Skip to content

fix: bridge quote fetch - #4079

Merged
cs1707 merged 3 commits into
developfrom
fix/bridge-quote-fetch
Sep 11, 2026
Merged

fix: bridge quote fetch#4079
cs1707 merged 3 commits into
developfrom
fix/bridge-quote-fetch

Conversation

@hz002

@hz002 hz002 commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

No description provided.

@hz002
hz002 marked this pull request as draft September 7, 2026 06:50
@ddddhm1234

Copy link
Copy Markdown
Contributor

PR扫描结果

依赖变更

依赖 版本 风险 下载 周下载量 最新版
@rabby-wallet/rabby-api 0.9.66-alpha.0 2 https://registry.npmjs.org/@rabby-wallet/rabby-api/-/rabby-api-0.9.66-alpha.0.tgz 891 0.9.65
@rabby-wallet/rabby-bridge 0.0.9-alpha.0 1 https://registry.npmjs.org/@rabby-wallet/rabby-bridge/-/rabby-bridge-0.0.9-alpha.0.tgz 208 0.0.8

详细风险信息

@rabby-wallet/rabby-api @ 0.9.66-alpha.0

  • 【中危】 使用了不常用的NPM包:
@rabby-wallet/rabby-api在2026-08-23 - 2026-08-29期间下载量仅有 891 次
  • 【高危】 使用了危险的全局变量:
- 访问 chrome (访问chrome扩展API): 访问chrome扩展API

@rabby-wallet/rabby-bridge @ 0.0.9-alpha.0

  • 【中危】 使用了不常用的NPM包:
@rabby-wallet/rabby-bridge在2026-08-31 - 2026-09-06期间下载量仅有 208 次

@socket-security

socket-security Bot commented Sep 7, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​rabby-wallet/​rabby-api@​0.9.65 ⏵ 0.9.6680 +110081 +1100 +10
Updated@​rabby-wallet/​rabby-bridge@​0.0.8 ⏵ 0.0.107710074 +198 +1100

View full report

@hz002
hz002 marked this pull request as ready for review September 10, 2026 09:30
@ddddhm1234

Copy link
Copy Markdown
Contributor

PR扫描结果

依赖变更

依赖 版本 风险 下载 周下载量 最新版
@rabby-wallet/rabby-api 0.9.66 3 https://registry.npmjs.org/@rabby-wallet/rabby-api/-/rabby-api-0.9.66.tgz 1195 0.9.66
@rabby-wallet/rabby-bridge 0.0.9 2 https://registry.npmjs.org/@rabby-wallet/rabby-bridge/-/rabby-bridge-0.0.9.tgz 208 0.0.9

详细风险信息

@rabby-wallet/rabby-api @ 0.9.66

  • 【低危】 使用了最新或最近发布的版本:
@rabby-wallet/rabby-api 使用了最新版本: 0.9.66, 且该版本为30天内发布
  • 【中危】 使用了不常用的NPM包:
@rabby-wallet/rabby-api在2026-08-31 - 2026-09-06期间下载量仅有 1195 次
  • 【高危】 使用了危险的全局变量:
- 访问 chrome (访问chrome扩展API): 访问chrome扩展API

@rabby-wallet/rabby-bridge @ 0.0.9

  • 【低危】 使用了最新或最近发布的版本:
@rabby-wallet/rabby-bridge 使用了最新版本: 0.0.9, 且该版本为30天内发布
  • 【中危】 使用了不常用的NPM包:
@rabby-wallet/rabby-bridge在2026-08-31 - 2026-09-06期间下载量仅有 208 次

@rabby-code-reviewer rabby-code-reviewer Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated inline review.

Comment thread package.json Outdated
"@rabby-wallet/rabby-api": "0.9.65",
"@rabby-wallet/rabby-bridge": "0.0.8",
"@rabby-wallet/rabby-api": "0.9.66",
"@rabby-wallet/rabby-bridge": "0.0.9",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Non-blocking/security: @ddddhm1234, this PR updates bridge/API dependencies and their lockfile checksums; please perform the required dependency and supply-chain security review.

@rabby-code-reviewer rabby-code-reviewer Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated inline review.

Comment thread package.json Outdated
"@rabby-wallet/rabby-api": "0.9.65",
"@rabby-wallet/rabby-bridge": "0.0.8",
"@rabby-wallet/rabby-api": "0.9.66",
"@rabby-wallet/rabby-bridge": "0.0.9",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Non-blocking/correctness: @rabby-wallet/rabby-bridge 0.0.9 now always forwards slippage to getBridgeQuoteListV2. The current Bridge hook derives that value with new BigNumber(slippageObj.slippageState).div(100).toString(10); closing the custom-slippage editor with a blank value commits "", which becomes the truthy string "NaN", passes the package’s requireSlippage check, and makes the quote requests fail/return no quotes. Please use the normalized slippageObj.slippage fallback here and reject non-finite slippage before invoking the package.

@ddddhm1234

Copy link
Copy Markdown
Contributor

PR扫描结果

依赖变更

依赖 版本 风险 下载 周下载量 最新版
@rabby-wallet/rabby-api 0.9.66 3 https://registry.npmjs.org/@rabby-wallet/rabby-api/-/rabby-api-0.9.66.tgz 580 0.9.66
@rabby-wallet/rabby-bridge 0.0.10 2 https://registry.npmjs.org/@rabby-wallet/rabby-bridge/-/rabby-bridge-0.0.10.tgz 108 0.0.10

详细风险信息

@rabby-wallet/rabby-api @ 0.9.66

  • 【低危】 使用了最新或最近发布的版本:
@rabby-wallet/rabby-api 使用了最新版本: 0.9.66, 且该版本为30天内发布
  • 【中危】 使用了不常用的NPM包:
@rabby-wallet/rabby-api在2026-09-03 - 2026-09-09期间下载量仅有 580 次
  • 【高危】 使用了危险的全局变量:
- 访问 chrome (访问chrome扩展API): 访问chrome扩展API

@rabby-wallet/rabby-bridge @ 0.0.10

  • 【低危】 使用了最新或最近发布的版本:
@rabby-wallet/rabby-bridge 使用了最新版本: 0.0.10, 且该版本为30天内发布
  • 【中危】 使用了不常用的NPM包:
@rabby-wallet/rabby-bridge在2026-09-03 - 2026-09-09期间下载量仅有 108 次

@cs1707
cs1707 merged commit 110387a into develop Sep 11, 2026
3 of 5 checks passed
@cs1707
cs1707 deleted the fix/bridge-quote-fetch branch September 11, 2026 03:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants