Search results

SDK drift: orderFromV0 in TypeScript does not map filledShares, feeRateBps, txHash, chain, blockNumber from V0 payload; Python order_from_v0 does

component: ts-sdk

sdk-driftCross-language SDK consistency findings (TypeScript vs Python)Cross-language SDK consistency findings (TypeScript vs Python)

sdk-parityConsistency between SDKsConsistency between SDKs

type: inconsistency

Status: Open.

#1122 In pmxt-dev/pmxt;

· realfishsam opened on Jun 15, 2026

SDK drift: Python HOSTED_UNSUPPORTED_METHODS gates fetch_closed_orders/fetch_all_orders in hosted mode; TypeScript has no equivalent gating

component: ts-sdk

sdk-driftCross-language SDK consistency findings (TypeScript vs Python)Cross-language SDK consistency findings (TypeScript vs Python)

sdk-parityConsistency between SDKsConsistency between SDKs

type: inconsistency

Status: Open.

#1121 In pmxt-dev/pmxt;

· realfishsam opened on Jun 15, 2026

SDK drift: validateEconomics parameters are all required in TypeScript but all optional (defaulting to None) in Python

component: ts-sdk

sdk-driftCross-language SDK consistency findings (TypeScript vs Python)Cross-language SDK consistency findings (TypeScript vs Python)

sdk-parityConsistency between SDKsConsistency between SDKs

type: inconsistency

Status: Open.

#1120 In pmxt-dev/pmxt;

· realfishsam opened on Jun 15, 2026

HIGH: idna@3.11 — Incomplete ReDoS fix allows unbounded CPU consumption via Unicode labels (CVE-2026-45409 / GHSA-65pc-fj4g-8rjx)

dependency-vulnerabilityDependency security vulnerability findingsDependency security vulnerability findings

Status: Open.

#1115 In pmxt-dev/pmxt;

· realfishsam opened on Jun 15, 2026

HIGH: cryptography@41.0.7 — Bleichenbacher RSA (CVE-2023-50782), OpenSSL vuln (GHSA-h4gh-qq45-vh27), EC Subgroup Bypass (CVE-2026-26007), DNS Constraint Bypass (CVE-2026-34073)

dependency-vulnerabilityDependency security vulnerability findingsDependency security vulnerability findings

Status: Open.

#1114 In pmxt-dev/pmxt;

· realfishsam opened on Jun 15, 2026

HIGH: pyjwt@2.7.0 — Algorithm Confusion (GHSA-xgmm-8j9v-c9wx), SSRF (GHSA-993g-76c3-p5m4), JWKS DoS (GHSA-fhv5-28vv-h8m8), crit bypass (GHSA-752w-5fwx-jx9f)

dependency-vulnerabilityDependency security vulnerability findingsDependency security vulnerability findings

Status: Open.

#1113 In pmxt-dev/pmxt;

· realfishsam opened on Jun 15, 2026

HIGH: esbuild@0.24.2 / 0.27.2 — Dev Server CORS Bypass & Deno Module RCE (GHSA-67mh-4wv8-2f99, GHSA-gv7w-rqvm-qjhr)

dependency-vulnerabilityDependency security vulnerability findingsDependency security vulnerability findings

Status: Open.

#1112 In pmxt-dev/pmxt;

· realfishsam opened on Jun 15, 2026

CRITICAL: shell-quote@1.8.3 — Shell Command Injection via newlines in .op values (GHSA-w7jw-789q-3m8p)

dependency-vulnerabilityDependency security vulnerability findingsDependency security vulnerability findings

Status: Open.

#1111 In pmxt-dev/pmxt;

· realfishsam opened on Jun 15, 2026

empty-catch: sdks/python/pmxt/server_manager.py:397 — except OSError: pass in _remove_stale_lock silently leaves lock behind

code-hygieneAutomated audit findingAutomated audit finding

Status: Open.

#1110 In pmxt-dev/pmxt;

· realfishsam opened on Jun 14, 2026

empty-catch: sdks/python/pmxt/server_manager.py:327 — except OSError: pass after SIGKILL with no logging

code-hygieneAutomated audit findingAutomated audit finding

Status: Open.

#1109 In pmxt-dev/pmxt;

· realfishsam opened on Jun 14, 2026

empty-catch: sdks/python/pmxt/client.py:512 — except Exception: pass silently swallows sidecar restart failure

code-hygieneAutomated audit findingAutomated audit finding

Status: Open.

#1108 In pmxt-dev/pmxt;

· realfishsam opened on Jun 14, 2026

empty-catch: sdks/python/pmxt/client.py:213 — except ValueError: pass silently drops malformed resolution date

code-hygieneAutomated audit findingAutomated audit finding

Status: Open.

#1107 In pmxt-dev/pmxt;

· realfishsam opened on Jun 14, 2026