GHSA-5h3x-9wvq-w4m2 OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning

• npm @openzeppelin/contracts: >= 4.3.0, < 4.9.1 → fixed in 4.9.1 • npm @openzeppelin/contracts-upgradeable: >= 4.3.0, < 4.9.1 → fixed in 4.9.1

Impact By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the `Governor` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0. Patches The problem has been patched in 4.9.1 by introducing opt-in frontrunning protection. Workarounds Submit the proposal creation transaction to an endpoint with frontrunning protection. Credit Reported by Lior Abadi and Joaquin Pereyra from Coinspect. References https://www.coinspect.com/openzeppelin-governor-dos/