Issues

• Response drift: limitless — priceOracleMetadata object present in live GET /markets/active response but not accessed by normalizer

  response-drift
  pmxt-dev/pmxt#2528 · Filter by author realfishsam opened on Oct 11, 2026

• Response drift: kalshi — taker_side and fill side/action read before v2 alternatives; removal deadline May 2026 is past

  response-drift
  pmxt-dev/pmxt#2527 · Filter by author realfishsam opened on Oct 11, 2026

• spec-drift [smarkets] MEDIUM: get_quotes bypassed via hardcoded URL — code comment claiming endpoint is "private" is inaccurate

  coreP2: mediumsmarketsspec-drift
  pmxt-dev/pmxt#2526 · Filter by author realfishsam opened on Oct 11, 2026

• spec-drift [rain] LOW: getPublicMarkets returns 8 new intermediate status values — normalizer only handles Live/Closed, intermediate markets invisible

  coreP3: lowrainspec-drift
  pmxt-dev/pmxt#2525 · Filter by author realfishsam opened on Oct 11, 2026

• spec-drift [rain] LOW: getTransactions missing required skip/orderDirection params — SDK v2.0.0 may error on user trade fetches

  coreP3: lowrainspec-drift
  pmxt-dev/pmxt#2524 · Filter by author realfishsam opened on Oct 11, 2026

• spec-drift [kalshi] P1: market.liquidity_dollars removed Oct 1 2026 — normalizer reads this field; fallback market.liquidity always returns 0 since Feb 2026

  bugcoreeffort: smallkalshiP1: highspec-drift
  pmxt-dev/pmxt#2523 · Filter by author realfishsam opened on Oct 11, 2026

• spec-drift [limitless] P2: WebSocket orderEvent.timestamp deprecated (Jul 27 2026); FAK/FOK EXECUTION frame types changed (Sep 25 2026)

  bugcoreeffort: smalllimitlessP2: mediumspec-drift
  pmxt-dev/pmxt#2522 · Filter by author realfishsam opened on Oct 11, 2026

• spec-drift [limitless] P1: POST /orders feeRateBps enforcement (Sep 23 2026) — all orders on fee-enabled markets return 400 FEE_RATE_MISMATCH

  bugcoreeffort: smalllimitlessP1: highspec-drift
  pmxt-dev/pmxt#2521 · Filter by author realfishsam opened on Oct 11, 2026

• Spec drift: hyperliquid — 7 POST /exchange action types missing (cancelByCloid, modify, batchModify, twapOrder, twapCancel, trailingStop, scheduleCancel)

  coreeffort: mediumenhancementP2: mediumspec-drift
  pmxt-dev/pmxt#2520 · Filter by author realfishsam opened on Oct 11, 2026

• Spec drift: hyperliquid — outcomeMeta questions field absent from public API docs — potential undocumented removal (see also #775)

  bugcoreeffort: smallP1: highspec-drifttype: inconsistency
  pmxt-dev/pmxt#2519 · Filter by author realfishsam opened on Oct 11, 2026

• Spec drift: gemini-titan — WebSocket GeminiWsBookTickerData missing c/C fields; GeminiWsOrderData missing e/m/P/a/h/n fields (2026-06 to 2026-09)

  bugcoreeffort: smallP2: mediumspec-drifttype: inconsistency
  pmxt-dev/pmxt#2518 · Filter by author realfishsam opened on Oct 11, 2026

• Spec drift: gemini-titan — GET /v1/prediction-markets/taker-rewards/summary missing from spec (added 2026-10-01; not in rewards namespace issue #2336)

  coreeffort: smallenhancementgood first issueP3: lowspec-drift
  pmxt-dev/pmxt#2517 · Filter by author realfishsam opened on Oct 11, 2026

• Spec drift: gemini-titan — GET /v1/prediction-markets/events/{eventTicker}/strike endpoint missing (added 2026-03-30)

  coreeffort: smallenhancementgood first issueP3: lowspec-drift
  pmxt-dev/pmxt#2516 · Filter by author realfishsam opened on Oct 11, 2026

• Spec drift: gemini-titan — GET /events missing 5 sports filter query params (sport, sports_market_type, sports_market_subject, sports_market_scope, sports_market_metric)

  coreeffort: smallenhancementP2: mediumspec-drifttype: inconsistency
  pmxt-dev/pmxt#2515 · Filter by author realfishsam opened on Oct 11, 2026

• Spec drift: gemini-titan — Contract precision metadata fields missing from spec (quantityIncrement, quantityMinimum, priceIncrement, priceMinimum added 2026-08-03)

  coreeffort: smallenhancementP2: mediumspec-drifttype: inconsistency
  pmxt-dev/pmxt#2514 · Filter by author realfishsam opened on Oct 11, 2026

• Spec drift: gemini-titan — Event.status enum breaking change: pending removed, approved/closed/under_review/invalid added, underreview renamed

  bugcoreeffort: smallP1: highspec-drifttype: inconsistency
  pmxt-dev/pmxt#2513 · Filter by author realfishsam opened on Oct 11, 2026

• Spec drift: baozi — REST API authenticated endpoints require wallet signature headers (x-wallet-address/x-signature/x-message) not implemented in auth.ts

  bugcoreeffort: smallP2: mediumspec-drifttype: inconsistency
  pmxt-dev/pmxt#2512 · Filter by author realfishsam opened on Oct 11, 2026

• SDK drift: userTradeToV0 rounds half-up (Math.round) but Python's user_trade_to_v0 uses banker's rounding (round) when converting shares to micro-shares

  bugcomponent: ts-sdkeffort: smallP2: mediumpythonsdk-driftsdk-paritytype: inconsistency
  pmxt-dev/pmxt#2511 · Filter by author realfishsam opened on Oct 6, 2026

• SDK drift: msToTimestamp/_ms_to_timestamp emit differently formatted ISO-8601 strings (.123Z/.000Z in TypeScript vs .123000Z/no fraction in Python)

  component: ts-sdkeffort: smallenhancementP3: lowpythonsdk-driftsdk-paritytype: inconsistency
  pmxt-dev/pmxt#2510 · Filter by author realfishsam opened on Oct 6, 2026

• HIGH: undici@6.24.1 — DoS via unrequested WebSocket subprotocol (GHSA-rfgv-xxqx-mfg5)

  bugcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2509 · Filter by author realfishsam opened on Oct 5, 2026

• HIGH: brace-expansion@1.x (nested under minimatch / test-exclude) and root — DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion (GHSA-6j4f-fj2g-mc7p)

  bugcomponent: ts-sdkcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2508 · Filter by author realfishsam opened on Oct 5, 2026

• HIGH: brace-expansion@1.x (nested under minimatch / test-exclude) and root — DoS via uncontrolled recursion on nested brace groups causing stack exhaustion (GHSA-qhr7-859c-m2p7)

  bugcomponent: ts-sdkcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2507 · Filter by author realfishsam opened on Oct 5, 2026

• HIGH: basic-ftp@5.1.0 — Quadratic-time CPU DoS in Client.list() Unix directory-listing parser (GHSA-c475-qrg2-pj4r)

  bugcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2506 · Filter by author realfishsam opened on Oct 5, 2026

• HIGH: axios@1.17.0 — maxRedirects: 0 not enforced by fetch adapter, allowing redirect-based SSRF (GHSA-r4gj-5m52-g5wh)

  bugcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2505 · Filter by author realfishsam opened on Oct 5, 2026

• HIGH: axios@1.17.0 / 1.13.2 — DoS via unhandled 'error' event in HTTP/2 ClientHttp2Session initialization (GHSA-542g-h47m-68v8)

  bugcomponent: ts-sdkcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2503 · Filter by author realfishsam opened on Oct 5, 2026