Dependabot/pip/backend api python/python runtime c5b646c891

.github/workflows/scorecard.yml

@@ -39,6 +39,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/upload-sarif@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
         with:
           sarif_file: results.sarif

.github/workflows/security-ci.yml

@@ -71,9 +71,9 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
         with:
           languages: python
 
       - name: Analyze
-        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2

backend_api_python/requirements-dev.txt

@@ -1,7 +1,7 @@
 bandit[toml]>=1.9.4,<2
 pip-audit>=2.10.1,<3
-pytest>=9.1.1,<10
+pytest>=9.2.0,<10
 pytest-cov>=7.1.0,<8
 pytest-timeout>=2.4.0,<3
-ruff>=0.17.1,<0.18
+ruff>=0.17.3,<0.18
 xlrd>=2.0.2,<3

backend_api_python/requirements.txt

@@ -7,25 +7,25 @@ yfinance>=1.7.0
 # GHSA-cq5v-8q36-5273 (C parser OOB read), GHSA-mfx4-hv73-q22v and
 # GHSA-mq44-7p77-q5h7 (WebSocket parsing); 3.14.3+
 aiohttp>=3.14.5,<3.15
-pandas>=3.0.6
+pandas>=3.1.0
 # Strategy API V2 technical indicator runtime. Wheels bundle the C library.
-TA-Lib==0.8.2
+TA-Lib==0.8.3
 exchange-calendars>=4.13.2,<5
 # LiteLLM currently declares filelock<4.0, but the 4.2.4 runtime is compatible
 # and resolves CVE-2026-112940, CVE-2026-112913, and CVE-2026-112907.
 # Production installs the complete verified lock with --no-deps.
-filelock>=4.2.4,<5
+filelock>=4.2.7,<5
 requests>=2.34.2
 # CVE-2026-97687 and related redirect/decompression advisories; 2.8.0+
 urllib3>=2.8.0,<3
 websocket-client>=1.9.2,<2
 # websocket-client 1.9+ delegates SOCKS4/5 proxy connections to python-socks.
-python-socks>=3.1.1,<4
+python-socks>=3.2.1,<4
 # CVE-2026-84377; 1.93.2+
 litellm>=1.106.2,<1.107
-certifi>=2026.10.19
+certifi>=2026.10.23
 PySocks>=1.7.1
-akshare>=1.19.1
+akshare>=1.20.25
 # GHSA-752w-5fwx-jx9f and 2026 JWT validation advisories; 2.15.0+
 PyJWT>=2.15.1,<3
 python-dotenv>=1.2.4
@@ -41,13 +41,13 @@ psycopg2-binary>=2.9.13
 # Runtime metrics
 prometheus-client>=0.26.0,<1
 # Kafka event backbone
-confluent-kafka>=2.16.0,<3
+confluent-kafka>=2.16.1,<3
 # Redis cache (optional but recommended for multi-worker setups).
 # Celery 5.6 / Kombu 5.6 currently require redis-py <6.5. This client remains
 # compatible with the Redis 8 server used by the production stack.
 redis>=6.4.0,<6.5
 # CVE-2026-114613; 1.2.3+
-msgpack>=1.2.3,<2
+msgpack>=1.2.4,<2
 # Durable background jobs and periodic maintenance
 celery[redis]>=5.6.3,<6
 # Production WSGI server
@@ -59,7 +59,7 @@ PyYAML>=6.0.3
 # Server-side PDF export for AI analysis reports
 # PDF parser security advisories through CVE-2026-119205; 6.21.4+
 pypdf>=6.21.4,<7
-reportlab>=5.0.1
+reportlab>=5.1.0
 # Password hashing
 bcrypt>=5.0.0
 # Interactive Brokers trading (optional, for US stock trading via TWS/IB Gateway)
@@ -71,4 +71,4 @@ ib_insync>=0.9.86
 # google-search-results>=2.4.0
 alpaca-py>=0.44.0
 # Official Tiger Brokers OpenAPI SDK.
-tigeropen==3.7.2
+tigeropen==3.8.0