Merge pull request #20 from manifoldbt/bench/fsspec-advisory

bench: pin a patched fsspec and install NautilusTrader without its deps

.github/workflows/bench-vs-hft.yml

@@ -88,6 +88,7 @@ jobs:
             pip install manifoldbt
           fi
           pip install -r ${BENCH_DIR}/requirements-lock.txt
+          pip install --no-deps -r ${BENCH_DIR}/requirements-nautilus.txt
 
       - name: Record the resolved environment
         shell: bash
@@ -176,6 +177,7 @@ jobs:
             pip install manifoldbt
           fi
           pip install -r ${BENCH_DIR}/requirements-lock.txt
+          pip install --no-deps -r ${BENCH_DIR}/requirements-nautilus.txt
 
       - name: Activate the benchmark licence
         env:
@@ -279,6 +281,7 @@ jobs:
             pip install manifoldbt
           fi
           pip install -r ${BENCH_DIR}/requirements-lock.txt
+          pip install --no-deps -r ${BENCH_DIR}/requirements-nautilus.txt
 
       - name: Activate the benchmark licence
         env:

.github/workflows/bench-vs-vectorbt.yml

@@ -156,6 +156,7 @@ jobs:
           # The lock adds NautilusTrader: a 189 MB wheel (manylinux_2_35) that
           # unpacks to about 610 MB, and 6 s to install on a fast connection.
           pip install -r benchmarks/vs_vectorbt/requirements-lock.txt
+          pip install --no-deps -r benchmarks/vs_vectorbt/requirements-nautilus.txt
 
       - name: Record the resolved environment
         shell: bash
@@ -254,6 +255,7 @@ jobs:
             pip install manifoldbt
           fi
           pip install -r benchmarks/vs_vectorbt/requirements-lock.txt
+          pip install --no-deps -r benchmarks/vs_vectorbt/requirements-nautilus.txt
 
       # Sweep timings are published from a licensed run only. This step exits
       # non-zero without a licence, and the harness refuses again on its own if

benchmarks/vs_hft/README.md

@@ -8,6 +8,7 @@ reports, beside how long each took, how far they did **the same work**.
 ```bash
 pip install manifoldbt
 pip install -r requirements-lock.txt
+pip install --no-deps -r requirements-nautilus.txt
 python prep_cli.py 2025-08-13                      # download + fingerprint + prepare one day
 python bench.py --day 2025-08-13 --reps 3 --out results-books.json
 python sweep.py --day 2025-08-13 --window 36000 43200 --grids 4 16 64 --workers 4 --out results-sweeps-maker.json

benchmarks/vs_hft/requirements-lock.txt

@@ -2,7 +2,8 @@
 # (the version under test); everything else is fixed so that a change of number
 # can be traced to an engine and not to a dependency.
 hftbacktest==2.4.4
-nautilus_trader==1.231.0
+# NautilusTrader 1.231.0 is pinned in requirements-nautilus.txt (see fsspec
+# below for why); its runtime dependencies are pinned in this file.
 numba==0.68.0
 llvmlite==0.50.0
 numpy==2.2.6
@@ -19,7 +20,11 @@ colorcet==3.2.1
 contourpy==1.4.0
 cycler==0.12.1
 fonttools==4.67.0
-fsspec==2026.2.0
+# fsspec: NautilusTrader asks for exactly 2026.2.0, which is inside the range of
+# GHSA-27vj-qcqg-25rc (fixed in 2026.6.0). It is installed with --no-deps from
+# requirements-nautilus.txt, after this file, so the patched pin below is the
+# one that lands.
+fsspec==2026.9.0
 holoviews==1.23.2
 idna==3.20
 Jinja2==3.1.6
@@ -54,5 +59,6 @@ tornado==6.6
 tqdm==4.70.1
 typing_extensions==4.16.0
 tzdata==2026.5
+uvloop==0.22.1 ; sys_platform != "win32"
 urllib3==2.8.0
 xyzservices==2026.9.1

benchmarks/vs_hft/requirements-nautilus.txt

@@ -0,0 +1,10 @@
+# NautilusTrader, installed on its own and with --no-deps, after
+# requirements-lock.txt:
+#
+#   pip install -r requirements-lock.txt
+#   pip install --no-deps -r requirements-nautilus.txt
+#
+# 1.231.0 asks for exactly fsspec 2026.2.0, inside the range of
+# GHSA-27vj-qcqg-25rc, and pip would refuse the patched fsspec pinned in the
+# lock. Every runtime dependency it needs is pinned there instead.
+nautilus_trader==1.231.0

benchmarks/vs_vectorbt/README.md

@@ -7,6 +7,7 @@ result**, and only then reports how long each took.
 ```bash
 pip install manifoldbt
 pip install -r requirements-lock.txt
+pip install --no-deps -r requirements-nautilus.txt
 python bench.py --bars 10000 100000 1000000 --reps 7 --cold-start-reps 3 --memory-bars 2000000 --out results.json
 python report.py results.json
 ```

benchmarks/vs_vectorbt/requirements-lock.txt

@@ -26,8 +26,8 @@ raptorbt==0.9.0
 # NautilusTrader: an event-driven engine with a Rust core and a Python API. It
 # asks for Python >=3.12,<3.15 and publishes cp312 wheels (checked on Linux,
 # manylinux_2_35, and on Windows), so it sits inside the interpreter that raptorbt
-# already pins us to. 1.231.0 is the latest stable release.
-nautilus_trader==1.231.0
+# already pins us to. 1.231.0 is the latest stable release; it is pinned in
+# requirements-nautilus.txt, see fsspec below for why.
 # Its runtime dependencies, pinned for the same reason plotly is above: nothing
 # in the set is allowed to move because a transitive dependency shipped a
 # release the day before the run. numpy, pandas and psutil are already pinned
@@ -36,7 +36,11 @@ msgspec==0.22.0
 portion==2.6.3
 sortedcontainers==2.4.0
 click==8.5.0
-fsspec==2026.2.0
+# fsspec: NautilusTrader asks for exactly 2026.2.0, which is inside the range of
+# GHSA-27vj-qcqg-25rc (fixed in 2026.6.0). It is installed with --no-deps from
+# requirements-nautilus.txt, after this file, so the patched pin below is the
+# one that lands.
+fsspec==2026.9.0
 pyarrow==26.0.0
 pytz==2026.5
 tzdata==2026.5

benchmarks/vs_vectorbt/requirements-nautilus.txt

@@ -0,0 +1,10 @@
+# NautilusTrader, installed on its own and with --no-deps, after
+# requirements-lock.txt:
+#
+#   pip install -r requirements-lock.txt
+#   pip install --no-deps -r requirements-nautilus.txt
+#
+# 1.231.0 asks for exactly fsspec 2026.2.0, inside the range of
+# GHSA-27vj-qcqg-25rc, and pip would refuse the patched fsspec pinned in the
+# lock. Every runtime dependency it needs is pinned there instead.
+nautilus_trader==1.231.0