Issues

• SDK drift: userTradeToV0 rounds half-up (Math.round) but Python's user_trade_to_v0 uses banker's rounding (round) when converting shares to micro-shares

  bugcomponent: ts-sdkeffort: smallP2: mediumpythonsdk-driftsdk-paritytype: inconsistency
  pmxt-dev/pmxt#2511 · Filter by author realfishsam opened on Oct 6, 2026

• SDK drift: msToTimestamp/_ms_to_timestamp emit differently formatted ISO-8601 strings (.123Z/.000Z in TypeScript vs .123000Z/no fraction in Python)

  component: ts-sdkeffort: smallenhancementP3: lowpythonsdk-driftsdk-paritytype: inconsistency
  pmxt-dev/pmxt#2510 · Filter by author realfishsam opened on Oct 6, 2026

• HIGH: brace-expansion@1.x (nested under minimatch / test-exclude) and root — DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion (GHSA-6j4f-fj2g-mc7p)

  bugcomponent: ts-sdkcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2508 · Filter by author realfishsam opened on Oct 5, 2026

• HIGH: undici@6.24.1 — DoS via unrequested WebSocket subprotocol (GHSA-rfgv-xxqx-mfg5)

  bugcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2509 · Filter by author realfishsam opened on Oct 5, 2026

• HIGH: brace-expansion@1.x (nested under minimatch / test-exclude) and root — DoS via uncontrolled recursion on nested brace groups causing stack exhaustion (GHSA-qhr7-859c-m2p7)

  bugcomponent: ts-sdkcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2507 · Filter by author realfishsam opened on Oct 5, 2026

• HIGH: axios@1.17.0 — maxRedirects: 0 not enforced by fetch adapter, allowing redirect-based SSRF (GHSA-r4gj-5m52-g5wh)

  bugcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2505 · Filter by author realfishsam opened on Oct 5, 2026

• HIGH: basic-ftp@5.1.0 — Quadratic-time CPU DoS in Client.list() Unix directory-listing parser (GHSA-c475-qrg2-pj4r)

  bugcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2506 · Filter by author realfishsam opened on Oct 5, 2026

• HIGH: axios@1.17.0 / 1.13.2 — Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection (GHSA-m8m8-qj5v-23w3)

  bugcomponent: ts-sdkcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2504 · Filter by author realfishsam opened on Oct 5, 2026

• HIGH: axios@1.17.0 / 1.13.2 — DoS via unhandled 'error' event in HTTP/2 ClientHttp2Session initialization (GHSA-542g-h47m-68v8)

  bugcomponent: ts-sdkcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2503 · Filter by author realfishsam opened on Oct 5, 2026

• HIGH: axios@1.17.0 / 1.13.2 — HTTP/2 adapter bypasses configured DNS lookup and proxy controls (GHSA-3pq3-5fj3-cg6v)

  bugcomponent: ts-sdkcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2502 · Filter by author realfishsam opened on Oct 5, 2026

• HIGH: axios@1.17.0 / 1.13.2 — Prototype pollution gadget in toFormData options (GHSA-x97p-jq2g-jp4f)

  bugcomponent: ts-sdkcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2501 · Filter by author realfishsam opened on Oct 5, 2026

• HIGH: axios@1.17.0 / 1.13.2 — O(N²) ReDoS in shouldBypassProxy host normalization, reachable via untrusted redirect Location (GHSA-mghh-pgcx-3jjj)

  bugcomponent: ts-sdkcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2500 · Filter by author realfishsam opened on Oct 5, 2026

• HIGH: axios@1.17.0 / 1.13.2 — ReDoS in fromDataURI data: URL parser freezes event loop (GHSA-c29m-xwm3-cm6r)

  bugcomponent: ts-sdkcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2499 · Filter by author realfishsam opened on Oct 5, 2026

• Response drift: probable — resolution/dispute proposal fields not captured (resolution_label, proposed_price, price_proposer, proposal_history)

  bugcoreeffort: smallP2: mediumresponse-drifttype: inconsistency
  pmxt-dev/pmxt#2498 · Filter by author realfishsam opened on Oct 4, 2026

• Response drift: myriad — 5 live market fields not accessed by normalizer (moneyline, token, volumeNotional, resolutionSource, resolutionTitle)

  bugcoreeffort: smallP2: mediumresponse-drifttype: inconsistency
  pmxt-dev/pmxt#2497 · Filter by author realfishsam opened on Oct 4, 2026

• Response drift: limitless — orderbook response includes tokenId field not accessed by normalizer

  bugcoreeffort: smallP3: lowresponse-drifttype: inconsistency
  pmxt-dev/pmxt#2496 · Filter by author realfishsam opened on Oct 4, 2026

• Response drift: limitless — tradePrices.buy.limit[] / sell.limit[] arrays in live market response not accessed by normalizer

  bugcoreeffort: smallP2: mediumresponse-drifttype: inconsistency
  pmxt-dev/pmxt#2495 · Filter by author realfishsam opened on Oct 4, 2026

• Response drift: kalshi — 7 new market fields in live GET /markets not accessed by normalizer (market_type, result, custom_strike, etc.)

  bugcoreeffort: smallP2: mediumresponse-drifttype: inconsistency
  pmxt-dev/pmxt#2494 · Filter by author realfishsam opened on Oct 4, 2026

• [smarkets] GET /v3/events/ jurisdiction enum missing IRGC value — filtering broken for IRGC-regulated markets

  coreeffort: smallenhancementgood first issueP3: lowspec-drifttype: inconsistency
  pmxt-dev/pmxt#2493 · Filter by author realfishsam opened on Oct 4, 2026

• [myriad] GET /questions and GET /questions/{id} removed from live API — replaced by /events resource

  bugcoreeffort: mediumP1: highspec-drifttype: inconsistency
  pmxt-dev/pmxt#2490 · Filter by author realfishsam opened on Oct 4, 2026

• [smarkets] GET /v3/events/ state param default dropped "new" — events in "new" state silently excluded

  bugcoreeffort: smallP2: mediumspec-drifttype: inconsistency
  pmxt-dev/pmxt#2486 · Filter by author realfishsam opened on Oct 4, 2026

• SDK drift: TypeScript's convertMarket leaves volume24h/liquidity undefined when absent from the raw payload; Python's _convert_market defaults both to 0

  bugcomponent: ts-sdkeffort: smallP2: mediumsdk-driftsdk-paritytype: inconsistency
  pmxt-dev/pmxt#2478 · Filter by author realfishsam opened on Sep 28, 2026

• core/docs/SETUP_LIMITLESS.md wrongly claims Limitless runs on "Ethereum network" — core hardcodes Base (chainId 8453)

  bugcore-sdk-gapdocumentationeffort: smallP2: medium
  pmxt-dev/pmxt#2477 · Filter by author realfishsam opened on Sep 27, 2026

• Both SDKs' positionFromV0 fabricate unrealizedPnL client-side even though the hosted API documents it as reserved/null-only

  bugcomponent: ts-sdkcore-sdk-gapeffort: mediumP1: highpythontype: inconsistency
  pmxt-dev/pmxt#2476 · Filter by author realfishsam opened on Sep 27, 2026

• Response drift: smarkets — events[].state field not accessed for status filtering

  bugcoreeffort: smallP2: mediumresponse-drifttype: inconsistency
  pmxt-dev/pmxt#2473 · Filter by author realfishsam opened on Sep 27, 2026