From 5f71a9591d71a5890dc123de1459fd6901868485 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 17:59:02 +0000 Subject: [PATCH] chore(deps): bump the python-runtime group across 1 directory with 17 updates Updates the requirements on [ruff](https://github.com/astral-sh/ruff), [werkzeug](https://github.com/pallets/werkzeug), [yfinance](https://github.com/ranaroussi/yfinance), [pandas](https://github.com/pandas-dev/pandas), [ta-lib](https://github.com/ta-lib/ta-lib-python), [websocket-client](https://github.com/websocket-client/websocket-client), [litellm](https://github.com/BerriAI/litellm), [certifi](https://github.com/certifi/python-certifi), [akshare](https://github.com/akfamily/akshare), [python-dotenv](https://github.com/theskumar/python-dotenv), [cryptography](https://github.com/pyca/cryptography), [psycopg2-binary](https://github.com/psycopg/psycopg2), [redis](https://github.com/redis/redis-py), [gunicorn](https://github.com/benoitc/gunicorn), [marshmallow](https://github.com/marshmallow-code/marshmallow), [reportlab](https://www.reportlab.com/) and [alpaca-py](https://github.com/alpacahq/alpaca-py) to permit the latest version. Updates `ruff` to 0.16.9 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](https://github.com/astral-sh/ruff/compare/0.16.0...0.16.9) Updates `werkzeug` to 3.1.9 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](https://github.com/pallets/werkzeug/compare/3.1.8...3.1.9) Updates `yfinance` to 1.7.0 - [Release notes](https://github.com/ranaroussi/yfinance/releases) - [Changelog](https://github.com/ranaroussi/yfinance/blob/main/CHANGELOG.rst) - [Commits](https://github.com/ranaroussi/yfinance/compare/1.5.2...1.7.0) Updates `pandas` to 3.0.6 - [Release notes](https://github.com/pandas-dev/pandas/releases) - [Commits](https://github.com/pandas-dev/pandas/compare/v3.0.5...v3.0.6) Updates `ta-lib` from 0.7.1 to 0.8.1 - [Release notes](https://github.com/ta-lib/ta-lib-python/releases) - [Changelog](https://github.com/TA-Lib/ta-lib-python/blob/master/CHANGELOG) - [Commits](https://github.com/ta-lib/ta-lib-python/compare/v0.7.1...v0.8.1) Updates `websocket-client` to 1.9.2 - [Release notes](https://github.com/websocket-client/websocket-client/releases) - [Changelog](https://github.com/websocket-client/websocket-client/blob/master/ChangeLog) - [Commits](https://github.com/websocket-client/websocket-client/compare/v1.9.0...v1.9.2) Updates `litellm` to 1.103.0 - [Release notes](https://github.com/BerriAI/litellm/releases) - [Commits](https://github.com/BerriAI/litellm/compare/v1.93.2...v1.103.0) Updates `certifi` to 2026.7.22 - [Commits](https://github.com/certifi/python-certifi/compare/2026.06.17...2026.07.22) Updates `akshare` to 1.18.97 - [Release notes](https://github.com/akfamily/akshare/releases) - [Changelog](https://github.com/akfamily/akshare/blob/main/docs/changelog.md) - [Commits](https://github.com/akfamily/akshare/compare/release-v1.18.80...release-v1.18.97) Updates `python-dotenv` to 1.2.3 - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](https://github.com/theskumar/python-dotenv/compare/v1.2.2...v1.2.3) Updates `cryptography` to 50.0.1 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pyca/cryptography/compare/50.0.0...50.0.1) Updates `psycopg2-binary` to 2.9.13 - [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS) - [Commits](https://github.com/psycopg/psycopg2/compare/2.9.12...2.9.13) Updates `redis` to 8.1.0 - [Release notes](https://github.com/redis/redis-py/releases) - [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES) - [Commits](https://github.com/redis/redis-py/compare/v6.4.0...v8.1.0) Updates `gunicorn` to 26.2.0 - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](https://github.com/benoitc/gunicorn/compare/26.0.0...26.2.0) Updates `marshmallow` to 4.3.1 - [Changelog](https://github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst) - [Commits](https://github.com/marshmallow-code/marshmallow/compare/4.3.0...4.3.1) Updates `reportlab` to 5.0.1 Updates `alpaca-py` to 0.44.0 - [Release notes](https://github.com/alpacahq/alpaca-py/releases) - [Commits](https://github.com/alpacahq/alpaca-py/compare/v0.43.5...v0.44.0) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.16.9 dependency-type: direct:development dependency-group: python-runtime - dependency-name: werkzeug dependency-version: 3.1.9 dependency-type: direct:production dependency-group: python-runtime - dependency-name: yfinance dependency-version: 1.7.0 dependency-type: direct:production dependency-group: python-runtime - dependency-name: pandas dependency-version: 3.0.6 dependency-type: direct:production dependency-group: python-runtime - dependency-name: ta-lib dependency-version: 0.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-runtime - dependency-name: websocket-client dependency-version: 1.9.2 dependency-type: direct:production dependency-group: python-runtime - dependency-name: litellm dependency-version: 1.103.0 dependency-type: direct:production dependency-group: python-runtime - dependency-name: certifi dependency-version: 2026.7.22 dependency-type: direct:production dependency-group: python-runtime - dependency-name: akshare dependency-version: 1.18.97 dependency-type: direct:production dependency-group: python-runtime - dependency-name: python-dotenv dependency-version: 1.2.3 dependency-type: direct:production dependency-group: python-runtime - dependency-name: cryptography dependency-version: 50.0.1 dependency-type: direct:production dependency-group: python-runtime - dependency-name: psycopg2-binary dependency-version: 2.9.13 dependency-type: direct:production dependency-group: python-runtime - dependency-name: redis dependency-version: 8.1.0 dependency-type: direct:production dependency-group: python-runtime - dependency-name: gunicorn dependency-version: 26.2.0 dependency-type: direct:production dependency-group: python-runtime - dependency-name: marshmallow dependency-version: 4.3.1 dependency-type: direct:production dependency-group: python-runtime - dependency-name: reportlab dependency-version: 5.0.1 dependency-type: direct:production dependency-group: python-runtime - dependency-name: alpaca-py dependency-version: 0.44.0 dependency-type: direct:production dependency-group: python-runtime ... Signed-off-by: dependabot[bot] --- backend_api_python/requirements-dev.txt | 2 +- backend_api_python/requirements.txt | 32 ++++++++++++------------- 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/backend_api_python/requirements-dev.txt b/backend_api_python/requirements-dev.txt index a322b7323..32612a60b 100644 --- a/backend_api_python/requirements-dev.txt +++ b/backend_api_python/requirements-dev.txt @@ -3,4 +3,4 @@ pip-audit>=2.10.1,<3 pytest>=9.1.1,<10 pytest-cov>=7.1.0,<8 pytest-timeout>=2.4.0,<3 -ruff>=0.16.0,<0.17 +ruff>=0.16.9,<0.17 diff --git a/backend_api_python/requirements.txt b/backend_api_python/requirements.txt index c33d5c140..2086b793e 100644 --- a/backend_api_python/requirements.txt +++ b/backend_api_python/requirements.txt @@ -1,35 +1,35 @@ # Flask 3.1.3+ / Werkzeug 3.1.6+: GHSA-68rp-wp8r-4726 (session/Vary: Cookie), GHSA-29vq-49wr-vm6x (safe_join) Flask==3.1.3 -Werkzeug>=3.1.8 +Werkzeug>=3.1.9 flask-cors==6.0.5 finnhub-python>=2.4.29 -yfinance>=1.5.2 +yfinance>=1.7.0 # GHSA-cq5v-8q36-5273 (C parser OOB read), GHSA-mfx4-hv73-q22v and # GHSA-mq44-7p77-q5h7 (WebSocket parsing); 3.14.3+ aiohttp>=3.14.3,<3.15 -pandas>=3.0.5 +pandas>=3.0.6 # Strategy API V2 technical indicator runtime. The 0.6.x wheels bundle the C library. -TA-Lib==0.7.1 +TA-Lib==0.8.1 exchange-calendars>=4.13.2,<5 requests>=2.34.2 # CVE-2026-97687 and related redirect/decompression advisories; 2.8.0+ urllib3>=2.8.0,<3 -websocket-client>=1.9.0,<2 +websocket-client>=1.9.2,<2 # CVE-2026-84377; 1.93.2+ -litellm>=1.93.2,<1.94 -certifi>=2026.6.17 +litellm>=1.103.0,<1.104 +certifi>=2026.7.22 PySocks>=1.7.1 -akshare>=1.18.80 +akshare>=1.18.97 # GHSA-752w-5fwx-jx9f and 2026 JWT validation advisories; 2.15.0+ PyJWT>=2.15.0,<3 -python-dotenv>=1.2.2 +python-dotenv>=1.2.3 # GHSA-g6cj-pr64-35w5 (PKCS#7 Bleichenbacher oracle); 50.0.0+ -cryptography>=50.0.0,<51 +cryptography>=50.0.1,<51 # TOTP MFA and QR code generation pyotp>=2.10.0 qrcode[pil]>=8.2 # PostgreSQL support (multi-user mode) -psycopg2-binary>=2.9.12 +psycopg2-binary>=2.9.13 # Runtime metrics prometheus-client>=0.26.0,<1 # Kafka event backbone @@ -37,19 +37,19 @@ confluent-kafka>=2.15.1,<3 # Redis cache (optional but recommended for multi-worker setups). # Celery 5.6 / Kombu 5.6 currently require redis-py <6.5. This client remains # compatible with the Redis 8 server used by the production stack. -redis>=6.4.0,<6.5 +redis>=8.1.0,<8.2 # Durable background jobs and periodic maintenance celery[redis]>=5.6.3,<6 # Production WSGI server -gunicorn>=26.0.0 +gunicorn>=26.2.0 # OpenAPI generation (flask-smorest) flask-smorest>=0.47.0,<0.48 -marshmallow>=4.3.0,<5 +marshmallow>=4.3.1,<5 PyYAML>=6.0.3 # Server-side PDF export for AI analysis reports # PDF parser security advisories; 6.19.0+ pypdf>=6.19.0,<7 -reportlab>=5.0.0 +reportlab>=5.0.1 # Password hashing bcrypt>=5.0.0 # Interactive Brokers trading (optional, for US stock trading via TWS/IB Gateway) @@ -59,4 +59,4 @@ ib_insync>=0.9.86 # tavily-python>=0.3.0 # SerpAPI - Google/Bing search scraper (free 100 requests/month) # google-search-results>=2.4.0 -alpaca-py>=0.43.5 +alpaca-py>=0.44.0