Skip to content

[FIX] Low severity - #28

Merged
neto737 merged 7 commits into
mainfrom
fix/low-severity
Oct 18, 2026
Merged

neto737 merged 7 commits into
mainfrom
fix/low-severity

Conversation

@neto737

@neto737 neto737 commented Oct 18, 2026

Copy link
Copy Markdown
Owner

No description provided.

ping() calls /api/v2/ping, which pings BitGo through Express, but its docblock
described /pingexpress, which checks Express alone without contacting BitGo.
ping() keeps its endpoint so existing callers are unaffected, its docblock now
says what it does, and the new pingExpress() calls /api/v2/pingexpress.
BitGoExpress::funoutWalletUnspents() was misspelled. fanoutWalletUnspents()
now does the work, and funoutWalletUnspents() stays as a @deprecated alias
that forwards its arguments unchanged.

Docblock fixes: "his SDK call", "pendingaapproval" (the webhook type is
pendingapproval), "transaaction", "the coin what you want", the copy-pasted
listKeychains() and listWalletWebhooks() descriptions, a stray tab, and three
"@return type" placeholders. The PHPStan baseline entries those caused are
gone.
addBlockWebhook(), listBlockWebhooks() and removeBlockWebhook() hit the same
/webhooks endpoint as addUserWebhook(), listUserWebhooks() and
removeUserWebhook(). The User names are kept: with simulateUserWebhook() they
form a complete set, and they send $type as given.

The Block names are now @deprecated aliases that forward to the User methods.
They still send any type other than 'block' or 'wallet_confirmation' as
'block', so existing callers see no change.
AddressType::P2SH_DEPOSIT is chain 10, which is SegWit wrapped in P2SH, while
plain P2SH is chain 0 (LEGACY_DEPOSIT). The new constants say what each chain
is: P2SH_P2WSH_* (10/11), P2WSH_* (20/21) and P2TR_* (30/31). P2SH_DEPOSIT and
P2SH_CHANGE are @deprecated with their values unchanged. BECH32_* and BECH32M_*
stay as aliases of P2WSH_* and P2TR_*.

The createWalletAddress() docblock said the chain defaulted to 0, but it has
defaulted to 10 since 2.2.0. The docblock now says so and points to chain 0
for coins without SegWit. The default is unchanged, now spelled
P2SH_P2WSH_DEPOSIT, and its $lowPriority and $gasPrice docs are in signature
order.
Adds Aptos, Arbitrum, Avalanche C-Chain and P-Chain (avaxc, avaxp), BNB Smart
Chain, Cardano, Cosmos, Dogecoin, NEAR, Optimism, Polkadot, Polygon, Solana,
Sui and TON with their testnets, plus the Bitcoin Gold testnet, Bitcoin
testnet4 and signet, and the Ethereum Hoodi (hteth) and Sepolia (sepeth)
testnets. Also adds USDT, USDC, DAI, LINK, WBTC, UNI and AAVE, and GLM,
REPv2 and KNC2, the tokens that replaced GNT, REP and KNC.

Nothing is removed. These are now @deprecated:
- AVAX and AVAX_TESTNET: 'avax' and 'tavax' are not BitGo coin codes.
- ETHEREUM_TESTNET: 'teth' is Kovan, which is retired.
- OMG, GNT, REP, KNC, QRL, PAY and BRD: tokens that migrated or wound down.

The ETH coin family now includes sepeth, and the BTC, UTXO and SegWit families
include tbtc4 and tbtcsig, so wallets on those testnets keep their
coin-specific params.
The src/ file headers still said GPL v3 and @Version 2.2. They now say MIT,
matching LICENSE and composer.json, and drop @Version so it can't go stale.
The policy-rule docblocks linked to the retired www.bitgo.com/api/v2 docs and
now link to developers.bitgo.com.

README: lists the requirements (PHP 7.4+ with cURL, an access token, and
Express for key operations), installs with a plain `composer require`, pins
^2.3 rather than "*", fixes the "Or if put" typo, links to the Express, API
reference, webhook and policy docs on developers.bitgo.com, replaces the
curl.haxx.se link with curl.se, and adds a License section.
setRequestIP() silently ignored an invalid IP and any IP on testnet. It now
returns true when the IP is applied and false otherwise, and a rejected IP
leaves any earlier one in place. The return type is declared in the docblock
only, so subclasses that override setRequestIP() keep working.
@neto737
neto737 merged commit 0041dcd into main Oct 18, 2026
23 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant