chore(deps): update 16 compatible Python dependencies (#282)

* chore(deps): bump the python-runtime group across 1 directory with 18 updates

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.10
  dependency-type: direct:development
  dependency-group: python-runtime
- dependency-name: yfinance
  dependency-version: 1.7.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: aiohttp
  dependency-version: 3.14.4
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: pandas
  dependency-version: 3.0.6
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: ta-lib
  dependency-version: 0.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: websocket-client
  dependency-version: 1.9.2
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: litellm
  dependency-version: 1.104.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: certifi
  dependency-version: 2026.7.22
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: akshare
  dependency-version: 1.19.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: pyjwt
  dependency-version: 2.15.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: python-dotenv
  dependency-version: 1.2.4
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: cryptography
  dependency-version: 50.0.2
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: psycopg2-binary
  dependency-version: 2.9.13
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: redis
  dependency-version: 8.1.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: gunicorn
  dependency-version: 26.2.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: marshmallow
  dependency-version: 4.3.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: reportlab
  dependency-version: 5.0.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: alpaca-py
  dependency-version: 0.44.0
  dependency-type: direct:production
  dependency-group: python-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(deps): keep compatible Python runtime versions

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: TIANHE <TIANHE@GMAIL.COM>

Author: dependabot[bot]

backend_api_python/requirements-dev.txt

@@ -3,4 +3,4 @@ pip-audit>=2.10.1,<3
 pytest>=9.1.1,<10
 pytest-cov>=7.1.0,<8
 pytest-timeout>=2.4.0,<3
-ruff>=0.16.0,<0.17
+ruff>=0.16.10,<0.17

backend_api_python/requirements.lock

@@ -1,11 +1,11 @@
 # Generated from requirements.txt for the verified Python 3.12 Linux production image.
 # Regenerate and validate this file whenever direct production requirements change.
 aiohappyeyeballs==2.7.1
-aiohttp==3.14.3
+aiohttp==3.14.5
 aiosignal==1.4.0
 akracer==0.0.14
-akshare==1.18.81
-alpaca-py==0.43.5
+akshare==1.19.1
+alpaca-py==0.44.0
 amqp==5.3.1
 annotated-types==0.7.0
 anyio==4.14.2
@@ -15,17 +15,19 @@ bcrypt==5.0.0
 beautifulsoup4==4.15.0
 billiard==4.2.4
 blinker==1.9.0
-build==1.5.0
+boto3==1.43.114
+botocore==1.43.114
+build==1.6.1
 celery==5.6.3
-certifi==2026.6.17
+certifi==2026.7.22
 cffi==2.0.0
 charset-normalizer==3.4.7
 click==8.4.2
 click-didyoumean==0.3.1
 click-plugins==1.1.1.2
 click-repl==0.3.0
 confluent-kafka==2.15.1
-cryptography==50.0.0
+cryptography==50.0.2
 curl-cffi==0.15.0
 decorator==5.3.1
 distro==1.9.0
@@ -40,29 +42,33 @@ flask-cors==6.0.5
 flask-smorest==0.47.0
 frozenlist==1.8.0
 fsspec==2026.6.0
-gunicorn==26.0.0
+gunicorn==26.2.0
 h11==0.16.0
+h2==4.4.1
 hf-xet==1.5.1
+hpack==4.2.0
 html5lib==1.1
 httpcore==1.0.9
 httpx==0.28.1
 huggingface-hub==1.23.0
+hyperframe==6.1.0
 ib-insync==0.9.86
 idna==3.18
 importlib-metadata==8.9.0
 itsdangerous==2.2.0
 jinja2==3.1.6
 jiter==0.16.0
+jmespath==1.1.0
 jsonpath==0.82.2
 jsonschema==4.26.0
 jsonschema-specifications==2025.9.1
 kombu==5.6.2
 korean-lunar-calendar==0.4.0
-litellm==1.93.2
+litellm==1.104.3
 lxml==6.1.1
 markdown-it-py==4.2.0
 markupsafe==3.0.3
-marshmallow==4.3.0
+marshmallow==4.3.1
 mdurl==0.1.2
 msgpack==1.2.1
 multidict==6.9.1
@@ -71,44 +77,44 @@ nest-asyncio==1.6.0
 numpy==2.5.1
 openai==2.45.0
 openpyxl==3.1.5
-orjson==3.11.9
 packaging==26.2
-pandas==3.0.5
+pandas==3.0.6
 peewee==4.1.2
 pillow==12.3.0
 platformdirs==4.10.0
 prometheus-client==0.26.0
 prompt-toolkit==3.0.52
 propcache==0.5.2
 protobuf==7.35.1
-psycopg2-binary==2.9.12
+psycopg2-binary==2.9.13
 py-mini-racer==0.6.0
 pycparser==3.0
 pydantic==2.13.4
 pydantic-core==2.46.4
+pydantic-settings==2.16.0
 pygments==2.20.0
-pyjwt==2.15.0
+pyjwt==2.15.1
 pyluach==2.3.0
 pyotp==2.10.0
 pypdf==6.19.0
-pyproject-hooks==1.2.0
+pyproject-hooks==1.3.3
 pysocks==1.7.1
 python-dateutil==2.9.0.post0
-python-dotenv==1.2.2
+python-dotenv==1.2.4
 pytz==2026.2
 pyyaml==6.0.3
 qrcode==8.2
 redis==6.4.0
 referencing==0.37.0
 regex==2026.7.10
-reportlab==5.0.0
+reportlab==5.0.1
 requests==2.34.2
 rich==15.0.0
 rpds-py==2026.6.3
-setuptools==83.0.0
+s3transfer==0.19.2
 six==1.17.0
 sniffio==1.3.1
-soupsieve==2.9.0
+soupsieve==2.9
 sseclient-py==1.9.0
 ta-lib==0.7.1
 tabulate==0.10.0
@@ -121,15 +127,14 @@ typing-inspection==0.4.2
 tzdata==2026.3
 tzlocal==5.4.4
 urllib3==2.8.0
-uvloop==0.22.1
 vine==5.1.0
 wcwidth==0.8.2
 webargs==8.7.1
 webencodings==0.5.1
-websocket-client==1.9.0
+websocket-client==1.9.2
 websockets==16.1
 werkzeug==3.1.9
 xlrd==2.0.2
-yarl==1.24.2
-yfinance==1.5.2
+yarl==1.25.1
+yfinance==1.7.0
 zipp==4.1.0

backend_api_python/requirements.txt

@@ -3,33 +3,33 @@ Flask==3.1.3
 Werkzeug>=3.1.9
 flask-cors==6.0.5
 finnhub-python>=2.4.29
-yfinance>=1.5.2
+yfinance>=1.7.0
 # GHSA-cq5v-8q36-5273 (C parser OOB read), GHSA-mfx4-hv73-q22v and
 # GHSA-mq44-7p77-q5h7 (WebSocket parsing); 3.14.3+
-aiohttp>=3.14.3,<3.15
-pandas>=3.0.5
+aiohttp>=3.14.4,<3.15
+pandas>=3.0.6
 # Strategy API V2 technical indicator runtime. The 0.6.x wheels bundle the C library.
 TA-Lib==0.7.1
 exchange-calendars>=4.13.2,<5
 requests>=2.34.2
 # CVE-2026-97687 and related redirect/decompression advisories; 2.8.0+
 urllib3>=2.8.0,<3
-websocket-client>=1.9.0,<2
+websocket-client>=1.9.2,<2
 # CVE-2026-84377; 1.93.2+
-litellm>=1.93.2,<1.94
-certifi>=2026.6.17
+litellm>=1.104.0,<1.105
+certifi>=2026.7.22
 PySocks>=1.7.1
-akshare>=1.18.80
+akshare>=1.19.1
 # GHSA-752w-5fwx-jx9f and 2026 JWT validation advisories; 2.15.0+
-PyJWT>=2.15.0,<3
-python-dotenv>=1.2.2
+PyJWT>=2.15.1,<3
+python-dotenv>=1.2.4
 # GHSA-g6cj-pr64-35w5 (PKCS#7 Bleichenbacher oracle); 50.0.0+
-cryptography>=50.0.0,<51
+cryptography>=50.0.2,<51
 # TOTP MFA and QR code generation
 pyotp>=2.10.0
 qrcode[pil]>=8.2
 # PostgreSQL support (multi-user mode)
-psycopg2-binary>=2.9.12
+psycopg2-binary>=2.9.13
 # Runtime metrics
 prometheus-client>=0.26.0,<1
 # Kafka event backbone
@@ -41,15 +41,15 @@ redis>=6.4.0,<6.5
 # Durable background jobs and periodic maintenance
 celery[redis]>=5.6.3,<6
 # Production WSGI server
-gunicorn>=26.0.0
+gunicorn>=26.2.0
 # OpenAPI generation (flask-smorest)
 flask-smorest>=0.47.0,<0.48
-marshmallow>=4.3.0,<5
+marshmallow>=4.3.1,<5
 PyYAML>=6.0.3
 # Server-side PDF export for AI analysis reports
 # PDF parser security advisories; 6.19.0+
 pypdf>=6.19.0,<7
-reportlab>=5.0.0
+reportlab>=5.0.1
 # Password hashing
 bcrypt>=5.0.0
 # Interactive Brokers trading (optional, for US stock trading via TWS/IB Gateway)
@@ -59,4 +59,4 @@ ib_insync>=0.9.86
 # tavily-python>=0.3.0
 # SerpAPI - Google/Bing search scraper (free 100 requests/month)
 # google-search-results>=2.4.0
-alpaca-py>=0.43.5
+alpaca-py>=0.44.0