Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ serde = { version = "1", features = ["derive"] }
tabled = "0.17"
rust_decimal = "1"
anyhow = "1"
reqwest = { version = "0.13", features = ["socks"] }
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cargo.lock missing tokio-socks breaks SOCKS5 proxy support

High Severity

The Cargo.toml adds reqwest with features = ["socks"], but the committed Cargo.lock does not contain tokio-socks anywhere — the required transitive dependency for SOCKS5 support. The reqwest 0.13.2 entry in the lockfile lists no socks-related dependencies. This means builds using cargo install --locked or CI with --locked will compile reqwest without actual SOCKS5 support, silently making the PR's core feature non-functional at runtime.

Additional Locations (1)

Fix in Cursor Fix in Web

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reqwest socks feature missing from direct dependency

High Severity

The reqwest dependency is added with the socks feature, but this is a separate reqwest 0.13 crate from the one used by alloy (which depends on reqwest 0.12). Cargo feature unification only works within the same version of a crate. Since alloy-transport-http and alloy-provider depend on reqwest 0.12, the socks feature enabled on reqwest 0.13 won't propagate to reqwest 0.12. The SOCKS5 proxy set via env vars (HTTPS_PROXY) will likely fail for alloy's HTTP transport because its reqwest 0.12 client wasn't compiled with socks support.

Fix in Cursor Fix in Web

chrono = "0.4"
dirs = "6"
rustyline = "15"
Expand All @@ -32,6 +33,9 @@ assert_cmd = "2"
predicates = "3"
rust_decimal_macros = "1"

[patch.crates-io]
polymarket-client-sdk = { path = "polymarket-client-sdk" }
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Vendored SDK as local path patch committed

High Severity

The [patch.crates-io] section overrides polymarket-client-sdk with a local path (polymarket-client-sdk), and the entire SDK source tree is vendored into the repository. This means the project no longer pulls the published crate from crates.io and instead depends on a local copy that could drift from upstream. This appears to be development scaffolding — the PR's stated goal is only to add proxy support, not to vendor the SDK. This will break builds for anyone who clones the repo without the vendored directory and complicates future SDK updates.

Fix in Cursor Fix in Web


[profile.release]
lto = "thin"
codegen-units = 1
Expand Down
3 changes: 3 additions & 0 deletions polymarket-client-sdk/.github/CODEOWNERS
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
# All PRs on any file must be reviewed by one of the following team members
# Wildcard (*) for all files
* @Polymarket/eng-platform
76 changes: 76 additions & 0 deletions polymarket-client-sdk/.github/CODE_OF_CONDUCT.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,76 @@
# Contributor Covenant Code of Conduct

## Our Pledge

In the interest of fostering an open and welcoming environment, we as
contributors and maintainers pledge to making participation in our project and
our community a harassment-free experience for everyone, regardless of age, body
size, disability, ethnicity, sex characteristics, gender identity and expression,
level of experience, education, socioeconomic status, nationality, personal
appearance, race, religion, or sexual identity and orientation.

## Our Standards

Examples of behavior that contributes to creating a positive environment
include:

- Using welcoming and inclusive language
- Being respectful of differing viewpoints and experiences
- Gracefully accepting constructive criticism
- Focusing on what is best for the community
- Showing empathy towards other community members

Examples of unacceptable behavior by participants include:

- The use of sexualized language or imagery and unwelcome sexual attention or
advances
- Trolling, insulting/derogatory comments, and personal or political attacks
- Public or private harassment
- Publishing others' private information, such as a physical or electronic
address, without explicit permission
- Other conduct which could reasonably be considered inappropriate in a
professional setting

## Our Responsibilities

Project maintainers are responsible for clarifying the standards of acceptable
behavior and are expected to take appropriate and fair corrective action in
response to any instances of unacceptable behavior.

Project maintainers have the right and responsibility to remove, edit, or
reject comments, commits, code, wiki edits, issues, and other contributions
that are not aligned to this Code of Conduct, or to ban temporarily or
permanently any contributor for other behaviors that they deem inappropriate,
threatening, offensive, or harmful.

## Scope

This Code of Conduct applies within all project spaces, and it also applies when
an individual is representing the project or its community in public spaces.
Examples of representing a project or community include using an official
project e-mail address, posting via an official social media account, or acting
as an appointed representative at an online or offline event. Representation of
a project may be further defined and clarified by project maintainers.

## Enforcement

Instances of abusive, harassing, or otherwise unacceptable behavior may be
reported by contacting the project team at [`engineering@polymarket.com`](mailto:engineering@polymarket.com). All
complaints will be reviewed and investigated and will result in a response that
is deemed necessary and appropriate to the circumstances. The project team is
obligated to maintain confidentiality with regard to the reporter of an incident.
Further details of specific enforcement policies may be posted separately.

Project maintainers who do not follow or enforce the Code of Conduct in good
faith may face temporary or permanent repercussions as determined by other
members of the project's leadership.

## Attribution

This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html

[homepage]: https://www.contributor-covenant.org

For answers to common questions about this code of conduct, see
https://www.contributor-covenant.org/faq
25 changes: 25 additions & 0 deletions polymarket-client-sdk/.github/CONTRIBUTING.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
# Contribution Guide

All contributions to the `rs-clob-client` are welcome and greatly appreciated! This document serves to outline the process
for contributions and help you get set up.

## Steps to get started

1. Fork `Polymarket/rs-clob-client`
1. Clone your fork
1. Install [pre-commit](https://pre-commit.com/#intro)
1. Open pull requests with the [wip](https://github.com/Polymarket/rs-clob-client/issues/labels?q=label%3Awip) label
against the `main` branch and include a description of the intended change in the PR description.

Before removing the `wip` label and submitting a PR for review, make sure that:

- It passes all checks, including lints and tests
- Your fork is up to date with `main`

## Branch structure & naming

Our main branch, `main`, represents the current development state of the codebase. All pull requests should be opened
against `main`.

Please follow the [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/) standard when
naming your PR.
17 changes: 17 additions & 0 deletions polymarket-client-sdk/.github/dependabot.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
version: 2
updates:
- package-ecosystem: "cargo"
directory: "/"
schedule:
interval: "weekly"
commit-message:
prefix: "chore(cargo)"
open-pull-requests-limit: 10

- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
commit-message:
prefix: "chore(gha)"
open-pull-requests-limit: 10
98 changes: 98 additions & 0 deletions polymarket-client-sdk/.github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,98 @@
name: CI

permissions:
contents: read

on:
push:
branches: [main]
pull_request:

jobs:
build-test:
runs-on: ${{ matrix.os }}-latest
strategy:
matrix:
os: [ macos, windows ]

steps:
- uses: actions/checkout@v6
- run: cargo build --all-targets --all-features
- run: cargo test

fmt-lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6

- name: Install stable Rust
uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561
with:
components: clippy
toolchain: '1.88'

- name: Install nightly Rust
uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561
with:
components: rustfmt
toolchain: 'nightly-2025-11-24'

- name: Rustfmt (nightly)
# Run nightly formatting to allow group imports
run: cargo +nightly-2025-11-24 fmt --all -- --check

- name: Clippy (All features)
run: cargo +1.88 clippy --all-targets --all-features -- -D warnings

- name: Clippy
run: cargo +1.88 clippy --all-targets -- -D warnings

cargo-sort:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v6

- name: Install cargo-sort
uses: baptiste0928/cargo-install@v3
with:
crate: 'cargo-sort'
version: 'v2.0.2'

- name: Check Cargo.toml sorting
run: cargo sort --check

test-coverage:
name: build-test (ubuntu) with coverage
runs-on: ubuntu-latest
permissions:
contents: read

steps:
- name: Checkout
uses: actions/checkout@v6

- name: Install stable Rust
uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561
with:
toolchain: '1.88'
components: llvm-tools-preview

- name: Install cargo-llvm-cov
uses: baptiste0928/cargo-install@v3
with:
crate: cargo-llvm-cov

- name: Test with coverage
run: |
cargo llvm-cov clean --workspace
cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info

- name: Upload coverage to Codecov
uses: codecov/codecov-action@v5
if: ${{ github.repository_owner == 'Polymarket' }}
with:
files: lcov.info
flags: rust
name: rust-llvm-cov
token: ${{ secrets.CODECOV_TOKEN }}
19 changes: 19 additions & 0 deletions polymarket-client-sdk/.github/workflows/conventional-title.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
name: PR Conventional Commit Validation

permissions:
contents: read

on:
pull_request:
types: [opened, synchronize, reopened, edited]

jobs:
validate-pr-title:
runs-on: ubuntu-latest
steps:
- name: PR Conventional Commit Validation
uses: ytanikin/pr-conventional-commits@1.5.1
with:
# https://www.conventionalcommits.org/en/v1.0.0/#specification
task_types: '["feat","fix","build","style","docs","test","ci","refactor","perf","chore","revert"]'
add_label: 'false'
32 changes: 32 additions & 0 deletions polymarket-client-sdk/.github/workflows/release-plz.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
name: Release-plz

permissions:
pull-requests: write
contents: write
id-token: write # Required for trusted publishing

on:
push:
branches:
- main

jobs:
release-plz:
name: Release-plz
runs-on: ubuntu-latest
if: ${{ github.repository_owner == 'Polymarket' }}
steps:
- name: Checkout repository
uses: actions/checkout@v6
with:
fetch-depth: 0

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561
with:
toolchain: '1.88'

- name: Run release-plz
uses: MarcoIeni/release-plz-action@e592230ad39e3ec735402572601fc621aa24355c # v0.5.124
env:
GITHUB_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
Loading