From e680a776a1405d7e7d4ece6362d2d28bb5888e96 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 4 Sep 2026 15:35:52 +0000 Subject: [PATCH] chore(deps): bump the python-runtime group Updates the requirements on [yfinance](https://github.com/ranaroussi/yfinance), [ccxt](https://github.com/ccxt/ccxt), [websocket-client](https://github.com/websocket-client/websocket-client), [litellm](https://github.com/BerriAI/litellm), [certifi](https://github.com/certifi/python-certifi), [akshare](https://github.com/akfamily/akshare), [python-dotenv](https://github.com/theskumar/python-dotenv), [cryptography](https://github.com/pyca/cryptography), [redis](https://github.com/redis/redis-py), [gunicorn](https://github.com/benoitc/gunicorn), [marshmallow](https://github.com/marshmallow-code/marshmallow), [reportlab](https://www.reportlab.com/), [alpaca-py](https://github.com/alpacahq/alpaca-py) and [ruff](https://github.com/astral-sh/ruff) to permit the latest version. Updates `yfinance` to 1.7.0 - [Release notes](https://github.com/ranaroussi/yfinance/releases) - [Changelog](https://github.com/ranaroussi/yfinance/blob/main/CHANGELOG.rst) - [Commits](https://github.com/ranaroussi/yfinance/compare/1.5.2...1.7.0) Updates `ccxt` to 4.5.76 - [Release notes](https://github.com/ccxt/ccxt/releases) - [Commits](https://github.com/ccxt/ccxt/compare/v4.5.73...v4.5.76) Updates `websocket-client` to 1.9.2 - [Release notes](https://github.com/websocket-client/websocket-client/releases) - [Changelog](https://github.com/websocket-client/websocket-client/blob/master/ChangeLog) - [Commits](https://github.com/websocket-client/websocket-client/compare/v1.9.0...v1.9.2) Updates `litellm` to 1.99.0 - [Release notes](https://github.com/BerriAI/litellm/releases) - [Commits](https://github.com/BerriAI/litellm/compare/v1.93.0...v1.99.0) Updates `certifi` to 2026.7.22 - [Commits](https://github.com/certifi/python-certifi/compare/2026.06.17...2026.07.22) Updates `akshare` to 1.18.94 - [Release notes](https://github.com/akfamily/akshare/releases) - [Changelog](https://github.com/akfamily/akshare/blob/main/docs/changelog.md) - [Commits](https://github.com/akfamily/akshare/compare/release-v1.18.80...release-v1.18.94) Updates `python-dotenv` to 1.2.3 - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](https://github.com/theskumar/python-dotenv/compare/v1.2.2...v1.2.3) Updates `cryptography` to 50.0.1 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pyca/cryptography/compare/50.0.0...50.0.1) Updates `redis` to 8.1.0 - [Release notes](https://github.com/redis/redis-py/releases) - [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES) - [Commits](https://github.com/redis/redis-py/compare/v6.4.0...v8.1.0) Updates `gunicorn` to 26.2.0 - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](https://github.com/benoitc/gunicorn/compare/26.0.0...26.2.0) Updates `marshmallow` to 4.3.1 - [Changelog](https://github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst) - [Commits](https://github.com/marshmallow-code/marshmallow/compare/4.3.0...4.3.1) Updates `reportlab` to 5.0.1 Updates `alpaca-py` to 0.44.0 - [Release notes](https://github.com/alpacahq/alpaca-py/releases) - [Commits](https://github.com/alpacahq/alpaca-py/compare/v0.43.5...v0.44.0) Updates `ruff` to 0.16.5 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](https://github.com/astral-sh/ruff/compare/0.16.0...0.16.5) --- updated-dependencies: - dependency-name: yfinance dependency-version: 1.7.0 dependency-type: direct:production dependency-group: python-runtime - dependency-name: ccxt dependency-version: 4.5.76 dependency-type: direct:production dependency-group: python-runtime - dependency-name: websocket-client dependency-version: 1.9.2 dependency-type: direct:production dependency-group: python-runtime - dependency-name: litellm dependency-version: 1.99.0 dependency-type: direct:production dependency-group: python-runtime - dependency-name: certifi dependency-version: 2026.7.22 dependency-type: direct:production dependency-group: python-runtime - dependency-name: akshare dependency-version: 1.18.94 dependency-type: direct:production dependency-group: python-runtime - dependency-name: python-dotenv dependency-version: 1.2.3 dependency-type: direct:production dependency-group: python-runtime - dependency-name: cryptography dependency-version: 50.0.1 dependency-type: direct:production dependency-group: python-runtime - dependency-name: redis dependency-version: 8.1.0 dependency-type: direct:production dependency-group: python-runtime - dependency-name: gunicorn dependency-version: 26.2.0 dependency-type: direct:production dependency-group: python-runtime - dependency-name: marshmallow dependency-version: 4.3.1 dependency-type: direct:production dependency-group: python-runtime - dependency-name: reportlab dependency-version: 5.0.1 dependency-type: direct:production dependency-group: python-runtime - dependency-name: alpaca-py dependency-version: 0.44.0 dependency-type: direct:production dependency-group: python-runtime - dependency-name: ruff dependency-version: 0.16.5 dependency-type: direct:development dependency-group: python-runtime ... Signed-off-by: dependabot[bot] --- backend_api_python/requirements-dev.txt | 2 +- backend_api_python/requirements.txt | 26 ++++++++++++------------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/backend_api_python/requirements-dev.txt b/backend_api_python/requirements-dev.txt index a322b7323..bc4a44360 100644 --- a/backend_api_python/requirements-dev.txt +++ b/backend_api_python/requirements-dev.txt @@ -3,4 +3,4 @@ pip-audit>=2.10.1,<3 pytest>=9.1.1,<10 pytest-cov>=7.1.0,<8 pytest-timeout>=2.4.0,<3 -ruff>=0.16.0,<0.17 +ruff>=0.16.5,<0.17 diff --git a/backend_api_python/requirements.txt b/backend_api_python/requirements.txt index a67055e4b..fea283360 100644 --- a/backend_api_python/requirements.txt +++ b/backend_api_python/requirements.txt @@ -3,8 +3,8 @@ Flask==3.1.3 Werkzeug>=3.1.8 flask-cors==6.0.5 finnhub-python>=2.4.29 -yfinance>=1.5.2 -ccxt>=4.5.73 +yfinance>=1.7.0 +ccxt>=4.5.76 # GHSA-cq5v-8q36-5273 (C parser OOB read), GHSA-mfx4-hv73-q22v and # GHSA-mq44-7p77-q5h7 (WebSocket parsing); 3.14.3+ aiohttp>=3.14.3,<3.15 @@ -13,19 +13,19 @@ pandas>=3.0.5 TA-Lib==0.7.1 exchange-calendars>=4.13.2,<5 requests>=2.34.2 -websocket-client>=1.9.0,<2 -litellm>=1.93.0,<1.94 +websocket-client>=1.9.2,<2 +litellm>=1.99.0,<1.100 # ccxt 4.5.73 pins certifi==2026.6.17. Keep the direct floor # aligned with the exchange client until ccxt relaxes its constraint. -certifi>=2026.6.17 +certifi>=2026.7.22 PySocks>=1.7.1 -akshare>=1.18.80 +akshare>=1.18.94 # GHSA-752w-5fwx-jx9f (crit header); 2.12.0+ PyJWT>=2.13.0,<3 -python-dotenv>=1.2.2 +python-dotenv>=1.2.3 # GHSA-g6cj-pr64-35w5 (PKCS#7 Bleichenbacher oracle); 50.0.0+ # ccxt 4.5.73 currently constrains cryptography to the 50.x release line. -cryptography>=50.0.0,<51 +cryptography>=50.0.1,<51 # TOTP MFA and QR code generation pyotp>=2.10.0 qrcode[pil]>=8.2 @@ -36,19 +36,19 @@ prometheus-client>=0.26.0,<1 # Redis cache (optional but recommended for multi-worker setups). # Celery 5.6 / Kombu 5.6 currently require redis-py <6.5. This client remains # compatible with the Redis 8 server used by the production stack. -redis>=6.4.0,<6.5 +redis>=8.1.0,<8.2 # Durable background jobs and periodic maintenance celery[redis]>=5.6.3,<6 # Production WSGI server -gunicorn>=26.0.0 +gunicorn>=26.2.0 # OpenAPI generation (flask-smorest) flask-smorest>=0.47.0,<0.48 -marshmallow>=4.3.0,<5 +marshmallow>=4.3.1,<5 PyYAML>=6.0.3 # Server-side PDF export for AI analysis reports # PDF resource exhaustion and malformed-stream advisories; 6.16.2+ pypdf>=6.16.2,<7 -reportlab>=5.0.0 +reportlab>=5.0.1 # Password hashing bcrypt>=5.0.0 # Interactive Brokers trading (optional, for US stock trading via TWS/IB Gateway) @@ -58,4 +58,4 @@ ib_insync>=0.9.86 # tavily-python>=0.3.0 # SerpAPI - Google/Bing search scraper (free 100 requests/month) # google-search-results>=2.4.0 -alpaca-py>=0.43.5 +alpaca-py>=0.44.0