hyperliquid 1.9.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a6d420027ac68a2d2959293fd9735798e80ad39f484dd2f43f1f808d5964944
-  data.tar.gz: 89c4e1688d7a5ac9d4cba3a214de798ec333161a0d6053abeac5d6d4da4916f3
+  metadata.gz: 8e6bb2e8c5d8813c99f4b22bddf75f04c86064312adae19611084220da933abd
+  data.tar.gz: 1e2af33ccfd4e1ed6675d0b5bbf37f5beda70dd701a4705bed9b2806105bb076
 SHA512:
-  metadata.gz: 7ca76a9847766153f734661dd91f9d62bb1c87e2c43aacb4dd63e20904a1f3ddff505b4e8f92eb80b0bf6624e584560c121a901e2a1865617062b0e1cc1963c4
-  data.tar.gz: 43d32462a0350f7f733f50cd1190b6acfde8647b141665998bf5e1fb6f6b3fc24c348ba04dbb6ca35d3aef8e8bce0770445ab44991e65d566c58a9ce01c928c3
+  metadata.gz: 0234a3af5933018870b8cfcff64fcd576ec5686d5e0afef43f97e52fc5c8fbdcec793a67c52648f157acf2f1f7b67ef3134ed8ab17450bab0c15ddf96d7b2b7a
+  data.tar.gz: 16ece5522815247ca7c708e70d9fb7529cdfdeeac3727fdf654dfff8e41df37aa4246d926d4b81e6f26db7e78be312f6ed61947653c6a9b8a5ad679b55900902

data/CHANGELOG.md

@@ -1,5 +1,68 @@
 ## [Ruby Hyperliquid SDK Changelog]
 
+## [2.0.0] - 2026-10-02
+
+### Breaking
+
+- `Exchange#activate_outcome_deployer` now takes `venue_name:` and sends the protocol's `activate: { venueName }` form. The previous `is_deactivate:` keyword sent a shape the exchange never accepted and has been removed; use the new `Exchange#deactivate_outcome_deployer` to deactivate.
+- `Info#aligned_quote_token_info` has been removed. The API stopped serving `alignedQuoteTokenInfo` (mainnet and testnet return HTTP 422), so every call already failed.
+- `WS::Client#subscribe` raises `Hyperliquid::WebSocketError` for a subscription that conflicts with an active one on a channel whose messages do not say which subscription they belong to: a second user on `orderUpdates`, `userEvents` or `notification`, or a second `aggregateByTime` (`userFills`) / `ignorePortfolioMargin` (`spotState`) value for the same user. Previously both callbacks silently received each other's messages.
+- `Hyperliquid.new(private_key:)` and `Signing::Signer` raise `ArgumentError` unless the key is 64 hex characters, optionally `0x`-prefixed. Empty strings and malformed keys are no longer accepted (the error never echoes the key).
+
+### Added
+
+- HIP-3 perp deployer actions (`perpDeploy`): `perp_deploy_register_asset`, `perp_deploy_register_asset2`, `perp_deploy_set_oracle`, `perp_deploy_set_funding_multipliers`, `perp_deploy_set_funding_interest_rates`, `perp_deploy_set_funding_clamps`, `perp_deploy_halt_trading`, `perp_deploy_insert_margin_table`, `perp_deploy_set_margin_table_ids`, `perp_deploy_set_margin_modes`, `perp_deploy_set_open_interest_caps`, `perp_deploy_set_fee_recipient`, `perp_deploy_set_deployer_fees`, `perp_deploy_set_sub_deployers`, `perp_deploy_set_perp_annotation`, `perp_deploy_disable_dex`.
+- HIP-3\* star operations (testnet): `star_modify_approval`, `star_modify_backstop_liquidator_approval`, `star_set_reduce_only`, `star_cancel`, `star_cancel_all`, `star_order`, `star_send_asset`, `star_set_oracle`, and `Info#user_star_state`.
+- HIP-1/HIP-2 spot deployer actions (`spotDeploy`): `spot_deploy_register_token`, `spot_deploy_user_genesis` (with `blacklist_users:`), `spot_deploy_genesis`, `spot_deploy_register_spot`, `spot_deploy_register_hyperliquidity`, `spot_deploy_set_deployer_trading_fee_share`, `spot_deploy_enable_freeze_privilege`, `spot_deploy_freeze_user`, `spot_deploy_revoke_freeze_privilege`, `spot_deploy_enable_quote_token`, `spot_deploy_disable_quote_token`, `spot_deploy_request_evm_contract`, `spot_deploy_set_token_annotation`, `spot_deploy_set_deployer_label`.
+- HIP-4 outcome deployer actions: `deactivate_outcome_deployer`, `register_standalone_outcome_from_template`, `register_question_from_template`, `register_and_associate_named_outcome_from_template`, `settle_outcome`, `settle_question`, `set_outcome_sub_deployers`; and `Info#outcome_deployer_limits`.
+- Validator-operator actions: `c_signer_jail_self`, `c_signer_unjail_self`, `c_validator_register`, `c_validator_change_profile`, `c_validator_unregister`, `validator_l1_stream`.
+- `Exchange#trailing_stop`.
+- 18 WebSocket channels: `userNonFundingLedgerUpdates`, `userTwapSliceFills`, `userTwapHistory`, `userHistoricalOrders`, `allDexsClearinghouseState`, `webData3`, `clearinghouseState`, `openOrders`, `twapStates`, `spotState`, `notification`, `activeAssetCtx` (spot updates arrive on `activeSpotAssetCtx` and are routed transparently), `activeAssetData`, `assetCtxs`, `allDexsAssetCtxs`, `spotAssetCtxs`, `outcomeMetaUpdates`, and `fastAssetCtxs` (base64 + raw-DEFLATE frames are decoded before the callback).
+- All new actions support `expires_after` and match the official Python SDK's signatures byte for byte where Python has the action.
+
+### Fixed
+
+- `create_sub_account`, `sub_account_transfer`, `sub_account_spot_transfer`, `vault_transfer` and `set_referrer` now include `expires_after` in the signed hash; with `expires_after` set they were previously rejected or attributed to the wrong signer.
+- Spot `market_order`/`market_close` read each pair's size decimals from its base token (the API never sends `szDecimals` on spotMeta pairs), so spot slippage prices now match the Python SDK.
+- Market-order slippage prices round ties to even on the exact binary value, like the Python SDK (some prices came out one tick higher).
+- `retry_enabled: true` now retries `/info` and explorer reads on 429/502/503/504, connection failures and timeouts (it previously retried nothing); `/exchange` is never retried. The `timeout:` option now also limits how long the SDK waits for a response.
+- `WS::Client` reconnects with backoff when the server closes the connection (previously subscriptions silently stopped), `close` no longer reports a spurious "queue closed" error, subscribing after `close` delivers messages again, a pending reconnect no longer opens a second connection after `close` + `connect`, and each subscription is sent once on open.
+- WebSocket subscription ids are unique across the main-API and explorer connections (`unsubscribe(id)` could remove the wrong subscription), and `userEvents` subscriptions now receive events (the server sends them on channel `user`).
+- Documentation for `Exchange#user_set_abstraction` (takes `unifiedAccount` / `portfolioMargin` / `disabled`) and `Exchange#schedule_cancel` (`time: nil` removes the scheduled cancel).
+
+### Changed
+
+- The gem declares `bigdecimal` (>= 3.1) as a runtime dependency; it was already required at load time.
+- The packaged gem contains only `lib/`, `docs/`, `README.md`, `CHANGELOG.md`, `LICENSE.txt` and `SECURITY.md`, every file world-readable (1.9.2 shipped `version.rb`, `CHANGELOG.md` and `CLAUDE.md` as owner-only).
+- `docs/API.md` lists every public method with full signatures and `docs/WS.md` covers both WebSocket transports and every channel.
+
+### Security
+
+- `Signing::Signer`, `Exchange` and the SDK object redact `inspect`/`to_s` to address and network, so private keys cannot appear in logs or exception messages.
+
+## [1.9.2] - 2026-09-29
+
+### Security
+
+- The development and CI lockfile now builds `rbsecp256k1` from the `carter2099/rbsecp256k1` fork (6.1.0, pinned by commit), which allows rubyzip 3.x and bundles libsecp256k1 0.8.0; rubyzip moves from 2.4.1 to 3.7.0, clearing GHSA-47m2-wp7j-p9vc (CVE-2026-85396) for this repository.
+- **Residual exposure for gem consumers:** a gemspec cannot declare git sources, so applications installing the published gem still resolve rubygems `rbsecp256k1` 6.0.0 (via `eth ~> 0.5`), which pins `rubyzip ~> 2.3`. rbsecp256k1 uses rubyzip only at install time, to unpack its SHA-256-pinned libsecp256k1 archive; the SDK never loads rubyzip at runtime. Applications that want rubyzip 3.x now can add the same `gem 'rbsecp256k1', github: 'carter2099/rbsecp256k1', ref: 'bbfe3e346828e39d13aa590cca7cc74f663d2fde'` line to their own Gemfile.
+
+### Release
+
+- 1.9.1 was tagged and has a GitHub Release but was never published to RubyGems; 1.9.2 supersedes it and includes all of its changes.
+
+## [1.9.1] - 2026-09-29
+
+### Security
+
+- Updated locked development and CI dependencies to patched releases: faraday 2.14.3, addressable 2.9.0, erb 6.0.1.1, json 2.19.9, msgpack 1.8.5, rexml 3.4.2 and uri 1.0.4. The gem's runtime constraints are unchanged; applications pick up the fixes by updating their own lockfiles.
+- Known remaining advisory: rubyzip GHSA-47m2-wp7j-p9vc (CVE-2026-85396) stays at 2.4.1 because `eth` requires `rbsecp256k1 ~> 6.0`, whose latest release (6.0.0) pins `rubyzip ~> 2.3`. rbsecp256k1 uses rubyzip only at install time, to unpack its SHA-256-pinned libsecp256k1 archive; the SDK never loads rubyzip at runtime.
+
+### Tooling
+
+- Updated RuboCop to 1.91.0, rake to 13.4.2, rspec to 3.13.2, webmock to 3.26.4, irb to 1.18.0 and faraday-retry to 2.4.0.
+- Updated GitHub Actions to `actions/checkout@v7` and `softprops/action-gh-release@v3`.
+
 ## [1.9.0] - 2026-08-31
 
 ### New Exchange actions

data/README.md

@@ -24,6 +24,32 @@ Or install it yourself as:
 
     $ gem install hyperliquid
 
+### rubyzip 3 (optional)
+
+This gem signs with [`eth`](https://github.com/q9f/eth.rb), which depends on
+`rbsecp256k1 ~> 6.0`. The latest `rbsecp256k1` on RubyGems (6.0.0) pins `rubyzip ~> 2.3`,
+so your app stays on rubyzip 2.x and scanners report
+[GHSA-47m2-wp7j-p9vc](https://github.com/advisories/GHSA-47m2-wp7j-p9vc) (fixed in rubyzip
+3.4.0).
+
+The practical risk is small. `rbsecp256k1` uses rubyzip only while installing, to unpack
+its libsecp256k1 source archive, which is checked against a pinned SHA-256. Neither this
+SDK nor `eth` loads rubyzip at runtime.
+
+Upstream has merged rubyzip 3 support
+([etscrivner/rbsecp256k1#85](https://github.com/etscrivner/rbsecp256k1/pull/85)), but it
+is not on RubyGems yet. Until that release, you can move to rubyzip 3 by adding the
+maintained fork to your own Gemfile. The fork is version 6.1.0: it allows `rubyzip >= 3.4,
+< 4` and bundles libsecp256k1 0.8.0, and it still satisfies `eth`'s `~> 6.0` requirement.
+
+```ruby
+gem 'hyperliquid'
+gem 'rbsecp256k1', github: 'carter2099/rbsecp256k1', ref: 'bbfe3e346828e39d13aa590cca7cc74f663d2fde'
+```
+
+Then run `bundle update rbsecp256k1 rubyzip`. This SDK's own test suite and CI run against
+that fork.
+
 ## Usage
 
 ### Basic Setup