kenneth/Auto-Trader
1
0 Fork 0
Code Issues Pull Requests Actions 16 Packages Projects Releases Wiki Activity
1,119 Commits 1 Branch 13 Tags
f736c106a3b9c3f0bbb22dcdb8a4ba4c7866f556
Commit Graph
14 Commits
Author SHA1 Message Date
dependabot[bot] cd04c93851 build(deps): bump the pip-minor-patch group across 1 directory with 6 updates (#893) 
Bumps the pip-minor-patch group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [akshare](https://github.com/akfamily/akshare) | `1.18.79` | `1.18.80` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.140.0` | `0.140.7` |
| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `3.4.4` | `3.4.5` |
| [fastmcp-slim](https://github.com/PrefectHQ/fastmcp) | `3.4.4` | `3.4.5` |
| [openai](https://github.com/openai/openai-python) | `2.48.0` | `2.49.0` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.69.1` | `4.70.0` |



Updates `akshare` from 1.18.79 to 1.18.80
- [Release notes](https://github.com/akfamily/akshare/releases)
- [Changelog](https://github.com/akfamily/akshare/blob/main/docs/changelog.md)
- [Commits](https://github.com/akfamily/akshare/compare/release-v1.18.79...release-v1.18.80)

Updates `fastapi` from 0.140.0 to 0.140.7
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](https://github.com/fastapi/fastapi/compare/0.140.0...0.140.7)

Updates `fastmcp` from 3.4.4 to 3.4.5
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](https://github.com/PrefectHQ/fastmcp/compare/v3.4.4...v3.4.5)

Updates `fastmcp-slim` from 3.4.4 to 3.4.5
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](https://github.com/PrefectHQ/fastmcp/compare/v3.4.4...v3.4.5)

Updates `openai` from 2.48.0 to 2.49.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/openai/openai-python/compare/v2.48.0...v2.49.0)

Updates `tqdm` from 4.69.1 to 4.70.0
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](https://github.com/tqdm/tqdm/compare/v4.69.1...v4.70.0)

---
updated-dependencies:
- dependency-name: akshare
  dependency-version: 1.18.80
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: fastapi
  dependency-version: 0.140.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: fastmcp
  dependency-version: 3.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: fastmcp-slim
  dependency-version: 3.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: openai
  dependency-version: 2.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: tqdm
  dependency-version: 4.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-28 14:30:09 +08:00
Haozhe Wu 58363fc01f chore(deps): unblock the ccxt/setuptools lock deadlock and cut dependabot churn 
Dependabot could not land either half of a mutually-blocking pair: the
minor/patch group wanted ccxt 4.5.68 (which pins setuptools==83.0.0) while
keeping setuptools at 82.0.1, and the separate setuptools 83.0.0 PR conflicted
with the ccxt 4.5.67 already in the lock. Neither can go green alone because
setuptools is a major bump and is excluded from the minor/patch group by
design, so it cannot ride along.

Regenerate the lock so both move together. Verified with pip-compile under
Python 3.11 on Linux (matching CI) and checked with CI's own gate,
pip install --dry-run --require-hashes. Note the lock is platform-sensitive:
regenerating on macOS drops jeepney/secretstorage and swaps py-mini-racer for
mini-racer, so it must be produced on Linux.

Also ignore websockets, capped at <16 by langgraph-sdk 0.4.2, and move all
three ecosystems to monthly with 2 concurrent PRs. Security updates are a
separate channel and are unaffected.
 2026-07-27 18:03:14 +08:00
Haozhe Wu 8aa7a13bfe fix(deps): repair cold hash-locked installs 2026-07-26 12:53:22 +08:00
Haozhe Wu 2867365845 Merge pull request #725 from HKUDS/dependabot/pip/websockets-16.1.1 
build(deps): bump websockets from 15.0.1 to 16.1.1
 2026-07-21 12:17:13 +08:00
dependabot[bot] 76e8f518f0 build(deps): bump the pip-minor-patch group across 1 directory with 20 updates 
Bumps the pip-minor-patch group with 20 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [langchain](https://github.com/langchain-ai/langchain) | `1.3.13` | `1.3.14` |
| [pypdfium2](https://github.com/pypdfium2-team/pypdfium2) | `5.11.0` | `5.12.1` |
| [ccxt](https://github.com/ccxt/ccxt) | `4.5.64` | `4.5.67` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.139.0` | `0.139.2` |
| [matplotlib](https://github.com/matplotlib/matplotlib) | `3.11.0` | `3.11.1` |
| [caio](https://github.com/mosquito/caio) | `0.9.25` | `0.10.2` |
| [cyclopts](https://github.com/BrianPugh/cyclopts) | `4.21.0` | `4.22.0` |
| [jaraco-functools](https://github.com/jaraco/jaraco.functools) | `4.5.0` | `4.6.0` |
| [joserfc](https://github.com/authlib/joserfc) | `1.7.3` | `1.7.4` |
| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.10.2` | `0.10.6` |
| [narwhals](https://github.com/narwhals-dev/narwhals) | `2.23.0` | `2.24.0` |
| [openai](https://github.com/openai/openai-python) | `2.45.0` | `2.46.0` |
| [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) | `1.43.0` | `1.44.0` |
| [peewee](https://github.com/coleifer/peewee) | `4.2.1` | `4.2.6` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.10.0` | `4.10.1` |
| [pydantic-core](https://github.com/pydantic/pydantic) | `2.46.4` | `2.47.0` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.7.10` | `2026.7.19` |
| [soupsieve](https://github.com/facelessuser/soupsieve) | `2.8.4` | `2.9` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.68.4` | `4.69.0` |
| [yarl](https://github.com/aio-libs/yarl) | `1.24.2` | `1.24.5` |



Updates `langchain` from 1.3.13 to 1.3.14
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](https://github.com/langchain-ai/langchain/compare/langchain==1.3.13...langchain==1.3.14)

Updates `pypdfium2` from 5.11.0 to 5.12.1
- [Release notes](https://github.com/pypdfium2-team/pypdfium2/releases)
- [Commits](https://github.com/pypdfium2-team/pypdfium2/compare/5.11.0...5.12.1)

Updates `ccxt` from 4.5.64 to 4.5.67
- [Release notes](https://github.com/ccxt/ccxt/releases)
- [Commits](https://github.com/ccxt/ccxt/compare/v4.5.64...v4.5.67)

Updates `fastapi` from 0.139.0 to 0.139.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](https://github.com/fastapi/fastapi/compare/0.139.0...0.139.2)

Updates `matplotlib` from 3.11.0 to 3.11.1
- [Release notes](https://github.com/matplotlib/matplotlib/releases)
- [Commits](https://github.com/matplotlib/matplotlib/compare/v3.11.0...v3.11.1)

Updates `caio` from 0.9.25 to 0.10.2
- [Release notes](https://github.com/mosquito/caio/releases)
- [Commits](https://github.com/mosquito/caio/compare/0.9.25...0.10.2)

Updates `cyclopts` from 4.21.0 to 4.22.0
- [Release notes](https://github.com/BrianPugh/cyclopts/releases)
- [Commits](https://github.com/BrianPugh/cyclopts/compare/v4.21.0...v4.22.0)

Updates `jaraco-functools` from 4.5.0 to 4.6.0
- [Release notes](https://github.com/jaraco/jaraco.functools/releases)
- [Changelog](https://github.com/jaraco/jaraco.functools/blob/main/NEWS.rst)
- [Commits](https://github.com/jaraco/jaraco.functools/compare/v4.5.0...v4.6.0)

Updates `joserfc` from 1.7.3 to 1.7.4
- [Release notes](https://github.com/authlib/joserfc/releases)
- [Changelog](https://github.com/authlib/joserfc/blob/main/docs/changelog.rst)
- [Commits](https://github.com/authlib/joserfc/compare/1.7.3...1.7.4)

Updates `langsmith` from 0.10.2 to 0.10.6
- [Release notes](https://github.com/langchain-ai/langsmith-sdk/releases)
- [Commits](https://github.com/langchain-ai/langsmith-sdk/compare/v0.10.2...v0.10.6)

Updates `narwhals` from 2.23.0 to 2.24.0
- [Release notes](https://github.com/narwhals-dev/narwhals/releases)
- [Commits](https://github.com/narwhals-dev/narwhals/compare/v2.23.0...v2.24.0)

Updates `openai` from 2.45.0 to 2.46.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/openai/openai-python/compare/v2.45.0...v2.46.0)

Updates `opentelemetry-api` from 1.43.0 to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python/compare/v1.43.0...v1.44.0)

Updates `peewee` from 4.2.1 to 4.2.6
- [Release notes](https://github.com/coleifer/peewee/releases)
- [Changelog](https://github.com/coleifer/peewee/blob/master/CHANGELOG.md)
- [Commits](https://github.com/coleifer/peewee/compare/4.2.1...4.2.6)

Updates `platformdirs` from 4.10.0 to 4.10.1
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](https://github.com/tox-dev/platformdirs/compare/4.10.0...4.10.1)

Updates `pydantic-core` from 2.46.4 to 2.47.0
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](https://github.com/pydantic/pydantic/commits)

Updates `regex` from 2026.7.10 to 2026.7.19
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](https://github.com/mrabarnett/mrab-regex/compare/2026.7.10...2026.7.19)

Updates `soupsieve` from 2.8.4 to 2.9
- [Release notes](https://github.com/facelessuser/soupsieve/releases)
- [Commits](https://github.com/facelessuser/soupsieve/compare/2.8.4...2.9)

Updates `tqdm` from 4.68.4 to 4.69.0
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](https://github.com/tqdm/tqdm/compare/v4.68.4...v4.69.0)

Updates `yarl` from 1.24.2 to 1.24.5
- [Release notes](https://github.com/aio-libs/yarl/releases)
- [Changelog](https://github.com/aio-libs/yarl/blob/master/CHANGES.rst)
- [Commits](https://github.com/aio-libs/yarl/compare/v1.24.2...v1.24.5)

---
updated-dependencies:
- dependency-name: langchain
  dependency-version: 1.3.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pypdfium2
  dependency-version: 5.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: ccxt
  dependency-version: 4.5.67
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: fastapi
  dependency-version: 0.139.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: matplotlib
  dependency-version: 3.11.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: caio
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: cyclopts
  dependency-version: 4.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: jaraco-functools
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: joserfc
  dependency-version: 1.7.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: langsmith
  dependency-version: 0.10.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: narwhals
  dependency-version: 2.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: openai
  dependency-version: 2.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: opentelemetry-api
  dependency-version: 1.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: peewee
  dependency-version: 4.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: platformdirs
  dependency-version: 4.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: pydantic-core
  dependency-version: 2.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: regex
  dependency-version: 2026.7.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
- dependency-name: soupsieve
  dependency-version: '2.9'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: tqdm
  dependency-version: 4.69.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: yarl
  dependency-version: 1.24.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-20 11:03:53 +00:00
dependabot[bot] 8d27badecd build(deps): bump websockets from 15.0.1 to 16.1.1 
Bumps [websockets](https://github.com/python-websockets/websockets) from 15.0.1 to 16.1.1.
- [Release notes](https://github.com/python-websockets/websockets/releases)
- [Commits](https://github.com/python-websockets/websockets/compare/15.0.1...16.1.1)

---
updated-dependencies:
- dependency-name: websockets
  dependency-version: 16.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-20 10:54:10 +00:00
root 0de5a78ccd build: add Longbridge credentials module and optional dependency 
- Add credentials.py: unified credential resolution for data and trading
- Add test_longbridge_credentials.py: coverage for credential resolution
- Remove longbridge from requirements.txt (optional extra only)
- Update requirements-lock.txt
- Update .env.example with Longbridge credential hints
 2026-07-16 19:23:54 +08:00
tianrking 3eb598faf5 fix(deps): regenerate runtime lock 
Signed-off-by: tianrking <10758833+tianrking@users.noreply.github.com>
 2026-07-16 12:58:47 +08:00
dependabot[bot] a45f465e9e chore(deps): bump pydantic-core from 2.46.4 to 2.47.0 (#503) 
CI green (test + build). Verified mergeable/clean against current main.
 2026-07-13 12:18:33 +08:00
dependabot[bot] 9ce904a388 chore(deps): bump anyio from 4.14.1 to 4.14.2 (#500) 
CI green (test + build). Verified mergeable/clean against current main.
 2026-07-13 12:18:27 +08:00
dependabot[bot] 4669bf1810 chore(deps): bump websockets from 15.0.1 to 16.1 (#495) 
CI green (test + build). Verified mergeable/clean against current main.
 2026-07-13 12:18:06 +08:00
dependabot[bot] bddbce9fef chore(deps): bump peewee from 4.1.2 to 4.2.1 (#491) 
CI green (test + build). Verified mergeable/clean against current main.
 2026-07-13 12:18:02 +08:00
dependabot[bot] 5cd3a26419 chore(deps): bump caio from 0.9.25 to 0.10.2 (#489) 
CI green (test + build). Verified mergeable/clean against current main.
 2026-07-13 12:17:54 +08:00
Haozhe Wu 4e3c91c77a security: address all 10 findings from external audit (issue #476) 
Implements VT-001 through VT-010 from the 2026-07-10 external security
audit (Trivy/Semgrep/ZAP/Gitleaks/pip-audit against a real deployment):

- VT-001 (Critical): AST hardening in backtest/runner.py rejects
  network/subprocess/eval/os.environ/unsafe-open calls reachable from
  generated SignalEngine method bodies (previously only checked
  top-level statements). Defense-in-depth: ephemeral per-run HOME,
  RLIMIT_AS/NOFILE caps, best-effort UID-drop to a new vibe-sandbox
  user (currently inert under Docker's cap model - see session doc;
  accepted as documented residual gap, primary AST defense unaffected).
- VT-002: multi-stage Dockerfile split so build-essential never
  reaches the runtime image.
- VT-003: SSE auth moved from a long-lived API key in the URL query
  string to short-lived single-use tickets; access-log redaction for
  any remaining query secrets.
- VT-004: agent/.env split-brain fixed (bind mount + atomic 0600
  writes) between docker-compose and Web UI settings writes.
- VT-005: /correlation now requires auth + per-IP rate limit; generic
  exceptions no longer leak raw text to clients.
- VT-006: CSP-Report-Only + security headers middleware; Google Fonts
  replaced with self-hosted @fontsource packages.
- VT-007: docker-compose hardening (cap_drop ALL + minimal cap_add,
  no-new-privileges, read_only rootfs, resource limits).
- VT-008: /health split into /live (liveness) and /ready (real
  provider-config readiness check); /health kept as a compat alias.
- VT-009: base images pinned by digest, GitHub Actions pinned by
  commit SHA, dependabot.yml added, hash-verified requirements-lock.txt
  now actually wired into the Docker build via --require-hashes.
- VT-010: universe-panel pickle cache sidecar upgraded from an
  unkeyed SHA-256 (forgeable by anyone with cache-dir write access)
  to a keyed HMAC.

Implemented via a 5-parcel Workflow (file-disjoint, independent
adversarial verification per parcel, then a holistic final audit).
The final audit caught a real regression (CI env-var-gate violation)
and confirmed a dependency-pinning gap, both fixed and re-verified
here, including a latent transitive-dependency bug the fix surfaced
(smartmoneyconcepts<0.0.27 pulls an unbuildable zigzag package) - see
docs/sessions/2026-07-13_session_vt476_security_hardening.md (local,
gitignored) for full evidence trail.

Full suite: 5191 passed, 6 pre-existing/environmental failures
(unchanged from main). Docker build + hardened compose boot verified
end-to-end.
 2026-07-13 01:40:53 +08:00