Skip to content

chore(deps): bump the python-runtime group across 1 directory with 19 updates - #265

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend_api_python/python-runtime-7f02fcbdb5
Open

chore(deps): bump the python-runtime group across 1 directory with 19 updates#265
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend_api_python/python-runtime-7f02fcbdb5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 25, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on ruff, yfinance, ccxt, pandas, ta-lib, websocket-client, litellm, certifi, akshare, pyjwt, python-dotenv, cryptography, psycopg2-binary, redis, gunicorn, marshmallow, pypdf, reportlab and alpaca-py to permit the latest version.
Updates ruff to 0.16.8

Release notes

Sourced from ruff's releases.

0.16.8

Release Notes

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

Install ruff 0.16.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.8

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

0.16.7

Released on 2026-09-10.

Preview features

  • [ruff] Add rule for default values on method receivers (RUF077) (#26700)

... (truncated)

Commits
  • 62914c4 Bump version to 0.16.8 (#28648)
  • c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
  • ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
  • 94efeaa [ty] Compact reachable binding and declaration histories (#28349)
  • 50020fb [ty] Avoid storing constraint nodes twice (#28375)
  • 446bb68 [ty] Compare bound-method receivers before signatures (#28384)
  • 304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
  • d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
  • fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
  • 31131db [ty] Support type[A & B] (#27124)
  • Additional commits viewable in compare view

Updates yfinance to 1.7.0

Release notes

Sourced from yfinance's releases.

1.7.0

Main change:

  • history_metadata now lazy-loads tradingPeriods

Fixes for:

  • proxy
  • stock-split price-repair

Full changelog #2959

Thanks @​amosli

Changelog

Sourced from yfinance's changelog.

1.7.0

Features / improvements:

  • Make history_metadata lazy-load 'tradingPeriods' #2922 Fixes
  • Improve robustness of YfData when behind a SOCKS5 proxy #2953 Price repair:
  • Fix bug in volume-validation of stock-split-repair #2958

1.6.0

Features / improvements

1.5.2

Patches

  • Fix yfinance breaking with curl_cffi>=0.16

1.5.1

Minor

  • Fall back to chunked requests when single-URL fundamentals fetch times out #2811
  • Replace valuation-measures HTML scrape with timeseries API #2851 Patches
  • Determine login and subscription tier via the subscriptions API #2845
  • Preserve user login cookies across cookie-strategy switches #2850

... (truncated)

Commits
  • 3d9d2f0 Version 1.7.0
  • 43f3021 Merge pull request #2959 from ranaroussi/dev
  • 686a031 Minor test fix
  • fdede94 Merge pull request #2953 from amosli/fix/cookie-crumb-proxy-resilience
  • 5c1f64e Fixes for PR #2958
  • c732994 Merge pull request #2958 from ranaroussi/fix/price-repair-split-volume-valida...
  • ba7b650 Fix proxy wipe and make cookie/crumb failures non-fatal
  • 0f29c85 Fix bug in volume-validation of stock-split-repair, that was wrongly blocking...
  • baeca64 Merge pull request #2918 from dokson/fix/drop-nospam-extra
  • 5261b4d Drop unusable nospam extra and py2 cruft
  • Additional commits viewable in compare view

Updates ccxt to 4.5.82

Commits
  • fd7842b [Automated changes] 4.5.82
  • 6c98f32 [Automated changes] Rust files
  • 437129b [Automated changes] Java files
  • 6454e87 [Automated changes] C# files
  • 47e83e4 [Automated changes] GO files
  • 9e47f96 [Automated changes] JS files
  • 66b798e [Automated changes] PHP files
  • 83d524b [Automated changes] Python files
  • d0974f6 fix(upbit): prevent concurrent subscription enumeration failures (#30514)
  • 2052889 [Automated changes] Rust files
  • Additional commits viewable in compare view

Updates pandas to 3.0.6

Release notes

Sourced from pandas's releases.

pandas 3.0.6

We are pleased to announce the release of pandas 3.0.6. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version. This is also the first release to support Python 3.15.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits
  • 2905718 RLS: 3.0.6
  • 3188ced [backport 3.0.x] BUG: read_csv(sep=None) raised TypeError instead of falling...
  • f097905 DOC: cleanup 3.0.6 whatsnew + mention Python 3.15 support (#68965) (#68969)
  • 4f68223 [backport 3.0.x] BUG: fix setting with bool column mask into 1-column DataFra...
  • e3df0e8 [backport 3.0.x] BUG: full-slice setitem into a pyarrow-backed array shared m...
  • b7735f6 Backport PR #66117 on branch 3.0.x (BUG: interpolate leaving NAs unfilled for...
  • bca0b77 [backport 3.0.x] BUG: read_csv leaked the string-intern table when a column f...
  • bca1e5d [backport 3.0.x] BUG: prevent external mutation of RangeIndex._data (CoW) (#6...
  • c95b42c [3.0.x] CI: skip cython-lint on pre-commit.ci (#68910)
  • 9cbd884 [backport 3.0.x] Backport of some already merged regression fixes (#68447)
  • Additional commits viewable in compare view

Updates ta-lib from 0.7.1 to 0.8.1

Release notes

Sourced from ta-lib's releases.

v0.8.1

  • [CHANGE]: talib.stream is now the real streaming API of TA-Lib C 0.8.1: stream.SMA(close) returns a handle, not a value. handle.value is the value at the last history bar, handle.update(bar) costs O(1) and returns that bar's value, handle.peek(bar) evaluates a forming bar without committing it, and handle.copy() forks it. stream.SMA.open_and_fill() returns the handle and the Function API's series in one pass. A multi-output function answers with the same tuple the Function API returns. The old last-value functions -- talib.stream.SMA, talib.stream_SMA, and their _ta_lib.pyi stubs -- are gone; talib/stream.pyi types the handles instead.

    Migrating is stream.X(...) -> stream.X(...).value, and the compiler cannot find the sites for you: if stream.CDLDOJI(o, h, l, c): used to test the pattern and now tests a handle, which is always true.

  • [NEW]: talib.InsufficientHistory, raised when a stream is opened with too little history. It is the library's one recoverable error, so it is catchable on its own rather than as a bare Exception.

  • [FIX]: help(talib.SUPERTREND) and the abstract stub named the outputs real and integer; they are supertrend and trend, the names abstract.Function('SUPERTREND').output_names already reported.

  • [FIX]: An empty array given to a function whose lookback is zero, such as talib.ACOS or talib.MA(x, timeperiod=1), made TA-Lib read and write one element outside the buffers, which could crash the interpreter later or corrupt memory silently. An empty input now returns empty outputs without calling TA-Lib, whatever the function and its parameters. The bug dates from 0.4.27.

v0.8.0

  • [NEW]: Support TA-Lib C 0.8.1, which is now the minimum required version.

  • [NEW]: The 40 functions TA-Lib C added since 0.7.1: AC, ADR, AO, CMF, CMOU, COPPOCK, CUMSUM, CVI, DONCHIAN, DPO, EFI, ER, ERI, FOSC, FRACTAL, HA, HMA, KC, KDJ, MARKETFI, MASSI, NVI, PERCENTILE, PERCENTRANK, PVI, PVO, PVT, QSTICK, RMA, RVI, RVOL, SMI, SUPERTREND, TSI, VHF, VORTEX, VWAP, VWMA, WAD, ZLEMA.

  • [NEW]: New moving averages: MA_Type.HMA, MA_Type.DISABLED, MA_Type.DEFAULT, MA_Type.ZLEMA and MA_Type.RMA.

  • [NEW]: set_unstable_period() and get_unstable_period() accept 'RMA', 'HA' and 'RVI'.

  • [FIX]: abstract raised KeyError on function and output flags added after this wrapper was written; unknown flag bits are now ignored.

  • [FIX]: A moving-average parameter not spelled exactly matype -- KDJ's slowk_matype -- defaulted to SMA rather than to the function's own documented default.

  • [FIX]: An integer output is documented as the candlestick -100/0/100 convention only for candlestick functions; SUPERTREND's is a trend direction.

  • [CHANGE]: APO and PPO now default matype to EMA, and BBANDS defaults timeperiod to 20, following TA-Lib C 0.8.1.

  • [FIX]: set_unstable_period() targeted the wrong function for every id after IMI (e.g. 'RSI' set PLUS_DM); ids now come from the C header. 'ADXR', 'MFI' and 'STOCHRSI' are no-ops that emit a DeprecationWarning.

  • [CHANGE]: Remove the unnecessary build runtime dependency and wheel build dependency.

  • [NEW]: Upgrade to Cython 3.3.0

Changelog

Sourced from ta-lib's changelog.

0.8.1

  • [CHANGE]: talib.stream is now the real streaming API of TA-Lib C 0.8.1: stream.SMA(close) returns a handle, not a value. handle.value is the value at the last history bar, handle.update(bar) costs O(1) and returns that bar's value, handle.peek(bar) evaluates a forming bar without committing it, and handle.copy() forks it. stream.SMA.open_and_fill() returns the handle and the Function API's series in one pass. A multi-output function answers with the same tuple the Function API returns. The old last-value functions -- talib.stream.SMA, talib.stream_SMA, and their _ta_lib.pyi stubs -- are gone; talib/stream.pyi types the handles instead.

    Migrating is stream.X(...) -> stream.X(...).value, and the compiler cannot find the sites for you: if stream.CDLDOJI(o, h, l, c): used to test the pattern and now tests a handle, which is always true.

  • [NEW]: talib.InsufficientHistory, raised when a stream is opened with too little history. It is the library's one recoverable error, so it is catchable on its own rather than as a bare Exception.

  • [FIX]: help(talib.SUPERTREND) and the abstract stub named the outputs real and integer; they are supertrend and trend, the names abstract.Function('SUPERTREND').output_names already reported.

  • [FIX]: An empty array given to a function whose lookback is zero, such as talib.ACOS or talib.MA(x, timeperiod=1), made TA-Lib read and write one element outside the buffers, which could crash the interpreter later or corrupt memory silently. An empty input now returns empty outputs without calling TA-Lib, whatever the function and its parameters. The bug dates from 0.4.27.

0.8.0

  • [NEW]: Support TA-Lib C 0.8.1, which is now the minimum required version.

  • [NEW]: The 40 functions TA-Lib C added since 0.7.1: AC, ADR, AO, CMF, CMOU, COPPOCK, CUMSUM, CVI, DONCHIAN, DPO, EFI, ER, ERI, FOSC, FRACTAL, HA, HMA, KC, KDJ, MARKETFI, MASSI, NVI, PERCENTILE, PERCENTRANK, PVI, PVO, PVT, QSTICK, RMA, RVI, RVOL, SMI, SUPERTREND, TSI, VHF, VORTEX, VWAP, VWMA, WAD, ZLEMA.

  • [NEW]: New moving averages: MA_Type.HMA, MA_Type.DISABLED, MA_Type.DEFAULT, MA_Type.ZLEMA and MA_Type.RMA.

  • [NEW]: set_unstable_period() and get_unstable_period() accept 'RMA', 'HA' and 'RVI'.

... (truncated)

Commits
  • 8f5cadc docs: updates
  • e5aab28 ci: add the dev-* release lane, pinned to the wheels' TA-Lib C
  • f4ad30e test: accept a TA-Lib C newer than we require
  • 9c7f7bd update README from TA-Lib C 0.7.1 to 0.8.1
  • 7a10655 version bump
  • f972213 fix(func): no input, no output
  • bdb8c5e fix(func): SUPERTREND's outputs are supertrend and trend
  • 7a5544c changelog: the streaming entries belong to the next release
  • 25dd74b fix(abstract): stop relying on Cython resolving __NAME from class scope
  • a93703b perf(stream): multi-output handles answer with a plain tuple
  • Additional commits viewable in compare view

Updates websocket-client to 1.9.2

Release notes

Sourced from websocket-client's releases.

v1.9.2

1.9.2

  • Fix race in WebSocketApp.close() when run_forever() thread clears the socket during the close handshake (#1057, fixes #1055 and #1056)
Changelog

Sourced from websocket-client's changelog.

  • 1.9.2

    • Fix race in WebSocketApp.close() when run_forever() thread clears the socket during the close handshake (#1057, fixes #1055 and #1056)

  • 1.9.1

    • Add Python 3.14 support to setup config and CI (f2bc97a)
    • Fix close() dropping close frame when reason is str (2f22e2e)
    • Fix close() type annotation and docstring for timeout and reason (d69f730)
    • Make abort() robust for sockets that cannot shutdown, same logic as shutdown() (1904e3d)
    • Raise WebSocketException for redirects missing a Location header (97e34db)
    • Raise when WebSocket connect redirect limit is exhausted (be0d38d)
    • Raise WebSocketException for redirects to invalid targets (62ef6af)
    • Fix unformatted ABNF validation error messages (0145b7b)
    • Fix validate_utf8() crash on str input (4a8e6ed)
    • Store status_message on WebSocketBadStatusException (368aeda)
    • Raise WebSocketException for check_hostname with CERT_NONE (0232aca)
    • Fix handleDisconnect type annotation: None default requires Optional (20f3712)
    • Remove unreachable not frame check in recv_data_frame() (b684242)
    • Set proxy_timeout on proxy_info without a proxy host (68f0aed)
    • Fix _wsdump.py bytes annotations and remove dead code (5ecc6e4)
    • Export STATUS_SERVICE_RESTART and STATUS_TRY_AGAIN_LATER close codes (22279c4)
    • Fix extract_err_message() to always return str (e2091bd)
    • Raise WebSocketProxyException for SOCKS proxy without a port, correct proxy port docs (3c62bdf)
    • Raise WebSocketException for malformed HTTP responses (04f4d94)
    • Fix docs examples using dead or unreachable endpoints (2fc92c0)
    • Add pyproject.toml, drop deprecated setup.py metadata (8b34f50)
    • Apply linting (3b4ffab)

  • 1.9.0

    • Remove Python 3.8 support (EOL), add Python 3.13 (5f25030)
    • Remove localhost and 127.0.0.1 from default NO_PROXY list (#994)
    • Support IPv6 CIDRs in the no_proxy option (#1033)
    • Fix thread safety condition in teardown() to improve run_forever() (#1015)
    • Fix #1024 by chunking data, recursion in on_error callback, thread leak in _stop_ping_thread(), avoid implicit None in recv() (#1036)
    • Avoid bare except clauses for better error handling (#1036)
    • Fix async (#983)
    • Resolve mypy type errors (#996, #1006, 813d570)
    • Test coverage improvements (#1035, #1036)
    • flake8 linting improvements (#1034)

  • 1.8.0

    • Added on_reconnect parameter to WebSocketApp to handle callback ambiguity (#972)
    • Improve handling of SSLEOFError and use reconnect bool (#961)
    • Minor linting and docs CI build upgrades (981c00e, 75ba91a, bec2608)

  • 1.7.0

    • Renamed mask variable in ABNF to prevent name collision with mask() function (9b51f73)
    • Fixed old http import of HTTPStatus in _handshake.py (9b51f73)
    • Add send_text() and send_bytes() to _app.py (#953)
    • Improved typehint support (#953, 9b51f73, 8b73d00)

... (truncated)

Commits

Updates litellm to 1.102.0

Release notes

Sourced from litellm's releases.

v1.102.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.102.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.102.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.102.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

... (truncated)

Commits
  • 9529383 Merge pull request #42059 from BerriAI/litellm_backport_42053_rc_1_102_0
  • 64db6e1 test(e2e): cite the source and date for the pinned Nova Sonic model id
  • c48532e test(e2e): point the Nova Sonic realtime test at nova-2-sonic
  • eebb3cb Merge pull request #41935 from BerriAI/litellm_backport_41347_rc_1_102_0
  • 868052b fix(team): apply team_member_budget updates to members still on the team default
  • 1a993c3 Merge pull request #41854 from BerriAI/litellm_backport_stable_batch_rc_1_102_0
  • 3a7a204 fix(responses): keep the addressed response id off bridged provider requests
  • 707a81a fix(utils): run post-call deployment hook on converted chat streams
  • 8f8b47d fix(proxy): retry rate-limit fallbacks from a pristine request snapshot
  • e6f29fb fix(logging): track spend for streams a deployment hook converted to non-stre...
  • Additional commits viewable in compare view

Updates certifi to 2026.7.22

Commits

Updates akshare to 1.18.97

Changelog

Sourced from akshare's changelog.

1.18.97 fix: fix stock_report_fund_hold interface

1. 修复 stock_report_fund_hold 接口因东方财富返回字段顺序变动导致的列错位问题，改为按字段名映射股票代码、股票简称及持仓变动相关数据
2. 为 stock_report_fund_hold 接口补充 15 秒请求超时，避免上游长时间无响应时进程一直阻塞不返回

1.18.96 fix: fix stock_zh_a_spot interface

1. 修复 stock_zh_a_spot 接口在新浪分页请求超时参数为 0 时，上游长时间无响应时进程一直阻塞不返回的问题

1.18.95 fix: raise a meaningful error when legulegu rejects the request

1. 修复乐咕乐股系列接口在上游拒绝请求时抛出 `AttributeError: 'NoneType' object has no attribute 'attrs'` 的问题：共用的 CSRF 获取逻辑此前既不校验状态码也不判空，上游返回的 403 错误页会被当作正常页面解析；现改为抛出携带状态码的 `APIError`，页面缺少 `_csrf` 标签时抛出 `DataParsingError`
2. 受益接口共 14 个：stock_buffett_index_lg、stock_index_pe_lg、stock_index_pb_lg、stock_market_pe_lg、stock_market_pb_lg、stock_a_congestion_lg、stock_ebs_lg、stock_a_gxl_lg、stock_hk_gxl_lg、stock_a_ttm_lyr、stock_a_all_pb、fund_stock_position_lg、fund_balance_position_lg、fund_linghuo_position_lg

1.18.94 fix: fix fund_money_fund_info_em interface

1. 优化 stock_board_concept_hist_em 接口的空数据兜底逻辑：仅对合法空历史返回空 DataFrame，对无效概念板块名称或 BK 代码抛出明确异常

1.18.93 fix: fix fund_money_fund_info_em interface

1. 修复 fund_money_fund_info_em 接口

1.18.92 fix: improve Xueqiu login requirement guidance

1. 优化 stock_individual_basic_info_xq 系列接口在雪球返回 400016 时的提示信息，明确匿名访问当前受限且需要通过 `token=` 传入有效 `xq_a_token`
2. 补充中概股、美股、港股雪球公司信息接口的登录态依赖说明
3. 修复 fund_money_fund_info_em 接口因东方财富历史净值返回体新增字段而触发 Length mismatch 的问题

1.18.91 docs: migrate the Markdown parser to myst-parser

1. 文档 Markdown 解析器由 recommonmark 迁移至 myst-parser，并移除随之无用的 sphinx-markdown-tables 与 markdown 依赖
2. 修正 docs 目录下 25 个文件的标题层级，使每个页面具备唯一的一级标题且不再跳级
3. 接口条目层级调整后可生成锚点，文档站中每个接口均支持直接链接定位
4. 为 dependabot 增加依赖分组配置，避免多个拉取请求同时修改同一文件

1.18.90 build: declare all and drop the akqmt integration

1. 为 akshare 声明 __all__，由 scripts/build_registry.py 生成并纳入 CI 校验
2. 修复 from akshare import * 会额外导出 39 个子模块名的问题
3. 移除 akqmt 集成及 full、qmt 两个附加依赖组
4. 修正 README 中的 Python 版本要求、失效的仓库条幅与错误的代码风格条幅

1.18.89 build: raise the minimum supported Python version to 3.11

1. 将 requires-python 提升至 3.11 以上，并同步 classifiers、CI 测试矩阵与 ruff target-version
2. 修复 uv.lock 中为 Python 3.9 保留的旧版本解析分支所引发的 24 条依赖安全告警
3. 新增 dependabot 配置，自动跟进 uv 与 GitHub Actions 的依赖更新
4. 同步更新文档中关于 Python 最低版本的说明

1.18.88 fix: fix fund_portfolio_hold_em interface

... (truncated)

Commits
  • 0191689 fix(stock_report_fund_hold): 修复接口字段错位并添加请求超时 (#7427)
  • 2e13a5f fix(stock_zh_a_spot): 修复接口超时阻塞问题 (#7425)
  • 72de989 Dev (#7424)
  • 8e95744 build(deps): bump the python group with 4 updates (#7408)
  • caa6c55 构建(pre-commit): 更新ruff-pre-commit至v0.16.4版本 (#7409)
  • 0e7db00 fix(stock_board_concept_hist_em): 优化错误处理与空数据兜底逻辑 (#7406)
  • e7d3e24 fix(fund): 修复fund_money_fund_info_em接口字段不匹配问题 (#7405)
  • 1b9aeb5 ci: bump astral-sh/setup-uv from 9.0.0 to 10.0.1 in the actions group (#7399)
  • ea5b388 build(deps-dev): bump ruff from 0.16.2 to 0.16.3 in the python group (#7400)
  • 8623219 fix(stock): 更新雪球token并完善接口登录态说明 (#7398)
  • Additional commits viewable in compare view

Updates pyjwt to 2.14.0

Release notes

Sourced from pyjwt's releases.

2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>__

Security


- Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`__,
  `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`__,
  `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`__,
  and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`__.
- Reject automatic redirects when ``PyJWKClient`` fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`__.
- Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`__.
- Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`__
  and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`__.
- Enforce compact JWS encoding rules during decoding. See
  `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`__.
- Reject detached-payload arguments for attached JWS inputs. Thanks to `@xclow3n
  <https://github.com/xclow3n>`__ for reporting this behavior; fixed in commit
  `37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>`__.

Fixed



- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.

v2.13.0 &amp;lt;https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0&amp;gt;__


Security

</code></pre>

<ul>

<li>Reject JWK JSON documents passed as raw HMAC secrets in

<code>HMACAlgorithm.prepare_key</code> to close an algorithm-confusion gap that

the existing PEM/SSH guard did not cover. Reported by <a href="https://github.com/aradona91&quot;&gt;&lt;code&gt;@​aradona91&lt;/code&gt;&lt;/a> in

<code>GHSA-xgmm-8j9v-c9wx &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx&amp;gt;&lt;/code&gt;__.&lt;/li>

<li>Bind the JWT header <code>alg</code> to <code>PyJWK.algorithm_name</code> during

verification so the caller's <code>algorithms=[...]</code> allow-list cannot be

bypassed when decoding with a <code>PyJWK</code> / <code>PyJWKClient</code> key. Reported</li>

</ul>

<!-- raw HTML omitted -->

</blockquote>

<p>... (truncated)</p>

</details>

<details>

<summary>Commits</summary>


<ul>

<li><a href="https://github.com/jpadilla/pyjwt/commit/c6fe464b356ff4b1ebc9ba62172d331a40aa27df&quot;&gt;&lt;code&gt;c6fe464&lt;/code&gt;&lt;/a> release: prepare v2.14.0</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/f5413029ae7a2e31b1367b5303ea86a2f54ccf42&quot;&gt;&lt;code&gt;f541302&lt;/code&gt;&lt;/a> style: apply Ruff formatting</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95&quot;&gt;&lt;code&gt;801cd12&lt;/code&gt;&lt;/a> fix: reject public JWK container HMAC keys</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/af8181ca0bec5e6b372fbba9afbe23702b787ceb&quot;&gt;&lt;code&gt;af8181c&lt;/code&gt;&lt;/a> fix: reject empty HMAC keys from JWKs</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1&quot;&gt;&lt;code&gt;ba4853a&lt;/code&gt;&lt;/a> Throttle repeated PyJWKClient refreshes</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499&quot;&gt;&lt;code&gt;2798504&lt;/code&gt;&lt;/a> fix: reject DER public keys as HMAC secrets</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07&quot;&gt;&lt;code&gt;8b4e233&lt;/code&gt;&lt;/a> fix: reject loader-accepted PEM variants</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/1f8180a211256dfe5cf32294b6753f554a5a4258&quot;&gt;&lt;code&gt;1f8180a&lt;/code&gt;&lt;/a> fix...


Description has been truncated

@dependabot
chore(deps): bump the python-runtime group across 1 directory with 19…
9a8e26f 
… updates

Updates the requirements on [ruff](https://github.com/astral-sh/ruff), [yfinance](https://github.com/ranaroussi/yfinance), [ccxt](https://github.com/ccxt/ccxt), [pandas](https://github.com/pandas-dev/pandas), [ta-lib](https://github.com/ta-lib/ta-lib-python), [websocket-client](https://github.com/websocket-client/websocket-client), [litellm](https://github.com/BerriAI/litellm), [certifi](https://github.com/certifi/python-certifi), [akshare](https://github.com/akfamily/akshare), [pyjwt](https://github.com/jpadilla/pyjwt), [python-dotenv](https://github.com/theskumar/python-dotenv), [cryptography](https://github.com/pyca/cryptography), [psycopg2-binary](https://github.com/psycopg/psycopg2), [redis](https://github.com/redis/redis-py), [gunicorn](https://github.com/benoitc/gunicorn), [marshmallow](https://github.com/marshmallow-code/marshmallow), [pypdf](https://github.com/py-pdf/pypdf), [reportlab](https://www.reportlab.com/) and [alpaca-py](https://github.com/alpacahq/alpaca-py) to permit the latest version.

Updates `ruff` to 0.16.8
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.8)

Updates `yfinance` to 1.7.0
- [Release notes](https://github.com/ranaroussi/yfinance/releases)
- [Changelog](https://github.com/ranaroussi/yfinance/blob/main/CHANGELOG.rst)
- [Commits](ranaroussi/yfinance@1.5.2...1.7.0)

Updates `ccxt` to 4.5.82
- [Release notes](https://github.com/ccxt/ccxt/releases)
- [Commits](ccxt/ccxt@v4.5.73...v4.5.82)

Updates `pandas` to 3.0.6
- [Release notes](https://github.com/pandas-dev/pandas/releases)
- [Commits](pandas-dev/pandas@v3.0.5...v3.0.6)

Updates `ta-lib` from 0.7.1 to 0.8.1
- [Release notes](https://github.com/ta-lib/ta-lib-python/releases)
- [Changelog](https://github.com/TA-Lib/ta-lib-python/blob/master/CHANGELOG)
- [Commits](TA-Lib/ta-lib-python@v0.7.1...v0.8.1)

Updates `websocket-client` to 1.9.2
- [Release notes](https://github.com/websocket-client/websocket-client/releases)
- [Changelog](https://github.com/websocket-client/websocket-client/blob/master/ChangeLog)
- [Commits](websocket-client/websocket-client@v1.9.0...v1.9.2)

Updates `litellm` to 1.102.0
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.93.0...v1.102.0)

Updates `certifi` to 2026.7.22
- [Commits](certifi/python-certifi@2026.06.17...2026.07.22)

Updates `akshare` to 1.18.97
- [Release notes](https://github.com/akfamily/akshare/releases)
- [Changelog](https://github.com/akfamily/akshare/blob/main/docs/changelog.md)
- [Commits](akfamily/akshare@release-v1.18.80...release-v1.18.97)

Updates `pyjwt` to 2.14.0
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.13.0...2.14.0)

Updates `python-dotenv` to 1.2.3
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.2...v1.2.3)

Updates `cryptography` to 50.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.0...50.0.1)

Updates `psycopg2-binary` to 2.9.13
- [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS)
- [Commits](psycopg/psycopg2@2.9.12...2.9.13)

Updates `redis` to 8.1.0
- [Release notes](https://github.com/redis/redis-py/releases)
- [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES)
- [Commits](redis/redis-py@v6.4.0...v8.1.0)

Updates `gunicorn` to 26.2.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@26.0.0...26.2.0)

Updates `marshmallow` to 4.3.1
- [Changelog](https://github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst)
- [Commits](marshmallow-code/marshmallow@4.3.0...4.3.1)

Updates `pypdf` to 6.19.0
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.16.2...6.19.0)

Updates `reportlab` to 5.0.1

Updates `alpaca-py` to 0.44.0
- [Release notes](https://github.com/alpacahq/alpaca-py/releases)
- [Commits](alpacahq/alpaca-py@v0.43.5...v0.44.0)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.8
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: yfinance
  dependency-version: 1.7.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: ccxt
  dependency-version: 4.5.82
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: pandas
  dependency-version: 3.0.6
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: ta-lib
  dependency-version: 0.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: websocket-client
  dependency-version: 1.9.2
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: litellm
  dependency-version: 1.102.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: certifi
  dependency-version: 2026.7.22
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: akshare
  dependency-version: 1.18.97
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: pyjwt
  dependency-version: 2.14.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: python-dotenv
  dependency-version: 1.2.3
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: psycopg2-binary
  dependency-version: 2.9.13
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: redis
  dependency-version: 8.1.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: gunicorn
  dependency-version: 26.2.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: marshmallow
  dependency-version: 4.3.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: pypdf
  dependency-version: 6.19.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: reportlab
  dependency-version: 5.0.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: alpaca-py
  dependency-version: 0.44.0
  dependency-type: direct:production
  dependency-group: python-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants