NexQuant/CHANGELOG.md

Changelog

1.3.9 (2026-05-01)

Bug Fixes

• security: resolve path-injection, B701, B101, B112 Bandit alerts (20b89a0)

1.3.8 (2026-04-30)

Bug Fixes

• deps: relax aiohttp constraint to >=3.13.4 for litellm compatibility (34ab192)
• qlib: correct indentation in except blocks in quant_proposal and factor_runner (8143451)
• security: replace eval() with ast.literal_eval in finetune validator (B307) (0508caf)
• security: replace shell=True subprocess calls with list args in env.py (B602) (2012d5a)
• security: resolve path-injection and add nosec for safe temp paths (B108, py/path-injection) (6727480)

1.3.7 (2026-04-30)

Bug Fixes

• security: nosec for B608/B701 false positives in UI and template code (5eb5d7e)
• security: replace eval() with ast.literal_eval and add request timeouts (B307, B113) (3301ada)
• security: replace shell=True subprocess calls with list args (B602) (13c08f4)

1.3.6 (2026-04-30)

Bug Fixes

• security: real fix for B110 (logging in factor_proposal.py #746) (16624e0)
• security: real fix for B110 (logging in factor_runner.py #744) (88cf0fb)
• security: real fix for B110 (logging in quant_proposal.py #741) (7cf2a64)
• security: real fix for B110 (logging in quant_proposal.py #741) (ef985f8)
• security: real fix for B404/B603 (sys.executable in factor_runner.py #745) (819655a)
• security: revert broken read_pickle encoding arg in kaggle template (B301) (3574907)
• security: validate SQL identifiers in _add_column_if_not_exists (B608) (e10dfa2)
• security: whitelist-validate metric column in get_top_factors (B608) (e50519f)

1.3.5 (2026-04-27)

Bug Fixes

• auto-fixer: add five new factor code fixes for groupby/apply errors (449c8fd)
• auto-fixer: add four new factor code fixes for common runtime errors (40484f6)
• auto-fixer: add groupby([level=N,'date']) SyntaxError fix (ca77c00)
• auto-fixer: disable _fix_min_periods for intraday data (77b0740)
• auto-fixer: fix chained groupby(level=N).groupby('date') pattern (7d5fe32)
• auto-fixer: fix df.loc[instrument] DateParseError on MultiIndex frames (b7860ea)
• auto-fixer: fix df['instrument'] KeyError on MultiIndex frames (aad6bd1)
• auto-fixer: fix two assignment-target bugs in instrument column fixers (421eedf)
• auto-fixer: preserve date dimension in groupby(['instrument','date']) fix (b58fdd8)
• auto-fixer: remove ddof from rolling() args, not only from std()/var() (b0fc328)
• auto-fixer: strip spurious .reset_index() after .transform() calls (8708aae)
• loop: prevent step_idx advance on unhandled exceptions + fix consecutive assistant messages (5ec4ad1)

1.3.4 (2026-04-27)

Bug Fixes

• auto-fixer: add five new factor code fixes for groupby/apply errors (449c8fd)
• auto-fixer: add four new factor code fixes for common runtime errors (40484f6)
• auto-fixer: add groupby([level=N,'date']) SyntaxError fix (ca77c00)
• auto-fixer: disable _fix_min_periods for intraday data (77b0740)
• auto-fixer: fix chained groupby(level=N).groupby('date') pattern (7d5fe32)
• auto-fixer: fix df.loc[instrument] DateParseError on MultiIndex frames (b7860ea)
• auto-fixer: fix df['instrument'] KeyError on MultiIndex frames (aad6bd1)
• auto-fixer: preserve date dimension in groupby(['instrument','date']) fix (b58fdd8)
• auto-fixer: remove ddof from rolling() args, not only from std()/var() (b0fc328)
• backtest: replace broken MC permutation test with binomial win-rate test (c38d894)
• factors: detect and correct look-ahead bias in daily-constant factors (eb490a4)
• factors: extend look-ahead rules to session factors and add intraday-factor guidance (c24c100)
• loop: compress old experiment history in proposal prompt to reduce context size (4bf90a9)
• loop: prevent step_idx advance on unhandled exceptions + fix consecutive assistant messages (5ec4ad1)

1.3.3 (2026-04-25)

Bug Fixes

• backtest: replace broken MC permutation test with binomial win-rate test (c38d894)
• factors: detect and correct look-ahead bias in daily-constant factors (eb490a4)
• factors: extend look-ahead rules to session factors and add intraday-factor guidance (c24c100)
• loop: compress old experiment history in proposal prompt to reduce context size (4bf90a9)
• strategies: guard against None IC in acceptance check, disable slow wf_rolling (2197f52)
• strategies: handle None ic/sharpe/dd in rejected strategy log output (ad2ad3a)

1.3.2 (2026-04-23)

Bug Fixes

• strategies: guard against None IC in acceptance check, disable slow wf_rolling (2197f52)
• strategies: handle None ic/sharpe/dd in rejected strategy log output (ad2ad3a)

1.3.1 (2026-04-21)

Bug Fixes

• deps: bump python-dotenv to >=1.2.2 (CVE symlink overwrite) (126ae7d)

1.3.0 (2026-04-21)

Features

• backtest: add rolling walk-forward validation and Monte Carlo trade permutation test (637a94c)

Bug Fixes

• security: resolve all 30 Bandit security alerts (B301, B614, B104) (ce5983d)

1.2.2 (2026-04-19)

Documentation

• claude: auto-merge release-please PR after every push (f500917)

2.2.0 (2026-04-18)

Features

• add Kronos CLI commands, expand tests, document in README (f911081)
• fin_quant: auto-generate Kronos factor before loop start (277063f)
• integrate Kronos-mini OHLCV foundation model (Option A + B) (4ae3b99)

Bug Fixes

• kronos: lazy torch import to fix CI ModuleNotFoundError (ccc1d27)
• kronos: pass actual datetime Series to Kronos predictor timestamps (dc6e7ce)
• kronos: replace rdagent_logger with stdlib logging for CI compatibility (b4558f2)

Performance Improvements

• kronos: batch GPU inference via predict_batch — 75x faster (74611d0)
• kronos: batch GPU inference via predict_batch — 75x faster (2babeb9)

Documentation

• fix duplicate sections, add hardware requirements and data setup guide (6c771b3)

2.1.0 (2026-04-18)

Features

• add daily log rotation, llama health wait, factor auto-fixer, and README updates (4ae4d6f)
• Add GitHub infrastructure, CI/CD pipelines, and examples (a0b5dc4)
• factor-coder: Add critical rules to prevent common factor implementation errors (a1edca8)
• logging: write complete LLM prompts and responses to daily JSONL log (803ef13)
• strategy: Continuous optimization with Optuna parameter injection (4fda5ea)
• unified backtest engine, LLM error handling, strategy refactor (76b9341)

Bug Fixes

• Add critical column name rules to factor generation prompt (3e74410)
• ci: fix closed-source asset check false positives in security workflow (4b83c2b)
• ci: remove CodeQL workflow (conflicts with default setup), drop duplicate lint job (a671361)
• ci: set JAVA_TOOL_OPTIONS UTF-8 in Codacy workflow (e36721c)
• deps: pin aiohttp>=3.13.4 to patch 4 CVEs (81adddc)
• optuna: fix inverted parameter range in Stage 2/3 when signal_bias is negative (eaf885e)
• security: Patch 5 CodeQL path injection and clear-text logging alerts (#22-#25, #9) (d386af9)
• security: Patch 5 CodeQL path injection and weak hashing alerts (#25-#30) (0d4c3b7)
• security: Patch path injection and stack trace exposure (CodeQL #31, #27) (b0b8432)
• security: replace relative_to() with realpath+startswith for CodeQL sanitization (6d70f1e)
• security: resolve CodeQL path-injection alerts in UI data loaders (cced426)
• security: resolve CodeQL path-injection and clear-text-logging alerts (ec50224)
• security: Resolve GitHub Security Scan alerts (6c85ba8)
• security: Upgrade vllm and transformers to patch 4 CVEs (6c9ba91)
• strategy: Fix template variables, APIBackend import, and JSON extraction (8220faa)
• strategy: Re-evaluate Optuna-optimized strategies with full OHLCV backtest (026edce)

Documentation

• Add CLI welcome screenshot to README (e6f2374)
• Add comprehensive data setup guide to README (f721d53)
• Add conda requirement to README + fix predix CLI (df45698)
• Clean changelog of closed-source performance metrics (a0f6587)
• improve README badges, fix llama-server flags, clean up structure (336e1a5)