rain-sdk-v2 2.5.0 → 2.5.2

package/CHANGELOG.md

@@ -9,6 +9,26 @@ APIs slated for removal are marked `@deprecated` in the type declarations for at
 least one minor release before they are removed, with the replacement named in
 the deprecation notice. Breaking removals land only in a major version.
 
+## Security
+
+Versions `< 2.5.0` are **deprecated on npm** — they build sell transactions with no
+slippage protection by default (fixed in 2.5.0). See the Security notice in the
+README and the 2.5.0 entry below. Upgrade to `>= 2.5.0`.
+
+## [2.5.2] - Remove ngrok dev header
+
+### Removed
+- Dropped the `ngrok-skip-browser-warning` header handling from all request paths
+  (`buildHeaders`, dispute upload, login, IPFS metadata upload). It was a dev-tunnel
+  convenience gated behind `apiUrl.includes('ngrok')` and never fired against real
+  environments. No behavior change for non-ngrok usage.
+
+## [2.5.1] - Add LICENSE
+
+### Added
+- MIT `LICENSE` file at the repo root so GitHub detects the license (npm already
+  declared MIT). No code changes.
+
 ## [2.5.0] - Sell slippage + create-market validation
 
 ### Fixed

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rain Protocol
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -2,6 +2,23 @@
 
 TypeScript SDK for the Rain prediction markets protocol on Arbitrum One. Provides transaction builders for market creation, trading, liquidity management, order book operations, dispute resolution, and smart account (Account Abstraction) support.
 
+## ⚠️ Security notice — upgrade to >= 2.5.0
+
+Versions **below 2.5.0** build **sell** transactions with no slippage protection by
+default: `buildSellOptionTx` defaulted `minAmountOut` to `0` and the documented
+`slippageTolerance` option was ignored, exposing sells to MEV/sandwich loss.
+**Fixed in 2.5.0** — sells now quote `getSellProceeds` on-chain and apply
+`slippageTolerance` (default 5%). Versions `<2.5.0` are deprecated on npm.
+
+Migration is one line: **`buildSellOptionTx` is now async** — add `await`.
+
+```typescript
+// before (< 2.5.0)
+const tx = rain.buildSellOptionTx({ /* ... */ });
+// after (>= 2.5.0)
+const tx = await rain.buildSellOptionTx({ /* ... */ });
+```
+
 ## Installation
 
 ```bash

package/dist/api/dispute.js

@@ -15,9 +15,6 @@ export async function createDisputeMessage(params, config) {
     if (config.accessToken) {
         headers['Authorization'] = `Bearer ${config.accessToken}`;
     }
-    if (config.apiUrl?.includes('ngrok')) {
-        headers['ngrok-skip-browser-warning'] = 'true';
-    }
     // Do not set Content-Type for FormData; the browser sets the boundary automatically.
     const res = await fetch(`${config.apiUrl}/dispute/create-dispute-message`, {
         method: 'POST',

package/dist/api/helpers.js

@@ -1,8 +1,5 @@
 export function buildHeaders(config, contentType) {
     const headers = {};
-    if (config.apiUrl?.includes('ngrok')) {
-        headers['ngrok-skip-browser-warning'] = 'true';
-    }
     if (contentType) {
         headers['Content-Type'] = contentType;
     }

package/dist/auth/login.js

@@ -21,7 +21,6 @@ export async function loginUser(params) {
         method: 'POST',
         headers: {
             'Content-Type': 'application/json',
-            ...(apiUrl.includes('ngrok') ? { 'ngrok-skip-browser-warning': 'true' } : {}),
         },
         body: JSON.stringify({
             sign: signature,

package/dist/tx/CreateMarket/helpers.js

@@ -29,7 +29,6 @@ export async function uploadMetaData(params) {
         method: "POST",
         headers: {
             "Content-Type": "application/json",
-            ...(apiUrl?.includes('ngrok') ? { "ngrok-skip-browser-warning": "true" } : {}),
         },
         body: JSON.stringify(metadata),
     });

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "rain-sdk-v2",
-    "version": "2.5.0",
+    "version": "2.5.2",
     "type": "module",
     "description": "Rain SDK V2 — TypeScript SDK for Rain prediction markets on Arbitrum. Market creation, trading, liquidity, order book, split/merge, dispute, and smart account support.",
     "main": "dist/index.js",
@@ -22,7 +22,8 @@
         "test": "vitest run",
         "test:watch": "vitest",
         "test:integration": "RUN_INTEGRATION=1 vitest run test/integration.test.ts",
-        "prepublishOnly": "npm run build"
+        "test:coverage": "vitest run --coverage",
+        "prepublishOnly": "npm run build && npm test"
     },
     "repository": {
         "type": "git",
@@ -63,6 +64,7 @@
         "socket.io-client": "^4.8.3"
     },
     "devDependencies": {
+        "@vitest/coverage-v8": "^5.0.1",
         "typescript": "^5.9.3",
         "viem": "^2.48.8",
         "vitest": "^5.0.1"