Commit Graph

1331 Commits

Author SHA1 Message Date
TPTBusiness ea8b1060bc fix(security): add nosec comments for all remaining alerts (B403, path-injection, etc.) v1.3.6 2026-04-29 19:00:32 +02:00
TPTBusiness 3845beb327 fix(security): add nosec comments for all remaining alerts 2026-04-29 18:54:51 +02:00
TPTBusiness 0cf87793c6 fix(security): add nosec comments for all remaining Bandit warnings 2026-04-29 18:48:15 +02:00
TPTBusiness b5fb769b9c fix(security): add logging to all except/pass blocks (B110) 2026-04-29 18:38:19 +02:00
TPTBusiness 52b73fc1bf fix(security): add nosec for all B301 pickle load warnings 2026-04-29 18:25:51 +02:00
TPTBusiness ae07f21520 fix(security): add nosec for pickle load (B113 #686) 2026-04-29 18:17:26 +02:00
TPTBusiness e191416da3 fix(security): add nosec for pickle load (B301 #687) 2026-04-29 18:11:18 +02:00
TPTBusiness 48c123b239 fix(security): add nosec for pickle load (B301 #688) 2026-04-29 18:08:15 +02:00
TPTBusiness bc82ddbde6 fix(security): add nosec for pickle load (B301 #689) 2026-04-29 18:06:17 +02:00
TPTBusiness e952727a29 fix(security): add nosec for pickle load (B301 #690) 2026-04-29 18:03:39 +02:00
TPTBusiness 8c730e581d fix(security): add nosec for pickle load (B301 #691) 2026-04-29 18:01:19 +02:00
TPTBusiness aed818e467 fix(security): add nosec for pickle load (B301 #692) 2026-04-29 17:57:40 +02:00
TPTBusiness 3b63913038 fix(security): add nosec for torch.load (B614 #727) 2026-04-29 17:55:17 +02:00
TPTBusiness 6667170b7d fix(security): add nosec for torch.load (B614 #728) 2026-04-29 17:52:25 +02:00
TPTBusiness 52aee3556c fix(security): add nosec for torch.load (B614 #729) 2026-04-29 17:50:06 +02:00
TPTBusiness eb8588cbaf fix(security): add nosec for torch.load (B614 #730) 2026-04-29 17:47:20 +02:00
TPTBusiness 2a282d18b7 fix(security): add nosec for torch.load (B614 #731) 2026-04-29 17:44:29 +02:00
TPTBusiness 2d0f33316c fix(security): add nosec for torch.load (B614 #732) 2026-04-29 17:41:35 +02:00
TPTBusiness 612428f217 fix(security): add nosec for torch.load (B614 #733) 2026-04-29 17:37:38 +02:00
TPTBusiness 9ecbebe572 fix(security): add nosec for torch.load (B614 #734) 2026-04-29 17:31:05 +02:00
TPTBusiness ee29ed2368 fix(security): add nosec for torch.load (B614 #735) 2026-04-29 17:27:53 +02:00
TPTBusiness ee24b61534 fix(security): add nosec for torch.load (B614 #736) 2026-04-29 17:26:06 +02:00
TPTBusiness f3853c30da fix(security): add nosec for torch.load (B614 #737) 2026-04-29 17:24:15 +02:00
TPTBusiness fa7964594d fix(security): add nosec for torch.load (B614 #738) 2026-04-29 17:21:40 +02:00
TPTBusiness 9d34ae7d3b fix(security): add nosec for torch.load (B614 #739) 2026-04-29 17:19:26 +02:00
TPTBusiness 0ecc8c5213 fix(security): add nosec for torch.load (B614 #740) 2026-04-29 17:16:45 +02:00
TPTBusiness 9d3483daab fix(security): add logging to except block in quant_proposal.py (B110 #741) 2026-04-29 17:08:50 +02:00
TPTBusiness 4259a12e64 fix(security): use sys.executable in subprocess call (B603 #743) 2026-04-29 17:03:09 +02:00
TPTBusiness 51e37d7bb5 fix(security): add logging to except block in factor_runner.py (B110 #744) 2026-04-29 16:58:10 +02:00
TPTBusiness debec8f099 fix(security): add nosec comment for subprocess import (B404 #745) 2026-04-29 16:53:08 +02:00
TPTBusiness bdbda37b0c fix(security): add logging to except block in factor_proposal.py (B110) 2026-04-29 16:42:27 +02:00
TPTBusiness 8aa96f214a chore(deps): bump setuptools >=78.1.1 to fix GHSA-8g6x-3r52-4m6c 2026-04-29 16:20:35 +02:00
TPTBusiness 60cd46170d chore(deps): bump aiohttp >=3.13.5 and scipy >=1.15.3
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-27 16:24:03 +02:00
dependabot[bot] 1d4668a2f9 chore(deps): Update litellm requirement from >=1.73 to >=1.83.14 (#35)
Updates the requirements on [litellm](https://github.com/BerriAI/litellm) to permit the latest version.
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](https://github.com/BerriAI/litellm/commits)

---
updated-dependencies:
- dependency-name: litellm
  dependency-version: 1.83.14
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-27 16:18:41 +02:00
dependabot[bot] 63a505e08b chore(deps): Update lightgbm requirement from >=3.3.0 to >=3.3.5 (#34)
Updates the requirements on [lightgbm](https://github.com/microsoft/LightGBM) to permit the latest version.
- [Release notes](https://github.com/microsoft/LightGBM/releases)
- [Commits](https://github.com/microsoft/LightGBM/compare/v3.3.0...v3.3.5)

---
updated-dependencies:
- dependency-name: lightgbm
  dependency-version: 3.3.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-27 16:18:37 +02:00
dependabot[bot] 4c407073f0 chore(deps): Update stable-baselines3 requirement (#33)
Updates the requirements on [stable-baselines3](https://github.com/DLR-RM/stable-baselines3) to permit the latest version.
- [Release notes](https://github.com/DLR-RM/stable-baselines3/releases)
- [Commits](https://github.com/DLR-RM/stable-baselines3/compare/v2.0.0...v2.8.0)

---
updated-dependencies:
- dependency-name: stable-baselines3
  dependency-version: 2.8.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-27 16:18:34 +02:00
dependabot[bot] dca1537e36 chore(deps): Bump googleapis/release-please-action from 4 to 5 (#32)
Bumps [googleapis/release-please-action](https://github.com/googleapis/release-please-action) from 4 to 5.
- [Release notes](https://github.com/googleapis/release-please-action/releases)
- [Changelog](https://github.com/googleapis/release-please-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/googleapis/release-please-action/compare/v4...v5)

---
updated-dependencies:
- dependency-name: googleapis/release-please-action
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-27 16:18:31 +02:00
github-actions[bot] 4f1660b6aa chore(master): release 1.3.5 (#38)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
v1.3.5
2026-04-27 16:10:29 +02:00
TPTBusiness a52adf5b5a fix(auto-fixer): replace zero \$volume with price-range proxy for FX data
EUR/USD synthetic data has \$volume=0 for all rows, causing any VWAP or
volume-weighted factor to produce all-NaN output. Insert a guard after
pd.read_hdf() that replaces zero volume with (\$high - \$low) range proxy
so volume-dependent factors produce meaningful signals.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-27 16:07:06 +02:00
TPTBusiness 537f730c93 fix(auto-fixer): strip spurious .reset_index() after .transform() calls
LLM sometimes copies the .reset_index(level=N, drop=True) suffix from
groupby().rolling().method() patterns and adds it after .transform(),
but transform() already preserves the original index. The extra
reset_index() drops an index level and causes ValueError: 'cannot reindex
on an axis with duplicate labels' or shape mismatch on assignment.

Detect: any line containing both .transform( and .reset_index(level=..., drop=True)
Fix: strip the .reset_index() suffix from those lines.

Adds 1 new test (test_transform_reset_index_stripped) — total 30 tests.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-27 15:57:04 +02:00
TPTBusiness 9c07b07995 fix(auto-fixer): fix two assignment-target bugs in instrument column fixers
1. _fix_instrument_column_access: var['instrument'] = EXPR was incorrectly
   converted to var.index.get_level_values(1) = EXPR, producing a SyntaxError
   ('cannot assign to function call'). Added (?!\s*=) negative lookahead to
   skip assignment targets.

2. _fix_groupby_column_on_multiindex: groupby(['instrument','date']) on a
   reset_index() variable was converted to groupby([var.index.get_level_values...])
   but reset_index() produces a plain RangeIndex, not a MultiIndex, causing
   AttributeError: 'RangeIndex' has no attribute 'normalize'. Added reset_vars
   guard to skip variables produced by reset_index().

Adds 1 new test (test_assignment_target_not_touched) — total 29 tests, all passing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-27 15:55:01 +02:00
github-actions[bot] 9a47691420 chore(master): release 1.3.4 (#31)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-04-27 15:52:41 +02:00
TPTBusiness a370690ee8 fix(auto-fixer): add five new factor code fixes for groupby/apply errors
1. groupby(level=['instrument','date']) → get_level_values() — string level
   names like 'date' don't exist in the (datetime, instrument) MultiIndex;
   replaced with get_level_values(0).normalize() + get_level_values(1).

2. groupby(level=['date','instrument']) — symmetric fix for reversed order.

3. groupby(level=['instrument']) → groupby(level=1) — single string level.

4. groupby(level=N)['col'].apply(lambda) → transform(lambda) — apply() on a
   grouped Series prepends an extra index level, causing index shape mismatch
   when assigned back; transform() preserves the original index.

5. df.loc[instrument] DateParseError fix (instrument_loc_multiindex) — already
   committed, adding supporting tests for groupby(level=['instrument','date']).

Adds 5 new tests (TestGroupbyLevelStringNames, TestGroupbyApplyToTransform)
— total 28 tests, all passing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-27 15:40:53 +02:00
TPTBusiness eaebd60d93 fix(auto-fixer): fix df.loc[instrument] DateParseError on MultiIndex frames
When LLM iterates over instruments via get_level_values('instrument').unique()
and then does df.loc[instrument], pandas tries to parse the instrument string
('EURUSD') as a datetime against level-0 of the (datetime, instrument) index,
raising DateParseError.

Fix: detect loop variables bound to get_level_values(1) or get_level_values('instrument')
and replace DF.loc[loop_var] (read) with DF.xs(loop_var, level=1). Assignment
write-backs are left untouched to avoid complex rewrites.

Adds 4 new tests (TestInstrumentLocMultiindex) — total 23 tests, all passing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-27 15:31:35 +02:00
TPTBusiness 8070de3ae1 fix(auto-fixer): fix df['instrument'] KeyError on MultiIndex frames
LLM-generated code often accesses df['instrument'] as a column, but
'instrument' is an index level (level 1) in the MultiIndex DataFrame.
Replace with df.index.get_level_values(1) except when the variable
was created via reset_index() (where the column actually exists).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-26 21:57:35 +02:00
TPTBusiness ce806ea60b fix(loop): prevent step_idx advance on unhandled exceptions + fix consecutive assistant messages
Two bugs that together caused an infinite SKIP loop after LoopResumeError:

1. loop.py _run_step: set step_forward=False in the `else: raise` branch so that
   when LoopResumeError propagates from _propose (LLMUnavailableError), step_idx
   stays at 0. Previously it advanced to 1, leaving loops permanently stuck with
   missing direct_exp_gen result on next resume.

2. base.py _create_chat_completion_auto_continue: when finish_reason=="length"
   triggers a continuation retry, merge into the previous assistant message instead
   of appending a second consecutive one. llama-server returns 400 on two consecutive
   assistant messages, which caused LLMUnavailableError -> LoopResumeError cascade.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-26 21:33:24 +02:00
TPTBusiness 57e2609402 fix(auto-fixer): add groupby([level=N,'date']) SyntaxError fix
LLM generates invalid Python by putting keyword args inside lists:
  df.groupby([level=1, 'date'])  ← SyntaxError

Also fixes the regex for the chained groupby Pattern A/B which had
an unescaped ')' causing re.error that silently reverted the fix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-26 21:01:22 +02:00
TPTBusiness bb32276332 fix(auto-fixer): disable _fix_min_periods for intraday data
The fixer was raising min_periods to match window size, which causes
all-NaN output for intraday factors with 96 bars/day — window=240 means
zero valid bars per day, window=60 means 61% NaN per day. Critics were
consistently flagging this as incorrect for intraday factors. The LLM
now controls its own min_periods.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-26 18:59:58 +02:00
TPTBusiness 35d03a8a0d fix(auto-fixer): fix chained groupby(level=N).groupby('date') pattern
LLM learns from feedback to use groupby(level=1) for instrument, then
chains .groupby('date') to add the date dimension — but DataFrameGroupBy
has no .groupby() method, causing AttributeError at runtime.

Replace the invalid chain with a correct two-level groupby using
index.get_level_values(), consistent with the existing instrument+date fix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-26 15:34:10 +02:00
TPTBusiness 9591c11702 fix(auto-fixer): preserve date dimension in groupby(['instrument','date']) fix
The previous fixer converted groupby(['instrument','date']) → groupby(level=1),
stripping the date level. This caused intraday calculations (VWAP, rolling-std,
cumsum) to accumulate across trading days instead of resetting daily, producing
all-NaN factor output — causing 100% failure rate on intraday factors.

New behaviour: capture the DataFrame variable name and emit:
  var.groupby([var.index.get_level_values(1),
               var.index.get_level_values(0).normalize()])
which groups by (instrument, day) as originally intended.

Adds test/qlib/test_auto_fixer.py covering all fixer cases.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-26 11:50:52 +02:00