable via available routes. Yellow conservatively given the dual-version pattern and unverified monorepo manifest.
Sources #
- URL@chainlink/contracts-ccip npm package — OpenZeppelin 4.8.3 and 5.0.2@chainlink/contracts-ccip npm — dual OZ 4.8.3 and 5.0.2 dependencyretrieved 2026-05-16
- ccip-owner-contracts .gitmodules — exact commit pins for all dependenciesccip-owner-contracts .gitmodules — forge-std@74cfb77, OZ@e50c24f (v4.9.2)retrieved 2026-05-16
Methodology #
Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).
See the full factor methodology and distribution across all protocols →