chore(deps): bump the python-runtime group

Updates the requirements on [yfinance](https://github.com/ranaroussi/yfinance), [ccxt](https://github.com/ccxt/ccxt), [websocket-client](https://github.com/websocket-client/websocket-client), [litellm](https://github.com/BerriAI/litellm), [certifi](https://github.com/certifi/python-certifi), [akshare](https://github.com/akfamily/akshare), [python-dotenv](https://github.com/theskumar/python-dotenv), [cryptography](https://github.com/pyca/cryptography), [redis](https://github.com/redis/redis-py), [gunicorn](https://github.com/benoitc/gunicorn), [marshmallow](https://github.com/marshmallow-code/marshmallow), [reportlab](https://www.reportlab.com/), [alpaca-py](https://github.com/alpacahq/alpaca-py) and [ruff](https://github.com/astral-sh/ruff) to permit the latest version.

Updates `yfinance` to 1.7.0
- [Release notes](https://github.com/ranaroussi/yfinance/releases)
- [Changelog](https://github.com/ranaroussi/yfinance/blob/main/CHANGELOG.rst)
- [Commits](ranaroussi/yfinance@1.5.2...1.7.0)

Updates `ccxt` to 4.5.76
- [Release notes](https://github.com/ccxt/ccxt/releases)
- [Commits](ccxt/ccxt@v4.5.73...v4.5.76)

Updates `websocket-client` to 1.9.2
- [Release notes](https://github.com/websocket-client/websocket-client/releases)
- [Changelog](https://github.com/websocket-client/websocket-client/blob/master/ChangeLog)
- [Commits](websocket-client/websocket-client@v1.9.0...v1.9.2)

Updates `litellm` to 1.99.0
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.93.0...v1.99.0)

Updates `certifi` to 2026.7.22
- [Commits](certifi/python-certifi@2026.06.17...2026.07.22)

Updates `akshare` to 1.18.94
- [Release notes](https://github.com/akfamily/akshare/releases)
- [Changelog](https://github.com/akfamily/akshare/blob/main/docs/changelog.md)
- [Commits](akfamily/akshare@release-v1.18.80...release-v1.18.94)

Updates `python-dotenv` to 1.2.3
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.2...v1.2.3)

Updates `cryptography` to 50.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.0...50.0.1)

Updates `redis` to 8.1.0
- [Release notes](https://github.com/redis/redis-py/releases)
- [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES)
- [Commits](redis/redis-py@v6.4.0...v8.1.0)

Updates `gunicorn` to 26.2.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@26.0.0...26.2.0)

Updates `marshmallow` to 4.3.1
- [Changelog](https://github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst)
- [Commits](marshmallow-code/marshmallow@4.3.0...4.3.1)

Updates `reportlab` to 5.0.1

Updates `alpaca-py` to 0.44.0
- [Release notes](https://github.com/alpacahq/alpaca-py/releases)
- [Commits](alpacahq/alpaca-py@v0.43.5...v0.44.0)

Updates `ruff` to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.5)

---
updated-dependencies:
- dependency-name: yfinance
  dependency-version: 1.7.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: ccxt
  dependency-version: 4.5.76
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: websocket-client
  dependency-version: 1.9.2
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: litellm
  dependency-version: 1.99.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: certifi
  dependency-version: 2026.7.22
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: akshare
  dependency-version: 1.18.94
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: python-dotenv
  dependency-version: 1.2.3
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: redis
  dependency-version: 8.1.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: gunicorn
  dependency-version: 26.2.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: marshmallow
  dependency-version: 4.3.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: reportlab
  dependency-version: 5.0.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: alpaca-py
  dependency-version: 0.44.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:development
  dependency-group: python-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>

Author: dependabot[bot]

backend_api_python/requirements-dev.txt

@@ -3,4 +3,4 @@ pip-audit>=2.10.1,<3
 pytest>=9.1.1,<10
 pytest-cov>=7.1.0,<8
 pytest-timeout>=2.4.0,<3
-ruff>=0.16.0,<0.17
+ruff>=0.16.5,<0.17

backend_api_python/requirements.txt

@@ -3,8 +3,8 @@ Flask==3.1.3
 Werkzeug>=3.1.8
 flask-cors==6.0.5
 finnhub-python>=2.4.29
-yfinance>=1.5.2
-ccxt>=4.5.73
+yfinance>=1.7.0
+ccxt>=4.5.76
 # GHSA-cq5v-8q36-5273 (C parser OOB read), GHSA-mfx4-hv73-q22v and
 # GHSA-mq44-7p77-q5h7 (WebSocket parsing); 3.14.3+
 aiohttp>=3.14.3,<3.15
@@ -13,19 +13,19 @@ pandas>=3.0.5
 TA-Lib==0.7.1
 exchange-calendars>=4.13.2,<5
 requests>=2.34.2
-websocket-client>=1.9.0,<2
-litellm>=1.93.0,<1.94
+websocket-client>=1.9.2,<2
+litellm>=1.99.0,<1.100
 # ccxt 4.5.73 pins certifi==2026.6.17. Keep the direct floor
 # aligned with the exchange client until ccxt relaxes its constraint.
-certifi>=2026.6.17
+certifi>=2026.7.22
 PySocks>=1.7.1
-akshare>=1.18.80
+akshare>=1.18.94
 # GHSA-752w-5fwx-jx9f (crit header); 2.12.0+
 PyJWT>=2.13.0,<3
-python-dotenv>=1.2.2
+python-dotenv>=1.2.3
 # GHSA-g6cj-pr64-35w5 (PKCS#7 Bleichenbacher oracle); 50.0.0+
 # ccxt 4.5.73 currently constrains cryptography to the 50.x release line.
-cryptography>=50.0.0,<51
+cryptography>=50.0.1,<51
 # TOTP MFA and QR code generation
 pyotp>=2.10.0
 qrcode[pil]>=8.2
@@ -36,19 +36,19 @@ prometheus-client>=0.26.0,<1
 # Redis cache (optional but recommended for multi-worker setups).
 # Celery 5.6 / Kombu 5.6 currently require redis-py <6.5. This client remains
 # compatible with the Redis 8 server used by the production stack.
-redis>=6.4.0,<6.5
+redis>=8.1.0,<8.2
 # Durable background jobs and periodic maintenance
 celery[redis]>=5.6.3,<6
 # Production WSGI server
-gunicorn>=26.0.0
+gunicorn>=26.2.0
 # OpenAPI generation (flask-smorest)
 flask-smorest>=0.47.0,<0.48
-marshmallow>=4.3.0,<5
+marshmallow>=4.3.1,<5
 PyYAML>=6.0.3
 # Server-side PDF export for AI analysis reports
 # PDF resource exhaustion and malformed-stream advisories; 6.16.2+
 pypdf>=6.16.2,<7
-reportlab>=5.0.0
+reportlab>=5.0.1
 # Password hashing
 bcrypt>=5.0.0
 # Interactive Brokers trading (optional, for US stock trading via TWS/IB Gateway)
@@ -58,4 +58,4 @@ ib_insync>=0.9.86
 # tavily-python>=0.3.0
 # SerpAPI - Google/Bing search scraper (free 100 requests/month)
 # google-search-results>=2.4.0
-alpaca-py>=0.43.5
+alpaca-py>=0.44.0