kenneth/Auto-Trader
1
0 Fork 0
Code Issues Pull Requests Actions 16 Packages Projects Releases Wiki Activity
2,968 Commits 1 Branch 13 Tags
a580b26dfcdf8a8c55740604446b99d72f45e774
Commit Graph
32 Commits
Author SHA1 Message Date
Haozhe Wu a580b26dfc Merge PR #1692 into reviewed maintenance batch 2026-10-10 23:05:35 +08:00
Yufeng He 01d319bc59 build(deps): pin new transitive deps from the grouped bump 
joblib 1.6.0 pulls in cloudpickle>=3.0 and langsmith 0.14.2
switches from httpx to httpx2<3,>=2 (which itself needs
httpcore2==2.13.1 and truststore>=0.10). None of them were in
requirements-lock.txt, so the hash-locked install check fails
with "all requirements must have their versions pinned".
Pin all four with their PyPI artifact hashes; h11 0.16.0 is
already locked and satisfies httpcore2.

Signed-off-by: Yufeng He <40085740+he-yufeng@users.noreply.github.com>
 2026-10-06 21:38:03 +08:00
zeus229 79f2ceb1a5 feat(email): protect scheduled PDF reports with password 
Signed-off-by: zeus229 <69399886+zeus229@users.noreply.github.com>
 2026-10-06 04:47:18 +00:00
dependabot[bot] 3c00cc4908 build(deps): bump the pip-minor-patch group across 1 directory with 47 updates 
Bumps the pip-minor-patch group with 47 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [langchain](https://github.com/langchain-ai/langchain) | `1.3.18` | `1.4.3` |
| [langchain-core](https://github.com/langchain-ai/langchain) | `1.6.1` | `1.6.6` |
| [langchain-openai](https://github.com/langchain-ai/langchain) | `1.6.0` | `1.6.7` |
| [langgraph](https://github.com/langchain-ai/langgraph) | `1.2.11` | `1.2.12` |
| [duckdb](https://github.com/duckdb/duckdb-python) | `1.5.5` | `1.5.6` |
| [scikit-learn](https://github.com/scikit-learn/scikit-learn) | `1.9.0` | `1.9.1` |
| [joblib](https://github.com/joblib/joblib) | `1.5.3` | `1.6.0` |
| [akshare](https://github.com/akfamily/akshare) | `1.18.94` | `1.19.1` |
| [ccxt](https://github.com/ccxt/ccxt) | `4.5.76` | `4.5.84` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.1` | `50.0.2` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.141.1` | `0.142.2` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.4` | `0.54.0` |
| [sse-starlette](https://github.com/sysid/sse-starlette) | `3.4.8` | `3.5.0` |
| [matplotlib](https://github.com/matplotlib/matplotlib) | `3.11.1` | `3.11.2` |
| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.13.0` | `2.15.1` |
| [baostock](http://www.baostock.com) | `0.9.3` | `0.9.4` |
| [anyio](https://github.com/agronholm/anyio) | `4.14.2` | `4.15.1` |
| [authlib](https://github.com/authlib/authlib) | `1.7.2` | `1.8.0` |
| [cachetools](https://github.com/tkem/cachetools) | `7.1.7` | `7.2.0` |
| [caio](https://github.com/mosquito/caio) | `0.12.2` | `0.12.9` |
| [cssselect2](https://github.com/Kozea/cssselect2) | `0.9.0` | `0.10.1` |
| [curl-cffi](https://github.com/lexiforest/curl_cffi) | `0.16.2` | `0.16.3` |
| [fonttools](https://github.com/fonttools/fonttools) | `4.63.0` | `4.66.1` |
| griffelib | `2.2.0` | `2.3.0` |
| [jiter](https://github.com/pydantic/jiter) | `0.16.0` | `0.17.0` |
| [langgraph-sdk](https://github.com/langchain-ai/langgraph) | `0.4.4` | `0.4.5` |
| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.11.2` | `0.14.2` |
| [lxml](https://github.com/lxml/lxml) | `6.1.2` | `6.1.3` |
| [narwhals](https://github.com/narwhals-dev/narwhals) | `2.25.0` | `2.26.0` |
| [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) | `1.44.0` | `1.45.0` |
| [peewee](https://github.com/coleifer/peewee) | `4.4.0` | `4.5.2` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.5` | `4.12.2` |
| [protobuf](https://developers.google.com/protocol-buffers/) | `7.36.0` | `7.36.2` |
| py-key-value-aio | `0.4.5` | `0.4.6` |
| [pyparsing](https://github.com/pyparsing/pyparsing) | `3.3.2` | `3.3.3` |
| [pytz](https://github.com/stub42/pytz) | `2026.3.post1` | `2026.4` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.7.19` | `2026.9.29` |
| [rich-rst](https://github.com/wasi-master/rich-rst) | `2.1.0` | `2.2.0` |
| [soupsieve](https://github.com/facelessuser/soupsieve) | `2.9.2` | `2.10` |
| [starlette](https://github.com/Kludex/starlette) | `1.6.0` | `1.7.0` |
| [threadpoolctl](https://github.com/joblib/threadpoolctl) | `3.6.0` | `3.7.0` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.70.0` | `4.70.1` |
| [tzdata](https://github.com/python/tzdata) | `2026.3` | `2026.4` |
| [watchfiles](https://github.com/samuelcolvin/watchfiles) | `1.2.0` | `1.3.0` |
| [wcwidth](https://github.com/jquast/wcwidth) | `0.8.3` | `0.9.1` |
| [websocket-client](https://github.com/websocket-client/websocket-client) | `1.9.1` | `1.9.2` |
| [yarl](https://github.com/aio-libs/yarl) | `1.24.5` | `1.25.1` |



Updates `langchain` from 1.3.18 to 1.4.3
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain==1.3.18...langchain==1.4.3)

Updates `langchain-core` from 1.6.1 to 1.6.6
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-core==1.6.1...langchain-core==1.6.6)

Updates `langchain-openai` from 1.6.0 to 1.6.7
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-openai==1.6.0...langchain-openai==1.6.7)

Updates `langgraph` from 1.2.11 to 1.2.12
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](https://github.com/langchain-ai/langgraph/compare/1.2.11...1.2.12)

Updates `duckdb` from 1.5.5 to 1.5.6
- [Release notes](https://github.com/duckdb/duckdb-python/releases)
- [Commits](https://github.com/duckdb/duckdb-python/compare/v1.5.5...v1.5.6)

Updates `scikit-learn` from 1.9.0 to 1.9.1
- [Release notes](https://github.com/scikit-learn/scikit-learn/releases)
- [Commits](https://github.com/scikit-learn/scikit-learn/compare/1.9.0...1.9.1)

Updates `joblib` from 1.5.3 to 1.6.0
- [Release notes](https://github.com/joblib/joblib/releases)
- [Changelog](https://github.com/joblib/joblib/blob/main/CHANGES.rst)
- [Commits](https://github.com/joblib/joblib/compare/1.5.3...1.6.0)

Updates `akshare` from 1.18.94 to 1.19.1
- [Release notes](https://github.com/akfamily/akshare/releases)
- [Changelog](https://github.com/akfamily/akshare/blob/main/docs/changelog.md)
- [Commits](https://github.com/akfamily/akshare/compare/release-v1.18.94...release-v1.19.1)

Updates `ccxt` from 4.5.76 to 4.5.84
- [Release notes](https://github.com/ccxt/ccxt/releases)
- [Commits](https://github.com/ccxt/ccxt/compare/v4.5.76...v4.5.84)

Updates `cryptography` from 50.0.1 to 50.0.2
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/50.0.1...50.0.2)

Updates `fastapi` from 0.141.1 to 0.142.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](https://github.com/fastapi/fastapi/compare/0.141.1...0.142.2)

Updates `uvicorn` from 0.52.4 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/uvicorn/compare/0.52.4...0.54.0)

Updates `sse-starlette` from 3.4.8 to 3.5.0
- [Release notes](https://github.com/sysid/sse-starlette/releases)
- [Commits](https://github.com/sysid/sse-starlette/compare/v3.4.8...v3.5.0)

Updates `matplotlib` from 3.11.1 to 3.11.2
- [Release notes](https://github.com/matplotlib/matplotlib/releases)
- [Commits](https://github.com/matplotlib/matplotlib/compare/v3.11.1...v3.11.2)

Updates `pyjwt` from 2.13.0 to 2.15.1
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/jpadilla/pyjwt/compare/2.13.0...2.15.1)

Updates `baostock` from 0.9.3 to 0.9.4

Updates `anyio` from 4.14.2 to 4.15.1
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](https://github.com/agronholm/anyio/compare/4.14.2...4.15.1)

Updates `authlib` from 1.7.2 to 1.8.0
- [Release notes](https://github.com/authlib/authlib/releases)
- [Commits](https://github.com/authlib/authlib/compare/v1.7.2...v1.8.0)

Updates `cachetools` from 7.1.7 to 7.2.0
- [Changelog](https://github.com/tkem/cachetools/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/tkem/cachetools/compare/v7.1.7...v7.2.0)

Updates `caio` from 0.12.2 to 0.12.9
- [Release notes](https://github.com/mosquito/caio/releases)
- [Commits](https://github.com/mosquito/caio/compare/0.12.2...0.12.9)

Updates `cssselect2` from 0.9.0 to 0.10.1
- [Release notes](https://github.com/Kozea/cssselect2/releases)
- [Changelog](https://github.com/Kozea/cssselect2/blob/main/docs/changelog.rst)
- [Commits](https://github.com/Kozea/cssselect2/compare/0.9.0...0.10.1)

Updates `curl-cffi` from 0.16.2 to 0.16.3
- [Release notes](https://github.com/lexiforest/curl_cffi/releases)
- [Changelog](https://github.com/lexiforest/curl_cffi/blob/main/docs/changelog.rst)
- [Commits](https://github.com/lexiforest/curl_cffi/compare/v0.16.2...v0.16.3)

Updates `fonttools` from 4.63.0 to 4.66.1
- [Release notes](https://github.com/fonttools/fonttools/releases)
- [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst)
- [Commits](https://github.com/fonttools/fonttools/compare/4.63.0...4.66.1)

Updates `griffelib` from 2.2.0 to 2.3.0

Updates `jiter` from 0.16.0 to 0.17.0
- [Release notes](https://github.com/pydantic/jiter/releases)
- [Commits](https://github.com/pydantic/jiter/compare/v0.16.0...v0.17.0)

Updates `langgraph-sdk` from 0.4.4 to 0.4.5
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](https://github.com/langchain-ai/langgraph/compare/0.4.4...0.4.5)

Updates `langsmith` from 0.11.2 to 0.14.2
- [Release notes](https://github.com/langchain-ai/langsmith-sdk/releases)
- [Commits](https://github.com/langchain-ai/langsmith-sdk/compare/v0.11.2...v0.14.2)

Updates `lxml` from 6.1.2 to 6.1.3
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](https://github.com/lxml/lxml/compare/lxml-6.1.2...lxml-6.1.3)

Updates `narwhals` from 2.25.0 to 2.26.0
- [Release notes](https://github.com/narwhals-dev/narwhals/releases)
- [Commits](https://github.com/narwhals-dev/narwhals/compare/v2.25.0...v2.26.0)

Updates `opentelemetry-api` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python/compare/v1.44.0...v1.45.0)

Updates `peewee` from 4.4.0 to 4.5.2
- [Release notes](https://github.com/coleifer/peewee/releases)
- [Changelog](https://github.com/coleifer/peewee/blob/master/CHANGELOG.md)
- [Commits](https://github.com/coleifer/peewee/compare/4.4.0...4.5.2)

Updates `platformdirs` from 4.11.5 to 4.12.2
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](https://github.com/tox-dev/platformdirs/compare/4.11.5...4.12.2)

Updates `protobuf` from 7.36.0 to 7.36.2

Updates `py-key-value-aio` from 0.4.5 to 0.4.6

Updates `pyparsing` from 3.3.2 to 3.3.3
- [Release notes](https://github.com/pyparsing/pyparsing/releases)
- [Changelog](https://github.com/pyparsing/pyparsing/blob/master/CHANGES)
- [Commits](https://github.com/pyparsing/pyparsing/compare/3.3.2...3.3.3)

Updates `pytz` from 2026.3.post1 to 2026.4
- [Release notes](https://github.com/stub42/pytz/releases)
- [Commits](https://github.com/stub42/pytz/compare/release_2026.3.post1...release_2026.4)

Updates `regex` from 2026.7.19 to 2026.9.29
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](https://github.com/mrabarnett/mrab-regex/compare/2026.7.19...2026.9.29)

Updates `rich-rst` from 2.1.0 to 2.2.0
- [Release notes](https://github.com/wasi-master/rich-rst/releases)
- [Changelog](https://github.com/wasi-master/rich-rst/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wasi-master/rich-rst/compare/v2.1.0...v2.2.0)

Updates `soupsieve` from 2.9.2 to 2.10
- [Release notes](https://github.com/facelessuser/soupsieve/releases)
- [Commits](https://github.com/facelessuser/soupsieve/compare/2.9.2...2.10)

Updates `starlette` from 1.6.0 to 1.7.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/1.6.0...1.7.0)

Updates `threadpoolctl` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/joblib/threadpoolctl/releases)
- [Changelog](https://github.com/joblib/threadpoolctl/blob/master/CHANGES.md)
- [Commits](https://github.com/joblib/threadpoolctl/compare/3.6.0...3.7.0)

Updates `tqdm` from 4.70.0 to 4.70.1
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](https://github.com/tqdm/tqdm/compare/v4.70.0...v4.70.1)

Updates `tzdata` from 2026.3 to 2026.4
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](https://github.com/python/tzdata/compare/2026.3...2026.4)

Updates `watchfiles` from 1.2.0 to 1.3.0
- [Release notes](https://github.com/samuelcolvin/watchfiles/releases)
- [Commits](https://github.com/samuelcolvin/watchfiles/compare/v1.2.0...v1.3.0)

Updates `wcwidth` from 0.8.3 to 0.9.1
- [Release notes](https://github.com/jquast/wcwidth/releases)
- [Changelog](https://github.com/jquast/wcwidth/blob/master/docs/history.rst)
- [Commits](https://github.com/jquast/wcwidth/compare/0.8.3...0.9.1)

Updates `websocket-client` from 1.9.1 to 1.9.2
- [Release notes](https://github.com/websocket-client/websocket-client/releases)
- [Changelog](https://github.com/websocket-client/websocket-client/blob/master/ChangeLog)
- [Commits](https://github.com/websocket-client/websocket-client/compare/v1.9.1...v1.9.2)

Updates `yarl` from 1.24.5 to 1.25.1
- [Release notes](https://github.com/aio-libs/yarl/releases)
- [Changelog](https://github.com/aio-libs/yarl/blob/master/CHANGES.rst)
- [Commits](https://github.com/aio-libs/yarl/compare/v1.24.5...v1.25.1)

---
updated-dependencies:
- dependency-name: langchain
  dependency-version: 1.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: langchain-core
  dependency-version: 1.6.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langchain-openai
  dependency-version: 1.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langgraph
  dependency-version: 1.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: duckdb
  dependency-version: 1.5.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: scikit-learn
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: joblib
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: akshare
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: ccxt
  dependency-version: 4.5.84
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: cryptography
  dependency-version: 50.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: fastapi
  dependency-version: 0.142.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: sse-starlette
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: matplotlib
  dependency-version: 3.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pyjwt
  dependency-version: 2.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: baostock
  dependency-version: 0.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: anyio
  dependency-version: 4.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: authlib
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: cachetools
  dependency-version: 7.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: caio
  dependency-version: 0.12.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: cssselect2
  dependency-version: 0.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: curl-cffi
  dependency-version: 0.16.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: fonttools
  dependency-version: 4.66.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: griffelib
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: jiter
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: langgraph-sdk
  dependency-version: 0.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langsmith
  dependency-version: 0.14.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: lxml
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: narwhals
  dependency-version: 2.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: opentelemetry-api
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: peewee
  dependency-version: 4.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: platformdirs
  dependency-version: 4.12.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: protobuf
  dependency-version: 7.36.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: py-key-value-aio
  dependency-version: 0.4.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pyparsing
  dependency-version: 3.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pytz
  dependency-version: '2026.4'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: regex
  dependency-version: 2026.9.29
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: rich-rst
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: soupsieve
  dependency-version: '2.10'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: starlette
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: threadpoolctl
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: tqdm
  dependency-version: 4.70.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: tzdata
  dependency-version: '2026.4'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: watchfiles
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: wcwidth
  dependency-version: 0.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: websocket-client
  dependency-version: 1.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: yarl
  dependency-version: 1.25.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-04 03:51:45 +00:00
Haozhe Wu 2ce2165160 fix(pdf): render shaped Arabic reports without clipping across pages 
Signed-off-by: Haozhe Wu <haozhe_wu@connect.hku.hk>
 2026-10-04 03:09:56 +08:00
Haozhe Wu 65a758f7c1 Merge PR #1680: HTML and PDF scheduled email reports 2026-10-04 02:33:04 +08:00
Yufeng He 193349dae9 feat(shadow): render the report PDF via reportlab when weasyprint cannot run 
Refs #1677. The shadow report's PDF half depends on weasyprint's system
pango/cairo libraries, which pip cannot install; hosts without them
silently degraded to HTML-only output. Add a pure-Python fallback that
renders the same 8-section payload (plus charts) through reportlab
platypus, with CJK font registration from the local system list. Engine
order is weasyprint, then reportlab, then html-only; the weasyprint path
and its one-shot import probe are unchanged.

Signed-off-by: Yufeng He <40085740+he-yufeng@users.noreply.github.com>
 2026-10-03 13:31:08 +08:00
zeus229 b3b1da052f feat(email): add rich scheduled report delivery 
Signed-off-by: zeus229 <69399886+zeus229@users.noreply.github.com>
 2026-10-02 14:53:45 +00:00
Haozhe Wu b6ef866247 chore(deps): bump weasyprint to 70.0 and js-yaml to 4.3.2 in the lock files 
Dependabot #37 (js-yaml, high) and #38/#39 (weasyprint SSRF, medium).
weasyprint 70.0 declares exactly the same requirements as 69.0, so both
hash locks change by the pin and its two hashes only. Every js-yaml
dependent in the desktop lock asks for ^4.1.0, so 4.3.2 satisfies them
without touching package.json.
 2026-09-11 21:18:25 +08:00
Haozhe Wu f4a6b6e19e build(deps): bump pydantic-core to 2.46.5 to match pydantic 2.13.5 
The pip-minor-patch group bumped pydantic to 2.13.5 but left pydantic-core
pinned at 2.46.4, and pydantic 2.13.5 requires pydantic-core==2.46.5
exactly — the hash-lock job failed ResolutionImpossible on Linux and macOS.
Both lock files now dry-run clean with --require-hashes.
 2026-09-02 14:22:46 +08:00
dependabot[bot] 1c5648c77e build(deps): bump the pip-minor-patch group with 43 updates 
Bumps the pip-minor-patch group with 43 updates:

| Package | From | To |
| --- | --- | --- |
| [langchain](https://github.com/langchain-ai/langchain) | `1.3.14` | `1.3.18` |
| [langchain-core](https://github.com/langchain-ai/langchain) | `1.5.3` | `1.6.1` |
| [langchain-openai](https://github.com/langchain-ai/langchain) | `1.4.1` | `1.6.0` |
| [langgraph](https://github.com/langchain-ai/langgraph) | `1.2.10` | `1.2.11` |
| [langgraph-checkpoint](https://github.com/langchain-ai/langgraph) | `4.1.1` | `4.2.0` |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.3` |
| [pypdfium2](https://github.com/pypdfium2-team/pypdfium2) | `5.12.1` | `5.13.0` |
| [yfinance](https://github.com/ranaroussi/yfinance) | `1.5.2` | `1.7.0` |
| [akshare](https://github.com/akfamily/akshare) | `1.18.82` | `1.18.94` |
| [ccxt](https://github.com/ccxt/ccxt) | `4.5.71` | `4.5.76` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.0` | `50.0.1` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.1` | `0.52.4` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` |
| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `3.4.6` | `3.4.7` |
| [ddgs](https://github.com/deedy5/ddgs) | `9.14.4` | `9.16.0` |
| [lark-oapi](https://github.com/larksuite/oapi-sdk-python) | `1.7.2` | `1.7.3` |
| [click](https://github.com/pallets/click) | `8.4.2` | `8.5.0` |
| [curl-cffi](https://github.com/lexiforest/curl_cffi) | `0.16.0` | `0.16.2` |
| [cyclopts](https://github.com/BrianPugh/cyclopts) | `4.22.5` | `4.23.3` |
| [fastmcp-slim](https://github.com/PrefectHQ/fastmcp) | `3.4.6` | `3.4.7` |
| griffelib | `2.1.0` | `2.2.0` |
| [joserfc](https://github.com/authlib/joserfc) | `1.7.4` | `1.7.5` |
| [kiwisolver](https://github.com/nucleic/kiwi) | `1.5.0` | `1.5.1` |
| [langchain-protocol](https://github.com/langchain-ai/agent-protocol) | `0.0.18` | `0.0.19` |
| [langgraph-sdk](https://github.com/langchain-ai/langgraph) | `0.4.2` | `0.4.4` |
| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.10.16` | `0.11.2` |
| [lxml](https://github.com/lxml/lxml) | `6.1.1` | `6.1.2` |
| [narwhals](https://github.com/narwhals-dev/narwhals) | `2.24.0` | `2.25.0` |
| [peewee](https://github.com/coleifer/peewee) | `4.3.0` | `4.4.0` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.0` | `4.11.5` |
| [protobuf](https://github.com/protocolbuffers/protobuf) | `7.35.1` | `7.36.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` |
| [pyphen](https://github.com/Kozea/Pyphen) | `0.17.2` | `0.18.1` |
| [simplejson](https://github.com/simplejson/simplejson) | `4.1.1` | `4.1.2` |
| [soupsieve](https://github.com/facelessuser/soupsieve) | `2.9.1` | `2.9.2` |
| [starlette](https://github.com/Kludex/starlette) | `1.4.1` | `1.6.0` |
| [tiktoken](https://github.com/openai/tiktoken) | `0.13.0` | `0.14.0` |
| [typing-inspection](https://github.com/pydantic/typing-inspection) | `0.4.2` | `0.4.4` |
| [uncalled-for](https://github.com/chrisguidry/uncalled-for) | `0.3.2` | `0.4.0` |
| [wcwidth](https://github.com/jquast/wcwidth) | `0.8.2` | `0.8.3` |
| [webencodings](https://github.com/CourtBouillon/webencodings) | `0.5.1` | `0.6.1` |
| [websocket-client](https://github.com/websocket-client/websocket-client) | `1.9.0` | `1.9.1` |


Updates `langchain` from 1.3.14 to 1.3.18
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain==1.3.14...langchain==1.3.18)

Updates `langchain-core` from 1.5.3 to 1.6.1
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-core==1.5.3...langchain-core==1.6.1)

Updates `langchain-openai` from 1.4.1 to 1.6.0
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-openai==1.4.1...langchain-openai==1.6.0)

Updates `langgraph` from 1.2.10 to 1.2.11
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](https://github.com/langchain-ai/langgraph/compare/1.2.10...1.2.11)

Updates `langgraph-checkpoint` from 4.1.1 to 4.2.0
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](https://github.com/langchain-ai/langgraph/compare/checkpoint==4.1.1...checkpoint==4.2.0)

Updates `python-dotenv` from 1.2.2 to 1.2.3
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](https://github.com/theskumar/python-dotenv/compare/v1.2.2...v1.2.3)

Updates `pypdfium2` from 5.12.1 to 5.13.0
- [Release notes](https://github.com/pypdfium2-team/pypdfium2/releases)
- [Commits](https://github.com/pypdfium2-team/pypdfium2/compare/5.12.1...5.13.0)

Updates `yfinance` from 1.5.2 to 1.7.0
- [Release notes](https://github.com/ranaroussi/yfinance/releases)
- [Changelog](https://github.com/ranaroussi/yfinance/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/ranaroussi/yfinance/compare/1.5.2...1.7.0)

Updates `akshare` from 1.18.82 to 1.18.94
- [Release notes](https://github.com/akfamily/akshare/releases)
- [Changelog](https://github.com/akfamily/akshare/blob/main/docs/changelog.md)
- [Commits](https://github.com/akfamily/akshare/compare/release-v1.18.82...release-v1.18.94)

Updates `ccxt` from 4.5.71 to 4.5.76
- [Release notes](https://github.com/ccxt/ccxt/releases)
- [Commits](https://github.com/ccxt/ccxt/compare/v4.5.71...v4.5.76)

Updates `cryptography` from 50.0.0 to 50.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/50.0.0...50.0.1)

Updates `uvicorn` from 0.52.1 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/uvicorn/compare/0.52.1...0.52.4)

Updates `pydantic` from 2.13.4 to 2.13.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md)
- [Commits](https://github.com/pydantic/pydantic/compare/v2.13.4...v2.13.5)

Updates `fastmcp` from 3.4.6 to 3.4.7
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](https://github.com/PrefectHQ/fastmcp/compare/v3.4.6...v3.4.7)

Updates `ddgs` from 9.14.4 to 9.16.0
- [Release notes](https://github.com/deedy5/ddgs/releases)
- [Commits](https://github.com/deedy5/ddgs/compare/v9.14.4...v9.16.0)

Updates `lark-oapi` from 1.7.2 to 1.7.3
- [Commits](https://github.com/larksuite/oapi-sdk-python/compare/v1.7.2...v1.7.3)

Updates `click` from 8.4.2 to 8.5.0
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](https://github.com/pallets/click/compare/8.4.2...8.5.0)

Updates `curl-cffi` from 0.16.0 to 0.16.2
- [Release notes](https://github.com/lexiforest/curl_cffi/releases)
- [Changelog](https://github.com/lexiforest/curl_cffi/blob/main/docs/changelog.rst)
- [Commits](https://github.com/lexiforest/curl_cffi/compare/v0.16.0...v0.16.2)

Updates `cyclopts` from 4.22.5 to 4.23.3
- [Release notes](https://github.com/BrianPugh/cyclopts/releases)
- [Commits](https://github.com/BrianPugh/cyclopts/compare/v4.22.5...v4.23.3)

Updates `fastmcp-slim` from 3.4.6 to 3.4.7
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](https://github.com/PrefectHQ/fastmcp/compare/v3.4.6...v3.4.7)

Updates `griffelib` from 2.1.0 to 2.2.0

Updates `joserfc` from 1.7.4 to 1.7.5
- [Release notes](https://github.com/authlib/joserfc/releases)
- [Changelog](https://github.com/authlib/joserfc/blob/main/docs/changelog.rst)
- [Commits](https://github.com/authlib/joserfc/compare/1.7.4...1.7.5)

Updates `kiwisolver` from 1.5.0 to 1.5.1
- [Release notes](https://github.com/nucleic/kiwi/releases)
- [Changelog](https://github.com/nucleic/kiwi/blob/main/releasenotes.rst)
- [Commits](https://github.com/nucleic/kiwi/compare/1.5.0...1.5.1)

Updates `langchain-protocol` from 0.0.18 to 0.0.19
- [Release notes](https://github.com/langchain-ai/agent-protocol/releases)
- [Commits](https://github.com/langchain-ai/agent-protocol/compare/langchain-protocol==0.0.18...langchain-protocol==0.0.19)

Updates `langgraph-sdk` from 0.4.2 to 0.4.4
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](https://github.com/langchain-ai/langgraph/compare/0.4.2...0.4.4)

Updates `langsmith` from 0.10.16 to 0.11.2
- [Release notes](https://github.com/langchain-ai/langsmith-sdk/releases)
- [Commits](https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.16...v0.11.2)

Updates `lxml` from 6.1.1 to 6.1.2
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](https://github.com/lxml/lxml/compare/lxml-6.1.1...lxml-6.1.2)

Updates `narwhals` from 2.24.0 to 2.25.0
- [Release notes](https://github.com/narwhals-dev/narwhals/releases)
- [Commits](https://github.com/narwhals-dev/narwhals/compare/v2.24.0...v2.25.0)

Updates `peewee` from 4.3.0 to 4.4.0
- [Release notes](https://github.com/coleifer/peewee/releases)
- [Changelog](https://github.com/coleifer/peewee/blob/master/CHANGELOG.md)
- [Commits](https://github.com/coleifer/peewee/compare/4.3.0...4.4.0)

Updates `platformdirs` from 4.11.0 to 4.11.5
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](https://github.com/tox-dev/platformdirs/compare/4.11.0...4.11.5)

Updates `protobuf` from 7.35.1 to 7.36.0
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](https://github.com/pydantic/pydantic-settings/compare/v2.14.2...v2.15.0)

Updates `pygments` from 2.20.0 to 2.21.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](https://github.com/pygments/pygments/compare/2.20.0...2.21.0)

Updates `pyphen` from 0.17.2 to 0.18.1
- [Release notes](https://github.com/Kozea/Pyphen/releases)
- [Changelog](https://github.com/Kozea/Pyphen/blob/main/docs/changelog.rst)
- [Commits](https://github.com/Kozea/Pyphen/compare/0.17.2...0.18.1)

Updates `simplejson` from 4.1.1 to 4.1.2
- [Release notes](https://github.com/simplejson/simplejson/releases)
- [Changelog](https://github.com/simplejson/simplejson/blob/main/CHANGES.txt)
- [Commits](https://github.com/simplejson/simplejson/compare/v4.1.1...v4.1.2)

Updates `soupsieve` from 2.9.1 to 2.9.2
- [Release notes](https://github.com/facelessuser/soupsieve/releases)
- [Commits](https://github.com/facelessuser/soupsieve/compare/2.9.1...2.9.2)

Updates `starlette` from 1.4.1 to 1.6.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/1.4.1...1.6.0)

Updates `tiktoken` from 0.13.0 to 0.14.0
- [Release notes](https://github.com/openai/tiktoken/releases)
- [Changelog](https://github.com/openai/tiktoken/blob/main/CHANGELOG.md)
- [Commits](https://github.com/openai/tiktoken/compare/0.13.0...0.14.0)

Updates `typing-inspection` from 0.4.2 to 0.4.4
- [Release notes](https://github.com/pydantic/typing-inspection/releases)
- [Changelog](https://github.com/pydantic/typing-inspection/blob/main/HISTORY.md)
- [Commits](https://github.com/pydantic/typing-inspection/compare/v0.4.2...v0.4.4)

Updates `uncalled-for` from 0.3.2 to 0.4.0
- [Release notes](https://github.com/chrisguidry/uncalled-for/releases)
- [Commits](https://github.com/chrisguidry/uncalled-for/compare/0.3.2...0.4.0)

Updates `wcwidth` from 0.8.2 to 0.8.3
- [Release notes](https://github.com/jquast/wcwidth/releases)
- [Commits](https://github.com/jquast/wcwidth/compare/0.8.2...0.8.3)

Updates `webencodings` from 0.5.1 to 0.6.1
- [Release notes](https://github.com/CourtBouillon/webencodings/releases)
- [Changelog](https://github.com/CourtBouillon/webencodings/blob/main/docs/changelog.rst)
- [Commits](https://github.com/CourtBouillon/webencodings/compare/v0.5.1...v0.6.1)

Updates `websocket-client` from 1.9.0 to 1.9.1
- [Release notes](https://github.com/websocket-client/websocket-client/releases)
- [Changelog](https://github.com/websocket-client/websocket-client/blob/master/ChangeLog)
- [Commits](https://github.com/websocket-client/websocket-client/compare/v1.9.0...v1.9.1)

---
updated-dependencies:
- dependency-name: langchain
  dependency-version: 1.3.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langchain-core
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: langchain-openai
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: langgraph
  dependency-version: 1.2.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langgraph-checkpoint
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: python-dotenv
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pypdfium2
  dependency-version: 5.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: yfinance
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: akshare
  dependency-version: 1.18.94
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: ccxt
  dependency-version: 4.5.76
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: uvicorn
  dependency-version: 0.52.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: fastmcp
  dependency-version: 3.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: ddgs
  dependency-version: 9.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: lark-oapi
  dependency-version: 1.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: click
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: curl-cffi
  dependency-version: 0.16.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: cyclopts
  dependency-version: 4.23.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: fastmcp-slim
  dependency-version: 3.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: griffelib
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: joserfc
  dependency-version: 1.7.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: kiwisolver
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langchain-protocol
  dependency-version: 0.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langgraph-sdk
  dependency-version: 0.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langsmith
  dependency-version: 0.11.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: lxml
  dependency-version: 6.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: narwhals
  dependency-version: 2.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: peewee
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: platformdirs
  dependency-version: 4.11.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: protobuf
  dependency-version: 7.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: pydantic-settings
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: pygments
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: pyphen
  dependency-version: 0.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: simplejson
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: soupsieve
  dependency-version: 2.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: starlette
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: tiktoken
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: typing-inspection
  dependency-version: 0.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: uncalled-for
  dependency-version: 0.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: wcwidth
  dependency-version: 0.8.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: webencodings
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: websocket-client
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-01 18:33:32 +00:00
Haozhe Wu 0bb1d87045 build: make smartmoneyconcepts an extra and drop the <3.14 cap 
`requires-python` capped Python at <3.14 because smartmoneyconcepts pulls
numba -> llvmlite, and llvmlite had no cp314 wheel. Two things are now
true that were not when that cap was written:

- llvmlite 0.49.0 does ship cp314 wheels (macOS arm64, manylinux x86_64
  and aarch64, win_amd64, win_arm64), so the cap blocks 3.14 everywhere
  for a reason that no longer holds;
- llvmlite ships no macOS x86_64 wheel at all from 0.46 on (0.45.1 is the
  last, cp310-cp313), so Intel Macs hit a cmake source build on *every*
  Python version. That is the failure in discussion #1035, and the cap
  never addressed it.

The cap also backfired: only 0.1.13 carries it, so on 3.14 pip backtracks
to 0.1.12 and installs the very thing the cap exists to prevent.

smartmoneyconcepts is imported by exactly one file, the skill example
src/skills/smc/example_signal_engine.py, whose SKILL.md already told the
reader to install it. Nothing else imports numba, and no test depends on
it. Every other extra (pyharmonics, statsmodels, arch, baostock, pykrx,
openbb-ai, langchain-anthropic) is already absent from agent/requirements.txt
and the lock, so this just brings smartmoneyconcepts in line.

Verified on a throwaway CPython 3.14.4 venv: base install carries neither
numba nor llvmlite nor smartmoneyconcepts, `vibe-trading --version` runs,
and the suite is 10774 passed / 23 skipped / 0 failed under CI's own
extras ([dev,openbb,stats]). The regenerated lock differs by exactly the
three removed packages, with no incidental version bumps, and still passes
`pip install --dry-run --require-hashes` on 3.11.

Note for CI: the test job pins python-version 3.11, so 3.14 is now
supported but unexercised.
 2026-08-19 13:59:22 +08:00
Haozhe Wu 6d5fb6cdb2 fix(deps): make hash locks cross-platform 
Signed-off-by: Haozhe Wu <haozhe_wu@connect.hku.hk>
 2026-08-15 04:02:24 +08:00
dependabot[bot] a07f5e8dfb chore(deps): bump akshare in the pip-minor-patch group 
Bumps the pip-minor-patch group with 1 update: [akshare](https://github.com/akfamily/akshare).


Updates `akshare` from 1.18.81 to 1.18.82
- [Release notes](https://github.com/akfamily/akshare/releases)
- [Changelog](https://github.com/akfamily/akshare/blob/main/docs/changelog.md)
- [Commits](https://github.com/akfamily/akshare/compare/release-v1.18.81...release-v1.18.82)

---
updated-dependencies:
- dependency-name: akshare
  dependency-version: 1.18.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-09 10:15:15 +00:00
Haozhe Wu 8460e18132 fix(deps): align caio with aiofile 3.12 2026-08-09 16:20:34 +08:00
dependabot[bot] 93e0fef4a2 chore(deps): bump the pip-minor-patch group with 15 updates 
Bumps the pip-minor-patch group with 15 updates:

| Package | From | To |
| --- | --- | --- |
| [langchain-core](https://github.com/langchain-ai/langchain) | `1.5.2` | `1.5.3` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.0` | `0.52.1` |
| [sse-starlette](https://github.com/sysid/sse-starlette) | `3.4.6` | `3.4.8` |
| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `3.4.5` | `3.4.6` |
| [aiofile](https://github.com/mosquito/aiofile) | `3.11.1` | `3.12.3` |
| [cachetools](https://github.com/tkem/cachetools) | `7.1.6` | `7.1.7` |
| [curl-cffi](https://github.com/lexiforest/curl_cffi) | `0.15.0` | `0.16.0` |
| [cyclopts](https://github.com/BrianPugh/cyclopts) | `4.22.2` | `4.22.5` |
| [fastmcp-slim](https://github.com/PrefectHQ/fastmcp) | `3.4.5` | `3.4.6` |
| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.10.12` | `0.10.16` |
| [openai](https://github.com/openai/openai-python) | `2.50.0` | `2.53.0` |
| [packaging](https://github.com/pypa/packaging) | `26.2` | `26.3` |
| [peewee](https://github.com/coleifer/peewee) | `4.2.6` | `4.3.0` |
| [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.4.1` |
| [yarl](https://github.com/aio-libs/yarl) | `1.24.2` | `1.24.5` |


Updates `langchain-core` from 1.5.2 to 1.5.3
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain-core==1.5.2...langchain-core==1.5.3)

Updates `uvicorn` from 0.52.0 to 0.52.1
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/uvicorn/compare/0.52.0...0.52.1)

Updates `sse-starlette` from 3.4.6 to 3.4.8
- [Release notes](https://github.com/sysid/sse-starlette/releases)
- [Commits](https://github.com/sysid/sse-starlette/compare/v3.4.6...v3.4.8)

Updates `fastmcp` from 3.4.5 to 3.4.6
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](https://github.com/PrefectHQ/fastmcp/compare/v3.4.5...v3.4.6)

Updates `aiofile` from 3.11.1 to 3.12.3
- [Release notes](https://github.com/mosquito/aiofile/releases)
- [Commits](https://github.com/mosquito/aiofile/compare/3.11.1...3.12.3)

Updates `cachetools` from 7.1.6 to 7.1.7
- [Changelog](https://github.com/tkem/cachetools/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/tkem/cachetools/compare/v7.1.6...v7.1.7)

Updates `curl-cffi` from 0.15.0 to 0.16.0
- [Release notes](https://github.com/lexiforest/curl_cffi/releases)
- [Changelog](https://github.com/lexiforest/curl_cffi/blob/main/docs/changelog.rst)
- [Commits](https://github.com/lexiforest/curl_cffi/compare/v0.15.0...v0.16.0)

Updates `cyclopts` from 4.22.2 to 4.22.5
- [Release notes](https://github.com/BrianPugh/cyclopts/releases)
- [Commits](https://github.com/BrianPugh/cyclopts/compare/v4.22.2...v4.22.5)

Updates `fastmcp-slim` from 3.4.5 to 3.4.6
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](https://github.com/PrefectHQ/fastmcp/compare/v3.4.5...v3.4.6)

Updates `langsmith` from 0.10.12 to 0.10.16
- [Release notes](https://github.com/langchain-ai/langsmith-sdk/releases)
- [Commits](https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.12...v0.10.16)

Updates `openai` from 2.50.0 to 2.53.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/openai/openai-python/compare/v2.50.0...v2.53.0)

Updates `packaging` from 26.2 to 26.3
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pypa/packaging/compare/26.2...26.3)

Updates `peewee` from 4.2.6 to 4.3.0
- [Release notes](https://github.com/coleifer/peewee/releases)
- [Changelog](https://github.com/coleifer/peewee/blob/master/CHANGELOG.md)
- [Commits](https://github.com/coleifer/peewee/compare/4.2.6...4.3.0)

Updates `starlette` from 1.3.1 to 1.4.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/starlette/compare/1.3.1...1.4.1)

Updates `yarl` from 1.24.2 to 1.24.5
- [Release notes](https://github.com/aio-libs/yarl/releases)
- [Changelog](https://github.com/aio-libs/yarl/blob/master/CHANGES.rst)
- [Commits](https://github.com/aio-libs/yarl/compare/v1.24.2...v1.24.5)

---
updated-dependencies:
- dependency-name: langchain-core
  dependency-version: 1.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: uvicorn
  dependency-version: 0.52.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: sse-starlette
  dependency-version: 3.4.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: fastmcp
  dependency-version: 3.4.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: aiofile
  dependency-version: 3.12.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: cachetools
  dependency-version: 7.1.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: curl-cffi
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: cyclopts
  dependency-version: 4.22.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: fastmcp-slim
  dependency-version: 3.4.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langsmith
  dependency-version: 0.10.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: openai
  dependency-version: 2.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: peewee
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: starlette
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: yarl
  dependency-version: 1.24.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-08 17:25:07 +00:00
Haozhe Wu 72df3f9408 deps: resolve Dependabot security alerts 2026-08-09 01:10:53 +08:00
dependabot[bot] 4da304fe0c build(deps): bump the pip-minor-patch group with 9 updates (#949) 
Bumps the pip-minor-patch group:
- langchain-core 1.5.1 → 1.5.2
- langgraph 1.2.9 → 1.2.10
- akshare 1.18.80 → 1.18.81
- ccxt 4.5.68 → 4.5.70
- fastapi 0.140.7 → 0.141.1
- uvicorn 0.51.0 → 0.52.0
- annotated-doc 0.0.4 → 0.0.5
- langsmith 0.10.10 → 0.10.12
- openai 2.49.0 → 2.50.0

Validated on synthetic merge 78188181: exact-version import checks and 330 focused tests passed. GitHub Linux CI passed the repository hash-lock check.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-02 14:02:41 +08:00
dependabot[bot] cd04c93851 build(deps): bump the pip-minor-patch group across 1 directory with 6 updates (#893) 
Bumps the pip-minor-patch group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [akshare](https://github.com/akfamily/akshare) | `1.18.79` | `1.18.80` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.140.0` | `0.140.7` |
| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `3.4.4` | `3.4.5` |
| [fastmcp-slim](https://github.com/PrefectHQ/fastmcp) | `3.4.4` | `3.4.5` |
| [openai](https://github.com/openai/openai-python) | `2.48.0` | `2.49.0` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.69.1` | `4.70.0` |



Updates `akshare` from 1.18.79 to 1.18.80
- [Release notes](https://github.com/akfamily/akshare/releases)
- [Changelog](https://github.com/akfamily/akshare/blob/main/docs/changelog.md)
- [Commits](https://github.com/akfamily/akshare/compare/release-v1.18.79...release-v1.18.80)

Updates `fastapi` from 0.140.0 to 0.140.7
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](https://github.com/fastapi/fastapi/compare/0.140.0...0.140.7)

Updates `fastmcp` from 3.4.4 to 3.4.5
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](https://github.com/PrefectHQ/fastmcp/compare/v3.4.4...v3.4.5)

Updates `fastmcp-slim` from 3.4.4 to 3.4.5
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](https://github.com/PrefectHQ/fastmcp/compare/v3.4.4...v3.4.5)

Updates `openai` from 2.48.0 to 2.49.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/openai/openai-python/compare/v2.48.0...v2.49.0)

Updates `tqdm` from 4.69.1 to 4.70.0
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](https://github.com/tqdm/tqdm/compare/v4.69.1...v4.70.0)

---
updated-dependencies:
- dependency-name: akshare
  dependency-version: 1.18.80
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: fastapi
  dependency-version: 0.140.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: fastmcp
  dependency-version: 3.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: fastmcp-slim
  dependency-version: 3.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: openai
  dependency-version: 2.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: tqdm
  dependency-version: 4.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 14:30:09 +08:00
Haozhe Wu 58363fc01f chore(deps): unblock the ccxt/setuptools lock deadlock and cut dependabot churn 
Dependabot could not land either half of a mutually-blocking pair: the
minor/patch group wanted ccxt 4.5.68 (which pins setuptools==83.0.0) while
keeping setuptools at 82.0.1, and the separate setuptools 83.0.0 PR conflicted
with the ccxt 4.5.67 already in the lock. Neither can go green alone because
setuptools is a major bump and is excluded from the minor/patch group by
design, so it cannot ride along.

Regenerate the lock so both move together. Verified with pip-compile under
Python 3.11 on Linux (matching CI) and checked with CI's own gate,
pip install --dry-run --require-hashes. Note the lock is platform-sensitive:
regenerating on macOS drops jeepney/secretstorage and swaps py-mini-racer for
mini-racer, so it must be produced on Linux.

Also ignore websockets, capped at <16 by langgraph-sdk 0.4.2, and move all
three ecosystems to monthly with 2 concurrent PRs. Security updates are a
separate channel and are unaffected.
 2026-07-27 18:03:14 +08:00
Haozhe Wu 8aa7a13bfe fix(deps): repair cold hash-locked installs 2026-07-26 12:53:22 +08:00
Haozhe Wu 2867365845 Merge pull request #725 from HKUDS/dependabot/pip/websockets-16.1.1 
build(deps): bump websockets from 15.0.1 to 16.1.1
 2026-07-21 12:17:13 +08:00
dependabot[bot] 76e8f518f0 build(deps): bump the pip-minor-patch group across 1 directory with 20 updates 
Bumps the pip-minor-patch group with 20 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [langchain](https://github.com/langchain-ai/langchain) | `1.3.13` | `1.3.14` |
| [pypdfium2](https://github.com/pypdfium2-team/pypdfium2) | `5.11.0` | `5.12.1` |
| [ccxt](https://github.com/ccxt/ccxt) | `4.5.64` | `4.5.67` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.139.0` | `0.139.2` |
| [matplotlib](https://github.com/matplotlib/matplotlib) | `3.11.0` | `3.11.1` |
| [caio](https://github.com/mosquito/caio) | `0.9.25` | `0.10.2` |
| [cyclopts](https://github.com/BrianPugh/cyclopts) | `4.21.0` | `4.22.0` |
| [jaraco-functools](https://github.com/jaraco/jaraco.functools) | `4.5.0` | `4.6.0` |
| [joserfc](https://github.com/authlib/joserfc) | `1.7.3` | `1.7.4` |
| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.10.2` | `0.10.6` |
| [narwhals](https://github.com/narwhals-dev/narwhals) | `2.23.0` | `2.24.0` |
| [openai](https://github.com/openai/openai-python) | `2.45.0` | `2.46.0` |
| [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) | `1.43.0` | `1.44.0` |
| [peewee](https://github.com/coleifer/peewee) | `4.2.1` | `4.2.6` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.10.0` | `4.10.1` |
| [pydantic-core](https://github.com/pydantic/pydantic) | `2.46.4` | `2.47.0` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.7.10` | `2026.7.19` |
| [soupsieve](https://github.com/facelessuser/soupsieve) | `2.8.4` | `2.9` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.68.4` | `4.69.0` |
| [yarl](https://github.com/aio-libs/yarl) | `1.24.2` | `1.24.5` |



Updates `langchain` from 1.3.13 to 1.3.14
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain==1.3.13...langchain==1.3.14)

Updates `pypdfium2` from 5.11.0 to 5.12.1
- [Release notes](https://github.com/pypdfium2-team/pypdfium2/releases)
- [Commits](https://github.com/pypdfium2-team/pypdfium2/compare/5.11.0...5.12.1)

Updates `ccxt` from 4.5.64 to 4.5.67
- [Release notes](https://github.com/ccxt/ccxt/releases)
- [Commits](https://github.com/ccxt/ccxt/compare/v4.5.64...v4.5.67)

Updates `fastapi` from 0.139.0 to 0.139.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](https://github.com/fastapi/fastapi/compare/0.139.0...0.139.2)

Updates `matplotlib` from 3.11.0 to 3.11.1
- [Release notes](https://github.com/matplotlib/matplotlib/releases)
- [Commits](https://github.com/matplotlib/matplotlib/compare/v3.11.0...v3.11.1)

Updates `caio` from 0.9.25 to 0.10.2
- [Release notes](https://github.com/mosquito/caio/releases)
- [Commits](https://github.com/mosquito/caio/compare/0.9.25...0.10.2)

Updates `cyclopts` from 4.21.0 to 4.22.0
- [Release notes](https://github.com/BrianPugh/cyclopts/releases)
- [Commits](https://github.com/BrianPugh/cyclopts/compare/v4.21.0...v4.22.0)

Updates `jaraco-functools` from 4.5.0 to 4.6.0
- [Release notes](https://github.com/jaraco/jaraco.functools/releases)
- [Changelog](https://github.com/jaraco/jaraco.functools/blob/main/NEWS.rst)
- [Commits](https://github.com/jaraco/jaraco.functools/compare/v4.5.0...v4.6.0)

Updates `joserfc` from 1.7.3 to 1.7.4
- [Release notes](https://github.com/authlib/joserfc/releases)
- [Changelog](https://github.com/authlib/joserfc/blob/main/docs/changelog.rst)
- [Commits](https://github.com/authlib/joserfc/compare/1.7.3...1.7.4)

Updates `langsmith` from 0.10.2 to 0.10.6
- [Release notes](https://github.com/langchain-ai/langsmith-sdk/releases)
- [Commits](https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.2...v0.10.6)

Updates `narwhals` from 2.23.0 to 2.24.0
- [Release notes](https://github.com/narwhals-dev/narwhals/releases)
- [Commits](https://github.com/narwhals-dev/narwhals/compare/v2.23.0...v2.24.0)

Updates `openai` from 2.45.0 to 2.46.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/openai/openai-python/compare/v2.45.0...v2.46.0)

Updates `opentelemetry-api` from 1.43.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python/compare/v1.43.0...v1.44.0)

Updates `peewee` from 4.2.1 to 4.2.6
- [Release notes](https://github.com/coleifer/peewee/releases)
- [Changelog](https://github.com/coleifer/peewee/blob/master/CHANGELOG.md)
- [Commits](https://github.com/coleifer/peewee/compare/4.2.1...4.2.6)

Updates `platformdirs` from 4.10.0 to 4.10.1
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](https://github.com/tox-dev/platformdirs/compare/4.10.0...4.10.1)

Updates `pydantic-core` from 2.46.4 to 2.47.0
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](https://github.com/pydantic/pydantic/commits)

Updates `regex` from 2026.7.10 to 2026.7.19
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](https://github.com/mrabarnett/mrab-regex/compare/2026.7.10...2026.7.19)

Updates `soupsieve` from 2.8.4 to 2.9
- [Release notes](https://github.com/facelessuser/soupsieve/releases)
- [Commits](https://github.com/facelessuser/soupsieve/compare/2.8.4...2.9)

Updates `tqdm` from 4.68.4 to 4.69.0
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](https://github.com/tqdm/tqdm/compare/v4.68.4...v4.69.0)

Updates `yarl` from 1.24.2 to 1.24.5
- [Release notes](https://github.com/aio-libs/yarl/releases)
- [Changelog](https://github.com/aio-libs/yarl/blob/master/CHANGES.rst)
- [Commits](https://github.com/aio-libs/yarl/compare/v1.24.2...v1.24.5)

---
updated-dependencies:
- dependency-name: langchain
  dependency-version: 1.3.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pypdfium2
  dependency-version: 5.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: ccxt
  dependency-version: 4.5.67
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: fastapi
  dependency-version: 0.139.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: matplotlib
  dependency-version: 3.11.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: caio
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: cyclopts
  dependency-version: 4.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: jaraco-functools
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: joserfc
  dependency-version: 1.7.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langsmith
  dependency-version: 0.10.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: narwhals
  dependency-version: 2.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: openai
  dependency-version: 2.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: opentelemetry-api
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: peewee
  dependency-version: 4.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: platformdirs
  dependency-version: 4.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pydantic-core
  dependency-version: 2.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: regex
  dependency-version: 2026.7.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: soupsieve
  dependency-version: '2.9'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: tqdm
  dependency-version: 4.69.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: yarl
  dependency-version: 1.24.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-20 11:03:53 +00:00
dependabot[bot] 8d27badecd build(deps): bump websockets from 15.0.1 to 16.1.1 
Bumps [websockets](https://github.com/python-websockets/websockets) from 15.0.1 to 16.1.1.
- [Release notes](https://github.com/python-websockets/websockets/releases)
- [Commits](https://github.com/python-websockets/websockets/compare/15.0.1...16.1.1)

---
updated-dependencies:
- dependency-name: websockets
  dependency-version: 16.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-20 10:54:10 +00:00
root 0de5a78ccd build: add Longbridge credentials module and optional dependency 
- Add credentials.py: unified credential resolution for data and trading
- Add test_longbridge_credentials.py: coverage for credential resolution
- Remove longbridge from requirements.txt (optional extra only)
- Update requirements-lock.txt
- Update .env.example with Longbridge credential hints
 2026-07-16 19:23:54 +08:00
tianrking 3eb598faf5 fix(deps): regenerate runtime lock 
Signed-off-by: tianrking <10758833+tianrking@users.noreply.github.com>
 2026-07-16 12:58:47 +08:00
dependabot[bot] a45f465e9e chore(deps): bump pydantic-core from 2.46.4 to 2.47.0 (#503) 
CI green (test + build). Verified mergeable/clean against current main.
 2026-07-13 12:18:33 +08:00
dependabot[bot] 9ce904a388 chore(deps): bump anyio from 4.14.1 to 4.14.2 (#500) 
CI green (test + build). Verified mergeable/clean against current main.
 2026-07-13 12:18:27 +08:00
dependabot[bot] 4669bf1810 chore(deps): bump websockets from 15.0.1 to 16.1 (#495) 
CI green (test + build). Verified mergeable/clean against current main.
 2026-07-13 12:18:06 +08:00
dependabot[bot] bddbce9fef chore(deps): bump peewee from 4.1.2 to 4.2.1 (#491) 
CI green (test + build). Verified mergeable/clean against current main.
 2026-07-13 12:18:02 +08:00
dependabot[bot] 5cd3a26419 chore(deps): bump caio from 0.9.25 to 0.10.2 (#489) 
CI green (test + build). Verified mergeable/clean against current main.
 2026-07-13 12:17:54 +08:00
Haozhe Wu 4e3c91c77a security: address all 10 findings from external audit (issue #476) 
Implements VT-001 through VT-010 from the 2026-07-10 external security
audit (Trivy/Semgrep/ZAP/Gitleaks/pip-audit against a real deployment):

- VT-001 (Critical): AST hardening in backtest/runner.py rejects
  network/subprocess/eval/os.environ/unsafe-open calls reachable from
  generated SignalEngine method bodies (previously only checked
  top-level statements). Defense-in-depth: ephemeral per-run HOME,
  RLIMIT_AS/NOFILE caps, best-effort UID-drop to a new vibe-sandbox
  user (currently inert under Docker's cap model - see session doc;
  accepted as documented residual gap, primary AST defense unaffected).
- VT-002: multi-stage Dockerfile split so build-essential never
  reaches the runtime image.
- VT-003: SSE auth moved from a long-lived API key in the URL query
  string to short-lived single-use tickets; access-log redaction for
  any remaining query secrets.
- VT-004: agent/.env split-brain fixed (bind mount + atomic 0600
  writes) between docker-compose and Web UI settings writes.
- VT-005: /correlation now requires auth + per-IP rate limit; generic
  exceptions no longer leak raw text to clients.
- VT-006: CSP-Report-Only + security headers middleware; Google Fonts
  replaced with self-hosted @fontsource packages.
- VT-007: docker-compose hardening (cap_drop ALL + minimal cap_add,
  no-new-privileges, read_only rootfs, resource limits).
- VT-008: /health split into /live (liveness) and /ready (real
  provider-config readiness check); /health kept as a compat alias.
- VT-009: base images pinned by digest, GitHub Actions pinned by
  commit SHA, dependabot.yml added, hash-verified requirements-lock.txt
  now actually wired into the Docker build via --require-hashes.
- VT-010: universe-panel pickle cache sidecar upgraded from an
  unkeyed SHA-256 (forgeable by anyone with cache-dir write access)
  to a keyed HMAC.

Implemented via a 5-parcel Workflow (file-disjoint, independent
adversarial verification per parcel, then a holistic final audit).
The final audit caught a real regression (CI env-var-gate violation)
and confirmed a dependency-pinning gap, both fixed and re-verified
here, including a latent transitive-dependency bug the fix surfaced
(smartmoneyconcepts<0.0.27 pulls an unbuildable zigzag package) - see
docs/sessions/2026-07-13_session_vt476_security_hardening.md (local,
gitignored) for full evidence trail.

Full suite: 5191 passed, 6 pre-existing/environmental failures
(unchanged from main). Docker build + hardened compose boot verified
end-to-end.
 2026-07-13 01:40:53 +08:00