# Flask 3.1.3+ / Werkzeug 3.1.9+: GHSA-68rp-wp8r-4726 (session/Vary: Cookie), GHSA-g6x2-hccm-hh4m (safe_join)
Flask==3.1.3
Werkzeug>=3.1.9
flask-cors==6.0.5
finnhub-python>=2.4.29
yfinance>=1.7.0
# GHSA-cq5v-8q36-5273 (C parser OOB read), GHSA-mfx4-hv73-q22v and
# GHSA-mq44-7p77-q5h7 (WebSocket parsing); 3.14.3+
aiohttp>=3.14.5,<3.15
pandas>=3.0.6
# Strategy API V2 technical indicator runtime. Wheels bundle the C library.
TA-Lib==0.8.2
exchange-calendars>=4.13.2,<5
# LiteLLM currently declares filelock<4.0, but the 4.2.4 runtime is compatible
# and resolves CVE-2026-112940, CVE-2026-112913, and CVE-2026-112907.
# Production installs the complete verified lock with --no-deps.
filelock>=4.2.4,<5
requests>=2.34.2
# CVE-2026-97687 and related redirect/decompression advisories; 2.8.0+
urllib3>=2.8.0,<3
websocket-client>=1.9.2,<2
# websocket-client 1.9+ delegates SOCKS4/5 proxy connections to python-socks.
python-socks>=3.1.1,<4
# CVE-2026-84377; 1.93.2+
litellm>=1.106.2,<1.107
certifi>=2026.10.19
PySocks>=1.7.1
akshare>=1.19.1
# GHSA-752w-5fwx-jx9f and 2026 JWT validation advisories; 2.15.0+
PyJWT>=2.15.1,<3
python-dotenv>=1.2.4
# GHSA-g6cj-pr64-35w5 (PKCS#7 Bleichenbacher oracle); 50.0.0+
cryptography>=50.0.2,<51
# TOTP MFA and QR code generation
pyotp>=2.10.0
qrcode[pil]>=8.2
# Pillow 13.0.0 resolves the 2026 image decoder security advisories.
Pillow>=13.0.0,<14
# PostgreSQL support (multi-user mode)
psycopg2-binary>=2.9.13
# Runtime metrics
prometheus-client>=0.26.0,<1
# Kafka event backbone
confluent-kafka>=2.16.0,<3
# Redis cache (optional but recommended for multi-worker setups).
# Celery 5.6 / Kombu 5.6 currently require redis-py <6.5. This client remains
# compatible with the Redis 8 server used by the production stack.
redis>=6.4.0,<6.5
# Durable background jobs and periodic maintenance
celery[redis]>=5.6.3,<6
# Production WSGI server
gunicorn>=26.2.0
# OpenAPI generation (flask-smorest)
flask-smorest>=0.47.0,<0.48
marshmallow>=4.3.1,<5
PyYAML>=6.0.3
# Server-side PDF export for AI analysis reports
# PDF parser security advisories through CVE-2026-115580; 6.21.2+
pypdf>=6.21.2,<7
reportlab>=5.0.1
# Password hashing
bcrypt>=5.0.0
# Interactive Brokers trading (optional, for US stock trading via TWS/IB Gateway)
ib_insync>=0.9.86
# Enhanced search services (optional, for better news search)
# Tavily - AI-optimized search API (free 1000 requests/month)
# tavily-python>=0.3.0
# SerpAPI - Google/Bing search scraper (free 100 requests/month)
# google-search-results>=2.4.0
alpaca-py>=0.44.0
