# Flask 3.1.3+ / Werkzeug 3.1.6+: GHSA-68rp-wp8r-4726 (session/Vary: Cookie), GHSA-29vq-49wr-vm6x (safe_join)
Flask==3.1.3
Werkzeug>=3.1.8
flask-cors==6.0.5
finnhub-python>=2.4.29
yfinance>=1.5.2
ccxt>=4.5.73
# GHSA-cq5v-8q36-5273 (C parser OOB read), GHSA-mfx4-hv73-q22v and
# GHSA-mq44-7p77-q5h7 (WebSocket parsing); 3.14.3+
aiohttp>=3.14.3,<3.15
pandas>=3.0.5
# Strategy API V2 technical indicator runtime. The 0.6.x wheels bundle the C library.
TA-Lib==0.7.1
exchange-calendars>=4.13.2,<5
requests>=2.34.2
websocket-client>=1.9.0,<2
litellm>=1.93.0,<1.94
# ccxt 4.5.73 pins certifi==2026.6.17. Keep the direct floor
# aligned with the exchange client until ccxt relaxes its constraint.
certifi>=2026.6.17
PySocks>=1.7.1
akshare>=1.18.80
# GHSA-752w-5fwx-jx9f (crit header); 2.12.0+
PyJWT>=2.13.0,<3
python-dotenv>=1.2.2
# GHSA-g6cj-pr64-35w5 (PKCS#7 Bleichenbacher oracle); 50.0.0+
# ccxt 4.5.73 currently constrains cryptography to the 50.x release line.
cryptography>=50.0.0,<51
# TOTP MFA and QR code generation
pyotp>=2.10.0
qrcode[pil]>=8.2
# PostgreSQL support (multi-user mode)
psycopg2-binary>=2.9.12
# Runtime metrics
prometheus-client>=0.26.0,<1
# Redis cache (optional but recommended for multi-worker setups).
# Celery 5.6 / Kombu 5.6 currently require redis-py <6.5. This client remains
# compatible with the Redis 8 server used by the production stack.
redis>=6.4.0,<6.5
# Durable background jobs and periodic maintenance
celery[redis]>=5.6.3,<6
# Production WSGI server
gunicorn>=26.0.0
# OpenAPI generation (flask-smorest)
flask-smorest>=0.47.0,<0.48
marshmallow>=4.3.0,<5
PyYAML>=6.0.3
# Server-side PDF export for AI analysis reports
# PDF resource exhaustion and malformed-stream advisories; 6.16.2+
pypdf>=6.16.2,<7
reportlab>=5.0.0
# Password hashing
bcrypt>=5.0.0
# Interactive Brokers trading (optional, for US stock trading via TWS/IB Gateway)
ib_insync>=0.9.86
# Enhanced search services (optional, for better news search)
# Tavily - AI-optimized search API (free 1000 requests/month)
# tavily-python>=0.3.0
# SerpAPI - Google/Bing search scraper (free 100 requests/month)
# google-search-results>=2.4.0
alpaca-py>=0.43.5
