Generated SDK #2897331076 (major) - #211
sdk-generation-automation[bot] merged 1 commit into
Conversation
|
Thank you for raising this! We will review it shortly. (Note that this SDK code is auto generated) |
![semgrep-code-fireblocks[bot]](https://avatars.githubusercontent.com/u/40918269?s=60&v=4){kind=small}
| "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz", | ||
| "integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==", | ||
| "version": "2.0.55", | ||
| "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.55.tgz", |
There was a problem hiding this comment.
🟠 High severity issue identified in your code:
package-lock.json contains a reference to a public package registry or CDN (https://registry.npmjs.org/node-releases/-/node-releases-2.0.55.tgz). Dependencies must be resolved through the approved internal JFrog/Artifactory registry. Update your .npmrc to point at the approved registry, delete node_modules and package-lock.json, then re-run npm install and commit the regenerated lockfile.
To resolve this comment:
✨ Commit fix suggestion
-
Update the project’s
.npmrcto use the approved internal JFrog/Artifactory npm registry, for exampleregistry=https://<approved-internal-registry>/artifactory/api/npm/<repository>/. Use the exact registry URL provided by your organization. -
Remove the existing dependency installation and lockfile so npm does not retain public registry URLs:
$ rm -rf node_modules package-lock.json -
Regenerate the dependencies using the configured internal registry:
$ npm install -
Confirm the regenerated
package-lock.jsonuses the approved internal registry for everyresolvedURL, including thenode-releasespackage, and does not referenceregistry.npmjs.orgor another public registry. Regenerating the lockfile is required because manually changing a single URL can invalidate the dependency metadata or leave other public references unchanged.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by block-public-registry-refs-in-package-lock.
You can view more details about this finding in the Semgrep AppSec Platform.
| "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.420.tgz", | ||
| "integrity": "sha512-2yD6XreGusOfNV+dUcvipJEXc3n/n7fgr7996aszTG+YY5E4mqM4tOq/3uhP129cazL9YHbVWSpc79ePotWtPA==", | ||
| "version": "1.5.425", | ||
| "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.425.tgz", |
There was a problem hiding this comment.
🟠 High severity issue identified in your code:
package-lock.json contains a reference to a public package registry or CDN (https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.425.tgz). Dependencies must be resolved through the approved internal JFrog/Artifactory registry. Update your .npmrc to point at the approved registry, delete node_modules and package-lock.json, then re-run npm install and commit the regenerated lockfile.
To resolve this comment:
✨ Commit fix suggestion
| "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.425.tgz", | |
| "resolved": "https://<VERIFIED_VALUE_REQUIRED>/artifactory/api/npm/npm-virtual/electron-to-chromium/-/electron-to-chromium-1.5.425.tgz", |
View step-by-step instructions
-
Configure the project to use the approved internal Artifactory npm registry in
.npmrc. Replace the example URL with the registry URL provided by your organization:
registry=https://example.com/artifactory/api/npm/npm-virtual/ -
Authenticate to Artifactory using your organization’s approved method, such as
npm loginor environment-provided credentials. Do not store usernames, passwords, or tokens directly in.npmrcor source control. -
Remove the existing dependency installation and lockfile so npm does not retain public registry URLs:
$ rm -rf node_modules package-lock.json -
Regenerate the dependencies using the configured internal registry:
$ npm install -
Confirm the regenerated
package-lock.jsonresolves packages through the approved Artifactory host, includingelectron-to-chromium, rather thanregistry.npmjs.orgor another public registry.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by block-public-registry-refs-in-package-lock.
You can view more details about this finding in the Semgrep AppSec Platform.
| "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz", | ||
| "integrity": "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==", | ||
| "version": "4.28.9", | ||
| "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.9.tgz", |
There was a problem hiding this comment.
🟠 High severity issue identified in your code:
package-lock.json contains a reference to a public package registry or CDN (https://registry.npmjs.org/browserslist/-/browserslist-4.28.9.tgz). Dependencies must be resolved through the approved internal JFrog/Artifactory registry. Update your .npmrc to point at the approved registry, delete node_modules and package-lock.json, then re-run npm install and commit the regenerated lockfile.
To resolve this comment:
✨ Commit fix suggestion
| "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.9.tgz", | |
| "resolved": "https://<VERIFIED_VALUE_REQUIRED>/browserslist/-/browserslist-4.28.9.tgz", |
View step-by-step instructions
-
Update the project’s
.npmrcto use the approved internal Artifactory registry, replacing the example URL with the registry supplied by your organization:
registry=https://example.com/artifactory/api/npm/<approved-repository>/ -
Configure registry authentication through the environment or an approved secret store. Do not commit credentials or tokens in
.npmrc. -
Remove the existing dependency installation and lockfile:
$ rm -rf node_modules package-lock.json -
Regenerate the dependency tree through the internal registry:
$ npm install -
Confirm that
package-lock.jsoncontains internal Artifactory URLs for everyresolvedpackage entry, includingbrowserslist, rather thanregistry.npmjs.orgor another public registry. Do not manually edit individual URLs because the lockfile must be regenerated consistently.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by block-public-registry-refs-in-package-lock.
You can view more details about this finding in the Semgrep AppSec Platform.
| "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.20.tgz", | ||
| "integrity": "sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==", | ||
| "version": "2.11.21", | ||
| "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.21.tgz", |
There was a problem hiding this comment.
🟠 High severity issue identified in your code:
package-lock.json contains a reference to a public package registry or CDN (https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.21.tgz). Dependencies must be resolved through the approved internal JFrog/Artifactory registry. Update your .npmrc to point at the approved registry, delete node_modules and package-lock.json, then re-run npm install and commit the regenerated lockfile.
To resolve this comment:
✨ Commit fix suggestion
| "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.21.tgz", | |
| "resolved": "https://artifactory.example.com/artifactory/api/npm/<VERIFIED_VALUE_REQUIRED>/baseline-browser-mapping/-/baseline-browser-mapping-2.11.21.tgz", |
View step-by-step instructions
-
Update the project
.npmrcto use the approved internal Artifactory npm repository:
registry=https://artifactory.example.com/artifactory/api/npm/<approved-repository>/
Replace the placeholder with the exact registry URL provided by your organization. -
Configure Artifactory authentication using the project’s existing secure credential mechanism. Do not commit usernames, tokens, or passwords to
.npmrc,package.json, or the lockfile. -
Remove the dependencies and lockfile so npm resolves every package through the internal registry:
$ rm -rf node_modules package-lock.json -
Regenerate the lockfile with the internal registry:
$ npm install -
Confirm the regenerated
package-lock.jsoncontains internal Artifactory URLs for everyresolvedentry, includingbaseline-browser-mapping, and does not containregistry.npmjs.orgor another public registry URL.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by block-public-registry-refs-in-package-lock.
You can view more details about this finding in the Semgrep AppSec Platform.
Changelog
2026-09-30
Breaking Change
Lower limit on UTXOs per labelling request
Products: UTXO Management (Beta)
Scope: API + SDKs
What's new
The maximum number of UTXO identifiers accepted in a single labelling request has been reduced from 200 to 50.
Impact
Integrations submitting more than 50 identifiers in one request will need to split them into smaller batches.
Affected endpoints:
Stricter validation for UTXO transaction hashes
Products: UTXO Management (Beta)
Scope: API + SDKs
What's new
Transaction hashes used to identify UTXOs must now be lowercase hexadecimal and no longer than 64 characters; uppercase hashes are no longer matched.
Impact
Integrations sending uppercase or malformed transaction hashes will need to update their values to match this stricter format.
Affected endpoints:
Update required Canton onboarding parties
Products: Canton (Beta)
Scope: API + SDKs
What's new
Onboarding a Canton participant no longer requires a provider party id, and now requires an upgrader party id used for model upgrade authority.
Impact
Existing integrations must remove the provider party id and add the new upgrader party id when onboarding a Canton participant.
Affected endpoints:
Simplify allocation withdrawal request
Products: Canton (Beta)
Scope: API + SDKs
What's new
Withdrawing an allocation no longer requires specifying the vault account or asset, since these are derived automatically from the original transaction.
Impact
Existing integrations that send
vaultAccountIdorassetwhen withdrawing an allocation will need to remove those fields.Affected endpoints:
Rename Canton offer domain values
Products: Canton (Beta)
Scope: API + SDKs
What's new
The values identifying an offer's domain when responding to a Canton offer have changed from plural to singular form.
Impact
Existing integrations that reference the plural domain values will need to be updated to use the new singular values.
Affected endpoints:
Add structured time-in-force type field
Products: Trading (Beta)
Scope: API + SDKs
What's new
The time-in-force value for limit orders is now a structured object with a type field instead of a plain text value.
Impact
Existing integrations that use fill-or-kill time-in-force will need to update how they specify it.
Affected endpoints:
OAuth credentials reference an mTLS configuration
Products: Webhooks V2
Scope: API + SDKs
What's new
OAuth credentials now point at an mTLS configuration by
webhookMtlsId, the same field and the same resource webhooks use, instead of carrying their own certificate. One certificate signed fromGET /webhooks_settings/mtls_csrcan serve both the token endpoint and the receiver. Deleting an mTLS configuration is refused while OAuth credentials reference it as well as webhooks;forceDelete=truedetaches both and returnsdetachedWebhookOauthIdsalongsidedetachedWebhookIds.Impact
Customers configure and rotate the certificate for their token endpoint the same way as for delivery, and can share one configuration between them. Existing certificates on OAuth credentials are migrated to an mTLS configuration automatically.
Affected endpoints:
Manage mTLS client certificates as their own resource
Products: Webhooks V2
Scope: API + SDKs
What's new
The signed client certificate moves off the webhook and onto its own resource under
/webhooks_settings/mtls, with endpoints to upload, list, read, replace and delete one. Several webhooks can share a configuration, so replacing the certificate is a single call instead of one per webhook. A webhook now references it bywebhookMtlsId, alongsidewebhookOauthId. Deleting a configuration is refused with409 Conflictwhile any webhook still references it, unlessforceDelete=trueis passed, which detaches those webhooks and returns their ids.Impact
Customers rotating an mTLS certificate used by several webhooks do it once, and can see which webhooks a configuration is in use by before removing it. Existing callers that set or read the certificate on the webhook itself must move to the new field names.
Affected endpoints:
Change
travelRuleProvidersfrom fixed enum to stringProducts: Compliance
Scope: API + SDKs
What's new
Changes the travel rule provider field from a fixed enum to a plain string to support dynamic provider lists and match actual API wire format.
Impact
Customers using strict enum validation must update their code to handle any string value.
Affected endpoints:
Add required
proofOfOwnershipAvailablefield to legal entityProducts: Compliance
Scope: API + SDKs
What's new
Adds a required boolean field indicating whether Proof of Ownership creation is available for a given address, and updates example values for travel rule providers.
Impact
Customers must update their models to include this new required field in legal entity responses.
Affected endpoints:
Added
Detailed errors for failed UTXO labelling
Products: UTXO Management (Beta)
Scope: API + SDKs
What's new
When a UTXO labelling request can't be completed, the response now lists each identifier that blocked it along with the specific reason it failed.
Impact
Customers can identify exactly which identifiers failed and why, and resubmit the request with only the valid ones.
Affected endpoints:
Delete console users via API (beta)
Products: Console User
Scope: API + SDKs
What's new
Adds an endpoint to request deletion of a console user, which goes through the workspace's configured approval policy before the user is removed.
Impact
Customers can trigger console user deletion programmatically instead of using the console UI; this is a non-breaking addition and existing integrations continue to work.
Affected endpoints:
Add customer-initiated Canton call operation type
Products: Off exchanges, Transactions
Scope: API + SDKs
What's new
Transactions can now report a new operation type for customer-initiated Canton actions, such as withdrawing an allocation or responding to an offer.
Impact
Customers can distinguish customer-initiated Canton operations from other transaction types in the API.
Affected endpoints:
Add Canton transaction details to transactions
Products: Transactions
Scope: API + SDKs
What's new
Transactions that are part of a Canton flow now include a
cantonDetailsblock describing the offer, call, or settlement context.Impact
Customers can identify and inspect Canton-related transactions directly from the transaction response.
Affected endpoints:
Support allocation withdrawal via Canton calls
Products: Canton (Beta)
Scope: API + SDKs
What's new
The endpoint for submitting Canton operations now supports withdrawing an allocation, returning a real result instead of a not-implemented response.
Impact
Customers can now withdraw Canton allocations through the API; other unimplemented call types are unaffected.
Affected endpoints:
Add new trade execution failure reasons
Products: Trading (Beta)
Scope: API + SDKs
What's new
Adds additional failure reason codes covering credit limits, quote expiration, desk rejection, requoting, and fill-or-kill cancellations.
Impact
Customers get more specific information about why a trade execution failed.
Affected endpoints:
Add post-trade settlement type
Products: Trading (Beta)
Scope: API + SDKs
What's new
Adds a post-trade settlement option where settlement happens bilaterally between the provider and customer after execution, rather than on-platform.
Impact
Customers can select post-trade settlement for trades, in addition to the existing prefunded and DVP options.
Affected endpoints:
Add limit order execution type
Products: Trading (Beta)
Scope: API + SDKs
What's new
Adds support for placing and executing limit orders at a specified price, in addition to market and quote-based execution.
Impact
Customers can now execute trades using limit orders through the API.
Affected endpoints:
Add optional
baseAmountto rate requestsProducts: Trading (Beta)
Scope: API + SDKs
What's new
Rate requests now accept an optional
baseAmountfield that specifies the amount to convert from, allowing quotes to be priced for a specific conversion size.Impact
Customers can request amount-specific rate quotes, and because the field is optional, existing requests continue to return rates unchanged.
Affected endpoints:
Add Address Registry Proof of Ownership endpoints
Products: Compliance
Scope: API + SDKs
What's new
Adds endpoints to create and verify Proof of Ownership PDFs for blockchain addresses, enabling customers to prove address ownership for compliance purposes.
Impact
Customers can generate verifiable PDF proofs of address ownership to share with counterparties or banks.
Affected endpoints:
Add UTXO selection config endpoints (beta)
Products: UTXO Management (Beta)
Scope: API + SDKs
What's new
Adds beta endpoints to get and upsert workspace-level UTXO selection strategy configuration. Strategies include ASC, DESC, and ADAPTIVE.
Impact
Customers can configure and inspect UTXO selection strategies at the workspace level through the API.
Affected endpoints:
Changed
Connected Accounts exits beta
Products: Connected Accounts
Scope: API + SDKs
What's new
The connected accounts feature, including listing and adding connected accounts, is now generally available and no longer marked as beta.
Impact
Customers can rely on the connected accounts endpoints as stable, generally available functionality.
Affected endpoints:
Clarify quote expiration time semantics
Products: Trading (Beta)
Scope: API + SDKs
What's new
Clarifies that a quote's expiration time is provided directly by the liquidity provider and is not adjusted with any safety margin by the API.
Impact
Customers should apply their own safety margin when using quote expiration times, if one is needed.
Affected endpoints:
Standardize Address Registry error responses
Products: Compliance
Scope: API + SDKs
What's new
Updates error responses to use the standard error schema and adds 403/429 response documentation for rate limiting and blocked workspace scenarios.
Impact
Customers get consistent error handling and clearer error documentation across address registry endpoints.
Affected endpoints:
Fixed
Clarify Canton onboarding response guidance
Products: Canton (Beta)
Scope: API + SDKs
What's new
Documentation for accepting or rejecting Canton onboarding offers now correctly points to where the available response options and offer status can be found.
Impact
No behavior change; documentation is now accurate for integrations checking whether an offer can still be answered.
Affected endpoints:
Mark nullable fields in
TravelRuleVASPschemaProducts: Travel Rule
Scope: API + SDKs
What's new
Adds explicit
nullable: trueannotations to VASP fields that may return null, including address fields, travel rule protocol statuses, and optional metadata.Impact
Customers using strongly-typed SDK clients will have accurate nullability information for VASP response fields.
Affected endpoints:
Fix
TravelRuleIssuersrequired field listProducts: Travel Rule
Scope: API + SDKs
What's new
Removes
regulatoryAuthorities,logo, anddescriptionfrom the required fields list to accurately reflect that these fields may be absent in responses.Impact
Customers will no longer see validation errors for missing optional VASP issuer fields.
Affected endpoints: