kenneth/Auto-Trader
1
0 Fork 0
Code Issues Pull Requests Actions 16 Packages Projects Releases Wiki Activity
2,790 Commits 1 Branch 13 Tags
3c00cc490813a6d0829759b6934d852acaffb353
Commit Graph
4 Commits
Author SHA1 Message Date
dependabot[bot] 3c00cc4908 build(deps): bump the pip-minor-patch group across 1 directory with 47 updates 
Bumps the pip-minor-patch group with 47 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [langchain](https://github.com/langchain-ai/langchain) | `1.3.18` | `1.4.3` |
| [langchain-core](https://github.com/langchain-ai/langchain) | `1.6.1` | `1.6.6` |
| [langchain-openai](https://github.com/langchain-ai/langchain) | `1.6.0` | `1.6.7` |
| [langgraph](https://github.com/langchain-ai/langgraph) | `1.2.11` | `1.2.12` |
| [duckdb](https://github.com/duckdb/duckdb-python) | `1.5.5` | `1.5.6` |
| [scikit-learn](https://github.com/scikit-learn/scikit-learn) | `1.9.0` | `1.9.1` |
| [joblib](https://github.com/joblib/joblib) | `1.5.3` | `1.6.0` |
| [akshare](https://github.com/akfamily/akshare) | `1.18.94` | `1.19.1` |
| [ccxt](https://github.com/ccxt/ccxt) | `4.5.76` | `4.5.84` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.1` | `50.0.2` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.141.1` | `0.142.2` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.4` | `0.54.0` |
| [sse-starlette](https://github.com/sysid/sse-starlette) | `3.4.8` | `3.5.0` |
| [matplotlib](https://github.com/matplotlib/matplotlib) | `3.11.1` | `3.11.2` |
| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.13.0` | `2.15.1` |
| [baostock](http://www.baostock.com) | `0.9.3` | `0.9.4` |
| [anyio](https://github.com/agronholm/anyio) | `4.14.2` | `4.15.1` |
| [authlib](https://github.com/authlib/authlib) | `1.7.2` | `1.8.0` |
| [cachetools](https://github.com/tkem/cachetools) | `7.1.7` | `7.2.0` |
| [caio](https://github.com/mosquito/caio) | `0.12.2` | `0.12.9` |
| [cssselect2](https://github.com/Kozea/cssselect2) | `0.9.0` | `0.10.1` |
| [curl-cffi](https://github.com/lexiforest/curl_cffi) | `0.16.2` | `0.16.3` |
| [fonttools](https://github.com/fonttools/fonttools) | `4.63.0` | `4.66.1` |
| griffelib | `2.2.0` | `2.3.0` |
| [jiter](https://github.com/pydantic/jiter) | `0.16.0` | `0.17.0` |
| [langgraph-sdk](https://github.com/langchain-ai/langgraph) | `0.4.4` | `0.4.5` |
| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.11.2` | `0.14.2` |
| [lxml](https://github.com/lxml/lxml) | `6.1.2` | `6.1.3` |
| [narwhals](https://github.com/narwhals-dev/narwhals) | `2.25.0` | `2.26.0` |
| [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) | `1.44.0` | `1.45.0` |
| [peewee](https://github.com/coleifer/peewee) | `4.4.0` | `4.5.2` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.5` | `4.12.2` |
| [protobuf](https://developers.google.com/protocol-buffers/) | `7.36.0` | `7.36.2` |
| py-key-value-aio | `0.4.5` | `0.4.6` |
| [pyparsing](https://github.com/pyparsing/pyparsing) | `3.3.2` | `3.3.3` |
| [pytz](https://github.com/stub42/pytz) | `2026.3.post1` | `2026.4` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.7.19` | `2026.9.29` |
| [rich-rst](https://github.com/wasi-master/rich-rst) | `2.1.0` | `2.2.0` |
| [soupsieve](https://github.com/facelessuser/soupsieve) | `2.9.2` | `2.10` |
| [starlette](https://github.com/Kludex/starlette) | `1.6.0` | `1.7.0` |
| [threadpoolctl](https://github.com/joblib/threadpoolctl) | `3.6.0` | `3.7.0` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.70.0` | `4.70.1` |
| [tzdata](https://github.com/python/tzdata) | `2026.3` | `2026.4` |
| [watchfiles](https://github.com/samuelcolvin/watchfiles) | `1.2.0` | `1.3.0` |
| [wcwidth](https://github.com/jquast/wcwidth) | `0.8.3` | `0.9.1` |
| [websocket-client](https://github.com/websocket-client/websocket-client) | `1.9.1` | `1.9.2` |
| [yarl](https://github.com/aio-libs/yarl) | `1.24.5` | `1.25.1` |



Updates `langchain` from 1.3.18 to 1.4.3
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain==1.3.18...langchain==1.4.3)

Updates `langchain-core` from 1.6.1 to 1.6.6
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-core==1.6.1...langchain-core==1.6.6)

Updates `langchain-openai` from 1.6.0 to 1.6.7
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-openai==1.6.0...langchain-openai==1.6.7)

Updates `langgraph` from 1.2.11 to 1.2.12
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](https://github.com/langchain-ai/langgraph/compare/1.2.11...1.2.12)

Updates `duckdb` from 1.5.5 to 1.5.6
- [Release notes](https://github.com/duckdb/duckdb-python/releases)
- [Commits](https://github.com/duckdb/duckdb-python/compare/v1.5.5...v1.5.6)

Updates `scikit-learn` from 1.9.0 to 1.9.1
- [Release notes](https://github.com/scikit-learn/scikit-learn/releases)
- [Commits](https://github.com/scikit-learn/scikit-learn/compare/1.9.0...1.9.1)

Updates `joblib` from 1.5.3 to 1.6.0
- [Release notes](https://github.com/joblib/joblib/releases)
- [Changelog](https://github.com/joblib/joblib/blob/main/CHANGES.rst)
- [Commits](https://github.com/joblib/joblib/compare/1.5.3...1.6.0)

Updates `akshare` from 1.18.94 to 1.19.1
- [Release notes](https://github.com/akfamily/akshare/releases)
- [Changelog](https://github.com/akfamily/akshare/blob/main/docs/changelog.md)
- [Commits](https://github.com/akfamily/akshare/compare/release-v1.18.94...release-v1.19.1)

Updates `ccxt` from 4.5.76 to 4.5.84
- [Release notes](https://github.com/ccxt/ccxt/releases)
- [Commits](https://github.com/ccxt/ccxt/compare/v4.5.76...v4.5.84)

Updates `cryptography` from 50.0.1 to 50.0.2
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/50.0.1...50.0.2)

Updates `fastapi` from 0.141.1 to 0.142.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](https://github.com/fastapi/fastapi/compare/0.141.1...0.142.2)

Updates `uvicorn` from 0.52.4 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/uvicorn/compare/0.52.4...0.54.0)

Updates `sse-starlette` from 3.4.8 to 3.5.0
- [Release notes](https://github.com/sysid/sse-starlette/releases)
- [Commits](https://github.com/sysid/sse-starlette/compare/v3.4.8...v3.5.0)

Updates `matplotlib` from 3.11.1 to 3.11.2
- [Release notes](https://github.com/matplotlib/matplotlib/releases)
- [Commits](https://github.com/matplotlib/matplotlib/compare/v3.11.1...v3.11.2)

Updates `pyjwt` from 2.13.0 to 2.15.1
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/jpadilla/pyjwt/compare/2.13.0...2.15.1)

Updates `baostock` from 0.9.3 to 0.9.4

Updates `anyio` from 4.14.2 to 4.15.1
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](https://github.com/agronholm/anyio/compare/4.14.2...4.15.1)

Updates `authlib` from 1.7.2 to 1.8.0
- [Release notes](https://github.com/authlib/authlib/releases)
- [Commits](https://github.com/authlib/authlib/compare/v1.7.2...v1.8.0)

Updates `cachetools` from 7.1.7 to 7.2.0
- [Changelog](https://github.com/tkem/cachetools/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/tkem/cachetools/compare/v7.1.7...v7.2.0)

Updates `caio` from 0.12.2 to 0.12.9
- [Release notes](https://github.com/mosquito/caio/releases)
- [Commits](https://github.com/mosquito/caio/compare/0.12.2...0.12.9)

Updates `cssselect2` from 0.9.0 to 0.10.1
- [Release notes](https://github.com/Kozea/cssselect2/releases)
- [Changelog](https://github.com/Kozea/cssselect2/blob/main/docs/changelog.rst)
- [Commits](https://github.com/Kozea/cssselect2/compare/0.9.0...0.10.1)

Updates `curl-cffi` from 0.16.2 to 0.16.3
- [Release notes](https://github.com/lexiforest/curl_cffi/releases)
- [Changelog](https://github.com/lexiforest/curl_cffi/blob/main/docs/changelog.rst)
- [Commits](https://github.com/lexiforest/curl_cffi/compare/v0.16.2...v0.16.3)

Updates `fonttools` from 4.63.0 to 4.66.1
- [Release notes](https://github.com/fonttools/fonttools/releases)
- [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst)
- [Commits](https://github.com/fonttools/fonttools/compare/4.63.0...4.66.1)

Updates `griffelib` from 2.2.0 to 2.3.0

Updates `jiter` from 0.16.0 to 0.17.0
- [Release notes](https://github.com/pydantic/jiter/releases)
- [Commits](https://github.com/pydantic/jiter/compare/v0.16.0...v0.17.0)

Updates `langgraph-sdk` from 0.4.4 to 0.4.5
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](https://github.com/langchain-ai/langgraph/compare/0.4.4...0.4.5)

Updates `langsmith` from 0.11.2 to 0.14.2
- [Release notes](https://github.com/langchain-ai/langsmith-sdk/releases)
- [Commits](https://github.com/langchain-ai/langsmith-sdk/compare/v0.11.2...v0.14.2)

Updates `lxml` from 6.1.2 to 6.1.3
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](https://github.com/lxml/lxml/compare/lxml-6.1.2...lxml-6.1.3)

Updates `narwhals` from 2.25.0 to 2.26.0
- [Release notes](https://github.com/narwhals-dev/narwhals/releases)
- [Commits](https://github.com/narwhals-dev/narwhals/compare/v2.25.0...v2.26.0)

Updates `opentelemetry-api` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python/compare/v1.44.0...v1.45.0)

Updates `peewee` from 4.4.0 to 4.5.2
- [Release notes](https://github.com/coleifer/peewee/releases)
- [Changelog](https://github.com/coleifer/peewee/blob/master/CHANGELOG.md)
- [Commits](https://github.com/coleifer/peewee/compare/4.4.0...4.5.2)

Updates `platformdirs` from 4.11.5 to 4.12.2
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](https://github.com/tox-dev/platformdirs/compare/4.11.5...4.12.2)

Updates `protobuf` from 7.36.0 to 7.36.2

Updates `py-key-value-aio` from 0.4.5 to 0.4.6

Updates `pyparsing` from 3.3.2 to 3.3.3
- [Release notes](https://github.com/pyparsing/pyparsing/releases)
- [Changelog](https://github.com/pyparsing/pyparsing/blob/master/CHANGES)
- [Commits](https://github.com/pyparsing/pyparsing/compare/3.3.2...3.3.3)

Updates `pytz` from 2026.3.post1 to 2026.4
- [Release notes](https://github.com/stub42/pytz/releases)
- [Commits](https://github.com/stub42/pytz/compare/release_2026.3.post1...release_2026.4)

Updates `regex` from 2026.7.19 to 2026.9.29
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](https://github.com/mrabarnett/mrab-regex/compare/2026.7.19...2026.9.29)

Updates `rich-rst` from 2.1.0 to 2.2.0
- [Release notes](https://github.com/wasi-master/rich-rst/releases)
- [Changelog](https://github.com/wasi-master/rich-rst/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wasi-master/rich-rst/compare/v2.1.0...v2.2.0)

Updates `soupsieve` from 2.9.2 to 2.10
- [Release notes](https://github.com/facelessuser/soupsieve/releases)
- [Commits](https://github.com/facelessuser/soupsieve/compare/2.9.2...2.10)

Updates `starlette` from 1.6.0 to 1.7.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/1.6.0...1.7.0)

Updates `threadpoolctl` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/joblib/threadpoolctl/releases)
- [Changelog](https://github.com/joblib/threadpoolctl/blob/master/CHANGES.md)
- [Commits](https://github.com/joblib/threadpoolctl/compare/3.6.0...3.7.0)

Updates `tqdm` from 4.70.0 to 4.70.1
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](https://github.com/tqdm/tqdm/compare/v4.70.0...v4.70.1)

Updates `tzdata` from 2026.3 to 2026.4
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](https://github.com/python/tzdata/compare/2026.3...2026.4)

Updates `watchfiles` from 1.2.0 to 1.3.0
- [Release notes](https://github.com/samuelcolvin/watchfiles/releases)
- [Commits](https://github.com/samuelcolvin/watchfiles/compare/v1.2.0...v1.3.0)

Updates `wcwidth` from 0.8.3 to 0.9.1
- [Release notes](https://github.com/jquast/wcwidth/releases)
- [Changelog](https://github.com/jquast/wcwidth/blob/master/docs/history.rst)
- [Commits](https://github.com/jquast/wcwidth/compare/0.8.3...0.9.1)

Updates `websocket-client` from 1.9.1 to 1.9.2
- [Release notes](https://github.com/websocket-client/websocket-client/releases)
- [Changelog](https://github.com/websocket-client/websocket-client/blob/master/ChangeLog)
- [Commits](https://github.com/websocket-client/websocket-client/compare/v1.9.1...v1.9.2)

Updates `yarl` from 1.24.5 to 1.25.1
- [Release notes](https://github.com/aio-libs/yarl/releases)
- [Changelog](https://github.com/aio-libs/yarl/blob/master/CHANGES.rst)
- [Commits](https://github.com/aio-libs/yarl/compare/v1.24.5...v1.25.1)

---
updated-dependencies:
- dependency-name: langchain
  dependency-version: 1.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: langchain-core
  dependency-version: 1.6.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langchain-openai
  dependency-version: 1.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langgraph
  dependency-version: 1.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: duckdb
  dependency-version: 1.5.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: scikit-learn
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: joblib
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: akshare
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: ccxt
  dependency-version: 4.5.84
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: cryptography
  dependency-version: 50.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: fastapi
  dependency-version: 0.142.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: sse-starlette
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: matplotlib
  dependency-version: 3.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pyjwt
  dependency-version: 2.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: baostock
  dependency-version: 0.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: anyio
  dependency-version: 4.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: authlib
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: cachetools
  dependency-version: 7.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: caio
  dependency-version: 0.12.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: cssselect2
  dependency-version: 0.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: curl-cffi
  dependency-version: 0.16.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: fonttools
  dependency-version: 4.66.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: griffelib
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: jiter
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: langgraph-sdk
  dependency-version: 0.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langsmith
  dependency-version: 0.14.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: lxml
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: narwhals
  dependency-version: 2.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: opentelemetry-api
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: peewee
  dependency-version: 4.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: platformdirs
  dependency-version: 4.12.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: protobuf
  dependency-version: 7.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: py-key-value-aio
  dependency-version: 0.4.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pyparsing
  dependency-version: 3.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pytz
  dependency-version: '2026.4'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: regex
  dependency-version: 2026.9.29
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: rich-rst
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: soupsieve
  dependency-version: '2.10'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: starlette
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: threadpoolctl
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: tqdm
  dependency-version: 4.70.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: tzdata
  dependency-version: '2026.4'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: watchfiles
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: wcwidth
  dependency-version: 0.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: websocket-client
  dependency-version: 1.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: yarl
  dependency-version: 1.25.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-04 03:51:45 +00:00
dependabot[bot] 1c5648c77e build(deps): bump the pip-minor-patch group with 43 updates 
Bumps the pip-minor-patch group with 43 updates:

| Package | From | To |
| --- | --- | --- |
| [langchain](https://github.com/langchain-ai/langchain) | `1.3.14` | `1.3.18` |
| [langchain-core](https://github.com/langchain-ai/langchain) | `1.5.3` | `1.6.1` |
| [langchain-openai](https://github.com/langchain-ai/langchain) | `1.4.1` | `1.6.0` |
| [langgraph](https://github.com/langchain-ai/langgraph) | `1.2.10` | `1.2.11` |
| [langgraph-checkpoint](https://github.com/langchain-ai/langgraph) | `4.1.1` | `4.2.0` |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.3` |
| [pypdfium2](https://github.com/pypdfium2-team/pypdfium2) | `5.12.1` | `5.13.0` |
| [yfinance](https://github.com/ranaroussi/yfinance) | `1.5.2` | `1.7.0` |
| [akshare](https://github.com/akfamily/akshare) | `1.18.82` | `1.18.94` |
| [ccxt](https://github.com/ccxt/ccxt) | `4.5.71` | `4.5.76` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.0` | `50.0.1` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.1` | `0.52.4` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` |
| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `3.4.6` | `3.4.7` |
| [ddgs](https://github.com/deedy5/ddgs) | `9.14.4` | `9.16.0` |
| [lark-oapi](https://github.com/larksuite/oapi-sdk-python) | `1.7.2` | `1.7.3` |
| [click](https://github.com/pallets/click) | `8.4.2` | `8.5.0` |
| [curl-cffi](https://github.com/lexiforest/curl_cffi) | `0.16.0` | `0.16.2` |
| [cyclopts](https://github.com/BrianPugh/cyclopts) | `4.22.5` | `4.23.3` |
| [fastmcp-slim](https://github.com/PrefectHQ/fastmcp) | `3.4.6` | `3.4.7` |
| griffelib | `2.1.0` | `2.2.0` |
| [joserfc](https://github.com/authlib/joserfc) | `1.7.4` | `1.7.5` |
| [kiwisolver](https://github.com/nucleic/kiwi) | `1.5.0` | `1.5.1` |
| [langchain-protocol](https://github.com/langchain-ai/agent-protocol) | `0.0.18` | `0.0.19` |
| [langgraph-sdk](https://github.com/langchain-ai/langgraph) | `0.4.2` | `0.4.4` |
| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.10.16` | `0.11.2` |
| [lxml](https://github.com/lxml/lxml) | `6.1.1` | `6.1.2` |
| [narwhals](https://github.com/narwhals-dev/narwhals) | `2.24.0` | `2.25.0` |
| [peewee](https://github.com/coleifer/peewee) | `4.3.0` | `4.4.0` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.0` | `4.11.5` |
| [protobuf](https://github.com/protocolbuffers/protobuf) | `7.35.1` | `7.36.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` |
| [pyphen](https://github.com/Kozea/Pyphen) | `0.17.2` | `0.18.1` |
| [simplejson](https://github.com/simplejson/simplejson) | `4.1.1` | `4.1.2` |
| [soupsieve](https://github.com/facelessuser/soupsieve) | `2.9.1` | `2.9.2` |
| [starlette](https://github.com/Kludex/starlette) | `1.4.1` | `1.6.0` |
| [tiktoken](https://github.com/openai/tiktoken) | `0.13.0` | `0.14.0` |
| [typing-inspection](https://github.com/pydantic/typing-inspection) | `0.4.2` | `0.4.4` |
| [uncalled-for](https://github.com/chrisguidry/uncalled-for) | `0.3.2` | `0.4.0` |
| [wcwidth](https://github.com/jquast/wcwidth) | `0.8.2` | `0.8.3` |
| [webencodings](https://github.com/CourtBouillon/webencodings) | `0.5.1` | `0.6.1` |
| [websocket-client](https://github.com/websocket-client/websocket-client) | `1.9.0` | `1.9.1` |


Updates `langchain` from 1.3.14 to 1.3.18
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain==1.3.14...langchain==1.3.18)

Updates `langchain-core` from 1.5.3 to 1.6.1
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-core==1.5.3...langchain-core==1.6.1)

Updates `langchain-openai` from 1.4.1 to 1.6.0
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-openai==1.4.1...langchain-openai==1.6.0)

Updates `langgraph` from 1.2.10 to 1.2.11
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](https://github.com/langchain-ai/langgraph/compare/1.2.10...1.2.11)

Updates `langgraph-checkpoint` from 4.1.1 to 4.2.0
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](https://github.com/langchain-ai/langgraph/compare/checkpoint==4.1.1...checkpoint==4.2.0)

Updates `python-dotenv` from 1.2.2 to 1.2.3
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](https://github.com/theskumar/python-dotenv/compare/v1.2.2...v1.2.3)

Updates `pypdfium2` from 5.12.1 to 5.13.0
- [Release notes](https://github.com/pypdfium2-team/pypdfium2/releases)
- [Commits](https://github.com/pypdfium2-team/pypdfium2/compare/5.12.1...5.13.0)

Updates `yfinance` from 1.5.2 to 1.7.0
- [Release notes](https://github.com/ranaroussi/yfinance/releases)
- [Changelog](https://github.com/ranaroussi/yfinance/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/ranaroussi/yfinance/compare/1.5.2...1.7.0)

Updates `akshare` from 1.18.82 to 1.18.94
- [Release notes](https://github.com/akfamily/akshare/releases)
- [Changelog](https://github.com/akfamily/akshare/blob/main/docs/changelog.md)
- [Commits](https://github.com/akfamily/akshare/compare/release-v1.18.82...release-v1.18.94)

Updates `ccxt` from 4.5.71 to 4.5.76
- [Release notes](https://github.com/ccxt/ccxt/releases)
- [Commits](https://github.com/ccxt/ccxt/compare/v4.5.71...v4.5.76)

Updates `cryptography` from 50.0.0 to 50.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/50.0.0...50.0.1)

Updates `uvicorn` from 0.52.1 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/uvicorn/compare/0.52.1...0.52.4)

Updates `pydantic` from 2.13.4 to 2.13.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md)
- [Commits](https://github.com/pydantic/pydantic/compare/v2.13.4...v2.13.5)

Updates `fastmcp` from 3.4.6 to 3.4.7
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](https://github.com/PrefectHQ/fastmcp/compare/v3.4.6...v3.4.7)

Updates `ddgs` from 9.14.4 to 9.16.0
- [Release notes](https://github.com/deedy5/ddgs/releases)
- [Commits](https://github.com/deedy5/ddgs/compare/v9.14.4...v9.16.0)

Updates `lark-oapi` from 1.7.2 to 1.7.3
- [Commits](https://github.com/larksuite/oapi-sdk-python/compare/v1.7.2...v1.7.3)

Updates `click` from 8.4.2 to 8.5.0
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](https://github.com/pallets/click/compare/8.4.2...8.5.0)

Updates `curl-cffi` from 0.16.0 to 0.16.2
- [Release notes](https://github.com/lexiforest/curl_cffi/releases)
- [Changelog](https://github.com/lexiforest/curl_cffi/blob/main/docs/changelog.rst)
- [Commits](https://github.com/lexiforest/curl_cffi/compare/v0.16.0...v0.16.2)

Updates `cyclopts` from 4.22.5 to 4.23.3
- [Release notes](https://github.com/BrianPugh/cyclopts/releases)
- [Commits](https://github.com/BrianPugh/cyclopts/compare/v4.22.5...v4.23.3)

Updates `fastmcp-slim` from 3.4.6 to 3.4.7
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](https://github.com/PrefectHQ/fastmcp/compare/v3.4.6...v3.4.7)

Updates `griffelib` from 2.1.0 to 2.2.0

Updates `joserfc` from 1.7.4 to 1.7.5
- [Release notes](https://github.com/authlib/joserfc/releases)
- [Changelog](https://github.com/authlib/joserfc/blob/main/docs/changelog.rst)
- [Commits](https://github.com/authlib/joserfc/compare/1.7.4...1.7.5)

Updates `kiwisolver` from 1.5.0 to 1.5.1
- [Release notes](https://github.com/nucleic/kiwi/releases)
- [Changelog](https://github.com/nucleic/kiwi/blob/main/releasenotes.rst)
- [Commits](https://github.com/nucleic/kiwi/compare/1.5.0...1.5.1)

Updates `langchain-protocol` from 0.0.18 to 0.0.19
- [Release notes](https://github.com/langchain-ai/agent-protocol/releases)
- [Commits](https://github.com/langchain-ai/agent-protocol/compare/langchain-protocol==0.0.18...langchain-protocol==0.0.19)

Updates `langgraph-sdk` from 0.4.2 to 0.4.4
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](https://github.com/langchain-ai/langgraph/compare/0.4.2...0.4.4)

Updates `langsmith` from 0.10.16 to 0.11.2
- [Release notes](https://github.com/langchain-ai/langsmith-sdk/releases)
- [Commits](https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.16...v0.11.2)

Updates `lxml` from 6.1.1 to 6.1.2
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](https://github.com/lxml/lxml/compare/lxml-6.1.1...lxml-6.1.2)

Updates `narwhals` from 2.24.0 to 2.25.0
- [Release notes](https://github.com/narwhals-dev/narwhals/releases)
- [Commits](https://github.com/narwhals-dev/narwhals/compare/v2.24.0...v2.25.0)

Updates `peewee` from 4.3.0 to 4.4.0
- [Release notes](https://github.com/coleifer/peewee/releases)
- [Changelog](https://github.com/coleifer/peewee/blob/master/CHANGELOG.md)
- [Commits](https://github.com/coleifer/peewee/compare/4.3.0...4.4.0)

Updates `platformdirs` from 4.11.0 to 4.11.5
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](https://github.com/tox-dev/platformdirs/compare/4.11.0...4.11.5)

Updates `protobuf` from 7.35.1 to 7.36.0
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](https://github.com/pydantic/pydantic-settings/compare/v2.14.2...v2.15.0)

Updates `pygments` from 2.20.0 to 2.21.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](https://github.com/pygments/pygments/compare/2.20.0...2.21.0)

Updates `pyphen` from 0.17.2 to 0.18.1
- [Release notes](https://github.com/Kozea/Pyphen/releases)
- [Changelog](https://github.com/Kozea/Pyphen/blob/main/docs/changelog.rst)
- [Commits](https://github.com/Kozea/Pyphen/compare/0.17.2...0.18.1)

Updates `simplejson` from 4.1.1 to 4.1.2
- [Release notes](https://github.com/simplejson/simplejson/releases)
- [Changelog](https://github.com/simplejson/simplejson/blob/main/CHANGES.txt)
- [Commits](https://github.com/simplejson/simplejson/compare/v4.1.1...v4.1.2)

Updates `soupsieve` from 2.9.1 to 2.9.2
- [Release notes](https://github.com/facelessuser/soupsieve/releases)
- [Commits](https://github.com/facelessuser/soupsieve/compare/2.9.1...2.9.2)

Updates `starlette` from 1.4.1 to 1.6.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/1.4.1...1.6.0)

Updates `tiktoken` from 0.13.0 to 0.14.0
- [Release notes](https://github.com/openai/tiktoken/releases)
- [Changelog](https://github.com/openai/tiktoken/blob/main/CHANGELOG.md)
- [Commits](https://github.com/openai/tiktoken/compare/0.13.0...0.14.0)

Updates `typing-inspection` from 0.4.2 to 0.4.4
- [Release notes](https://github.com/pydantic/typing-inspection/releases)
- [Changelog](https://github.com/pydantic/typing-inspection/blob/main/HISTORY.md)
- [Commits](https://github.com/pydantic/typing-inspection/compare/v0.4.2...v0.4.4)

Updates `uncalled-for` from 0.3.2 to 0.4.0
- [Release notes](https://github.com/chrisguidry/uncalled-for/releases)
- [Commits](https://github.com/chrisguidry/uncalled-for/compare/0.3.2...0.4.0)

Updates `wcwidth` from 0.8.2 to 0.8.3
- [Release notes](https://github.com/jquast/wcwidth/releases)
- [Commits](https://github.com/jquast/wcwidth/compare/0.8.2...0.8.3)

Updates `webencodings` from 0.5.1 to 0.6.1
- [Release notes](https://github.com/CourtBouillon/webencodings/releases)
- [Changelog](https://github.com/CourtBouillon/webencodings/blob/main/docs/changelog.rst)
- [Commits](https://github.com/CourtBouillon/webencodings/compare/v0.5.1...v0.6.1)

Updates `websocket-client` from 1.9.0 to 1.9.1
- [Release notes](https://github.com/websocket-client/websocket-client/releases)
- [Changelog](https://github.com/websocket-client/websocket-client/blob/master/ChangeLog)
- [Commits](https://github.com/websocket-client/websocket-client/compare/v1.9.0...v1.9.1)

---
updated-dependencies:
- dependency-name: langchain
  dependency-version: 1.3.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langchain-core
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: langchain-openai
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: langgraph
  dependency-version: 1.2.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langgraph-checkpoint
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: python-dotenv
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pypdfium2
  dependency-version: 5.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: yfinance
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: akshare
  dependency-version: 1.18.94
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: ccxt
  dependency-version: 4.5.76
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: uvicorn
  dependency-version: 0.52.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: fastmcp
  dependency-version: 3.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: ddgs
  dependency-version: 9.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: lark-oapi
  dependency-version: 1.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: click
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: curl-cffi
  dependency-version: 0.16.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: cyclopts
  dependency-version: 4.23.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: fastmcp-slim
  dependency-version: 3.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: griffelib
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: joserfc
  dependency-version: 1.7.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: kiwisolver
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langchain-protocol
  dependency-version: 0.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langgraph-sdk
  dependency-version: 0.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langsmith
  dependency-version: 0.11.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: lxml
  dependency-version: 6.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: narwhals
  dependency-version: 2.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: peewee
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: platformdirs
  dependency-version: 4.11.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: protobuf
  dependency-version: 7.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: pydantic-settings
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: pygments
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: pyphen
  dependency-version: 0.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: simplejson
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: soupsieve
  dependency-version: 2.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: starlette
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: tiktoken
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: typing-inspection
  dependency-version: 0.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: uncalled-for
  dependency-version: 0.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: wcwidth
  dependency-version: 0.8.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: webencodings
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: websocket-client
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-01 18:33:32 +00:00
Haozhe Wu 6d5fb6cdb2 fix(deps): make hash locks cross-platform 
Signed-off-by: Haozhe Wu <haozhe_wu@connect.hku.hk>
 2026-08-15 04:02:24 +08:00
Haozhe Wu adaeeb5629 fix(docker): pin the build workflow and keep the image on hash-locked dependencies 
Four issues in the new workflow and Dockerfile:

- Every action floated on a mutable major tag, and BuildKit was pinned to
  moby/buildkit:master. This was the only workflow in the repo doing so; the
  other four already pin full commit SHAs. All seven actions are now SHA-pinned
  with a version comment, and the custom driver-opts block is dropped, which
  also removes an unneeded network=host.
- id-token: write was granted with no OIDC consumer anywhere in the workflow —
  no cosign, attestation, provenance, or OIDC login step. Dropped.
- The Dockerfile installed channel extras with 'pip install -e ".[extras]"'
  after the --require-hashes lock install. lark-oapi, qrcode and
  python-telegram-bot are in neither requirements-lock.txt nor its source, so
  the build resolved them and their transitive deps unhashed from PyPI at build
  time — six lines below a comment stating deps come from the hash-pinned lock.
  They now come from requirements-channels-lock.txt (16 pins, all hashed,
  generated under the same constraint as the main lock: 12 packages are shared
  with it and none diverge in version). The project install is --no-deps, which
  is safe because all 44 pyproject base deps are already in the main lock.
- The workflow_dispatch input was interpolated directly into the Summary step's
  run: body. It now passes through env, and the tag is validated against the
  Docker tag grammar before any registry work.

CI verifies the new lock too. The existing 'Verify hash-locked dependencies'
step only dry-ran requirements-lock.txt, so a second lock could have rotted
undetected until a release build failed; both are now dry-run separately, since
the Docker build installs them as two independent --require-hashes passes.

The summary also states that a new GHCR package is private until its visibility
is set once, so the pull command it prints is not read as working out of the box.
 2026-08-13 15:37:38 +08:00