From b94df989316f239fa63fa2fae12c383f38a6d2e0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 19:31:19 +0000 Subject: [PATCH 1/2] chore(deps): Bump the python-runtime group across 1 directory with 4 updates Bumps the python-runtime group with 4 updates in the / directory: [websockets](https://github.com/python-websockets/websockets), [ruff](https://github.com/astral-sh/ruff), [coverage](https://github.com/coveragepy/coveragepy) and [claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-python). Updates `websockets` from 17.0 to 17.0.1 - [Release notes](https://github.com/python-websockets/websockets/releases) - [Commits](https://github.com/python-websockets/websockets/compare/17.0...17.0.1) Updates `ruff` from 0.16.1 to 0.16.2 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](https://github.com/astral-sh/ruff/compare/0.16.1...0.16.2) Updates `coverage` from 7.15.2 to 7.15.4 - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](https://github.com/coveragepy/coveragepy/compare/7.15.2...7.15.4) Updates `claude-agent-sdk` from 0.2.128 to 0.2.132 - [Release notes](https://github.com/anthropics/claude-agent-sdk-python/releases) - [Changelog](https://github.com/anthropics/claude-agent-sdk-python/blob/main/CHANGELOG.md) - [Commits](https://github.com/anthropics/claude-agent-sdk-python/compare/v0.2.128...v0.2.132) --- updated-dependencies: - dependency-name: websockets dependency-version: 17.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-runtime - dependency-name: ruff dependency-version: 0.16.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-runtime - dependency-name: coverage dependency-version: 7.15.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-runtime - dependency-name: claude-agent-sdk dependency-version: 0.2.132 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-runtime ... Signed-off-by: dependabot[bot] --- requirements-ai.txt | 2 +- requirements-dev.txt | 4 ++-- requirements.txt | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/requirements-ai.txt b/requirements-ai.txt index ab5f511..c36b30f 100644 --- a/requirements-ai.txt +++ b/requirements-ai.txt @@ -3,7 +3,7 @@ # These versions are the Python 3.12/3.13 set validated by the MAT safety stack. # The first three packages are the Claude Agent SDK's direct runtime dependencies; # pinning them prevents a fresh install from silently changing the agent transport. -claude-agent-sdk==0.2.128 +claude-agent-sdk==0.2.132 anyio==4.14.2 mcp==1.29.0 sniffio==1.3.1 diff --git a/requirements-dev.txt b/requirements-dev.txt index da48319..7e7333e 100644 --- a/requirements-dev.txt +++ b/requirements-dev.txt @@ -1,11 +1,11 @@ # Development / CI quality-gate tools (runtime deps live in requirements.txt). # Versions mirror the Streamlit Scanner App's verified set where shared. pytest==9.1.1 -ruff==0.16.1 +ruff==0.16.2 mypy==1.20.2 bandit==1.9.4 pre-commit==4.6.1 -coverage==7.15.2 +coverage==7.15.4 pytest-cov==7.1.0 pip-audit==2.10.1 # Type stubs for typed third-party usage in the mypy scope. pandas-stubs is diff --git a/requirements.txt b/requirements.txt index 5bf8063..1f70f48 100644 --- a/requirements.txt +++ b/requirements.txt @@ -27,7 +27,7 @@ websocket-client==1.8.0 # `websockets` library at package import time. It already arrives transitively # with dhanhq, but per DEPS-001 the exact version the live runner was verified # with must be pinned here rather than left to transitive resolution. -websockets==17.0 +websockets==17.0.1 TA-Lib==0.6.8 # ---- Exact optional dependency sets ----------------------------------------- From e96ca76517f6d49929e0db35af3a1deb45c5f891 Mon Sep 17 00:00:00 2001 From: DoRmAmMu1997 Date: Tue, 11 Aug 2026 01:16:14 +0530 Subject: [PATCH 2/2] test(deps): move the guarded pins to match the python-runtime bump Dependabot changed requirements.txt and requirements-ai.txt but not the two assertions in test_repository_policy.py that pin them, so CI failed on `websockets==17.0` -- the guard doing exactly its job. websockets 17.0 -> 17.0.1: the upstream tag-to-tag diff removes Server.wrap() and reworks the asyncio server, but all of that is SERVER-side and dhanhq.marketfeed is a client. Its whole surface is three names -- websockets.connect, websockets.ConnectionClosed and websockets.protocol.State.CLOSED -- and all three were confirmed present in 17.0.1. That rules out the import-time "runner fails to start" failure this pin guards against, but not transport behaviour, which needs a real socket. claude-agent-sdk 0.2.128 -> 0.2.132: SL Hunting's transport. Operator decision: both are active paths (MARKET_DATA_SOURCE=WEBSOCKET, SL_HUNTING_ENABLED=true) but every strategy is PAPER (LIVE_TRADING_ENABLED=false), so validation happens on the next run rather than ahead of the merge -- a bad feed costs a session, not money. Revert the pin first if the feed does not tick. ruff 0.16.1 -> 0.16.2 was verified clean against the whole repo in an isolated venv before this commit. coverage 7.15.2 -> 7.15.4 is dev-only. Co-Authored-By: Claude Opus 5 --- Tests/Dependencies/test_repository_policy.py | 23 +++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/Tests/Dependencies/test_repository_policy.py b/Tests/Dependencies/test_repository_policy.py index 39a3a15..a38b383 100644 --- a/Tests/Dependencies/test_repository_policy.py +++ b/Tests/Dependencies/test_repository_policy.py @@ -47,11 +47,24 @@ def test_optional_dependency_sets_are_exact_and_kotak_uses_official_tag(): # regression and a live session. Move it together with requirements.txt, and # only once a PAPER session has confirmed the feed still ticks on the new # version -- CI never opens a real socket, so a green build proves nothing - # about the transport. Note this is a MAJOR (16 -> 17): dhanhq.marketfeed - # hard-imports websockets at package import time, so an incompatible API - # would surface as the RUNNER FAILING TO START, not merely a quiet feed. - assert "websockets==17.0" in core - assert "claude-agent-sdk==0.2.128" in ai + # about the transport. + # + # 17.0 -> 17.0.1 (2026-08-11, PR #119). The upstream tag-to-tag diff looks + # alarming -- it removes `Server.wrap()` and reworks the asyncio server -- + # but every one of those is SERVER-side and marketfeed is a client. Its + # entire surface is three names, all confirmed present in 17.0.1: + # `websockets.connect`, `websockets.ConnectionClosed`, and + # `websockets.protocol.State.CLOSED`. That rules out the import-time + # "runner fails to start" failure this pin exists to prevent; it does NOT + # prove the transport behaves, which only a session on the real socket can. + # Operator decision: validate on the next run rather than ahead of the + # merge, because MARKET_DATA_SOURCE=WEBSOCKET is active but every strategy + # is PAPER (LIVE_TRADING_ENABLED=false), so a bad feed costs a session and + # not money. If the feed does not tick, revert this pin first. + assert "websockets==17.0.1" in core + # Same reasoning for the agent transport: SL_HUNTING_ENABLED=true, so this + # is an active path, but paper-only until the next session confirms it. + assert "claude-agent-sdk==0.2.132" in ai assert "pydantic==2.13.4" in ai assert all("==" in line for line in ai) # The independent CPR agent is an optional, subscription-authenticated