chore: upgrade cow-sdk 7.3.4 -> 9.2.7 - #3101
Conversation
Two major versions. Adapts the four breaking changes that affect us:
- SupportedChainId dropped LENS (v8) and added SOLANA (v9). Removes the
Lens entries and adds Solana to the exhaustive chain records in
cow.constants.ts. Solana is not in CoWProtocolSupportedNetworks, so the
dead Lens safe-check entry goes with it.
- sdk-flash-loans v3 replaced CollateralSwapOrder's {sellAmount, buyAmount}
with a single flashLoanAmount; the buy side is now read off
orderToSign.buyAmount. Values are unchanged at all three call sites:
orderToSign.buyAmount already held the old buyAmount, and
flashLoanAmount = orderToSign.sellAmount + flashLoanFeeAmount resolves to
the old sellAmount.
- OrderParameters gained gasAmount/gasPrice/sellTokenPrice, which are
quote-response-only, so UnsignedOrder no longer satisfies it. The two
places that held an orderToSign are retyped to UnsignedOrder.
- cow-sdk PR #800 (in 7.3.5+) fixed the inverted beforeNetworkCosts /
afterNetworkCosts labels for SELL orders. Only the sellAmount fields
swapped; buyAmount kept its meaning. Both branches in getCowProtocolSellRates
now collapse to beforeNetworkCosts, which reproduces the previous displayed
amounts exactly for both SELL and BUY.
Pinned to 9.2.7 rather than 9.2.9: pnpm-workspace.yaml quarantines releases
younger than 7 days and 9.2.8/9.2.9 are still inside that window.
The v9.0.0 "bring cow.fi back" break is a revert of a v8.1.0 domain change we
never shipped, so it is a no-op here.
Mjolnir Security Review
18 PRs reviewed · 1 finding |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📦 Next.js Bundle Analysis for aave-uiThis analysis was generated by the Next.js Bundle Analysis action. 🤖 🎉 Global Bundle Size Decreased
DetailsThe global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster. Any third party scripts you have added directly to your app using the If you want further insight into what is behind the changes, give @next/bundle-analyzer a try! Four Pages Changed SizeThe following pages changed size from the code in this PR compared to its base branch:
DetailsOnly the gzipped size is provided here based on an expert tip. First Load is the size of the global bundle plus the bundle for the individual page. If a user were to show up to your website and land on a given page, the first load size represents the amount of javascript that user would need to download. If Any third party scripts you have added directly to your app using the Next to the size is how much the size has increased or decreased compared with the base branch of this PR. If this percentage has increased by 20% or more, there will be a red status indicator applied, indicating that special attention should be given to this. |
|
3 participants
Two major versions of
@cowprotocol/cow-sdk, plus the flash-loans and ethers-v5 adapter packages that move with it.@cowprotocol/cow-sdk@cowprotocol/sdk-flash-loans@cowprotocol/sdk-ethers-v5-adapter9.2.7 rather than the latest 9.2.9:
pnpm-workspace.yamlquarantines releases younger than 7 days and 9.2.8/9.2.9 are still inside that window. They become installable on Sep 14 if we want to bump again before merging.Breaking changes adapted
SupportedChainIddroppedLENS(v8) and addedSOLANA(v9). Removes the Lens entries and adds Solana to the four exhaustiveRecord<SupportedChainId, string>maps incow.constants.ts. Solana is not inCoWProtocolSupportedNetworks, so the Lens "safe check" entry inCOW_UNSUPPORTED_ASSETSwas already unreachable and goes with it.sdk-flash-loansv3 changedCollateralSwapOrderfrom{sellAmount, buyAmount}to a singleflashLoanAmount, reading the buy side offorderToSign.buyAmountinstead. Values are unchanged at all three call sites:orderToSign.buyAmountalready held the oldbuyAmount, andcalculateFlashLoanAmountsis untouched, soflashLoanAmount = orderToSign.sellAmount + flashLoanFeeAmountresolves to exactly the oldsellAmount.OrderParametersgainedgasAmount/gasPrice/sellTokenPrice, which are quote-response-only fields, soUnsignedOrderno longer satisfies it. The two places that hold anorderToSign(CowProtocolRatesType.order,CowProtocolActionParams.quote) are retyped toUnsignedOrder, which is what they actually hold.cow-sdk #800 (shipped in 7.3.5+) fixed the inverted
beforeNetworkCosts/afterNetworkCostslabels for SELL orders. Only thesellAmountfields swapped;buyAmountkept its meaning. Both branches ofgetCowProtocolSellRatesnow collapse tobeforeNetworkCosts, which reproduces the previously displayed amounts exactly for SELL and BUY alike.This closes #2886, which targeted the same #800 fix at 7.3.8. Note that #2886's buy-side change was wrong: it moved the destination amount to
afterNetworkCosts.buyAmount, which understates the displayed output by the network fee on SELL quotes. Running both SDK versions on identical inputs (S=0.99 WETH, B=3000 USDC, F=0.01 WETH):The v9.0.0 "bring cow.fi back" break is a revert of a v8.1.0 domain change we never shipped, so it is a no-op here. The
sdk-order-bookv4/solver_competitionv2 migration and theAppDataSdk.legacyremoval insdk-app-datav6 touch APIs we do not call.Verification
tsc --noEmitclean, eslint 0 errors, prettier clean. All 33 symbols imported from@cowprotocol/*confirmed to resolve at runtime in the new ESM builds. Runtime constants diffed old vs new: onlyBARN_ETH_FLOW_ADDRESSESmoved, which we do not read (see below).pnpm test:cifails the same way here as on a pristine--frozen-lockfiletree at 7.3.4 — same 4 suites, same 3 tests, a jest ESM transform issue unrelated to this change. CI does not run jest.CI is green: build,
next_js_analyze,deploy, i18n and the full cypress matrix all pass. (pnpm builddoes fail in my local worktree on@narval-xyz/connect->ox->@noble/curves, but that is an artifact of the worktree resolving a hoistednode_modulesoutside its own tree, not a repo problem — CI builds this branch fine.)Needs a human on preview
The swap paths need exercising against a live CoW backend, which I cannot do locally: a SELL quote (input amount and output amount should read the same as production), a BUY quote, and one flash-loan flow per adapter type (collateral swap, debt swap, repay with collateral) to confirm the
flashLoanAmountchange produces the same hooks.Follow-up, not in this PR
The SDK's
BARN_ETH_FLOW_ADDRESSES[1]moved from0x04501b9b...to0xb37aDD6A..., andcow.constants.tsstill hardcodes the old value asCOW_PROTOCOL_ETH_FLOW_ADDRESS_STAGING. It is unreachable today becauseCOW_ENVis a hardcoded'prod', and the prod address still matches the SDK. Worth a separate change pointing both constants at the SDK's exported address lists rather than hardcoding them.