[Snyk] Security upgrade web3 from 6.20.4 to 7.15.0

[revan-zhang]

Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

• python/requirements-optional.txt

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Server-side Request Forgery (SSRF)

---

[revan-zhang]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[devin-ai-integration]

Devin Review found 1 potential issue.

View 2 additional findings in Devin Review.

[devin-ai-integration]

🔴 web3 version bumped to >=7.15.0 but code uses removed camelCase API methods

Bumping web3 to >=7.15.0 breaks all Ethereum CLI functionality because web3.py v7 removed all camelCase method aliases that the code depends on. I verified by installing web3 7.15.0 that isConnected, estimateGas, getTransactionCount, sendRawTransaction, encodeABI no longer exist (all return False for hasattr).

All broken call sites

• python/src/trezorlib/cli/ethereum.py:158-159: contract.encodeABI(...) → should be contract.encode_abi(...)
• python/src/trezorlib/cli/ethereum.py:393: _get_web3().isConnected() → should be _get_web3().is_connected()
• python/src/trezorlib/cli/ethereum.py:428: .eth.estimateGas(...) → should be .eth.estimate_gas(...)
• python/src/trezorlib/cli/ethereum.py:438: .eth.getTransactionCount(...) → should be .eth.get_transaction_count(...)
• python/src/trezorlib/cli/ethereum.py:467: .eth.gasPrice → should be .eth.gas_price
• python/src/trezorlib/cli/ethereum.py:522: .eth.sendRawTransaction(...) → should be .eth.send_raw_transaction(...)
• python/src/trezorlib/cli/ethereum_onekey.py:143: contract.encodeABI(...) → should be contract.encode_abi(...)
• python/src/trezorlib/cli/ethereum_onekey.py:280: _get_web3().isConnected() → should be _get_web3().is_connected()
• python/src/trezorlib/cli/ethereum_onekey.py:306: .eth.estimateGas(...) → should be .eth.estimate_gas(...)
• python/src/trezorlib/cli/ethereum_onekey.py:316: .eth.getTransactionCount(...) → should be .eth.get_transaction_count(...)
• python/src/trezorlib/cli/ethereum_onekey.py:339: .eth.gasPrice → should be .eth.gas_price
• python/src/trezorlib/cli/ethereum_onekey.py:393: .eth.sendRawTransaction(...) → should be .eth.send_raw_transaction(...)

Prompt for agents

The web3 version requirement was bumped from >=4.8 to >=7.15.0 in requirements-optional.txt, but the code in python/src/trezorlib/cli/ethereum.py and python/src/trezorlib/cli/ethereum_onekey.py still uses the old camelCase web3 API that was removed in web3.py v6+. All 12 call sites need to be updated to use the new snake_case API:

1. isConnected() -> is_connected()
2. eth.estimateGas() -> eth.estimate_gas()
3. eth.getTransactionCount() -> eth.get_transaction_count()
4. eth.sendRawTransaction() -> eth.send_raw_transaction()
5. eth.gasPrice -> eth.gas_price
6. contract.encodeABI() -> contract.encode_abi()

Additionally, python/setup.py line 30 still has web3>=4.8 in the ethereum extras_require, which is inconsistent with the new requirements-optional.txt. The setup.py should also be updated to web3>=7.15.0.

Note that there may be other breaking API changes in web3 v7 beyond the method renames (e.g., changes to the Web3() constructor, middleware API, etc.) that should also be reviewed.

---

Was this helpful? React with 👍 or 👎 to provide feedback.