Skip to content

chore(deps): bump the python-runtime group across 1 directory with 20 updates - #269

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend_api_python/python-runtime-4fcab109d3
Closed

chore(deps): bump the python-runtime group across 1 directory with 20 updates#269
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend_api_python/python-runtime-4fcab109d3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on ruff, werkzeug, yfinance, ccxt, pandas, ta-lib, websocket-client, litellm, certifi, akshare, pyjwt, python-dotenv, cryptography, psycopg2-binary, redis, gunicorn, marshmallow, pypdf, reportlab and alpaca-py to permit the latest version.
Updates ruff to 0.16.9

Release notes

Sourced from ruff's releases.

0.16.9

Release Notes

Released on 2026-09-24.

Preview features

  • [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

  • [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
  • [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

  • Update LibCST-based fixes for Python 3.15 (#28616)
  • [flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

  • Fix horizontal overflow on the rules documentation page (#28699)
  • Update rules table with category information (#28651)
  • [flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)
  • [flake8-bugbear] Document type-checker interaction (B010) (#28509)
  • [flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)
  • [ruff] Mention related isort settings (RUF022) (#28719)

Contributors

Install ruff 0.16.9

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh | sh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.9

Released on 2026-09-24.

Preview features

  • [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

  • [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
  • [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

  • Update LibCST-based fixes for Python 3.15 (#28616)
  • [flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

  • Fix horizontal overflow on the rules documentation page (#28699)
  • Update rules table with category information (#28651)
  • [flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)
  • [flake8-bugbear] Document type-checker interaction (B010) (#28509)
  • [flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)
  • [ruff] Mention related isort settings (RUF022) (#28719)

Contributors

0.16.8

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)

... (truncated)

Commits
  • 0be08a2 Bump version to 0.16.9 (#28882)
  • b4920b7 Rename ruff_cli to ruff_command_line (#28881)
  • 47c751b Update dependency astral-sh/uv to v0.12.18 (#28880)
  • 8c244e5 [flake8-comprehensions] Document map/generator exception behavior (C417...
  • 5edf5a1 Use target form in rooster.version_files (#28876)
  • 915bb2b [ty] Prefer existing @ paths over response files in Ruff and ty (#28877)
  • 4710e1a ci(github): update version number in placeholder of issue template (#28871)
  • eedfc62 [ty] Propagate outer type context through cast calls (#28855)
  • ceaa6a0 [ty] Contain rendered code within Markdown fences (#28869)
  • dba0f30 authorize ruff-pre-commit dispatch via OIDC (#28867)
  • Additional commits viewable in compare view

Updates werkzeug to 3.1.9

Release notes

Sourced from werkzeug's releases.

3.1.9

This is the Werkzeug 3.1.9 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.9/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-9 Milestone: https://github.com/pallets/werkzeug/milestone/46?closed=1

  • safe_join on Windows does not allow special devices names with empty ADS markers on NTFS. GHSA-g6x2-hccm-hh4m
  • ProfilerMiddleware uses profiling.tracing on Python 3.15. #3207
  • uri_to_iri and iri_to_uri preserve empty username, password, and port 0. #3189
  • Improve performance of parse_options_header. #3231
  • Improve performance of parse_etags. #3231
  • Improve performance of parse_cookie. #3231
  • get_host also checks that the port is in the valid range. #3236
  • The int URL converter returns a 404 instead of 500 error when the value is longer than sys.get_int_max_str_digits(). #3237
  • Improve debugger PIN generation from cgroup data inside Podman. #3245
  • Authorization parsing basic auth disallows non-base64 characters. #3248
  • application/x-www-form-urlencoded form data is no longer limited to max_form_memory_size, only max_content_length. #3251
  • LimitedStream.readinto does not resize the buffer when it reads less than the remaining size. #3253
  • Rules with 10 or more converters in a single part assign matched values correctly. #3254
  • The invalid Range suffix length -0 is no longer accepted. #3255
Changelog

Sourced from werkzeug's changelog.

Version 3.1.9

Released 2026-09-27

  • safe_join on Windows does not allow special devices names with empty ADS markers on NTFS. :ghsa:g6x2-hccm-hh4m
  • ProfilerMiddleware uses profiling.tracing on Python 3.15. :issue:3207
  • uri_to_iri and iri_to_uri preserve empty username, password, and port 0. :issue:3189
  • Improve performance of parse_options_header. :pr:3231
  • Improve performance of parse_etags. :pr:3231
  • Improve performance of parse_cookie. :pr:3231
  • get_host also checks that the port is in the valid range. :pr:3236
  • The int URL converter returns a 404 instead of 500 error when the value is longer than sys.get_int_max_str_digits(). :issue:3237
  • Improve debugger PIN generation from cgroup data inside Podman. :issue:3245
  • Authorization parsing basic auth disallows non-base64 characters. :pr:3248
  • application/x-www-form-urlencoded form data is no longer limited to max_form_memory_size, only max_content_length. :pr:3251
  • LimitedStream.readinto does not resize the buffer when it reads less than the remaining size. :pr:3253
  • Rules with 10 or more converters in a single part assign matched values correctly. :pr:3254
  • The invalid Range suffix length -0 is no longer accepted. :pr:3255

Version 3.1.8

Released 2026-04-02

  • Request.host and get_host return the empty string if the header is missing or has invalid characters. :issue:3142

Version 3.1.7

Released 2026-03-23

  • parse_list_header preserves partially quoted items, discards empty items, and returns empty for unclosed quoted values. :pr:3128
  • WWWAuthenticate.to_header does not produce a trailing space when there are no parameters. :issue:3127
  • Transfer-Encoding is parsed as a set. :pr:3134
  • Request.host, get_host, and host_is_trusted validate the

... (truncated)

Commits

Updates yfinance to 1.7.0

Release notes

Sourced from yfinance's releases.

1.7.0

Main change:

  • history_metadata now lazy-loads tradingPeriods

Fixes for:

  • proxy
  • stock-split price-repair

Full changelog #2959

Thanks @​amosli

Changelog

Sourced from yfinance's changelog.

1.7.0

Features / improvements:

  • Make history_metadata lazy-load 'tradingPeriods' #2922 Fixes
  • Improve robustness of YfData when behind a SOCKS5 proxy #2953 Price repair:
  • Fix bug in volume-validation of stock-split-repair #2958

1.6.0

Features / improvements

1.5.2

Patches

  • Fix yfinance breaking with curl_cffi>=0.16

1.5.1

Minor

  • Fall back to chunked requests when single-URL fundamentals fetch times out #2811
  • Replace valuation-measures HTML scrape with timeseries API #2851 Patches
  • Determine login and subscription tier via the subscriptions API #2845
  • Preserve user login cookies across cookie-strategy switches #2850

... (truncated)

Commits
  • 3d9d2f0 Version 1.7.0
  • 43f3021 Merge pull request #2959 from ranaroussi/dev
  • 686a031 Minor test fix
  • fdede94 Merge pull request #2953 from amosli/fix/cookie-crumb-proxy-resilience
  • 5c1f64e Fixes for PR #2958
  • c732994 Merge pull request #2958 from ranaroussi/fix/price-repair-split-volume-valida...
  • ba7b650 Fix proxy wipe and make cookie/crumb failures non-fatal
  • 0f29c85 Fix bug in volume-validation of stock-split-repair, that was wrongly blocking...
  • baeca64 Merge pull request #2918 from dokson/fix/drop-nospam-extra
  • 5261b4d Drop unusable nospam extra and py2 cruft
  • Additional commits viewable in compare view

Updates ccxt to 4.5.84

Commits

Updates pandas to 3.0.6

Release notes

Sourced from pandas's releases.

pandas 3.0.6

We are pleased to announce the release of pandas 3.0.6. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version. This is also the first release to support Python 3.15.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits
  • 2905718 RLS: 3.0.6
  • 3188ced [backport 3.0.x] BUG: read_csv(sep=None) raised TypeError instead of falling...
  • f097905 DOC: cleanup 3.0.6 whatsnew + mention Python 3.15 support (#68965) (#68969)
  • 4f68223 [backport 3.0.x] BUG: fix setting with bool column mask into 1-column DataFra...
  • e3df0e8 [backport 3.0.x] BUG: full-slice setitem into a pyarrow-backed array shared m...
  • b7735f6 Backport PR #66117 on branch 3.0.x (BUG: interpolate leaving NAs unfilled for...
  • bca0b77 [backport 3.0.x] BUG: read_csv leaked the string-intern table when a column f...
  • bca1e5d [backport 3.0.x] BUG: prevent external mutation of RangeIndex._data (CoW) (#6...
  • c95b42c [3.0.x] CI: skip cython-lint on pre-commit.ci (#68910)
  • 9cbd884 [backport 3.0.x] Backport of some already merged regression fixes (#68447)
  • Additional commits viewable in compare view

Updates ta-lib from 0.7.1 to 0.8.1

Release notes

Sourced from ta-lib's releases.

v0.8.1

  • [CHANGE]: talib.stream is now the real streaming API of TA-Lib C 0.8.1: stream.SMA(close) returns a handle, not a value. handle.value is the value at the last history bar, handle.update(bar) costs O(1) and returns that bar's value, handle.peek(bar) evaluates a forming bar without committing it, and handle.copy() forks it. stream.SMA.open_and_fill() returns the handle and the Function API's series in one pass. A multi-output function answers with the same tuple the Function API returns. The old last-value functions -- talib.stream.SMA, talib.stream_SMA, and their _ta_lib.pyi stubs -- are gone; talib/stream.pyi types the handles instead.

    Migrating is stream.X(...) -> stream.X(...).value, and the compiler cannot find the sites for you: if stream.CDLDOJI(o, h, l, c): used to test the pattern and now tests a handle, which is always true.

  • [NEW]: talib.InsufficientHistory, raised when a stream is opened with too little history. It is the library's one recoverable error, so it is catchable on its own rather than as a bare Exception.

  • [FIX]: help(talib.SUPERTREND) and the abstract stub named the outputs real and integer; they are supertrend and trend, the names abstract.Function('SUPERTREND').output_names already reported.

  • [FIX]: An empty array given to a function whose lookback is zero, such as talib.ACOS or talib.MA(x, timeperiod=1), made TA-Lib read and write one element outside the buffers, which could crash the interpreter later or corrupt memory silently. An empty input now returns empty outputs without calling TA-Lib, whatever the function and its parameters. The bug dates from 0.4.27.

v0.8.0

  • [NEW]: Support TA-Lib C 0.8.1, which is now the minimum required version.

  • [NEW]: The 40 functions TA-Lib C added since 0.7.1: AC, ADR, AO, CMF, CMOU, COPPOCK, CUMSUM, CVI, DONCHIAN, DPO, EFI, ER, ERI, FOSC, FRACTAL, HA, HMA, KC, KDJ, MARKETFI, MASSI, NVI, PERCENTILE, PERCENTRANK, PVI, PVO, PVT, QSTICK, RMA, RVI, RVOL, SMI, SUPERTREND, TSI, VHF, VORTEX, VWAP, VWMA, WAD, ZLEMA.

  • [NEW]: New moving averages: MA_Type.HMA, MA_Type.DISABLED, MA_Type.DEFAULT, MA_Type.ZLEMA and MA_Type.RMA.

  • [NEW]: set_unstable_period() and get_unstable_period() accept 'RMA', 'HA' and 'RVI'.

  • [FIX]: abstract raised KeyError on function and output flags added after this wrapper was written; unknown flag bits are now ignored.

  • [FIX]: A moving-average parameter not spelled exactly matype -- KDJ's slowk_matype -- defaulted to SMA rather than to the function's own documented default.

  • [FIX]: An integer output is documented as the candlestick -100/0/100 convention only for candlestick functions; SUPERTREND's is a trend direction.

  • [CHANGE]: APO and PPO now default matype to EMA, and BBANDS defaults timeperiod to 20, following TA-Lib C 0.8.1.

  • [FIX]: set_unstable_period() targeted the wrong function for every id after IMI (e.g. 'RSI' set PLUS_DM); ids now come from the C header. 'ADXR', 'MFI' and 'STOCHRSI' are no-ops that emit a DeprecationWarning.

  • [CHANGE]: Remove the unnecessary build runtime dependency and wheel build dependency.

  • [NEW]: Upgrade to Cython 3.3.0

Changelog

Sourced from ta-lib's changelog.

0.8.1

  • [CHANGE]: talib.stream is now the real streaming API of TA-Lib C 0.8.1: stream.SMA(close) returns a handle, not a value. handle.value is the value at the last history bar, handle.update(bar) costs O(1) and returns that bar's value, handle.peek(bar) evaluates a forming bar without committing it, and handle.copy() forks it. stream.SMA.open_and_fill() returns the handle and the Function API's series in one pass. A multi-output function answers with the same tuple the Function API returns. The old last-value functions -- talib.stream.SMA, talib.stream_SMA, and their _ta_lib.pyi stubs -- are gone; talib/stream.pyi types the handles instead.

    Migrating is stream.X(...) -> stream.X(...).value, and the compiler cannot find the sites for you: if stream.CDLDOJI(o, h, l, c): used to test the pattern and now tests a handle, which is always true.

  • [NEW]: talib.InsufficientHistory, raised when a stream is opened with too little history. It is the library's one recoverable error, so it is catchable on its own rather than as a bare Exception.

  • [FIX]: help(talib.SUPERTREND) and the abstract stub named the outputs real and integer; they are supertrend and trend, the names abstract.Function('SUPERTREND').output_names already reported.

  • [FIX]: An empty array given to a function whose lookback is zero, such as talib.ACOS or talib.MA(x, timeperiod=1), made TA-Lib read and write one element outside the buffers, which could crash the interpreter later or corrupt memory silently. An empty input now returns empty outputs without calling TA-Lib, whatever the function and its parameters. The bug dates from 0.4.27.

0.8.0

  • [NEW]: Support TA-Lib C 0.8.1, which is now the minimum required version.

  • [NEW]: The 40 functions TA-Lib C added since 0.7.1: AC, ADR, AO, CMF, CMOU, COPPOCK, CUMSUM, CVI, DONCHIAN, DPO, EFI, ER, ERI, FOSC, FRACTAL, HA, HMA, KC, KDJ, MARKETFI, MASSI, NVI, PERCENTILE, PERCENTRANK, PVI, PVO, PVT, QSTICK, RMA, RVI, RVOL, SMI, SUPERTREND, TSI, VHF, VORTEX, VWAP, VWMA, WAD, ZLEMA.

  • [NEW]: New moving averages: MA_Type.HMA, MA_Type.DISABLED, MA_Type.DEFAULT, MA_Type.ZLEMA and MA_Type.RMA.

  • [NEW]: set_unstable_period() and get_unstable_period() accept 'RMA', 'HA' and 'RVI'.

... (truncated)

Commits
  • 8f5cadc docs: updates
  • e5aab28 ci: add the dev-* release lane, pinned to the wheels' TA-Lib C
  • f4ad30e test: accept a TA-Lib C newer than we require
  • 9c7f7bd update README from TA-Lib C 0.7.1 to 0.8.1
  • 7a10655 version bump
  • f972213 fix(func): no input, no output
  • bdb8c5e fix(func): SUPERTREND's outputs are supertrend and trend
  • 7a5544c changelog: the streaming entries belong to the next release
  • 25dd74b fix(abstract): stop relying on Cython resolving __NAME from class scope
  • a93703b perf(stream): multi-output handles answer with a plain tuple
  • Additional commits viewable in compare view

Updates websocket-client to 1.9.2

Release notes

Sourced from websocket-client's releases.

v1.9.2

1.9.2

  • Fix race in WebSocketApp.close() when run_forever() thread clears the socket during the close handshake (#1057, fixes #1055 and #1056)
Changelog

Sourced from websocket-client's changelog.

  • 1.9.2

    • Fix race in WebSocketApp.close() when run_forever() thread clears the socket during the close handshake (#1057, fixes #1055 and #1056)

  • 1.9.1

    • Add Python 3.14 support to setup config and CI (f2bc97a)
    • Fix close() dropping close frame when reason is str (2f22e2e)
    • Fix close() type annotation and docstring for timeout and reason (d69f730)
    • Make abort() robust for sockets that cannot shutdown, same logic as shutdown() (1904e3d)
    • Raise WebSocketException for redirects missing a Location header (97e34db)
    • Raise when WebSocket connect redirect limit is exhausted (be0d38d)
    • Raise WebSocketException for redirects to invalid targets (62ef6af)
    • Fix unformatted ABNF validation error messages (0145b7b)
    • Fix validate_utf8() crash on str input (4a8e6ed)
    • Store status_message on WebSocketBadStatusException (368aeda)
    • Raise WebSocketException for check_hostname with CERT_NONE (0232aca)
    • Fix handleDisconnect type annotation: None default requires Optional (20f3712)
    • Remove unreachable not frame check in recv_data_frame() (b684242)
    • Set proxy_timeout on proxy_info without a proxy host (68f0aed)
    • Fix _wsdump.py bytes annotations and remove dead code (5ecc6e4)
    • Export STATUS_SERVICE_RESTART and STATUS_TRY_AGAIN_LATER close codes (22279c4)
    • Fix extract_err_message() to always return str (e2091bd)
    • Raise WebSocketProxyException for SOCKS proxy without a port, correct proxy port docs (3c62bdf)
    • Raise WebSocketException for malformed HTTP responses (04f4d94)
    • Fix docs examples using dead or unreachable endpoints (2fc92c0)
    • Add pyproject.toml, drop deprecated setup.py metadata (8b34f50)
    • Apply linting (3b4ffab)

  • 1.9.0

    • Remove Python 3.8 support (EOL), add Python 3.13 (5f25030)
    • Remove localhost and 127.0.0.1 from default NO_PROXY list (#994)
    • Support IPv6 CIDRs in the no_proxy option (#1033)
    • Fix thread safety condition in teardown() to improve run_forever() (#1015)
    • Fix #1024 by chunking data, recursion in on_error callback, thread leak in _stop_ping_thread(), avoid implicit None in recv() (#1036)
    • Avoid bare except clauses for better error handling (#1036)
    • Fix async (#983)
    • Resolve mypy type errors (#996, #1006, 813d570)
    • Test coverage improvements (#1035, #1036)
    • flake8 linting improvements (#1034)

  • 1.8.0

    • Added on_reconnect parameter to WebSocketApp to handle callback ambiguity (#972)
    • Improve handling of SSLEOFError and use reconnect bool (#961)
    • Minor linting and docs CI build upgrades (981c00e, 75ba91a, bec2608)

  • 1.7.0

    • Renamed mask variable in ABNF to prevent name collision with mask() function (9b51f73)
    • Fixed old http import of HTTPStatus in _handshake.py (9b51f73)
    • Add send_text() and send_bytes() to _app.py (#953)
    • Improved typehint support (#953, 9b51f73, 8b73d00)

... (truncated)

Commits

Updates litellm to 1.103.0

Release notes

Sourced from litellm's releases.

v1.103.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.103.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.103.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.103.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

... (truncated)

Commits
  • c991f4b fix(proxy): unregister logging callbacks removed from the stored config (#43429)
  • cc111d1 fix(streaming): backport text-completion usage fix and e2e provider-flake tol...
  • 4dbbe6e test(ci): fix the e2e and integration reds left on rc/1.103.0 after #43382 an...
  • 8aca86a test(e2e): clear the two rc/1.103.0 e2e reds owned by upstream providers (#43...
  • e640c0e test(integration): make rc/1.103.0 integration groups collect and pass again ...
  • 10e77ce fix(caching): stand default cache points down when extra_body hides a direct ...
  • 6076c0a fix(jwt,otel): backport session conversation id and JWT team header selection...
  • 6bfc987 chore: update Next.js build artifacts (2026-09-26 18:18 UTC, node v24.19.0) (...
  • 6397b36 fix: backport five regression fixes to rc/1.103.0 (#43331)
  • 4d08789 fix(proxy): pass team member spend rows as jsonb so a $0 flush cannot poison ...
  • Additional commits viewable in compare view

Updates certifi to 2026.7.22

Commits

Updates akshare to 1.18.97

Changelog

Sourced from akshare's changelog.

1.18.97 fix: fix stock_report_fund_hold interface

1. 修复 stock_report_fund_hold 接口因东方财富返回字段顺序变动导致的列错位问题，改为按字段名映射股票代码、股票简称及持仓变动相关数据
2. 为 stock_report_fund_hold 接口补充 15 秒请求超时，避免上游长时间无响应时进程一直阻塞不返回

1.18.96 fix: fix stock_zh_a_spot interface

1. 修复 stock_zh_a_spot 接口在新浪分页请求超时参数为 0 时，上游长时间无响应时进程一直阻塞不返回的问题

1.18.95 fix: raise a meaningful error when legulegu rejects the request

1. 修复乐咕乐股系列接口在上游拒绝请求时抛出 `AttributeError: 'NoneType' object has no attribute 'attrs'` 的问题：共用的 CSRF 获取逻辑此前既不校验状态码也不判空，上游返回的 403 错误页会被当作正常页面解析；现改为抛出携带状态码的 `APIError`，页面缺少 `_csrf` 标签时抛出 `DataParsingError`
2. 受益接口共 14 个：stock_buffett_index_lg、stock_index_pe_lg、stock_index_pb_lg、stock_market_pe_lg、stock_market_pb_lg、stock_a_congestion_lg、stock_ebs_lg、stock_a_gxl_lg、stock_hk_gxl_lg、stock_a_ttm_lyr、stock_a_all_pb、fund_stock_position_lg、fund_balance_position_lg、fund_linghuo_position_lg

1.18.94 fix: fix fund_money_fund_info_em interface

1. 优化 stock_board_concept_hist_em 接口的空数据兜底逻辑：仅对合法空历史返回空 DataFrame，对无效概念板块名称或 BK 代码抛出明确异常

1.18.93 fix: fix fund_money_fund_info_em interface

1. 修复 fund_money_fund_info_em 接口

1.18.92 fix: improve Xueqiu login requirement guidance

1. 优化 stock_individual_basic_info_xq 系列接口在雪球返回 400016 时的提示信息，明确匿名访问当前受限且需要通过 `token=` 传入有效 `xq_a_token`
2. 补充中概股、美股、港股雪球公司信息接口的登录态依赖说明
3. 修复 fund_money_fund_info_em 接口因东方财富历史净值返回体新增字段而触发 Length mismatch 的问题

1.18.91 docs: migrate the Markdown parser to myst-parser

1. 文档 Markdown 解析器由 recommonmark 迁移至 myst-parser，并移除随之无用的 sphinx-markdown-tables 与 markdown 依赖
2. 修正 docs 目录下 25 个文件的标题层级，使每个页面具备唯一的一级标题且不再跳级
3. 接口条目层级调整后可生成锚点，文档站中每个接口均支持直接链接定位
4. 为 dependabot 增加依赖分组配置，避免多个拉取请求同时修改同一文件

1.18.90 build: declare all and drop the akqmt integration

1. 为 akshare 声明 __all__，由 scripts/build_registry.py 生成并纳入 CI 校验
2. 修复 from akshare import * 会额外导出 39 个子模块名的问题
3. 移除 akqmt 集成及 full、qmt 两个附加依赖组
4. 修正 README 中的 Python 版本要求、失效的仓库条幅与错误的代码风格条幅

1.18.89 build: raise the minimum supported Python version to 3.11

1. 将 requires-python 提升至 3.11 以上，并同步 classifiers、CI 测试矩阵与 ruff target-version
2. 修复 uv.lock 中为 Python 3.9 保留的旧版本解析分支所引发的 24 条依赖安全告警
3. 新增 dependabot 配置，自动跟进 uv 与 GitHub Actions 的依赖更新
4. 同步更新文档中关于 Python 最低版本的说明

1.18.88 fix: fix fund_portfolio_hold_em interface

... (truncated)

Commits
  • 0191689 fix(stock_report_fund_hold): 修复接口字段错位并添加请求超时 (#7427)
  • 2e13a5f fix(stock_zh_a_spot): 修复接口超时阻塞问题 (#7425)
  • 72de989 Dev (#7424)
  • 8e95744 build(deps): bump the python group with 4 updates (#7408)

@dependabot
chore(deps): bump the python-runtime group across 1 directory with 20…
6262843 
… updates

Updates the requirements on [ruff](https://github.com/astral-sh/ruff), [werkzeug](https://github.com/pallets/werkzeug), [yfinance](https://github.com/ranaroussi/yfinance), [ccxt](https://github.com/ccxt/ccxt), [pandas](https://github.com/pandas-dev/pandas), [ta-lib](https://github.com/ta-lib/ta-lib-python), [websocket-client](https://github.com/websocket-client/websocket-client), [litellm](https://github.com/BerriAI/litellm), [certifi](https://github.com/certifi/python-certifi), [akshare](https://github.com/akfamily/akshare), [pyjwt](https://github.com/jpadilla/pyjwt), [python-dotenv](https://github.com/theskumar/python-dotenv), [cryptography](https://github.com/pyca/cryptography), [psycopg2-binary](https://github.com/psycopg/psycopg2), [redis](https://github.com/redis/redis-py), [gunicorn](https://github.com/benoitc/gunicorn), [marshmallow](https://github.com/marshmallow-code/marshmallow), [pypdf](https://github.com/py-pdf/pypdf), [reportlab](https://www.reportlab.com/) and [alpaca-py](https://github.com/alpacahq/alpaca-py) to permit the latest version.

Updates `ruff` to 0.16.9
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.9)

Updates `werkzeug` to 3.1.9
- [Release notes](https://github.com/pallets/werkzeug/releases)
- [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst)
- [Commits](pallets/werkzeug@3.1.8...3.1.9)

Updates `yfinance` to 1.7.0
- [Release notes](https://github.com/ranaroussi/yfinance/releases)
- [Changelog](https://github.com/ranaroussi/yfinance/blob/main/CHANGELOG.rst)
- [Commits](ranaroussi/yfinance@1.5.2...1.7.0)

Updates `ccxt` to 4.5.84
- [Release notes](https://github.com/ccxt/ccxt/releases)
- [Commits](ccxt/ccxt@v4.5.73...v4.5.84)

Updates `pandas` to 3.0.6
- [Release notes](https://github.com/pandas-dev/pandas/releases)
- [Commits](pandas-dev/pandas@v3.0.5...v3.0.6)

Updates `ta-lib` from 0.7.1 to 0.8.1
- [Release notes](https://github.com/ta-lib/ta-lib-python/releases)
- [Changelog](https://github.com/TA-Lib/ta-lib-python/blob/master/CHANGELOG)
- [Commits](TA-Lib/ta-lib-python@v0.7.1...v0.8.1)

Updates `websocket-client` to 1.9.2
- [Release notes](https://github.com/websocket-client/websocket-client/releases)
- [Changelog](https://github.com/websocket-client/websocket-client/blob/master/ChangeLog)
- [Commits](websocket-client/websocket-client@v1.9.0...v1.9.2)

Updates `litellm` to 1.103.0
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.93.0...v1.103.0)

Updates `certifi` to 2026.7.22
- [Commits](certifi/python-certifi@2026.06.17...2026.07.22)

Updates `akshare` to 1.18.97
- [Release notes](https://github.com/akfamily/akshare/releases)
- [Changelog](https://github.com/akfamily/akshare/blob/main/docs/changelog.md)
- [Commits](akfamily/akshare@release-v1.18.80...release-v1.18.97)

Updates `pyjwt` to 2.15.0
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.13.0...2.15.0)

Updates `python-dotenv` to 1.2.3
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.2...v1.2.3)

Updates `cryptography` to 50.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.0...50.0.1)

Updates `psycopg2-binary` to 2.9.13
- [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS)
- [Commits](psycopg/psycopg2@2.9.12...2.9.13)

Updates `redis` to 8.1.0
- [Release notes](https://github.com/redis/redis-py/releases)
- [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES)
- [Commits](redis/redis-py@v6.4.0...v8.1.0)

Updates `gunicorn` to 26.2.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@26.0.0...26.2.0)

Updates `marshmallow` to 4.3.1
- [Changelog](https://github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst)
- [Commits](marshmallow-code/marshmallow@4.3.0...4.3.1)

Updates `pypdf` to 6.19.0
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.16.2...6.19.0)

Updates `reportlab` to 5.0.1

Updates `alpaca-py` to 0.44.0
- [Release notes](https://github.com/alpacahq/alpaca-py/releases)
- [Commits](alpacahq/alpaca-py@v0.43.5...v0.44.0)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.9
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: werkzeug
  dependency-version: 3.1.9
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: yfinance
  dependency-version: 1.7.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: ccxt
  dependency-version: 4.5.84
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: pandas
  dependency-version: 3.0.6
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: ta-lib
  dependency-version: 0.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: websocket-client
  dependency-version: 1.9.2
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: litellm
  dependency-version: 1.103.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: certifi
  dependency-version: 2026.7.22
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: akshare
  dependency-version: 1.18.97
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: pyjwt
  dependency-version: 2.15.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: python-dotenv
  dependency-version: 1.2.3
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: psycopg2-binary
  dependency-version: 2.9.13
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: redis
  dependency-version: 8.1.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: gunicorn
  dependency-version: 26.2.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: marshmallow
  dependency-version: 4.3.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: pypdf
  dependency-version: 6.19.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: reportlab
  dependency-version: 5.0.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: alpaca-py
  dependency-version: 0.44.0
  dependency-type: direct:production
  dependency-group: python-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 30, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 1, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 1, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/backend_api_python/python-runtime-4fcab109d3 branch October 1, 2026 05:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants