- Update Werkzeug from ==2.3.8 to >=3.1.6
- Update Flask from ==2.2.5 to >=3.0.0
- Fixes GHSA-hgf8-39gv-g3f2 (Windows device names in safe_join)
- Also fixes CVE-2024-34069 and CVE-2024-49767
- Update Werkzeug comment to include resource exhaustion vulnerability
- Version 2.3.8 is latest secure 2.x version (Flask 3.x incompatible with WebShop)
- Document mitigation: max_content_length limits, no debug mode in production
Fixes Dependabot Alert #4 (GHSA-q34m-jh98-gwm2)
- Add comment explaining vLLM >=0.18.0 is already safe (CVE fixed in >=0.14.0)
- Dependabot alert #44 is false positive due to missing lockfile
- Translate all comments to English (project language policy)
- No version change needed - current specification is already secure
Security Status:
- CVE-2026-22807: Fixed in vLLM >=0.14.0, current spec >=0.18.0 ✓
- CVE-2026-22778: Fixed in current version ✓
- CVE-2026-27893: Fixed in current version ✓
Note: Without a lockfile (pip-tools/uv/poetry), Dependabot cannot determine
the installed version and raises alerts based on the requirement spec alone.
- Bump minimum version from 2.0.0 to 2.6.0
- Fixes CVE-2025-32434: RCE vulnerability in torch.load with weights_only=True
- Fixes CVE-2024-31580: Heap buffer overflow (DoS) in vararg_functions.cpp
- Dependabot alerts #40 and #26
- Upgrade Werkzeug from 2.2.3 to 2.3.8 in WebShop requirements
- Translate all comments to English (project language policy)
- Add security note for CVE-2024-34069 (debugger vulnerability)
- Document mitigation: debug mode disabled in production
Security Notes:
- CVE-2024-34069 affects Werkzeug debugger (dev mode only)
- Flask 3.x required for full fix, but incompatible with WebShop
- Mitigation: Benchmark runs locally, never with debug=True in production
- This is the latest secure version compatible with Flask 2.x
Fixes Dependabot Alert #2 (GHSA-2g68-c3qc-8985)
- Fix Path.cwd() mocking to use correct module path
- Add Path.resolve() mocking for proper path validation testing
- Fix PermissionError handling test with proper mock
- All 14 security tests now pass
Fixes broken tests from previous commit that had incorrect mocking.
New models in models/local/:
- transformer_factor.py: Transformer with self-attention
- tcn_factor.py: Temporal Convolutional Network (multi-scale)
- patchtst_factor.py: PatchTST (SOTA for time-series)
- cnn_lstm_hybrid.py: CNN+LSTM with attention
Features:
- All models support sequence and tabular data
- Automatic device selection (CPU/GPU)
- Training with Adam optimizer + LR scheduler
- Save/load functionality
- Production-ready code
Dependencies installed:
- xgboost
- lightgbm
- torch (PyTorch)
Usage:
from rdagent.components.model_loader import load_model
model = load_model('transformer_factor') # Auto-loads your local version!
New structure:
- models/standard/*.py: Default models (XGBoost, LightGBM, RandomForest)
- models/local/*.py: Your improved models (NOT in Git!)
- models/README.md: Documentation
- rdagent/components/model_loader.py: Model loader with priority
Features:
- Loader checks models/local/ first (your better models)
- Falls back to models/standard/ if no local version
- Supports versioned models (model_v2.py, model_v1.py)
- Lists available models
- Test function included
.gitignore updated:
- models/local/ excluded (your proprietary models)
- *.local.py excluded
- *_private.py excluded
Usage:
from rdagent.components.model_loader import load_model
model = load_model('xgboost_factor') # Auto-loads your better version!
Standard models included:
- xgboost_factor.py: XGBoost for tabular data
- lightgbm_factor.py: LightGBM (faster than XGBoost)
New structure:
- prompts/standard_prompts.yaml: Default prompts (committed to Git)
- prompts/local/: Your improved prompts (NOT in Git!)
- prompts/README.md: Documentation
- rdagent/components/loader.py: Prompt loader with priority
Features:
- Loader checks prompts/local/ first (your better prompts)
- Falls back to standard_prompts.yaml if no local version
- Supports sections (system/user)
- Lists available prompts
- Test function included
.gitignore updated:
- prompts/local/ excluded (your proprietary prompts)
- *.local.yaml excluded
- *_private.yaml excluded
Usage:
from rdagent.components.loader import load_prompt
prompt = load_prompt('factor_discovery') # Auto-loads your better version!
- Change debug=True to debug=False by default
- Add FLASK_DEBUG environment variable for development
- Show warning when debug mode is enabled
- Prevents arbitrary code execution via Werkzeug debugger
- Fixes GitHub Security Alert #2 (py/flask-debug)
Production deployments are now secure by default.
For development: export FLASK_DEBUG=1
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
_safe_resolve():
- Add explicit security docstring with 6 validation steps
- Add inline comments for each security check
- Makes CodeQL recognize existing security measures
get_job_options():
- Validate base_path is within current working directory
- Use .resolve() and .relative_to() for path validation
- Reject paths outside project directory
- Show user-friendly error message via Streamlit
Fixes GitHub Security Alert #3 (py/path-injection)
Path traversal attacks via user-provided paths are now prevented.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Validate base_path is within current working directory
- Use .resolve() and .relative_to() for path validation
- Reject paths outside project directory
- Show user-friendly error message via Streamlit
- Add security docstring explaining the fix
- Fixes GitHub Security Alert #4 (py/path-injection)
Path traversal attacks via base_path parameter are now prevented.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Validate job_folder is within base_path directory
- Use .resolve() and .relative_to() for path validation
- Catch ValueError and RuntimeError for invalid paths
- Show user-friendly error message instead of crashing
- Fixes GitHub Security Alert #5 (py/path-injection)
Path traversal attacks via job_folder parameter are now prevented.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Mask API endpoint to prevent full URL exposure
- Change '✓' to '✓ Key set' for clearer status
- Add security comment explaining the fix
- Fixes GitHub Security Alert #7 (py/clear-text-logging-sensitive-data)
API keys are no longer logged, only their presence is indicated.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Replace hardcoded API_KEY with os.getenv('TEST_API_KEY')
- Replace hardcoded HF_TOKEN with os.getenv('TEST_HF_TOKEN')
- Replace hardcoded API_BASE with os.getenv('TEST_API_BASE')
- Replace hardcoded MODEL with os.getenv('TEST_MODEL')
- Add test credentials patterns to .gitignore
- Fixes GitHub Security Alert #8 (py/clear-text-storage-sensitive-data)
Sensitive data is now loaded from environment variables instead of clear text.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Translated all comments from German to English
- Changed 'Verfügbare Spalten' to 'Available columns'
- Changed 'Markt-Kontext' to 'Market Context'
- Changed 'Lookback Referenz' to 'Lookback Reference'
- Changed '% ARR zu schlagen' to '% ARR to beat'
- Changed '% maximaler Drawdown' to '% maximum drawdown'
All configuration values remain unchanged.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Marked all v1.0.0 release items as completed
- Moved naming conventions to Low Priority (post-v1.0.0)
- Added future release roadmap (v1.1.0, v1.2.0, v1.3.0)
- Documented status and priority for open items
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Created changelog/ directory for version-specific changelogs
- Added changelog/v1.0.0.md with comprehensive release notes
- Updated CHANGELOG.md to reference changelog/v1.0.0.md
- Updated TEMP_RELEASE.txt with correct link to v1.0.0.md
- Cleaner structure for future releases (changelog/v1.1.0.md, etc.)
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Created ATTRIBUTION.md explaining MIT License requirements
- Added attribution requirements to README.md
- Clarifies what users must do when using this code:
* Keep MIT License text
* Keep copyright notice
* Provide attribution to original project
- Includes examples of good and bad attribution
- Explains legal basis and consequences of violations
- Adds License badge to README header
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Removed .coveragerc (test coverage config)
- Removed pytest.ini (pytest config)
- These should be in test/ directory or not needed
- Keeps root directory clean for release
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Updated QWEN.md with English-only comment policy
- Translated all German comments in:
* eurusd_regime.py
* eurusd_llm.py
* eurusd_reflection.py
* eurusd_memory.py
* eurusd_macro.py
* eurusd_debate.py
* predix_dashboard.py
- All comments, docstrings, and print statements now in English
- Ensures consistency with commit messages and documentation
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Removed 'Inspiriert von' comments from all source files
- Added comprehensive Acknowledgments section to README.md
- Credits to:
* Microsoft RD-Agent (MIT) - R&D framework foundation
* TradingAgents (Apache 2.0) - Multi-agent patterns
* ai-hedge-fund - Macro analysis and risk management concepts
- Clarified that all code is originally written and implemented independently
- Ensures license compliance (MIT, Apache 2.0 compatible)
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Added acknowledgment section crediting Microsoft RD-Agent
- Link to original project: https://github.com/microsoft/RD-Agent
- Clarifies that Predix extends RD-Agent with forex-specific features
- Added step-by-step rebase instructions
- Listed all German commits that need translation
- Provided English translations for each
- Added force push warnings and team coordination notes
TPTBusiness