Issues

• Spec drift: polymarket_us taker fee moved to 30 day volume tiers on 2026-11-06 (0.095 to 0.0695); feeCoefficient now shows the Tier 1 rate

  pmxt-dev/pmxt#2636 · Filter by author Div770770 opened on Nov 9, 2026

• SDK drift: AuthNonceResponse/AuthLoginResponse are typed in TypeScript; Python's get_auth_nonce/login_with_signature return untyped Dict[str, Any]

  component: ts-sdkeffort: smallenhancementP2: mediumpythonsdk-driftsdk-paritytype: inconsistency
  pmxt-dev/pmxt#2630 · Filter by author realfishsam opened on Oct 29, 2026

• HIGH: zod (via @buidlrrr/rain-sdk) — memory exhaustion validating oversized constrained collections (GHSA-mrhx-c7xc-m3w5)

  bugcomponent: ts-sdkcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2626 · Filter by author realfishsam opened on Oct 26, 2026

• HIGH: undici@6.24.1 — DoS via unhandled error on excessive content-encodings (GHSA-xjj6-f33q-929c)

  bugcomponent: ts-sdkcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2625 · Filter by author realfishsam opened on Oct 26, 2026

• HIGH: follow-redirects@1.16.0 — sensitiveHeaders regex escaping can expose credential headers (GHSA-8r9p-f939-6h3c)

  bugcomponent: ts-sdkcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2624 · Filter by author realfishsam opened on Oct 26, 2026

• HIGH: follow-redirects@1.16.0 — array-form headers bypass cross-origin credential stripping (GHSA-q3jh-wrc6-jgq8)

  bugcomponent: ts-sdkcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2623 · Filter by author realfishsam opened on Oct 26, 2026

• HIGH: body-parser@2.2.2 — DoS via trailing bytes after a compressed request body (GHSA-27r3-jxmh-p828)

  bugcomponent: ts-sdkcoredependency-vulnerabilityeffort: smallP1: hightype: security
  pmxt-dev/pmxt#2622 · Filter by author realfishsam opened on Oct 26, 2026

• TypeScript SDK Position type and hosted positionFromV0 omit currentValue — core and Python SDK both carry it

  component: ts-sdkcore-sdk-gapeffort: smallenhancementP2: mediumsdk-paritytype: inconsistency
  pmxt-dev/pmxt#2619 · Filter by author realfishsam opened on Oct 25, 2026

• Response drift: probable — public order book endpoint returns HTTP 500

  bugcoreeffort: smallP2: mediumresponse-drift
  pmxt-dev/pmxt#2617 · Filter by author realfishsam opened on Oct 25, 2026

• Response drift: polymarket_us — outcomePrices is JSON-encoded string in live API; normalizer indexes it as string[]

  bugcoreeffort: smallP1: highresponse-drifttype: inconsistency
  pmxt-dev/pmxt#2616 · Filter by author realfishsam opened on Oct 25, 2026

• Spec drift: metaculus — GET /api/posts/ missing acting_user, categories, include_cp_history params (2026-Q3)

  coreeffort: smallenhancementP2: mediumspec-drift
  pmxt-dev/pmxt#2615 · Filter by author realfishsam opened on Oct 25, 2026

• Spec drift: metaculus — Multiple-choice Question missing options_history and all_options_ever fields (2026-Q3)

  bugcoreeffort: smallP2: mediumspec-drift
  pmxt-dev/pmxt#2614 · Filter by author realfishsam opened on Oct 25, 2026

• Spec drift: metaculus — POST /api/questions/withdraw/ missing withdraw_at param; endpoint not in spec (2026-Q3)

  coreeffort: smallenhancementP2: mediumspec-drift
  pmxt-dev/pmxt#2613 · Filter by author realfishsam opened on Oct 25, 2026

• Spec drift: metaculus — GET/POST /api/questions/bulk-forecast-read/ endpoints missing from spec (2026-Q3)

  coreeffort: smallenhancementP2: mediumspec-drift
  pmxt-dev/pmxt#2612 · Filter by author realfishsam opened on Oct 25, 2026

• Spec drift: metaculus — QuestionScaling schema missing inbound_outcome_count and continuous_range fields (added 2026-Q3)

  bugcoreeffort: smallP1: highspec-drift
  pmxt-dev/pmxt#2611 · Filter by author realfishsam opened on Oct 25, 2026

• Spec drift: polymarket — HIGH: Market.positionIds and Market.version fields missing from Gamma spec — V2 protocol markets unidentifiable

  coreeffort: smallenhancementP1: highspec-drift
  pmxt-dev/pmxt#2610 · Filter by author realfishsam opened on Oct 25, 2026

• Spec drift: polymarket — HIGH: GET /markets/keyset (cursor-based pagination) missing from Gamma spec — now primary market-discovery endpoint

  coreeffort: mediumenhancementmissing-specP1: highspec-drift
  pmxt-dev/pmxt#2609 · Filter by author realfishsam opened on Oct 25, 2026

• Spec drift: gemini-titan — MEDIUM: Fetcher never uses callApi() despite having an OpenAPI spec — all HTTP calls bypass spec validation

  coreeffort: mediummaintenanceP2: mediumspec-drifttype: inconsistency
  pmxt-dev/pmxt#2608 · Filter by author realfishsam opened on Oct 25, 2026

• Spec drift: polymarket_us — MEDIUM: Metals market fields and GET /v1/asset-prices/history endpoint missing (Oct 22, 2026)

  coreeffort: mediumenhancementmissing-specP2: mediumspec-drift
  pmxt-dev/pmxt#2607 · Filter by author realfishsam opened on Oct 25, 2026

• Spec drift: polymarket_us — MEDIUM: 10 new basketball market_sport_type enum values (Oct 19–21, 2026) not in normalizer — follow-up to #2241

  coreeffort: smallenhancementP2: mediumspec-drift
  pmxt-dev/pmxt#2606 · Filter by author realfishsam opened on Oct 25, 2026

• Spec drift: polymarket_us — HIGH: GET /v1/events now returns only primary market per event (Oct 15, 2026) — fetchEvents silently drops spreads, totals, and props

  bugcoreeffort: mediumP1: highspec-drift
  pmxt-dev/pmxt#2605 · Filter by author realfishsam opened on Oct 25, 2026

• Spec drift: smarkets — IRGC missing from jurisdiction enum on 3 non-events endpoints (parallel gap to #2493)

  coreeffort: smallenhancementP2: mediumspec-drift
  pmxt-dev/pmxt#2604 · Filter by author realfishsam opened on Oct 25, 2026

• Spec drift: limitless — 6 new /parlay/partner/* endpoints (partner pack flow) missing from spec (Oct 19, 2026)

  coreeffort: largeenhancementmissing-specP2: mediumspec-drift
  pmxt-dev/pmxt#2603 · Filter by author realfishsam opened on Oct 25, 2026

• Spec drift: kalshi — 5 Oct 29 changes: orderbook clock field, event_ticker limit raised to 100, subaccount balance per-index fields, transfer client_transfer_id, user_orders ms truncation

  coreeffort: mediumenhancementP3: lowspec-drift
  pmxt-dev/pmxt#2602 · Filter by author realfishsam opened on Oct 25, 2026

• Spec drift: kalshi — GET /trade-api/v2/margin/corporate_actions endpoint + corporate_actions WebSocket channel missing from spec (Oct 22, 2026)

  coreeffort: mediumenhancementP2: mediumspec-drift
  pmxt-dev/pmxt#2601 · Filter by author realfishsam opened on Oct 25, 2026