Version Packages - #520
Conversation
pr-reviewer Summary for #a7eba58✅ No issues found The code review completed successfully with no findings. Review effort: 1/5 (Trivial) SummaryThis is the automated Changesets release PR bumping Token usage: 2,523 input, 1,880 output, 147,266 cache read, 25,717 cache write | Usage Guide New pushes are reviewed automatically with a 10-minute cooldown between reviews. To request a review at any time, comment |
![nansen-pr-reviewer[bot]](https://avatars.githubusercontent.com/u/65251086?s=60&v=4){kind=small}
There was a problem hiding this comment.
Auto-approved
This PR was automatically approved because:
- Claude recommends approval
- Claude assessed this as a minimal effort change
- The effort level is within the auto-approval threshold of 2
- No high or critical issues were detected
If you have any concerns, please request a manual review.
548a5a9
d2d1e63 to
548a5a9
Compare
There was a problem hiding this comment.
Auto-approved
This PR was automatically approved because:
- Claude recommends approval
- Claude assessed this as a minimal effort change
- The effort level is within the auto-approval threshold of 2
- No high or critical issues were detected
If you have any concerns, please request a manual review.
e8b99fa
548a5a9 to
e8b99fa
Compare
There was a problem hiding this comment.
Auto-approved
This PR was automatically approved because:
- Claude recommends approval
- Claude assessed this as a minimal effort change
- The effort level is within the auto-approval threshold of 2
- No high or critical issues were detected
If you have any concerns, please request a manual review.
d37f909
e8b99fa to
d37f909
Compare
There was a problem hiding this comment.
Auto-approved
This PR was automatically approved because:
- Claude recommends approval
- Claude assessed this as a minimal effort change
- The effort level is within the auto-approval threshold of 2
- No high or critical issues were detected
If you have any concerns, please request a manual review.
51b69fc
d37f909 to
51b69fc
Compare
There was a problem hiding this comment.
Auto-approved
This PR was automatically approved because:
- Claude recommends approval
- Claude assessed this as a minimal effort change
- The effort level is within the auto-approval threshold of 2
- No high or critical issues were detected
If you have any concerns, please request a manual review.
a7eba58
51b69fc to
a7eba58
Compare
There was a problem hiding this comment.
Auto-approved
This PR was automatically approved because:
- Claude recommends approval
- Claude assessed this as a minimal effort change
- The effort level is within the auto-approval threshold of 2
- No high or critical issues were detected
If you have any concerns, please request a manual review.
1 participant
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
nansen-cli@1.41.0
Minor Changes
#512
ba42a9cThanks @kome12! - Validate Solana swap quotes against the original request before signing (local, Privy, and WalletConnect wallets). The CLI now checks that a quote's chain, token pair, amounts, and target wallet match what was requested at quote time and refuses to sign when they don't, bringing Solana in line with the existing EVM checks.--swap-mode exactOutnow also requires--max-inputon Solana (previously EVM-only), so the maximum spend is bounded by a value you supply rather than one taken from the quote itself.#514
1bc7337Thanks @kome12! -trade executeandtrade limit-orderon Solana now statically check the aggregator's compiled instructions before signing, and reject a transaction that grants a token delegate, changes a token account's authority, closes an account with its rent redirected to a stranger, or sets an excessive compute-budget priority fee — closing a class of drain vector a balance-delta simulation alone can't see.#522
820bf05Thanks @kome12! - Verify a Solana swap's simulated on-chain outcome before signing (local, Privy, and WalletConnect wallets), mirroring the existing EVM balance-delta check. The CLI simulates the aggregator's transaction and confirms the wallet's balance changes match the quote — input spent within your max, expected output received, no other asset drained — refusing to sign on a mismatch or an in-simulation revert. Covered by the existing--no-verify-outcomeflag; degrades with a warning (and still signs) when no simulation-capable RPC is available, so an RPC outage never blocks a trade. New env var:NANSEN_SOLANA_SIM_RPC.Patch Changes
#519
55ab7dbThanks @kome12! - trade execute: confirm EVM transactions against the hash derived locally fromthe signed bytes instead of trusting the broadcaster's reported hash, and fail
closed if they disagree. Once a transaction has been broadcast, every uncertain
outcome now aborts the whole execute instead of silently trying the next quote
(which could broadcast a second transaction): a hash mismatch, a signed
transaction we cannot re-derive a hash for, and a receipt-confirmation timeout
(distinguished from a genuine on-chain revert) are all fatal across the swap,
approval, and revoke paths. Broadcaster hashes are also compared
prefix-insensitively, so a bare (0x-less) hash is no longer a false mismatch.
#521
977e326Thanks @aikido-autofix! - Fix potential path traversal in safeQuotesPath by rejecting absolute relative paths (Windows cross-drive escape).#497
223a9d5Thanks @crazywriter1! - Reject--oidvalues above 2^53-1 onperp cancel: large Hyperliquid uint64 order IDs would be silently rounded by JS Number, potentially cancelling the wrong order.