This release includes 2 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summarySeparates read and write RPC endpoints for Polymarket transactions, fixing a hazardous shared list.
Full changelog
-
fix(polymarket)— reads and writes no longer share one RPC list. There was
a singlePOLYGON_RPC_URLS, and entry 0 doubled as the sole un-fallbacked
transport for every SIGNING wallet client (withdraw, redeem, relayer, setup).
So reordering what read like a read-only fallback list silently changed which
endpoint broadcasts every money transaction — a write-path change disguised as
a comment tweak, and one nobody would review as such. 0.32.4 documented the
hazard; this fixes it.POLYGON_READ_RPC_URLSkeeps itsfallback()chain;
POLYGON_WRITE_RPC_URLis a single endpoint, overridable with
POLYMARKET_WRITE_RPC_URL.The write default is publicnode, not 1rpc — 1rpc answers once and then
returns-32001 "usage limit"(measured 2026-07-21), which is the last thing
you want broadcasting a withdrawal. And the write side is deliberately a single
endpoint rather than a fallback chain: viem'sfallback()would re-send a
signed transaction to the next provider on a timeout, and a transaction the
first provider actually mined must not be broadcast twice. Failing loudly on
one endpoint is correct; silently retrying a money movement is not.Credit to @KillerQueen-Z, who proposed splitting these in #66.
-
211 tests, typecheck, build and
verify:prices(28/28) green.
Breaking Changes
- Removed shared `POLYGON_RPC_URLS` for reads and writes; introduced distinct `POLYGON_READ_RPC_URLS` (fallback chain) and single `POLYGON_WRITE_RPC_URL` (default publicnode).
- Renamed/config split: `POLYGON_RPC_URLS` → `POLYGON_READ_RPC_URLS` + `POLYGON_WRITE_RPC_URL`; override via `POLYMARKET_WRITE_RPC_URL`.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About blockrunai/blockrun-mcp
Live data for AI agents — search, research, markets, crypto, X/Twitter. Pay-per-call via x402 micropayments.
Related context
Beta — feedback welcome: [email protected]