From 7b46d41f856bd045943d68d4de7b0ead43c22e24 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Nov 2026 15:34:31 +0000 Subject: [PATCH 1/2] chore(deps): bump the codeql-actions group with 3 updates Bumps the codeql-actions group with 3 updates: [github/codeql-action/upload-sarif](https://github.com/github/codeql-action), [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/upload-sarif` from 4.39.1 to 4.39.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...1fc58d04a4d4374f921bdac573c3811c240f9c26) Updates `github/codeql-action/init` from 4.39.1 to 4.39.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...1fc58d04a4d4374f921bdac573c3811c240f9c26) Updates `github/codeql-action/analyze` from 4.39.1 to 4.39.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9b3254085494b55a0f7c4c2b3d2d52cc712ce370...1fc58d04a4d4374f921bdac573c3811c240f9c26) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/init dependency-version: 4.39.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: codeql-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/scorecard.yml | 2 +- .github/workflows/security-ci.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 67b4e49fd..cb0c42fd9 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -39,6 +39,6 @@ jobs: retention-days: 5 - name: Upload to code scanning - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 + uses: github/codeql-action/upload-sarif@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2 with: sarif_file: results.sarif diff --git a/.github/workflows/security-ci.yml b/.github/workflows/security-ci.yml index 13afb602e..c7ce3c206 100644 --- a/.github/workflows/security-ci.yml +++ b/.github/workflows/security-ci.yml @@ -71,9 +71,9 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - name: Initialize CodeQL - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 + uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2 with: languages: python - name: Analyze - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 + uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2 From 07a49c94dcf8ec09b95b8d211acbf86e8375ea01 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Nov 2026 15:35:40 +0000 Subject: [PATCH 2/2] chore(deps): bump the python-runtime group across 1 directory with 12 updates Updates the requirements on [pandas](https://github.com/pandas-dev/pandas), [ta-lib](https://github.com/ta-lib/ta-lib-python), [filelock](https://github.com/tox-dev/filelock), [python-socks](https://github.com/romis2012/python-socks), [certifi](https://github.com/certifi/python-certifi), [akshare](https://github.com/akfamily/akshare), [confluent-kafka](https://github.com/confluentinc/confluent-kafka-python), [msgpack](https://github.com/msgpack/msgpack-python), [reportlab](https://www.reportlab.com/), [tigeropen](https://github.com/tigerfintech/openapi-python-sdk), [pytest](https://github.com/pytest-dev/pytest) and [ruff](https://github.com/astral-sh/ruff) to permit the latest version. Updates `pandas` to 3.1.0 - [Release notes](https://github.com/pandas-dev/pandas/releases) - [Commits](https://github.com/pandas-dev/pandas/compare/v3.0.6...v3.1.0) Updates `ta-lib` from 0.8.2 to 0.8.3 - [Release notes](https://github.com/ta-lib/ta-lib-python/releases) - [Changelog](https://github.com/TA-Lib/ta-lib-python/blob/master/CHANGELOG) - [Commits](https://github.com/ta-lib/ta-lib-python/compare/v0.8.2...v0.8.3) Updates `filelock` to 4.2.7 - [Release notes](https://github.com/tox-dev/filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](https://github.com/tox-dev/filelock/compare/4.2.4...4.2.7) Updates `python-socks` to 3.2.1 - [Release notes](https://github.com/romis2012/python-socks/releases) - [Commits](https://github.com/romis2012/python-socks/compare/v3.1.1...v3.2.1) Updates `certifi` to 2026.10.23 - [Commits](https://github.com/certifi/python-certifi/compare/2026.10.19...2026.10.23) Updates `akshare` to 1.20.25 - [Release notes](https://github.com/akfamily/akshare/releases) - [Changelog](https://github.com/akfamily/akshare/blob/main/docs/changelog.md) - [Commits](https://github.com/akfamily/akshare/compare/release-v1.19.1...v1.20.25) Updates `confluent-kafka` to 2.16.1 - [Release notes](https://github.com/confluentinc/confluent-kafka-python/releases) - [Changelog](https://github.com/confluentinc/confluent-kafka-python/blob/master/CHANGELOG.md) - [Commits](https://github.com/confluentinc/confluent-kafka-python/compare/v2.16.0...v2.16.1) Updates `msgpack` to 1.2.4 - [Release notes](https://github.com/msgpack/msgpack-python/releases) - [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md) - [Commits](https://github.com/msgpack/msgpack-python/compare/v1.2.3...v1.2.4) Updates `reportlab` to 5.1.0 Updates `tigeropen` from 3.7.2 to 3.8.0 - [Release notes](https://github.com/tigerfintech/openapi-python-sdk/releases) - [Changelog](https://github.com/tigerfintech/openapi-python-sdk/blob/master/CHANGELOG.md) - [Commits](https://github.com/tigerfintech/openapi-python-sdk/compare/v3.7.2...v3.8.0) Updates `pytest` to 9.2.0 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pytest-dev/pytest/compare/9.1.1...9.2.0) Updates `ruff` to 0.17.3 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](https://github.com/astral-sh/ruff/compare/0.17.1...0.17.3) --- updated-dependencies: - dependency-name: pandas dependency-version: 3.1.0 dependency-type: direct:production dependency-group: python-runtime - dependency-name: ta-lib dependency-version: 0.8.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-runtime - dependency-name: filelock dependency-version: 4.2.7 dependency-type: direct:production dependency-group: python-runtime - dependency-name: python-socks dependency-version: 3.2.1 dependency-type: direct:production dependency-group: python-runtime - dependency-name: certifi dependency-version: 2026.10.23 dependency-type: direct:production dependency-group: python-runtime - dependency-name: akshare dependency-version: 1.20.25 dependency-type: direct:production dependency-group: python-runtime - dependency-name: confluent-kafka dependency-version: 2.16.1 dependency-type: direct:production dependency-group: python-runtime - dependency-name: msgpack dependency-version: 1.2.4 dependency-type: direct:production dependency-group: python-runtime - dependency-name: reportlab dependency-version: 5.1.0 dependency-type: direct:production dependency-group: python-runtime - dependency-name: tigeropen dependency-version: 3.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-runtime - dependency-name: pytest dependency-version: 9.2.0 dependency-type: direct:development dependency-group: python-runtime - dependency-name: ruff dependency-version: 0.17.3 dependency-type: direct:development dependency-group: python-runtime ... Signed-off-by: dependabot[bot] --- backend_api_python/requirements-dev.txt | 4 ++-- backend_api_python/requirements.txt | 20 ++++++++++---------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/backend_api_python/requirements-dev.txt b/backend_api_python/requirements-dev.txt index 101a5c92b..8ba7dc072 100644 --- a/backend_api_python/requirements-dev.txt +++ b/backend_api_python/requirements-dev.txt @@ -1,7 +1,7 @@ bandit[toml]>=1.9.4,<2 pip-audit>=2.10.1,<3 -pytest>=9.1.1,<10 +pytest>=9.2.0,<10 pytest-cov>=7.1.0,<8 pytest-timeout>=2.4.0,<3 -ruff>=0.17.1,<0.18 +ruff>=0.17.3,<0.18 xlrd>=2.0.2,<3 diff --git a/backend_api_python/requirements.txt b/backend_api_python/requirements.txt index b08d96d27..1207cf19d 100644 --- a/backend_api_python/requirements.txt +++ b/backend_api_python/requirements.txt @@ -7,25 +7,25 @@ yfinance>=1.7.0 # GHSA-cq5v-8q36-5273 (C parser OOB read), GHSA-mfx4-hv73-q22v and # GHSA-mq44-7p77-q5h7 (WebSocket parsing); 3.14.3+ aiohttp>=3.14.5,<3.15 -pandas>=3.0.6 +pandas>=3.1.0 # Strategy API V2 technical indicator runtime. Wheels bundle the C library. -TA-Lib==0.8.2 +TA-Lib==0.8.3 exchange-calendars>=4.13.2,<5 # LiteLLM currently declares filelock<4.0, but the 4.2.4 runtime is compatible # and resolves CVE-2026-112940, CVE-2026-112913, and CVE-2026-112907. # Production installs the complete verified lock with --no-deps. -filelock>=4.2.4,<5 +filelock>=4.2.7,<5 requests>=2.34.2 # CVE-2026-97687 and related redirect/decompression advisories; 2.8.0+ urllib3>=2.8.0,<3 websocket-client>=1.9.2,<2 # websocket-client 1.9+ delegates SOCKS4/5 proxy connections to python-socks. -python-socks>=3.1.1,<4 +python-socks>=3.2.1,<4 # CVE-2026-84377; 1.93.2+ litellm>=1.106.2,<1.107 -certifi>=2026.10.19 +certifi>=2026.10.23 PySocks>=1.7.1 -akshare>=1.19.1 +akshare>=1.20.25 # GHSA-752w-5fwx-jx9f and 2026 JWT validation advisories; 2.15.0+ PyJWT>=2.15.1,<3 python-dotenv>=1.2.4 @@ -41,13 +41,13 @@ psycopg2-binary>=2.9.13 # Runtime metrics prometheus-client>=0.26.0,<1 # Kafka event backbone -confluent-kafka>=2.16.0,<3 +confluent-kafka>=2.16.1,<3 # Redis cache (optional but recommended for multi-worker setups). # Celery 5.6 / Kombu 5.6 currently require redis-py <6.5. This client remains # compatible with the Redis 8 server used by the production stack. redis>=6.4.0,<6.5 # CVE-2026-114613; 1.2.3+ -msgpack>=1.2.3,<2 +msgpack>=1.2.4,<2 # Durable background jobs and periodic maintenance celery[redis]>=5.6.3,<6 # Production WSGI server @@ -59,7 +59,7 @@ PyYAML>=6.0.3 # Server-side PDF export for AI analysis reports # PDF parser security advisories through CVE-2026-119205; 6.21.4+ pypdf>=6.21.4,<7 -reportlab>=5.0.1 +reportlab>=5.1.0 # Password hashing bcrypt>=5.0.0 # Interactive Brokers trading (optional, for US stock trading via TWS/IB Gateway) @@ -71,4 +71,4 @@ ib_insync>=0.9.86 # google-search-results>=2.4.0 alpaca-py>=0.44.0 # Official Tiger Brokers OpenAPI SDK. -tigeropen==3.7.2 +tigeropen==3.8.0