hyperliquid 1.9.0 → 1.9.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a6d420027ac68a2d2959293fd9735798e80ad39f484dd2f43f1f808d5964944
-  data.tar.gz: 89c4e1688d7a5ac9d4cba3a214de798ec333161a0d6053abeac5d6d4da4916f3
+  metadata.gz: 11b5874db2bd1216e1c16286b4170433837e5b78270cb06604dc31f0cbd71e55
+  data.tar.gz: 6d2257b428f3b9f74c776660005e93354c5520ce703e4407b570a68588c986ab
 SHA512:
-  metadata.gz: 7ca76a9847766153f734661dd91f9d62bb1c87e2c43aacb4dd63e20904a1f3ddff505b4e8f92eb80b0bf6624e584560c121a901e2a1865617062b0e1cc1963c4
-  data.tar.gz: 43d32462a0350f7f733f50cd1190b6acfde8647b141665998bf5e1fb6f6b3fc24c348ba04dbb6ca35d3aef8e8bce0770445ab44991e65d566c58a9ce01c928c3
+  metadata.gz: e52c6c735384f3b1e6fd38b9ac908598b62eaceb775fdf37a2a90520bf362ce176de11a69d4cb9911732b1a5c674d5cea86058a21535567c8e8fa85b3bda400f
+  data.tar.gz: 3ca54c192cd59d0ffdee4c967bea92646c40a09daf9cee96c9b19658986cedbf6f9ac553b35361c9ebcea66385bdd64eb09131e127170ac580b091a356190113

data/CHANGELOG.md

@@ -1,5 +1,28 @@
 ## [Ruby Hyperliquid SDK Changelog]
 
+## [1.9.2] - 2026-09-29
+
+### Security
+
+- The development and CI lockfile now builds `rbsecp256k1` from the `carter2099/rbsecp256k1` fork (6.1.0, pinned by commit), which allows rubyzip 3.x and bundles libsecp256k1 0.8.0; rubyzip moves from 2.4.1 to 3.7.0, clearing GHSA-47m2-wp7j-p9vc (CVE-2026-85396) for this repository.
+- **Residual exposure for gem consumers:** a gemspec cannot declare git sources, so applications installing the published gem still resolve rubygems `rbsecp256k1` 6.0.0 (via `eth ~> 0.5`), which pins `rubyzip ~> 2.3`. rbsecp256k1 uses rubyzip only at install time, to unpack its SHA-256-pinned libsecp256k1 archive; the SDK never loads rubyzip at runtime. Applications that want rubyzip 3.x now can add the same `gem 'rbsecp256k1', github: 'carter2099/rbsecp256k1', ref: 'bbfe3e346828e39d13aa590cca7cc74f663d2fde'` line to their own Gemfile.
+
+### Release
+
+- 1.9.1 was tagged and has a GitHub Release but was never published to RubyGems; 1.9.2 supersedes it and includes all of its changes.
+
+## [1.9.1] - 2026-09-29
+
+### Security
+
+- Updated locked development and CI dependencies to patched releases: faraday 2.14.3, addressable 2.9.0, erb 6.0.1.1, json 2.19.9, msgpack 1.8.5, rexml 3.4.2 and uri 1.0.4. The gem's runtime constraints are unchanged; applications pick up the fixes by updating their own lockfiles.
+- Known remaining advisory: rubyzip GHSA-47m2-wp7j-p9vc (CVE-2026-85396) stays at 2.4.1 because `eth` requires `rbsecp256k1 ~> 6.0`, whose latest release (6.0.0) pins `rubyzip ~> 2.3`. rbsecp256k1 uses rubyzip only at install time, to unpack its SHA-256-pinned libsecp256k1 archive; the SDK never loads rubyzip at runtime.
+
+### Tooling
+
+- Updated RuboCop to 1.91.0, rake to 13.4.2, rspec to 3.13.2, webmock to 3.26.4, irb to 1.18.0 and faraday-retry to 2.4.0.
+- Updated GitHub Actions to `actions/checkout@v7` and `softprops/action-gh-release@v3`.
+
 ## [1.9.0] - 2026-08-31
 
 ### New Exchange actions

data/CLAUDE.md

@@ -95,9 +95,13 @@ Predicate methods follow Ruby style (`vip?`, `connected?`, `testnet?`) — not `
 
 GitHub Actions (`.github/workflows/main.yml`): runs `bundle exec rake` (tests + lint) on the Ruby matrix defined in that workflow, for pushes to `main` and on all PRs. The release workflow creates GitHub releases from `CHANGELOG.md` on version tags. Dependabot checks Bundler and GitHub Actions dependencies weekly with a 14-day default cooldown; Bundler major updates use a 30-day cooldown.
 
+### rbsecp256k1 git source
+
+The `Gemfile` pins `rbsecp256k1` to Carter's fork (`carter2099/rbsecp256k1`, full-SHA `ref:`, version 6.1.0) because rubygems only has 6.0.0, which requires `rubyzip ~> 2.3` (GHSA-47m2-wp7j-p9vc); the fork requires `rubyzip >= 3.4, < 4` and builds libsecp256k1 0.8.0. This affects only the dev/CI lockfile — a gemspec cannot declare git sources, so consumers of the published gem still resolve rubygems rbsecp256k1 6.0.0 via `eth ~> 0.5`. Dependabot is not expected to bump a SHA-pinned git ref; a Dependabot PR touching rbsecp256k1's source/ref or moving rubyzip below 3.4 must not be applied without Carter. Never `bundle update` it or drop the declaration; moving the ref is a deliberate, reviewed change (re-run the signature-parity specs in `spec/hyperliquid/signing/`). Remove the git source once an upstream rbsecp256k1 release on rubygems allows rubyzip 3.
+
 ## Release Flow
 
-Releases happen from `main`. Day-to-day work lands on `dev`, then `dev` is merged into `main` and tagged at release time. `CHANGELOG.md` follows Keep-a-Changelog conventions; `lib/hyperliquid/version.rb` is the single source of version truth (gemspec reads it). Tags push automatically trigger the GitHub release workflow.
+Releases happen from `main`. Day-to-day work lands on `dev`, then `dev` is merged into `main` and the version commit is pushed. `CHANGELOG.md` follows Keep-a-Changelog conventions; `lib/hyperliquid/version.rb` is the single source of version truth (gemspec reads it). Releases are atomic: only after the `Ruby` workflow is green on main and the gem is built is the RubyGems OTP requested; `gem push` goes first and the `vX.Y.Z` tag is pushed only after it succeeds. The tag push triggers the GitHub release workflow, so a failed gem push leaves no tag and no GitHub Release.
 
 ## Additional Docs
 

data/lib/hyperliquid/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Hyperliquid
-  VERSION = '1.9.0'
+  VERSION = '1.9.2'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hyperliquid
 version: !ruby/object:Gem::Version
-  version: 1.9.0
+  version: 1.9.2
 platform: ruby
 authors:
 - carter2099