Skip to content

v3.3.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Oct 01:43
· 16 commits to master since this release
v3.3.0
dc3c13f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

📖 Overview

Protocol TVL no longer downloads a protocol's entire history to report its current value. CryptoCoin::tvl reads DefiLlama's shared protocol list instead of the per-protocol payload (10.8 MB for Aave), so it stops running into the 45-second timeout, and grouped protocols such as Aave or Spark are summed from their sub-protocols the way DefiLlama itself reports them. Market-calendar earnings entries carry the rest of what Nasdaq publishes: company name, estimate count, EPS surprise, last year's EPS and report date, and market cap. rustls and zip move past seven RUSTSEC advisories.

⬆️ Upgrade notes

  • CalendarDetail::Earnings gains six fields and is now #[non_exhaustive]. A pattern that names every field without .., or code that builds the variant directly, stops compiling. Add .. to the pattern.
  • Negative EPS figures from the Nasdaq earnings calendar now come back negative. Accounting-style ($0.12) used to parse as +0.12.
  • CryptoCoin::tvl figures for grouped protocols change. A group leaves out the share a sub-protocol excludes from its parent (Spark reads 6.85B, matching DefiLlama, instead of 9.50B), and its 1-day and 7-day change only compares sub-protocols that report both values.

✨ Features

  • Carry full earnings data in the market calendar (#546)

🐛 Fixes

  • Serve protocol TVL from DefiLlama's lite list (#552)

📦 Dependencies

  • Bump the all-dependencies group across 1 directory with 6 updates (#547)
  • Bump virtualenv from 20.36.1 to 21.7.13 in /v1 in the uv group across 1 directory (#543)
  • Bump debian from 3783cc0 to 7c7b2c9 in /server (#549)
  • Bump debian from 3783cc0 to 7c7b2c9 in /finance-query-mcp (#548)

🔧 Internal

  • Run CI and security checks on Dependabot PRs (#550)

🔒 Security

  • Bumped rustls 0.23.45 → 0.23.46 (RUSTSEC-2026-0346: Debug output of client session values exposed TLS secrets; RUSTSEC-2026-0347: buffered application data sent to the outer server after ECH rejection; RUSTSEC-2026-0348: Brotli certificate decompression could allocate 1 GiB before authentication; RUSTSEC-2026-0349: an unauthenticated ServerHello could downgrade later connections to classical key exchange) (#553). rustls reaches the library through reqwest and tokio-tungstenite, so every HTTP and streaming connection uses it.
  • Bumped the optional zip dependency 2.4.2 → 9.0.5 (RUSTSEC-2026-0367, RUSTSEC-2026-0368, RUSTSEC-2026-0369: ZipArchive::extract preserved SUID/SGID bits and created or followed symlinks outside the destination) (#553). The library only reads archive entries and never calls extract, so it was not exposed; the bump clears the advisories for secftd, housetrades and translation-offline builds.

🔍 API surface

CHANGED  finance_query::CalendarDetail (signature)
CHANGED  finance_query::models::calendar::market::CalendarDetail (signature)
Assets 2
Loading