rain-sdk-v2 2.5.1 → 2.5.2

package/CHANGELOG.md

@@ -9,6 +9,20 @@ APIs slated for removal are marked `@deprecated` in the type declarations for at
 least one minor release before they are removed, with the replacement named in
 the deprecation notice. Breaking removals land only in a major version.
 
+## Security
+
+Versions `< 2.5.0` are **deprecated on npm** — they build sell transactions with no
+slippage protection by default (fixed in 2.5.0). See the Security notice in the
+README and the 2.5.0 entry below. Upgrade to `>= 2.5.0`.
+
+## [2.5.2] - Remove ngrok dev header
+
+### Removed
+- Dropped the `ngrok-skip-browser-warning` header handling from all request paths
+  (`buildHeaders`, dispute upload, login, IPFS metadata upload). It was a dev-tunnel
+  convenience gated behind `apiUrl.includes('ngrok')` and never fired against real
+  environments. No behavior change for non-ngrok usage.
+
 ## [2.5.1] - Add LICENSE
 
 ### Added

package/README.md

@@ -2,6 +2,23 @@
 
 TypeScript SDK for the Rain prediction markets protocol on Arbitrum One. Provides transaction builders for market creation, trading, liquidity management, order book operations, dispute resolution, and smart account (Account Abstraction) support.
 
+## ⚠️ Security notice — upgrade to >= 2.5.0
+
+Versions **below 2.5.0** build **sell** transactions with no slippage protection by
+default: `buildSellOptionTx` defaulted `minAmountOut` to `0` and the documented
+`slippageTolerance` option was ignored, exposing sells to MEV/sandwich loss.
+**Fixed in 2.5.0** — sells now quote `getSellProceeds` on-chain and apply
+`slippageTolerance` (default 5%). Versions `<2.5.0` are deprecated on npm.
+
+Migration is one line: **`buildSellOptionTx` is now async** — add `await`.
+
+```typescript
+// before (< 2.5.0)
+const tx = rain.buildSellOptionTx({ /* ... */ });
+// after (>= 2.5.0)
+const tx = await rain.buildSellOptionTx({ /* ... */ });
+```
+
 ## Installation
 
 ```bash

package/dist/api/dispute.js

@@ -15,9 +15,6 @@ export async function createDisputeMessage(params, config) {
     if (config.accessToken) {
         headers['Authorization'] = `Bearer ${config.accessToken}`;
     }
-    if (config.apiUrl?.includes('ngrok')) {
-        headers['ngrok-skip-browser-warning'] = 'true';
-    }
     // Do not set Content-Type for FormData; the browser sets the boundary automatically.
     const res = await fetch(`${config.apiUrl}/dispute/create-dispute-message`, {
         method: 'POST',

package/dist/api/helpers.js

@@ -1,8 +1,5 @@
 export function buildHeaders(config, contentType) {
     const headers = {};
-    if (config.apiUrl?.includes('ngrok')) {
-        headers['ngrok-skip-browser-warning'] = 'true';
-    }
     if (contentType) {
         headers['Content-Type'] = contentType;
     }

package/dist/auth/login.js

@@ -21,7 +21,6 @@ export async function loginUser(params) {
         method: 'POST',
         headers: {
             'Content-Type': 'application/json',
-            ...(apiUrl.includes('ngrok') ? { 'ngrok-skip-browser-warning': 'true' } : {}),
         },
         body: JSON.stringify({
             sign: signature,

package/dist/tx/CreateMarket/helpers.js

@@ -29,7 +29,6 @@ export async function uploadMetaData(params) {
         method: "POST",
         headers: {
             "Content-Type": "application/json",
-            ...(apiUrl?.includes('ngrok') ? { "ngrok-skip-browser-warning": "true" } : {}),
         },
         body: JSON.stringify(metadata),
     });

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "rain-sdk-v2",
-    "version": "2.5.1",
+    "version": "2.5.2",
     "type": "module",
     "description": "Rain SDK V2 — TypeScript SDK for Rain prediction markets on Arbitrum. Market creation, trading, liquidity, order book, split/merge, dispute, and smart account support.",
     "main": "dist/index.js",
@@ -22,7 +22,8 @@
         "test": "vitest run",
         "test:watch": "vitest",
         "test:integration": "RUN_INTEGRATION=1 vitest run test/integration.test.ts",
-        "prepublishOnly": "npm run build"
+        "test:coverage": "vitest run --coverage",
+        "prepublishOnly": "npm run build && npm test"
     },
     "repository": {
         "type": "git",
@@ -63,6 +64,7 @@
         "socket.io-client": "^4.8.3"
     },
     "devDependencies": {
+        "@vitest/coverage-v8": "^5.0.1",
         "typescript": "^5.9.3",
         "viem": "^2.48.8",
         "vitest": "^5.0.1"