wickra

Author	SHA1	Message	Date
dependabot[bot]	c6972dd476	deps(actions): bump the github-actions group with 4 updates (#346 ) Bumps the github-actions group with 4 updates: [actions/checkout](https://github.com/actions/checkout), [taiki-e/install-action](https://github.com/taiki-e/install-action), [actions/setup-java](https://github.com/actions/setup-java) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release). Updates `actions/checkout` from 6.0.2 to 7.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6.0.2...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0) Updates `taiki-e/install-action` from 2.81.10 to 2.82.0 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/7a79fe8c3a13344501c80d99cae481c1c9085912...b8cecb83565409bcc297b2df6e77f030b2a468d5) Updates `actions/setup-java` from 5.2.0 to 5.3.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/be666c2fcd27ec809703dec50e508c2fdc7f6654...ad2b38190b15e4d6bdf0c97fb4fca8412226d287) Updates `softprops/action-gh-release` from 3.0.0 to 3.0.1 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.82.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/setup-java dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-28 00:25:33 +02:00
kingchenc	57e52c67b9	ci: add external link check (lychee, hybrid non-blocking) (#339 ) * ci: add external link check (lychee, scheduled + on-demand) Adds a non-blocking external-link checker mirroring wickra-docs: an authoritative weekly + on-demand lychee run (this workflow), kept off the PR/release path so a flaky third-party site can never block a merge or an irreversible publish. Fixes the one redirecting link it would flag (docs.rs/wickra -> docs.rs/wickra/latest/wickra/ in SUPPORT.md). * ci: run lychee as a non-blocking PR job (continue-on-error) Hybrid link-check: the authoritative run is the scheduled links.yml; this adds an early heads-up on PRs that never gates the merge. release.yml stays ungated so a flaky third-party site can never block an irreversible publish.	2026-06-22 15:59:14 +02:00
dependabot[bot]	98bb57c868	deps(actions): bump the github-actions group with 4 updates (#336 ) Bumps the github-actions group with 4 updates: [actions/setup-python](https://github.com/actions/setup-python), [actions/upload-artifact](https://github.com/actions/upload-artifact), [taiki-e/install-action](https://github.com/taiki-e/install-action) and [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `actions/setup-python` from 5.6.0 to 6.2.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v5.6.0...a309ff8b426b58ec0e2a45f0f869d46889d02405) Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4.6.2...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a) Updates `taiki-e/install-action` from 2.81.6 to 2.81.10 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/59012be0884e296ca2da49b530610e72c49039ad...7a79fe8c3a13344501c80d99cae481c1c9085912) Updates `codecov/codecov-action` from 6.0.1 to 7.0.0 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/e79a6962e0d4c0c17b229090214935d2e33f8354...fb8b3582c8e4def4969c97caa2f19720cb33a72f) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: taiki-e/install-action dependency-version: 2.81.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: codecov/codecov-action dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-21 15:30:13 +02:00
kingchenc	7e5d394f2a	fix(r): document the data-layer exports + add an R CMD check gate (#330 ) Clears the R CMD check WARNINGs r-universe surfaced when it finally built 0.9.5 (it was stuck on 0.9.2, before the data layer existed): 11/13 platform builds reported the same two warnings. ### Warnings fixed 1. Undocumented code objects — the data layer added in 0.9.3 (`BinanceFeed`, `CandleReader`, `Resampler`, `TickAggregator`, `fetch_binance_klines` and the generics `name` / `is_ready` / `warmup_period` / `push` / `read`). The roxygen blocks existed in `methods.R`, but the `man/.Rd` were never regenerated, and the constructors had only a title. 2. Codoc mismatch* — `AwesomeOscillatorHistogram.Rd` still documented `sma_period` after the argument was renamed to `lookback`. ### Changes - Full `@param`/`@return` roxygen on the seven data-layer constructors. - Regenerated `man/.Rd` + `NAMESPACE` with roxygen2: 13 new pages, the stale AwesomeOscillator usage refreshed, and `flush` registered on `base::flush`. - Fixed the `push()` example (`TickAggregator(1000)` was missing the required `gap_fill`) — it only ran once `push()` got a generated `.Rd`. - New CI gate:* a ubuntu-only `R CMD check` in the `r` job that fails on doc WARNING/ERROR, so stale docs fail the PR instead of reaching r-universe. Verified locally with `R CMD check` (R 4.6.0 + Rtools45): missing documentation entries and Rd \usage sections now OK, examples OK, tests OK. This PR's own CI exercises the new gate. Follow-up: a separate `0.9.6` release ships these doc fixes to r-universe.	2026-06-18 01:38:44 +02:00
kingchenc	929fc17127	ci: harden cache, timeouts and retries across CI and release (#328 ) Hardens both workflows after the R-on-ubuntu job repeatedly hit the 20-minute job cap and was cancelled (no R-package cache + no retry + a slow source build). Each item below maps to the requested checklist. ### CI (`ci.yml`) - Timeouts 20 → 30 min on every job (backstop only; real jobs finish well under). - R dependencies cached: replace the manual `install.packages(testthat/knitr)` with `r-lib/actions/setup-r-dependencies` — restores a cached R library and pulls RSPM binaries instead of compiling from source (the slow/flaky path that blew the cap). This is the actual root-cause fix. - NuGet cache for the C# job (`~/.nuget/packages`, keyed on the project files). - Retry the network installs that had none — `npm ci`, `dotnet test`, `mvn install` — via `nick-fields/retry` (2–3 attempts, backoff). On top of the existing env-level retries (`CARGO_NET_RETRY`, `npm_config_fetch_retries`, `PIP_RETRIES`) and the setup-* CDN-flake retries. - Go stays `cache: false` on purpose: the module has no `go.sum` / external deps, so there is nothing to cache (enabling it would only warn). ### Release (`release.yml`) - Per-job timeouts added (there were none — only GitHub's 6h default): 45 min, higher than CI's 30 because the wheel/build jobs compile from source incl. vendored OpenSSL and must not be killed mid-build. - wasm-publish gets a `Swatinem/rust-cache` like the other Rust-build jobs. - Retry the no-retry network installs (`npm ci` ×2, `dotnet pack`). The actual publish/deploy steps are left alone — they are already idempotent (skip-existing / skip-duplicate), so re-running the job is the safe recovery. ### R binding download (`bindings/r/configure[.win]`) - A freshly cut release can 404 for 1–2 min while assets propagate, which broke the C ABI download (`cannot open URL … 404`). Add a `wickra_download` retry helper (6 × 20s ≈ 2 min backoff) for both the release-asset and wasm-source downloads. Note: the CI R job builds the C ABI locally (`WICKRA_*_DIR`), so it never downloads — this fix covers the real-world r-universe / end-user build. This PR's own CI exercises the CI changes (the reworked R job, caches, retries, timeouts) before merge; the release-only changes are validated on the next tag.	2026-06-17 23:42:06 +02:00
kingchenc	41d5a7dd25	fix: build Linux Python wheels with vendored OpenSSL (manylinux + musllinux) (#327 ) Fixes the Linux Python wheel build that broke the `0.9.3` release (and would have broken `0.9.4`), and adds a CI guard so it cannot regress silently. ### Root cause The `live-binance` data layer links `native-tls` -> `openssl-sys`, which needs OpenSSL at build time. Neither wheel container provides it: - manylinux ships no OpenSSL headers, and - musllinux cross-compiles against a musl sysroot that has no OpenSSL at all, so installing a host package (`yum`/`apk`) cannot reach the cross target. The 3-OS Python CI jobs build natively on the runner, which already has system OpenSSL, so CI stayed green while the release container build failed. ### Fix - New opt-in `vendored-tls` feature on `wickra-data` and the Python binding: enables `native-tls/vendored`, compiling OpenSSL from source and linking it statically. No system OpenSSL needed on either libc. No-op on macOS/Windows (Security.framework / SChannel — `openssl-sys` is never in the graph there). - `release.yml` builds the Linux wheels with `--features vendored-tls` (replaces the manylinux-only `before-script-linux` header install, which could not fix the musllinux cross build). - CI gains a `manylinux` + `musllinux` container build-smoke matrix job, so both container builds run on every PR. This PR's own CI is the proof the fix works before any release re-attempt. ### Notes - No version bump: `0.9.4` published nowhere (the release run was cancelled before any publish job ran), so this lands on `0.9.4` and the tag is re-pointed at the fixed commit. - Adds checks to `ci.yml` (the smoke job is now a 2-entry matrix).	2026-06-17 22:26:21 +02:00
kingchenc	59acefa1ea	ci: retry-harden the Rust toolchain install across all jobs (#307 )	2026-06-15 07:09:39 +02:00
kingchenc	120b6ac265	docs+ci: surface 10-language golden verification (#303 ) * docs+ci: surface 10-language golden verification; add WASM golden CI - README: add C++ to the Quickstart list and state prominently that all 514 indicators are replayed through all 10 languages and checked bit-for-bit against the Rust reference. - CHANGELOG: document the cross-language golden suite, the Java and R C-ABI bool-marshalling fixes, the C# nullable directive and the live_binance rename. - ci.yml: run the WASM golden suite (nodejs-target build + node --test); the C/C++ golden tests already run via the C-ABI job's ctest and the other bindings pick up their golden runners in their existing test suites. * readme: add verified badge + prominent per-language throughput table - Add the 'verified across 10 languages' badge to the badge row, linking to the FAQ that explains the cross-language golden parity. - Surface a per-binding throughput table (the cost of each language's FFI boundary) so readers can pick a binding that keeps up with streaming hot loops — the cross-library benchmarks stay in BENCHMARKS.md. * changelog: note the verified badge and per-binding throughput table * docs: fix cross-language consistency (audit) - docs/README.md: add the missing C++ quickstart link. - README testing section: the golden parity now covers all 10 languages and all 514 indicators (was 'four C-ABI bindings, 7 archetype indicators'). - CHANGELOG: the live_binance rename also covers the C examples.	2026-06-15 05:07:52 +02:00
kingchenc	4a12f60a88	ci: test the Node binding on the 22/24 LTS (18/20 are EOL) (#294 ) * ci: test the Node binding on the 22/24 LTS (18/20 are EOL) Node 18 is EOL and 20 reaches EOL; move the binding CI matrix from [18, 20] to [22, 24] (both LTS), bump the fixed Node setups in ci.yml/release.yml to 22, and raise package.json engines to >= 20. The N-API 8 binary is ABI-stable across Node versions, so no per-version build is needed. The `npm test` script (`node --test __tests__/`) breaks on Node 22 — it resolves `__tests__` as a module — so switch to `node --test` (auto- discovery). Verified locally on Node 22: build + 584 tests green. * build(node): sync package-lock engines.node to >= 20 * ci(node): drop the __tests__/ path arg so node --test auto-discovers On Node 22+, `node --test __tests__/` resolves the directory as a single module and fails with one unrunnable subtest. `node --test` (no path) auto-discovers every *.test.js under the package, matching the package.json test script. Verified locally: 584 tests pass.	2026-06-14 00:23:36 +02:00
kingchenc	db5bd5e028	ci: build the Java binding on JDK 25 LTS (22 is EOL) (#292 ) Java 22 is a non-LTS that has reached end of life; bump the build JDK in ci.yml and release.yml to the 25 LTS. The pom pins `maven.compiler.release` to 22, so the emitted bytecode and the Java 22+ runtime floor (FFM API, final since 22) are unchanged. Not 21 — FFM was only preview there.	2026-06-13 23:55:49 +02:00
dependabot[bot]	baffebd3da	deps(actions): bump actions/checkout from 6.0.2 to 6.0.3 (#269 ) Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <h2>v4.2.0</h2> <ul> <li>Add Ref and Commit outputs by <a href="https://github.com/lucacome"><code>@lucacome</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li> <li>Dependency updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>- <a href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>, <a href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li> </ul> <h2>v4.1.7</h2> <ul> <li>Bump the minor-npm-dependencies group across 1 directory with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li> <li>Bump actions/checkout from 3 to 4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li> <li>Check out other refs/* by commit by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1cce3390c2bfda521930d01229c073c7ff920824"><code>1cce339</code></a> Fix checkout init for SHA-256 repositories (<a href="https://redirect.github.com/actions/checkout/issues/2439">#2439</a>)</li> <li><a href="https://github.com/actions/checkout/commit/900f2210b1d28bbbd0bd22d17926b9e224e8f231"><code>900f221</code></a> fix: expand merge commit SHA regex and add SHA-256 test cases (<a href="https://redirect.github.com/actions/checkout/issues/2414">#2414</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0c366fd6a839edf440554fa01a7085ccba70ac98"><code>0c366fd</code></a> Update changelog (<a href="https://redirect.github.com/actions/checkout/issues/2357">#2357</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=6.0.2&new-version=6.0.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>	2026-06-12 22:36:18 +02:00
dependabot[bot]	e631e55195	deps(actions): bump actions/setup-java from 4.8.0 to 5.2.0 (#268 ) Bumps [actions/setup-java](https://github.com/actions/setup-java) from 4.8.0 to 5.2.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-java/releases">actions/setup-java's releases</a>.</em></p> <blockquote> <h2>v5.2.0</h2> <h2>What's Changed</h2> <h3>Enhancement</h3> <ul> <li>Retry on HTTP 522 Connection timed out by <a href="https://github.com/findepi"><code>@findepi</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/964">actions/setup-java#964</a></li> </ul> <h3>Documentation Changes</h3> <ul> <li>Update gradle caching by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/972">actions/setup-java#972</a></li> <li>Update checkout to v6 by <a href="https://github.com/mahabaleshwars"><code>@mahabaleshwars</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/973">actions/setup-java#973</a></li> </ul> <h3>Dependency Updates</h3> <ul> <li>Upgrade <code>@actions/cache</code> to v5 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/968">actions/setup-java#968</a></li> <li>Upgrade actions/checkout from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/961">actions/setup-java#961</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/findepi"><code>@findepi</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-java/pull/964">actions/setup-java#964</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-java/compare/v5...v5.2.0">https://github.com/actions/setup-java/compare/v5...v5.2.0</a></p> <h2>v5.1.0</h2> <h2>What's Changed</h2> <h3>New Features</h3> <ul> <li>Add support for <code>.sdkmanrc</code> file in <code>java-version-file</code> parameter by <a href="https://github.com/guicamest"><code>@guicamest</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/736">actions/setup-java#736</a></li> <li>Add support for Microsoft OpenJDK 25 builds by <a href="https://github.com/the-mod"><code>@the-mod</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/927">actions/setup-java#927</a></li> </ul> <h3>Bug Fixes & Improvements</h3> <ul> <li>Update Regex to Support All ASDF Versions for the supported distributions in tool-versions File by <a href="https://github.com/aparnajyothi-y"><code>@aparnajyothi-y</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/767">actions/setup-java#767</a></li> <li>Enhance error logging for network failures to include endpoint/IP details, add retry mechanism and update workflows to use macos-15-intel by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/946">actions/setup-java#946</a></li> <li>Update SapMachine URLs by <a href="https://github.com/RealCLanger"><code>@RealCLanger</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/955">actions/setup-java#955</a></li> <li>Add GitHub Token Support for GraalVM and Refactor Code by <a href="https://github.com/mahabaleshwars"><code>@mahabaleshwars</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/849">actions/setup-java#849</a></li> </ul> <h3>Documentation changes</h3> <ul> <li>Update documentation to use checkout and Java v5 by <a href="https://github.com/lmvysakh"><code>@lmvysakh</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/903">actions/setup-java#903</a></li> <li>Clarify JAVA_HOME and PATH setup in README by <a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/841">actions/setup-java#841</a></li> </ul> <h3>Dependency updates</h3> <ul> <li>Upgrade prettier from 2.8.8 to 3.6.2 and document breaking changes in v5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/873">actions/setup-java#873</a></li> <li>Upgrade actions/publish-action from 0.3.0 to 0.4.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/912">actions/setup-java#912</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/lmvysakh"><code>@lmvysakh</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-java/pull/903">actions/setup-java#903</a></li> <li><a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-java/pull/841">actions/setup-java#841</a></li> <li><a href="https://github.com/the-mod"><code>@the-mod</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-java/pull/927">actions/setup-java#927</a></li> <li><a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-java/pull/946">actions/setup-java#946</a></li> <li><a href="https://github.com/guicamest"><code>@guicamest</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-java/pull/736">actions/setup-java#736</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-java/compare/v5...v5.1.0">https://github.com/actions/setup-java/compare/v5...v5.1.0</a></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-java/commit/be666c2fcd27ec809703dec50e508c2fdc7f6654"><code>be666c2</code></a> Chore: Version Update and Checkout Update to v6 (<a href="https://redirect.github.com/actions/setup-java/issues/973">#973</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/f7a6fefba97e80156950e16f2a9dafc8579b7d05"><code>f7a6fef</code></a> Bump actions/checkout from 5 to 6 (<a href="https://redirect.github.com/actions/setup-java/issues/961">#961</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/d81c4e45f3ac973cc936d79104023e20054ba578"><code>d81c4e4</code></a> Upgrade <code>@actions/cache</code> to v5 (<a href="https://redirect.github.com/actions/setup-java/issues/968">#968</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/1b1bbe1085cb6ab21b5b19b7bebc091a9430026a"><code>1b1bbe1</code></a> readme update (<a href="https://redirect.github.com/actions/setup-java/issues/972">#972</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/5d7b2146334bacf88728daaa70414a99f5164e0f"><code>5d7b214</code></a> Retry on HTTP 522 Connection timed out (<a href="https://redirect.github.com/actions/setup-java/issues/964">#964</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/f2beeb24e141e01a676f977032f5a29d81c9e27e"><code>f2beeb2</code></a> Bump actions/publish-action from 0.3.0 to 0.4.0 (<a href="https://redirect.github.com/actions/setup-java/issues/912">#912</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/4e7e684fbb6e33f88ecb2cf1e6b3797739cf499b"><code>4e7e684</code></a> feat: Add support for <code>.sdkmanrc</code> file in <code>java-version-file</code> parameter (<a href="https://redirect.github.com/actions/setup-java/issues/736">#736</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/46c56d6f92c88cf540acf95a12a4a41197499222"><code>46c56d6</code></a> Add GitHub Token Support for GraalVM and Refactor Code (<a href="https://redirect.github.com/actions/setup-java/issues/849">#849</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/66b945764b75604b3cfd644c3ada5232cf6c90c6"><code>66b9457</code></a> Update SapMachine URLs (<a href="https://redirect.github.com/actions/setup-java/issues/955">#955</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/6ba5449b7dcda52941806a19f0cf626b6420191e"><code>6ba5449</code></a> Enhance error logging for network failures to include endpoint/IP details, ad...</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-java/compare/c1e323688fd81a25caa38c78aa6df2d33d3e20d9...be666c2fcd27ec809703dec50e508c2fdc7f6654">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-java&package-manager=github_actions&previous-version=4.8.0&new-version=5.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>	2026-06-12 22:21:13 +02:00
dependabot[bot]	63949f6fc8	deps(actions): bump actions/setup-go from 5.6.0 to 6.4.0 (#267 ) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.6.0 to 6.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-go/releases">actions/setup-go's releases</a>.</em></p> <blockquote> <h2>v6.4.0</h2> <h2>What's Changed</h2> <h3>Enhancement</h3> <ul> <li>Add go-download-base-url input for custom Go distributions by <a href="https://github.com/gdams"><code>@gdams</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/721">actions/setup-go#721</a></li> </ul> <h3>Dependency update</h3> <ul> <li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/727">actions/setup-go#727</a></li> </ul> <h3>Documentation update</h3> <ul> <li>Rearrange README.md, add advanced-usage.md by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/724">actions/setup-go#724</a></li> <li>Fix Microsoft build of Go link by <a href="https://github.com/gdams"><code>@gdams</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/734">actions/setup-go#734</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gdams"><code>@gdams</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/721">actions/setup-go#721</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v6...v6.4.0">https://github.com/actions/setup-go/compare/v6...v6.4.0</a></p> <h2>v6.3.0</h2> <h2>What's Changed</h2> <ul> <li>Update default Go module caching to use go.mod by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/705">actions/setup-go#705</a></li> <li>Fix golang download url to go.dev by <a href="https://github.com/178inaba"><code>@178inaba</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/469">actions/setup-go#469</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v6...v6.3.0">https://github.com/actions/setup-go/compare/v6...v6.3.0</a></p> <h2>v6.2.0</h2> <h2>What's Changed</h2> <h3>Enhancements</h3> <ul> <li>Example for restore-only cache in documentation by <a href="https://github.com/aparnajyothi-y"><code>@aparnajyothi-y</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/696">actions/setup-go#696</a></li> <li>Update Node.js version in action.yml by <a href="https://github.com/ccoVeille"><code>@ccoVeille</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/691">actions/setup-go#691</a></li> <li>Documentation update of actions/checkout by <a href="https://github.com/deining"><code>@deining</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/683">actions/setup-go#683</a></li> </ul> <h3>Dependency updates</h3> <ul> <li>Upgrade js-yaml from 3.14.1 to 3.14.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/682">actions/setup-go#682</a></li> <li>Upgrade <code>@actions/cache</code> to v5 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/695">actions/setup-go#695</a></li> <li>Upgrade actions/checkout from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/686">actions/setup-go#686</a></li> <li>Upgrade qs from 6.14.0 to 6.14.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/703">actions/setup-go#703</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ccoVeille"><code>@ccoVeille</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/691">actions/setup-go#691</a></li> <li><a href="https://github.com/deining"><code>@deining</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/683">actions/setup-go#683</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v6...v6.2.0">https://github.com/actions/setup-go/compare/v6...v6.2.0</a></p> <h2>v6.1.0</h2> <h2>What's Changed</h2> <h3>Enhancements</h3> <ul> <li>Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang by <a href="https://github.com/nicholasngai"><code>@nicholasngai</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/665">actions/setup-go#665</a></li> <li>Add support for .tool-versions file and update workflow by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/673">actions/setup-go#673</a></li> <li>Add comprehensive breaking changes documentation for v6 by <a href="https://github.com/mahabaleshwars"><code>@mahabaleshwars</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/674">actions/setup-go#674</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-go/commit/4a3601121dd01d1626a1e23e37211e3254c1c06c"><code>4a36011</code></a> docs: fix Microsoft build of Go link (<a href="https://redirect.github.com/actions/setup-go/issues/734">#734</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/8f19afcc704763637be6b1718da0af52ca05785d"><code>8f19afc</code></a> feat: add go-download-base-url input for custom Go distributions (<a href="https://redirect.github.com/actions/setup-go/issues/721">#721</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/27fdb267c15a8835f1ead03dfa07f89be2bb741a"><code>27fdb26</code></a> Bump minimatch from 3.1.2 to 3.1.5 (<a href="https://redirect.github.com/actions/setup-go/issues/727">#727</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/def8c394e3ad351a79bc93815e4a585520fe993b"><code>def8c39</code></a> Rearrange README.md, add advanced-usage.md (<a href="https://redirect.github.com/actions/setup-go/issues/724">#724</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/4b73464bb391d4059bd26b0524d20df3927bd417"><code>4b73464</code></a> Fix golang download url to go.dev (<a href="https://redirect.github.com/actions/setup-go/issues/469">#469</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/a5f9b05d2d216f63e13859e0d847461041025775"><code>a5f9b05</code></a> Update default Go module caching to use go.mod (<a href="https://redirect.github.com/actions/setup-go/issues/705">#705</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5"><code>7a3fe6c</code></a> Bump qs from 6.14.0 to 6.14.1 (<a href="https://redirect.github.com/actions/setup-go/issues/703">#703</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/b9adafd441833a027479ddd0db37eaece68d35cb"><code>b9adafd</code></a> Bump actions/checkout from 5 to 6 (<a href="https://redirect.github.com/actions/setup-go/issues/686">#686</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/d73f6bcfc2b419b74f47075f8a487b40cc4680f8"><code>d73f6bc</code></a> README.md: correct to actions/checkout@v6 (<a href="https://redirect.github.com/actions/setup-go/issues/683">#683</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/ae252ee6fb24babc50e89fc67c4aa608e69fbf8f"><code>ae252ee</code></a> Bump <code>@actions/cache</code> to v5 (<a href="https://redirect.github.com/actions/setup-go/issues/695">#695</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-go/compare/40f1582b2485089dde7abd97c1529aa768e1baff...4a3601121dd01d1626a1e23e37211e3254c1c06c">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-go&package-manager=github_actions&previous-version=5.6.0&new-version=6.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>	2026-06-12 22:08:01 +02:00
dependabot[bot]	92210eb7b8	deps(actions): bump taiki-e/install-action from 2.79.15 to 2.81.6 (#266 ) Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.79.15 to 2.81.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/releases">taiki-e/install-action's releases</a>.</em></p> <blockquote> <h2>2.81.6</h2> <ul> <li> <p>Update <code>prek@latest</code> to 0.4.4.</p> </li> <li> <p>Update <code>cargo-shear@latest</code> to 1.13.0.</p> </li> </ul> <h2>2.81.5</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.29.0.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.19.</p> </li> <li> <p>Update <code>typos@latest</code> to 1.47.2.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.0.</p> </li> </ul> <h2>2.81.4</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.28.4.</p> </li> <li> <p>Update <code>typos@latest</code> to 1.47.1.</p> </li> <li> <p>Update <code>syft@latest</code> to 1.45.0.</p> </li> <li> <p>Update <code>cargo-neat@latest</code> to 0.4.0.</p> </li> <li> <p>Update <code>cargo-mutants@latest</code> to 27.1.0.</p> </li> </ul> <h2>2.81.3</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.28.3.</p> </li> <li> <p>Update <code>uv@latest</code> to 0.11.18.</p> </li> <li> <p>Update <code>trivy@latest</code> to 0.71.0.</p> </li> </ul> <h2>2.81.2</h2> <ul> <li> <p>Update <code>mise@latest</code> to 2026.5.18.</p> </li> <li> <p>Update <code>cargo-semver-checks@latest</code> to 0.48.0.</p> </li> </ul> <h2>2.81.1</h2> <ul> <li> <p>Update <code>cargo-no-dev-deps@latest</code> to 0.2.24.</p> </li> <li> <p>Update <code>cargo-hack@latest</code> to 0.6.45.</p> </li> </ul> <h2>2.81.0</h2> <ul> <li> <p>Support <code>convco</code>. (<a href="https://redirect.github.com/taiki-e/install-action/pull/1831">#1831</a>, thanks <a href="https://github.com/graelo"><code>@graelo</code></a>)</p> </li> <li> <p>Support <code>docgarden</code> (<a href="https://redirect.github.com/taiki-e/install-action/pull/1830">#1830</a>, thanks <a href="https://github.com/jesse-black"><code>@jesse-black</code></a>)</p> </li> <li> <p>Update <code>vacuum@latest</code> to 0.28.0.</p> </li> <li> <p>Update <code>cargo-binstall@latest</code> to 1.19.1.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md">taiki-e/install-action's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file.</p> <p>This project adheres to <a href="https://semver.org">Semantic Versioning</a>.</p> <!-- raw HTML omitted --> <h2>[Unreleased]</h2> <h2>[2.81.10] - 2026-06-11</h2> <ul> <li> <p>Update <code>tombi@latest</code> to 1.1.3.</p> </li> <li> <p>Update <code>release-plz@latest</code> to 0.3.159.</p> </li> <li> <p>Update <code>cosign@latest</code> to 3.1.1.</p> </li> </ul> <h2>[2.81.9] - 2026-06-10</h2> <ul> <li> <p>Update <code>wasm-bindgen@latest</code> to 0.2.123.</p> </li> <li> <p>Update <code>tombi@latest</code> to 1.1.2.</p> </li> <li> <p>Update <code>parse-changelog@latest</code> to 0.6.17.</p> </li> <li> <p>Update <code>just@latest</code> to 1.52.0.</p> </li> <li> <p>Update <code>gungraun-runner@latest</code> to 0.19.2.</p> </li> <li> <p>Update <code>cargo-binstall@latest</code> to 1.20.0.</p> </li> </ul> <h2>[2.81.8] - 2026-06-08</h2> <ul> <li> <p>Update <code>vacuum@latest</code> to 0.29.2.</p> </li> <li> <p>Update <code>parse-dockerfile@latest</code> to 0.1.7.</p> </li> <li> <p>Update <code>mise@latest</code> to 2026.6.1.</p> </li> <li> <p>Update <code>cargo-shear@latest</code> to 1.13.1.</p> </li> </ul> <h2>[2.81.7] - 2026-06-06</h2> <ul> <li> <p>Update <code>wasmtime@latest</code> to 45.0.1.</p> </li> <li> <p>Update <code>vacuum@latest</code> to 0.29.1.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/taiki-e/install-action/commit/59012be0884e296ca2da49b530610e72c49039ad"><code>59012be</code></a> Release 2.81.6</li> <li><a href="https://github.com/taiki-e/install-action/commit/52d2b0721d1d96983ea68305ea47cf412c2cb542"><code>52d2b07</code></a> Update <code>prek@latest</code> to 0.4.4</li> <li><a href="https://github.com/taiki-e/install-action/commit/eeedd6ad125e98661ca2977b004703515f466511"><code>eeedd6a</code></a> Update <code>cargo-shear@latest</code> to 1.13.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/f23697a9b80ca29d330c6f9063d9df132e8be880"><code>f23697a</code></a> Update cargo-audit manifest</li> <li><a href="https://github.com/taiki-e/install-action/commit/4bc351f7f2614e48088386e2a0ad917ca3a7e4ba"><code>4bc351f</code></a> Release 2.81.5</li> <li><a href="https://github.com/taiki-e/install-action/commit/ee19c896b554e8b0244999a8559d4eaecf29da0c"><code>ee19c89</code></a> Update <code>vacuum@latest</code> to 0.29.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/026a7c19d8cde560882d2f6a1057690e982d4d70"><code>026a7c1</code></a> Update <code>uv@latest</code> to 0.11.19</li> <li><a href="https://github.com/taiki-e/install-action/commit/73ae273667d96854ff27b31a096a2eff0076704b"><code>73ae273</code></a> Update <code>typos@latest</code> to 1.47.2</li> <li><a href="https://github.com/taiki-e/install-action/commit/afcf03672edd439d42ab0d5d07c5254be5b35577"><code>afcf036</code></a> Update <code>mise@latest</code> to 2026.6.0</li> <li><a href="https://github.com/taiki-e/install-action/commit/cde8c9e634f4a17bc06b61413ac0ef75450eac46"><code>cde8c9e</code></a> Release 2.81.4</li> <li>Additional commits viewable in <a href="https://github.com/taiki-e/install-action/compare/0fd46367812ee04360509b4169d9f659d6892bb2...59012be0884e296ca2da49b530610e72c49039ad">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=taiki-e/install-action&package-manager=github_actions&previous-version=2.79.15&new-version=2.81.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>	2026-06-12 21:54:06 +02:00
kingchenc	32e18cb3a3	feat(r): getting-started vignette + sample_ohlcv dataset (#262 ) Fills the two empty r-universe tabs (Articles, Datasets) for the R package and gives R users a runnable onboarding path. ## What - `vignettes/getting-started.Rmd` — Articles tab. Walks through batch vs streaming (and that they're equivalent), multi-output MACD, candle ATR, and `reset()`, all over the bundled sample series. Built strictly from the already-proven README quick-start + golden-test API (`Sma`/`Ema`/`Rsi`/`Atr`/`MacdIndicator`, `batch`/`update`/`reset`) — no new indicator logic. - `data/sample_ohlcv.rda` (+ `data-raw/sample_ohlcv.R` generator) — Datasets tab. A deterministic, seeded synthetic daily OHLCV series (250 rows × `date/open/high/low/close/volume`); documented via `R/data.R` + `man/sample_ohlcv.Rd`. `LazyData: true` → available right after `library(wickra)`. - `DESCRIPTION` — `Suggests: knitr, rmarkdown`, `VignetteBuilder: knitr`, `LazyData: true`. - `ci.yml` — the R job now knits the vignette (executes its R chunks, no pandoc needed) so a broken example is caught in CI before r-universe / CRAN `R CMD check`. The main job otherwise only `R CMD INSTALL`s. ## Verified locally (R 4.6.0 + Rtools45) - Package installs with the dev C-ABI override; dataset moves to the lazyload DB. - Vignette knits cleanly — every chunk runs, `batch == streaming` holds, MACD/ATR/RSI produce sensible values. ## Notes - No version bump — metadata/docs only; rides the next release. Merging triggers an r-universe rebuild → Articles + Datasets populate and (now that `support@wickra.org` is verified) the maintainer avatar resolves. - `data-raw/` is `.Rbuildignore`d (generator, not shipped). The `.rda` is XZ-compressed (~3 KB). Not merging — for review.	2026-06-11 21:44:56 +02:00
kingchenc	20c0002f8e	ci: cap job runtimes and auto-retry the flaky Node test step (#252 ) ## Problem A Node test job wedged on a macOS runner: the Run Node tests step (`node --test`) hung for over an hour while the identical tests passed in ~1.5 min on every other runner (Node 20 macOS same run: 1m46s; Node 18 macOS on a sibling PR: 1m34s). It is a one-off stuck process — the macOS analogue of the documented `setup-node` Windows CDN flake — not a real Node 18 vs 20 difference. No job in `ci.yml` set any `timeout-minutes`, so a hung step runs toward GitHub's 6h default before the platform kills it. ## Changes - Job-level `timeout-minutes: 20` backstop on all 15 jobs. The slowest real job is ~5 min, so 20 min is generous headroom (survives cold-cache spikes) while turning a 6h hang into a 20-min fail. The clock counts execution time only — queued/waiting time does not count against it. - `Run Node tests` wrapped in `nick-fields/retry` (SHA-pinned, v4.0.0): a hung attempt is killed after 6 min and retried once (`timeout_minutes: 6`, `max_attempts: 2`), so a one-off wedge self-heals without a manual re-run. Normal run is well under a minute; worst case 2×6 min stays under the 20-min job backstop. ## Notes - New SHA-pinned third-party action (`nick-fields/retry@ad98453…` = v4.0.0) — satisfies the SHA-pin convention; `zizmor` runs on this PR. - `ci.yml` validated as well-formed YAML; all 15 jobs confirmed to carry a job-level timeout.	2026-06-11 03:27:05 +02:00
kingchenc	b06ce2678a	Restructure the Go binding for self-contained distribution (#236 ) ## Problem Plain `go get` + `go build` of the Go binding never worked as a dependency: - cgo `CFLAGS` pointed at `${SRCDIR}/../c/include` — the parent dir is outside the Go module, so a proxy-fetched module has no header. - the library under `./lib` was git-ignored and never shipped; the README told users to `cargo build` it from the workspace, which only works inside a clone, not from the read-only module cache. cgo has no build hook and Go has no registry, so the only way a consumer's `go get`+build can find the lib is for it to be committed inside the module the consumer pulls. Per the design decision, that module is a separate `wickra-go` repo (keeps this repo free of committed binaries), populated by the release pipeline — this PR is the in-repo restructure that makes that possible. ## Changes - Vendor the header at `bindings/go/include/wickra.h` (committed copy of `bindings/c/include/wickra.h`); `CFLAGS` → `-I${SRCDIR}/include`. A CI drift check fails if the copy goes stale. - Per-platform libraries: cgo `LDFLAGS` become per `GOOS`/`GOARCH`, linking `${SRCDIR}/lib/<goos>_<goarch>/`. - CI stages the host library into `lib/<goos>_<goarch>/` (`RUNNER_OS`/`RUNNER_ARCH` — note `macos-latest` is arm64) and exports `WICKRA_GO_LIBDIR` for the Windows PATH; libraries stay git-ignored here. - README: install via the `wickra-go` module + a contributor build section. ## Validation - Local windows/amd64: `gofmt` clean, `go vet`, `go build`, `go test` all green against the staged library + vendored header. - Linux/macOS arches → the 3-OS `Go on …` CI job. Follow-up (Stage 2, separate): create `wickra-lib/wickra-go` + a `release.yml` mirror job (source + 6 platform libs → `lib/<goos>_<goarch>/`, commit + tag), and point the docs at the new import path. Part of the self-contained gap (`todo-11`).	2026-06-09 23:06:16 +02:00
kingchenc	5b7523265c	Make the R binding self-contained (fetch the C ABI at install time) (#235 ) ## Problem The R package built only inside the dev/CI workspace. `src/Makevars` and `configure.win` hard-required `WICKRA_INCLUDE_DIR` / `WICKRA_LIB_DIR` pointing at a pre-built `libwickra` (`configure.win` literally `: "${WICKRA_LIB_DIR:?...}"`), and there was no Unix `configure`. So r-universe and any plain `install.packages` / `install_github` failed — R had no working end-user install path. ## Fix Fetch the prebuilt `wickra-c-<triple>.tar.gz` release asset matching the package version at install time and bundle the library into the package (same outcome as the C# / Java bindings, which bundle per-platform native libs): - New POSIX `configure` (the Unix hook R lacked): detect OS/arch → triple, download + `untar` via base R (no curl/wget system dep), stage `wickra.h` + `libwickra.{so,dylib}` into `src/`, generate `src/Makevars` from `Makevars.in` with an rpath (`$ORIGIN` Linux, `@loader_path` + `install_name_tool` macOS) so the bundled lib resolves post-install. - `configure.win`: drop the hard `WICKRA_LIB_DIR` requirement; download the Windows triple when unset, then keep the existing `wickra_abi.dll` rename + `objdump`/`dlltool` import-lib dance (sourcing the dll/header from the asset). - `install.libs.R` also bundles `libwickra.dylib` (macOS); the `.so`/`.dll` globs already covered Linux/Windows. - `WICKRA_INCLUDE_DIR`/`WICKRA_LIB_DIR` stay as an optional dev override. - CI (3 OS) keeps building against the locally built C ABI (version-independent — avoids the chicken-egg of downloading the in-flight version) but no longer exports `LD_LIBRARY_PATH`/`DYLD_LIBRARY_PATH`, so it now verifies the bundled rpath — the real self-contained path users and r-universe get. `Makevars` is now generated from `Makevars.in`; `SystemRequirements` + ignore/attributes files updated. ## Validation - The Windows `objdump`/`dlltool` import-lib dance was smoke-tested locally against the real v0.7.9 asset (2412 `wickra_` exports → import lib built). - Linux/macOS rpath bundling can't be tested on this Windows host → the 3-OS `r` CI job is the gate (now without the loader-path mask). - Follow-up (separate, after release): set up `wickra-lib/wickra-lib.r-universe.dev` (`packages.json` → `bindings/r`). Closes the R half of the self-contained-distribution gap (`todo-10`).	2026-06-09 22:11:50 +02:00
kingchenc	167f7b3ffe	Add the Java binding over the C ABI hub (Panama/FFM) (#233 ) Adds a Java binding (`bindings/java`) over the C ABI hub — the fourth language stecker after C#, Go and R, reaching the hub through the Java Foreign Function & Memory API (Panama, `java.lang.foreign`, final in Java 22) rather than JNI or jextract. ## What's here - `bindings/java` — a Maven module (`org.wickra:wickra`) exposing all 514 indicators as idiomatic `AutoCloseable` classes. The downcall handles (`internal/NativeMethods.java`), the per-indicator wrappers and the output records are generated from `bindings/c/include/wickra.h` (same eight-archetype taxonomy as the C#/Go/R generators: scalar/batch, multi-output, bars, profile, values-profile, array-input). The opaque handle is a `MemorySegment` freed by a registered `java.lang.ref.Cleaner` action; multi-output returns a `record` (`null` at warmup), bars a `record[]`, profiles a record with a trailing `double[]`. The hand-written `WickraNative` resolves the native library (a bundled per-platform copy, or a `target/release` fallback for local development) and validates it against a sentinel symbol. repr(C) struct offsets are computed in the generator so the FFM reads land on the exact bytes. - `examples/java` — the full example suite mirroring C/C#/Go/R: streaming, backtest, multi_timeframe, parallel_assets (parallel streams), three strategies, and `FetchBtcusdt`/`LiveBinance`. - CI — a `java` job builds the C ABI library, sets up JDK 22 (Temurin, with a CDN-flake retry), runs the archetype test suite and the seven offline examples on Linux, macOS and Windows. - Release — a gated `java-publish` job (skipped until the `JAVA_PUBLISH_ENABLED` repository variable is set) stages the native libraries from the `wickra-c-<triple>.tar.gz` assets into the binding's resources and deploys to Maven Central with GPG signing. Independent of the GitHub-release job, like the NuGet job. - Docs — Java added to the README languages table, project layout, building/testing and comparison table, CONTRIBUTING, ARCHITECTURE, the examples index, the issue/PR templates, the About-description template, and the other binding READMEs. ## Requirements Java 22+ (the FFM API is final since Java 22). The binding requires `--enable-native-access=ALL-UNNAMED` at runtime; the test and example runners pass it automatically. No Rust crate or `Cargo.toml` change — the Java binding is standalone and additive. The generated `*.java` are committed (like the node `index.js`/`index.d.ts`); the generator stays private.	2026-06-09 20:30:29 +02:00
kingchenc	b7ef63400d	Add the R binding over the C ABI hub (#230 ) Adds an R binding (`bindings/r`) over the C ABI hub — the third language stecker after C# and Go, reaching the hub through R's native `.Call` interface (not extendr). ## What's here - `bindings/r` — an R package exposing all 514 indicators as constructors that return a `wickra_indicator` object with generic `update`/`batch`/`reset` methods. The C glue (`src/wickra.c`) and R wrappers (`R/indicators.R`) are generated from `bindings/c/include/wickra.h` (same archetype taxonomy as the C#/Go generators: scalar/batch, multi-output, bars, profile, profile-values, array-input). The opaque handle is an R external pointer freed by a registered finalizer; multi-output returns a named vector (`NA` at warmup), bars a matrix, profiles a list. - `examples/r` — the full example suite mirroring C/C#/Go: streaming, backtest, multi_timeframe, parallel_assets (`mclapply`), three strategies, and `fetch_btcusdt`/`live_binance`. - CI — an `r` job builds the C ABI library, installs the package, runs the `testthat` suite and the offline examples on Linux, macOS and Windows (`R CMD check` is clean: 0 warnings, 0 notes). - Docs — R added to the README languages table, project layout, building/testing, CONTRIBUTING binding table + regenerate note, ARCHITECTURE, examples index, issue/PR templates, the About-description template, and the other binding READMEs. ## Linking / distribution The package compiles a thin `.Call` glue layer against the prebuilt C ABI library (header via `WICKRA_INCLUDE_DIR`, library via `WICKRA_LIB_DIR`). On Windows the package's own `wickra.dll` would collide with the C ABI's `wickra.dll`, so `configure.win` stages a renamed copy (`wickra_abi.dll`) and builds an import library referencing it; `install.libs.R` bundles the DLL and `.onLoad` puts it on the load path. On Linux/macOS the rpath locates the shared library. No `release.yml` change — R is distributed via r-universe / source install (gated). No Rust crate or `Cargo.toml` change — the R package is standalone and additive.	2026-06-09 19:18:40 +02:00
kingchenc	23d636fd97	Add the Go binding over the C ABI hub (#228 ) Adds a Go binding (`bindings/go`) over the C ABI hub — the second language stecker after C#. ## What's here - `bindings/go` — a cgo binding exposing all 514 indicators as idiomatic Go types with `New<Indicator>` constructors and `Update`/`Batch`/`Reset`/`Close` methods. The wrappers in `indicators_gen.go` are generated from `bindings/c/include/wickra.h` (same archetype taxonomy as the C# generator: scalar/batch, multi-output, bars, profile, profile-values, array-input). Opaque handles are freed by `Close()` with a `runtime.SetFinalizer` backstop; pointer arguments are caller-owned, panics never cross the boundary. - `examples/go` — the full example suite mirroring C/C#: streaming, backtest, multi_timeframe, parallel_assets (goroutine fan-out), three strategies, and `fetch_btcusdt`/`live_binance`. - CI — a `go` job builds the C ABI library, stages it, and runs `gofmt`/`go vet`/`go test` plus the offline examples on Linux, macOS and Windows. - Docs — Go added to the README languages table, project layout, building/testing, CONTRIBUTING binding table + regenerate note, ARCHITECTURE, examples index, issue/PR templates, the About-description template, and the other binding READMEs. ## Linking / distribution The binding links the prebuilt C ABI library via cgo (`libwickra.so`/`.dylib`/`wickra.dll` staged under `bindings/go/lib`, gitignored). The native libraries are already shipped per target triple by the existing `c-abi-build` release job; distribution is via the subdirectory module tag `bindings/go/vX.Y.Z` (gated), so `release.yml` needs no new publish job. No Rust crate or `Cargo.toml` change — the Go module is standalone and additive. Not for merge yet (gated, per request).	2026-06-09 17:33:37 +02:00
kingchenc	91f6f67257	Add C# (.NET) binding over the C ABI hub (#226 ) The first language stecker on the C ABI hub: a .NET binding exposing all 514 indicators as idiomatic `IDisposable` classes, generated from `wickra.h`. ## What's here - `bindings/csharp/` — the `Wickra` .NET 8 package. `[LibraryImport]` source-generated P/Invoke (`NativeMethods.g.cs`) plus idiomatic wrappers (`Indicators.g.cs`), both generated from the committed `bindings/c/include/wickra.h`. The binding owns no indicator maths — it only marshals types across the C ABI. - Marshalling, verified end-to-end against the native library. Opaque handles cross as `nint` kept alive per call via a `SafeHandle`; `bool` as `[MarshalAs(U1)]` (Rust `bool` is one byte); a self-correcting `DllImportResolver` validates the loaded library actually exports the Wickra ABI. Tests cover one representative per FFI archetype (scalar, candle, pairwise, multi-output, bars, profile, values-profile, order-book / array-input) plus exact Sma reference values. - NuGet packaging — `dotnet pack` produces `Wickra.<version>.nupkg`; the release pipeline stages prebuilt native libraries under `runtimes/<rid>/native/` for six target triples (win/linux/osx × x64/arm64). - `examples/csharp/` — nine examples mirroring `examples/c/`: streaming, backtest, multi_timeframe, parallel_assets, three strategies, and fetch_btcusdt + live_binance. - CI — a `csharp` job on the three OSes builds the C ABI, tests the binding, and runs the offline examples. Release — a gated `csharp-publish` job packs and pushes to NuGet (gated on `NUGET_API_KEY`, independent of the GitHub-release job so a C# hiccup never blocks the C/C++ asset release). - Docs consistency wave — README, CONTRIBUTING, CHANGELOG, examples/README, the issue / PR templates, `sync-about.yml`, and `.gitattributes`. The native Python / Node / WASM bindings and the C ABI are untouched; this is additive. Publishing to NuGet stays gated behind the release tag and the secret.	2026-06-09 14:32:05 +02:00
kingchenc	91e05e3c26	C ABI hub crate (bindings/c) foundation (#222 ) ## What Introduces `wickra-c` — a `cdylib` + `staticlib` that exposes the Rust core over a C ABI. This is the hub every C-capable language (C, C++, Go, C#, Java, R) links against, instead of re-wiring each indicator natively. The native Python/Node/WASM bindings are untouched; this is purely additive, for ecosystems without first-class Rust tooling. ## Scope (foundation slice) This PR deliberately validates the whole pipeline end to end with one indicator (SMA) before scaling to all 514, so the CI / cross-OS / header-drift mechanics are proven green first. - Opaque `mut T` handles; `wickra_<ind>_{new,update,batch,reset,free}`. - NaN sentinel for warmup / NULL handles; caller-owned batch buffers; every function NULL-safe. - cbindgen generates and commits `bindings/c/include/wickra.h` with opaque handle typedefs. - A C smoke example (`examples/c/`) links the header + compiled library and runs (CMake + ctest). - A `c-abi` CI job builds the library and runs the smoke test on Linux, macOS and Windows, plus a header drift check on Linux. ## Notes - The per-indicator FFI blocks are plain `#[no_mangle]` functions, not* a macro: cbindgen cannot see macro-generated functions on stable Rust (macro expansion needs nightly), so the blocks are written literally and will be generated mechanically by the ScriptHelpers `capi` wrapper in a follow-up (same model as the committed-but-generated Node `index.js`). - `bindings/c` cannot inherit the workspace `forbid(unsafe_code)` lint (the C boundary needs raw pointers), so it mirrors every workspace lint and only relaxes `unsafe_code`. The Rust core stays `unsafe`-forbidden. ## Follow-ups (separate PRs) - ScriptHelpers `capi` generator + wire the scalar family (~235). - Hand-written blocks for multi-output / custom-input / bars (~279). - Docs consistency wave (README / docs / webpage: Python·Node·WASM·Rust → +C). - Release wiring (native-lib matrix + header/lib GH-release assets) — gated.	2026-06-09 02:07:03 +02:00
kingchenc	d16df1e224	ci: warm the cargo registry with backoff so a DNS blip can't fail clippy (#210 ) ## Problem A macOS runner on #206 failed the Rust job's clippy step with: ``` Updating crates.io index error: failed to get `rayon` as a dependency ... download of config.json failed [6] Couldn't resolve host name (Could not resolve host: index.crates.io) ``` A pure transient DNS blip — unrelated to the change (a docs-only PR). `CARGO_NET_RETRY=10` only does fast in-process retries; a longer DNS outage outlasts them, so the very first cargo step's crates.io index fetch fails the whole job. ## Fix Add a Warm cargo registry step right after the cache restore in the `rust`, `clippy-bindings` and `msrv` jobs. It runs `cargo fetch` in a 5-attempt loop with real backoff (20/40/60/80s sleeps) so the dependency graph is pulled once, patiently, riding out a multi-second DNS outage that cargo's rapid retries can't. The later clippy/build/test steps then resolve from the warmed local cache. Mirrors the existing inline retry pattern already used for setup-node/setup-python CDN flakes. Can be extended to the coverage/python/wasm/node jobs if they ever hit the same blip.	2026-06-08 02:22:26 +02:00
kingchenc	73415cd2dc	ci: zizmor security hardening (#133 ) * ci: pass ref context through env in release tag step zizmor flagged the "Resolve target tag" step in release.yml for template-injection: github.event_name / github.ref / github.ref_name were interpolated directly into the shell script. On a tag push the tag name is attacker-influenceable, so a crafted tag could inject commands. Move all three context values into the step env and reference them as shell variables instead. Verified with zizmor 1.16.3: template-injection findings on release.yml drop from 2 to 0. * ci: accept release.yml build caches via zizmor config The release pipeline restores Swatinem/rust-cache and actions/setup-node caches as a deliberate optimisation. zizmor flags all eight under cache-poisoning because release.yml publishes to crates.io / PyPI / npm. The caches are maintainer-controlled and the restore speedup is kept on purpose, so accept the finding via a zizmor config ignore for release.yml rather than running cache-free release builds. (Six of the eight are actions/setup-node, reported at Low confidence.) Adds .github/zizmor.yml; release.yml now reports 0 high findings. * ci: drop persisted checkout credentials on read-only jobs zizmor's artipacked audit flags every actions/checkout that keeps the default persisted credential: the token is written to the runner's .git/config, where it can leak if a later step packs .git into an uploaded artifact, or be read by another step in the same job. Set persist-credentials: false on the 20 checkouts whose jobs never push or authenticate to git (build/test/clippy/msrv/coverage/supply-chain/ fuzz/python/wasm/node in ci.yml, plus bench.yml, codeql.yml, the seven release.yml build/publish jobs, and sync-metadata.yml). The publish and release jobs authenticate to crates.io / npm / PyPI / the GitHub API with their own tokens, not persisted git credentials, so this is safe. sync-about.yml genuinely pushes the indicator-count fix-up to the PR branch, so it keeps its credential and is accepted via .github/zizmor.yml. zizmor artipacked for the repo drops to 0 (0 high, 0 medium remaining).	2026-06-02 02:08:40 +02:00
kingchenc	5b23b36261	ci: pin CI dependency installs by hash (Scorecard PinnedDependencies) (#114 ) * ci: use npm ci instead of npm install for reproducible installs Pins the node binding dependency install to the committed package-lock.json integrity hashes (OpenSSF Scorecard PinnedDependencies). npm ci installs strictly from the lockfile; npm install could resolve newer patch versions. Covers ci.yml and both release.yml node steps. * ci: hash-pin Python dev tooling in ci.yml (Scorecard #19) Replaces the unpinned 'pip install maturin pytest numpy hypothesis' with a hash-locked '--require-hashes -r' install (OpenSSF Scorecard PinnedDependencies). Two lock files are needed because numpy publishes no single release with wheels for both cp39 and cp313 (<=2.0.2 has cp39 only, >=2.1 drops cp39): ci-dev-py39.txt numpy 2.0.2 (Python 3.9, + tomli/exceptiongroup) ci-dev-py3.txt numpy 2.4.6 (Python 3.10+) The step selects the file by matrix.python-version under shell: bash. Both are generated from ci-dev.in via uv (scripts/update-lockfiles.sh, added next). * ci: hash-pin Python deps in bench.yml (Scorecard #16) Replaces the unpinned 'pip install maturin numpy pandas talipp finta' with a hash-locked '--require-hashes -r .github/requirements/bench.txt' install. bench.yml runs on a single Python version (3.11), so one lock file (generated from bench.in via uv) is sufficient. * build: add scripts/update-lockfiles.sh to regenerate all lockfiles One command refreshes every committed lockfile across languages: Cargo.lock and fuzz/Cargo.lock (cargo update), the Node binding package-lock.json, and the hash-pinned Python requirements under .github/requirements/ (uv pip compile --generate-hashes). Uses uv for the Python locks so a target Python version's hashed transitive closure can be resolved without that interpreter installed (needed for the numpy cp39/cp313 split); bootstraps uv if absent. .gitattributes pins .sh to LF so the script stays runnable on Linux/macOS. ci: split ci-dev requirements per Python version + Dependabot rehash Splits the single ci-dev.in into ci-dev-py39.in (numpy <2.1, the last series with cp39 wheels) and ci-dev-py3.in (3.10+), giving a 1:1 .in->.txt layout. The cap keeps Python 3.9 permanently installable and stops Dependabot from proposing 3.9-breaking numpy bumps. Adds a Dependabot pip entry on /.github/requirements so the hash-locked tooling is kept current automatically; the canonical manual refresh stays scripts/update-lockfiles.sh. Only the '# via -r' provenance lines in the .txt change; no package versions or hashes move. * ci: cache pip and npm downloads in the PR-loop jobs Adds setup-python cache: pip (ci.yml python matrix + bench.yml, keyed on the hash-locked requirements) and setup-node cache: npm (ci.yml node job, keyed on bindings/node/package-lock.json), on both the primary and retry setup steps. Scoped to jobs that actually install dependencies; the examples-smoke and clippy-bindings jobs install nothing and are left uncached. release.yml is intentionally left out: it runs only on tag push (not the PR loop) and is the publish-critical path, so no caching is added there. * docs: document hash-pinned requirements and update-lockfiles.sh Updates the lockfile-policy table: the bindings/python row no longer claims CI installs tooling unpinned, and a new .github/requirements row documents the hash-locked CI/bench tooling and the per-Python-version ci-dev split. Adds a paragraph pointing contributors at scripts/update-lockfiles.sh (uv-based, self-bootstrapping) as the canonical lockfile refresh. * docs: changelog entry for hash-pinned CI dependency installs	2026-06-01 17:58:31 +02:00
kingchenc	99af5f8ee1	ci: retry transient registry/DNS flakes at the cargo/npm/pip tool level (#105 ) The v0.4.0-era CI failure was a runner network blip — `napi build` invokes cargo, whose fetch of index.crates.io hit "Could not resolve host: index.crates.io" and failed the Node-on-macOS job, forcing a manual re-run. The earlier flake-hardening (setup-node/setup-python + rust-cache retries) only covered toolchain download and cache restore, not the registry fetches inside the actual build/publish steps. Set tool-level network retries as workflow env so every cargo/napi/maturin/ wasm-pack/npm/pip invocation in every job inherits them — including the nested cargo calls inside napi/maturin/wasm-pack: - CARGO_NET_RETRY=10 (default 3): cargo classes DNS-resolve / connect / timeout errors as spurious and retries with backoff; 10 attempts ride out a transient blip instead of failing the job. - CARGO_NET_GIT_FETCH_WITH_CLI=true: more robust git-dep fetches. - npm_config_fetch_retries=5 / maxtimeout=120s: npm ci/install registry retries. - PIP_RETRIES=5 / PIP_DEFAULT_TIMEOUT=120: pip install resilience. Applied to ci.yml, release.yml and bench.yml (the workflows that build). No more manual re-runs for transient registry flakes.	2026-06-01 04:08:18 +02:00
kingchenc	ebddc5e376	ci: set least-privilege top-level token permissions (P21.1b) (#103 ) The auto-injected GITHUB_TOKEN defaulted to write-all in ci.yml, bench.yml and release.yml (no top-level permissions block), and codeql.yml declared its scopes only at job level. Add a top-level `permissions: contents: read` to all four so the token starts read-only and only the jobs that genuinely write through it raise the scope: - release.yml: github-release keeps contents: write; node-/wasm-publish and attestations keep their id-token / attestations: write blocks. The cargo/python/node publish jobs push to crates.io/PyPI/npm via their own registry secrets, not the GITHUB_TOKEN, so read-only is correct for them. - codeql.yml: analyze keeps security-events: write (job level). - ci.yml / bench.yml: no job writes back to the repo (coverage uploads via CODECOV_TOKEN; bench only uploads an artifact), so no job override is needed. sync-about.yml already had a top-level block but at contents: write; demote the top level to read and move contents: write down to the single `sync` job (the PR-head counter push is the only GITHUB_TOKEN write). The cross-repo About/docs/webpage/org writes are unaffected — they run through the fine-grained ABOUT_SYNC_TOKEN, which the permissions key does not govern. Raises OpenSSF Scorecard Token-Permissions from 0 toward 10.	2026-06-01 02:01:31 +02:00
kingchenc	01dd08714b	ci: harden workflows against network/CDN flakes (resilient cache + setup retries) (#101 )	2026-06-01 01:07:56 +02:00
kingchenc	21c86f348f	examples + bindings: Node/WASM strategy parity + test/benchmark parity (P2 + P3) (#81 ) * examples(node): add RSI mean-reversion strategy Node counterpart of strategy_rsi_mean_reversion.{py,rs}: RSI(14) < 30 long, > 70 exit, 0.1% fees, hourly BTCUSDT. Output verified byte-identical to the Rust reference (37 trades W24/L13, -17.84% return, 46.89% max drawdown). * examples(node): add MACD + ADX trend-filter strategy Node counterpart of strategy_macd_adx.{py,rs}: MACD(12,26,9) histogram crossover entries gated by ADX(14) > 20, hourly BTCUSDT, 0.1% fees. Output verified byte-identical to the Rust reference (246 trades W90/L156, -47.19% return, 53.75% max drawdown). * examples(node): add Bollinger-squeeze breakout strategy Node counterpart of strategy_bollinger_squeeze.{py,rs}: enter on a fresh 180-bar Bollinger-bandwidth low + close above the upper band, exit on a 2ATR(14) stop or upper-band collapse, daily BTCUSDT, 0.1% fees. Output verified byte-identical to the Rust reference (1 trade, -7.82% return, 13.01% max drawdown). examples(wasm): add RSI mean-reversion strategy demo Browser counterpart of strategy_rsi_mean_reversion.{py,js,rs}: RSI(14) < 30 long, > 70 exit, 0.1% fees, summary table. Same signal/fill/PnL/equity loop as the runtime-verified Node example; loads via the established wickra_wasm.js init + fetch-CSV pattern. (wasm32 build runs in CI.) * examples(wasm): add MACD + ADX trend-filter strategy demo Browser counterpart of strategy_macd_adx.{py,js,rs}: MACD(12,26,9) histogram crossover gated by ADX(14) > 20, hourly BTCUSDT, 0.1% fees. Logic identical to the runtime-verified Node example; standard wickra_wasm.js init + fetch-CSV loader. (wasm32 build runs in CI.) * examples(wasm): add Bollinger-squeeze breakout strategy demo Browser counterpart of strategy_bollinger_squeeze.{py,js,rs}: fresh 180-bar Bollinger-bandwidth low + upper-band breakout, 2ATR(14) stop, daily BTCUSDT, 0.1% fees. Logic identical to the runtime-verified Node example; standard wickra_wasm.js init + fetch-CSV loader. (wasm32 build runs in CI.) ci: add examples syntax-smoke job (P2.3) The Rust examples are built by 'cargo build -p wickra-examples --bins'; the Node, browser-WASM and Python examples had no build gate. New job parse-checks every examples/{node,wasm}/.js, extracts and node --checks each WASM .html module script, and python -m py_compile's every examples/python/.py — so a broken example edit fails CI instead of landing silently. * docs(examples): list the new Node + WASM strategy examples Add the three Node strategy scripts and three WASM strategy demos to the examples README tables, bringing Node and WASM to parity with the existing Rust and Python strategy rows. * chore(examples): refresh examples/node lockfile for the linked wickra binding npm install rewrote the file: dependency snapshot of the local wickra binding that the examples link against (version 0.1.4 -> 0.3.1, license + engines fields), which had gone stale in the committed lockfile. * test(node): add input-validation suite Node counterpart of bindings/python/tests/test_input_validation.py: invalid constructor parameters (ATR zero period, MACD non-increasing fast/slow, BollingerBands negative multiplier, PSAR step > max, ValueArea period/pct, InitialBalance/OpeningRange zero period, Ichimoku non-increasing periods, Ehlers-family ordering) and unequal-length candle/ValueArea batch inputs all throw a JS Error. Validated against the built binding. * test(node): add indicator completeness contract Introspects every exported indicator class and asserts the full interface (update / batch / reset / isReady / warmupPeriod) plus the pre-warmup contract for zero-arg indicators, and guards that the full catalogue (>= 200 classes) is exported. Catches a new indicator wired without the standard methods, or a stale/partial native build dropping exports, with no per-indicator boilerplate. * test(wasm): broaden scalar streaming-vs-batch coverage Extend the inline wasm-bindgen-test suite with a streaming==batch check across ~70 scalar indicators spanning moving averages, momentum, volatility, statistics/regression, Ehlers/cycle and risk/performance families (previously only EMA + the candle-input group were covered per-indicator), plus four more invalid-constructor assertions. Constructor args mirror the CI-passing Node factories. Host-compiles (cargo test -p wickra-wasm --no-run); executed in CI via wasm-pack test --node. * bench(node): add indicator throughput benchmark Node counterpart of the Rust criterion benches / Python compare_libraries: measures streaming (per-tick update) and batch throughput in Mupd/s across a representative indicator set over a synthetic OHLCV series (--bars, default 200k). Dependency-free; wired as 'npm run bench'. * docs(wasm): list strategy demos + document the benchmark story Add the three new strategy demos to the WASM examples table and a Performance section: parallel_assets.html is the in-browser benchmark, with raw throughput covered by the Rust criterion / Python / Node benchmarks (the WASM engine is the same core compiled to wasm32).	2026-05-31 05:09:26 +02:00
dependabot[bot]	37e5e19b57	deps(actions): bump taiki-e/install-action from 2.79.5 to 2.79.15 (#76 ) Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.79.5 to 2.79.15. - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/6c1f7cf125e42770ff087ea443901b487cc5471a...0fd46367812ee04360509b4169d9f659d6892bb2) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.79.15 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-30 18:54:31 +02:00
dependabot[bot]	c189075491	deps(actions): bump EmbarkStudios/cargo-deny-action (#74 ) Bumps [EmbarkStudios/cargo-deny-action](https://github.com/embarkstudios/cargo-deny-action) from 2.0.19 to 2.0.20. - [Release notes](https://github.com/embarkstudios/cargo-deny-action/releases) - [Commits](https://github.com/embarkstudios/cargo-deny-action/compare/a531616d8ce3b9177443e48a1159bc945a099823...bb137d7af7e4fb67e5f82a49c4fce4fad40782fe) --- updated-dependencies: - dependency-name: EmbarkStudios/cargo-deny-action dependency-version: 2.0.20 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-30 18:52:23 +02:00
kingchenc	0edb9f4857	fix(bindings): clear clippy pedantic lints and lint bindings in CI (#77 ) * fix(bindings): clear clippy pedantic lints and lint bindings in CI Resolve the pedantic lints that only surfaced under a full `cargo clippy --workspace` (the CI clippy job covered only the core crates, so the Python/Node bindings drifted): - manual_midpoint: `(a + b) / 2.0` -> `f64::midpoint(a, b)` (node + python) - new_without_default: add `Default` impls for the six no-arg Node nodes - type_complexity: factor the pivot/Ichimoku return tuples into `PivotLevels` / `WoodieLevels` / `IchimokuLines` aliases (python) - many_single_char_names: allow at crate level — OHLCV batch helpers bind the conventional o/h/l/c/v column names Add a dedicated `clippy-bindings` CI job (ubuntu-only, with Python + Node toolchains) so future binding lints fail CI instead of slipping through. * ci: lint Python and Node bindings in a dedicated clippy job The main `rust` job's clippy step only covers wickra-core/wickra/ wickra-data/wickra-wasm, so pedantic lints in the PyO3/napi bindings slipped through. Add an ubuntu-only `clippy-bindings` job that provisions Python + Node (needed by the build scripts) and runs `cargo clippy -p wickra-node -p wickra-python --all-targets -- -D warnings`.	2026-05-30 18:16:21 +02:00
kingchenc	d9d3ad18aa	feat: Family 03 MACD & Price Oscillators — APO / AO-Hist / CFO / Zero-Lag MACD / Elder Impulse / STC (#41 ) * feat(apo): add Absolute Price Oscillator EMA(close, fast) - EMA(close, slow). Like MACD without the signal EMA. Defaults to (fast = 12, slow = 26); fast must be strictly less than slow. Touchpoints: apo.rs + mod.rs + lib.rs re-export, PyApo + __init__.py + test_new_indicators SCALAR + test_known_values flat reference, ApoNode + index.d.ts/index.js + indicators.test.js factory + reference, WasmApo via scalar macro, scalar-fuzz target, README + CHANGELOG. * fix(apo): add PyApo + ApoNode + WasmApo bindings missed from `ec269d8` The previous APO commit (`ec269d8`) only registered APO in the Python __init__.py / Node index.js / Node index.d.ts / fuzz / tests / docs. The actual PyApo pyclass, ApoNode napi class, and WasmApo wasm class edits silently no-op'd because the underlying lib.rs files had been touched by a branch switch between Read and Edit. The bindings were therefore advertising APO from the Python module / Node package / WASM module but not actually exposing it. Fix: insert PyApo block + add_class call in bindings/python/src/lib.rs, ApoNode block in bindings/node/src/lib.rs, WasmApo macro line in bindings/wasm/src/lib.rs. cargo test workspace stays at 615 (no new tests added; the existing test_known_values + indicators.test.js references would have failed at import once the bindings rebuilt without these classes). * feat(ao-histogram): add Awesome Oscillator Histogram AO - SMA(AO, sma_period). A configurable variant of the existing AcceleratorOscillator (which fixes fast=5, slow=34, sma=5). Three parameters; defaults match Bill Williams' Accelerator. Touchpoints: awesome_oscillator_histogram.rs + mod.rs + lib.rs re-export, PyAoHist + __init__.py + test_new_indicators CANDLE_SCALAR + test_known_values flat reference, AwesomeOscillatorHistogramNode + index.d.ts/index.js + indicators.test.js factory + reference, WasmAoHist, candle-fuzz target, README + CHANGELOG. * feat(cfo): add Chande Forecast Oscillator 100 * (close - LinReg(close, period)) / close. Positive when close overshoots the linear forecast, negative when it undershoots. Holds the previous value if the close is zero (percentage form undefined). Single param period (default 14). Touchpoints: cfo.rs + mod.rs + lib.rs re-export, PyCfo + __init__.py + test_new_indicators SCALAR + test_known_values linear reference, CfoNode + index.d.ts/index.js + indicators.test.js factory + reference, WasmCfo via scalar macro, scalar-fuzz target, README + CHANGELOG. * fix(cfo): add WasmCfo binding missed from `733afd9` * feat(zero-lag-macd): add Zero-Lag MACD Classic MACD topology with ZLEMA substituted for EMA everywhere: faster reaction to trend changes at the cost of slightly noisier readings. Multi-output ZeroLagMacdOutput { macd, signal, histogram }. Three parameters (fast = 12, slow = 26, signal = 9); fast must be strictly less than slow. Touchpoints: zero_lag_macd.rs + mod.rs + lib.rs re-export, PyZeroLagMacd + __init__.py + test_new_indicators MULTI + test_known_values flat reference, ZeroLagMacdNode + ZeroLagMacdValue + index.d.ts/index.js + indicators.test.js multi factory + reference, WasmZeroLagMacd, scalar fuzz with hand-rolled drive (multi-output bypasses the f64-only helper), README + CHANGELOG. * feat(elder-impulse): add Alexander Elder Impulse System Tri-state momentum gauge: +1 (green/buy) when EMA trend and MACD histogram both rise, -1 (red/sell) when both fall, 0 (blue/neutral) on disagreement. Four parameters (ema_period, macd_fast, macd_slow, macd_signal); defaults (13, 12, 26, 9) match Elder. Internally feeds both branches on every input so they warm in parallel; needs one bar past the slowest branch to seed direction state. Touchpoints: elder_impulse.rs + mod.rs + lib.rs re-export, PyElderImpulse + __init__.py + test_new_indicators SCALAR + test_known_values neutral reference, ElderImpulseNode + index.d.ts/index.js + indicators.test.js factory + reference, WasmElderImpulse via scalar macro, scalar-fuzz target, README + CHANGELOG. * feat(stc): add Schaff Trend Cycle Doug Schaff's doubly-Stochastic-smoothed MACD. Bounded [0, 100] reading that reacts faster than MACD by extracting the percentile of MACD within a recent window, half-EMA-smoothing it, and re-stochasing the smoothed series. Four parameters (fast = 23, slow = 50, schaff_period = 10, factor = 0.5); fast must be strictly less than slow and factor must lie in (0, 1]. Output clamped to [0, 100] to absorb floating-point rounding. The stochastic stages clamp to 0 when their rolling range collapses (flat input or perfectly monotone trend), so a flat series settles deterministically at 0 after warmup. Touchpoints: stc.rs + mod.rs + lib.rs re-export, PyStc + __init__.py + test_new_indicators SCALAR + test_known_values flat reference, StcNode + index.d.ts/index.js + indicators.test.js factory + reference, WasmStc via scalar macro, scalar-fuzz target, README + CHANGELOG. * fix(stc): rename last_stc -> last_value to satisfy clippy * ci: Retry setup-node and setup-python on CDN flakes Setup-node on Windows runners and setup-python across all OSes occasionally fail with a silent hang or 5xx mid-download ("Attempting to download 18..." → fail in <1s) — pure upstream CDN flake. The fix ran on this branch's previous merge commit (`24e723f`) had to be re-triggered manually via `gh run rerun --failed`. Wrap both setup actions with continue-on-error and a follow-up retry step that waits 30s and re-runs the same setup. The retry only fires when the first attempt failed (steps.<id>.outcome == 'failure'), so a green setup costs nothing extra. The retry uses the identical pinned SHA so we still get supply-chain verification on both attempts. Applied to ci.yml (Python matrix and Node matrix). release.yml has the same setup-node / setup-python steps but is rarely re-run, so the existing manual rerun pattern stays sufficient for now. * test(zero-lag-macd): Fix MULTI dict shape mismatch + cover warmup_period ZeroLagMACD was registered in the Python MULTI dict (which asserts a (n, 2) batch shape) but actually emits (n, 3) — macd, signal, histogram — like MACD. Moved out into its own standalone test test_zero_lag_macd_streaming_matches_batch (3-tuple shape), and included in the lifecycle sweep. Mirrors the existing Alligator pattern for 3-output candle indicators. Also adds a unit test for ZeroLagMacd::warmup_period that pins both the (12, 26, 9) classic case and a small-period config — these four lines were the codecov/patch miss on PR 41.	2026-05-25 17:26:46 +02:00
kingchenc	466faddd87	feat: Family 01 Moving Averages — ALMA / McGinley / FRAMA / VIDYA / JMA / Alligator / EVWMA (#39 ) * feat(alma): add Arnaud Legoux Moving Average Gaussian-weighted moving average with configurable centre (offset in [0, 1]) and kernel width (sigma > 0). Pre-computes normalised weights at construction so each update is a single rolling window dot product. Reference: Arnaud Legoux and Dimitrios Kouzis-Loukas, 2009. Touchpoints: - crates/wickra-core: alma.rs + mod.rs + lib.rs re-export - bindings/python: PyAlma + __init__.py + test_new_indicators + test_known_values reference - bindings/node: AlmaNode + index.d.ts/index.js + indicators.test.js factory + reference value - bindings/wasm: wasm_scalar_indicator! macro - fuzz: indicator_update target covers ALMA(9, 0.85, 6.0) - crates/wickra/benches: bench_scalar entry - README + CHANGELOG: Moving Averages row + Unreleased entry * feat(mcginley): add McGinley Dynamic moving average John McGinley's self-adjusting moving average with the recurrence MD + (price - MD) / (0.6 * period * (price / MD)^4). Speeds up when price falls below the indicator and damps when price runs above the indicator. Seeded with the simple average of the first period inputs. Reference: McGinley, Technical Analysis of Stocks & Commodities, 1990. Touchpoints: - crates/wickra-core: mcginley_dynamic.rs + mod.rs + lib.rs re-export - bindings/python: PyMcGinleyDynamic + __init__.py + test_new_indicators + test_known_values reference - bindings/node: McGinleyDynamicNode (scalar macro) + index.d.ts/index.js + indicators.test.js factory + reference value - bindings/wasm: wasm_scalar_indicator! macro - fuzz: indicator_update target covers McGinleyDynamic(10) - crates/wickra/benches: bench_scalar entry - README + CHANGELOG: Moving Averages row + Unreleased entry * feat(frama): add Fractal Adaptive Moving Average Ehlers' FRAMA adapts its smoothing constant to the fractal dimension of the recent window: tight tracking in trends, heavy smoothing in chop. Uses the close-only variant where max/min over each window half drive the dimension estimate. Period must be even (default 16). Reference: Ehlers, Fractal Adaptive Moving Average, 2005. Touchpoints: - crates/wickra-core: frama.rs + mod.rs + lib.rs re-export - bindings/python: PyFrama + __init__.py + test_new_indicators + test_known_values reference (constant series + uptrend tracking) - bindings/node: FramaNode (scalar macro) + index.d.ts/index.js + indicators.test.js factory + reference value - bindings/wasm: wasm_scalar_indicator! macro - fuzz: indicator_update target covers Frama(16) - crates/wickra/benches: bench_scalar entry - README + CHANGELOG: Moving Averages row + Unreleased entry * feat(vidya): add Variable Index Dynamic Average Chande's VIDYA — an EMA whose alpha scales with \|CMO(cmo_period)\| / 100. Strong directional momentum lifts the smoothing constant toward the EMA-of-period rate; flat or choppy windows shrink it toward zero so VIDYA coasts on its previous value. Two parameters: period (14) and cmo_period (9). Reuses the existing wickra-core Cmo internally. Reference: Chande, Stocks & Commodities, 1992. Also fixes a silent gap from `d37fbd1` (feat(frama)): the PyFrama Python class wrapper and its add_class registration were dropped because the two edits hit "File has not been read yet" errors that scrolled past in a batch. Adds them here alongside VIDYA's bindings. Touchpoints (VIDYA): vidya.rs + mod.rs + lib.rs re-export, PyVidya + __init__.py + test_new_indicators + test_known_values reference, VidyaNode (manual two-param binding) + index.d.ts/index.js + indicators.test.js factory + reference, wasm_scalar_indicator! macro, fuzz target, bench, README + CHANGELOG. * feat(jma): add Jurik Moving Average Three-stage filter reconstruction of Mark Jurik's adaptive MA (the algorithm is proprietary; this is the form used by most open-source ports since the 1999 TASC article). Parameters: period (14), phase in [-100, 100] (0), power in 1..=4 (2). State is seeded by setting e0 = JMA = first input so a constant input stream is reproduced exactly. Touchpoints: jma.rs + mod.rs + lib.rs re-export, PyJma + __init__.py + test_new_indicators + test_known_values reference, JmaNode (manual three-param binding) + index.d.ts/index.js + indicators.test.js factory + reference, wasm_scalar_indicator! macro, fuzz target, bench, README + CHANGELOG. * feat(alligator): add Bill Williams Alligator Three SMMA lines (Jaw / Teeth / Lips) over the median price (high + low) / 2 with default periods 13 / 8 / 5. Multi-output indicator returning AlligatorOutput { jaw, teeth, lips }. The original chart variant shifts each line forward for display; we publish the unshifted SMMA values and leave the visual shift to the consumer. Reference: Bill Williams, Trading Chaos, 1995. Touchpoints: alligator.rs + mod.rs + lib.rs re-export, PyAlligator (Candle input, returns 3-tuple, ndarray (n, 3) batch) + __init__.py + test_new_indicators + test_known_values reference, AlligatorNode + AlligatorValue + index.d.ts/index.js + indicators.test.js multi factory + reference, WasmAlligator (manual JsValue object) + candle-fuzz target + README + CHANGELOG. * feat(evwma): add Elastic Volume-Weighted Moving Average Christian P. Fries' elastic recurrence where the smoothing weight is the bar's volume relative to the running window total: V_sum_t = sum of volumes over the last period candles EVWMA_t = ((V_sum_t - v_t) * EVWMA_{t-1} + v_t * close_t) / V_sum_t A bar whose volume is small barely moves the average; a bar that dominates the window pulls it strongly toward that bar's close. Seeded with the close of the first full window; holds its previous value if the entire window has zero volume. Reference: Fries, Wilmott Magazine, 2001. Touchpoints: evwma.rs + mod.rs + lib.rs re-export, PyEvwma (close + volume batch) + __init__.py + test_new_indicators CANDLE_SCALAR + test_known_values reference, EvwmaNode + index.d.ts/index.js + indicators.test.js candleScalar factory + reference, WasmEvwma, candle-fuzz target + README + CHANGELOG. * ci: Force local wheel install in Python jobs Use --no-index --no-deps so the Python matrix installs the freshly built wheel from dist/ and never falls back to PyPI. Previously pip sometimes picked the released 0.2.x wheel on macOS / Windows when its platform tag was a wider match than the local build, which made the job test the released package and miss any new symbols added in the PR (e.g. AttributeError: module 'wickra' has no attribute 'ALMA'). numpy is already installed by the preceding pip step, so --no-deps is safe.	2026-05-25 15:01:14 +02:00
kingchenc	3fcf2094f1	ci(wasm): install wasm-pack via taiki-e prebuilt instead of jetli's stale 0.10 jetli/wasm-pack-action@v0.4.0 with no version: input installs whatever wasm-pack the action's bundled installer fetches — currently a ~0.10.x release whose 'build' subcommand does not yet accept --features. Our build invocation 'wasm-pack build … --features panic-hook' now fails with error: Found argument '--features' which wasn't expected, or isn't valid in this context USAGE: wasm-pack build --release --target <target> even though that exact command worked on past runs where the action happened to install a newer wasm-pack. (The bundler-target release.yml job passed for v0.2.1 only because it shared the same cached install on that runner.) wasm-pack's --features top-level flag has been stable since 0.12.0, so the fix is to install a fresh wasm-pack each run. Switch both the ci.yml 'WASM build' step and the release.yml 'wasm-publish' job to the same taiki-e/install-action prebuilt-binary installer we already use for cargo-llvm-cov and cargo-fuzz. taiki-e tracks the latest wasm-pack release and the install is a single binary download — no compile, no shell installer. The wasm-pack invocations themselves are unchanged.	2026-05-23 23:00:13 +02:00
kingchenc	ed57632576	build: lift workspace MSRV to 1.86 to satisfy criterion 0.8.2 criterion 0.8.2 raised its MSRV from 1.85 to 1.86 (rustc 1.85.1 is now explicitly rejected by its Cargo.toml `rust-version`). One more notch on the same upward drift that already took us from 1.75 -> 1.80 (rayon) -> 1.85 (clap_lex/edition2024). Updated: - Cargo.toml workspace rust-version 1.85 -> 1.86 - .github/workflows/ci.yml MSRV matrix name + toolchain - ci.yml comment refreshed to reflect the new driving dep	2026-05-23 21:36:56 +02:00
dependabot[bot]	862a130d8c	deps(actions): bump actions/checkout from 4.3.1 to 6.0.2 Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-23 19:21:27 +00:00
kingchenc	c009ecc7f9	Merge pull request #8 from kingchenc/dependabot/github_actions/actions/setup-python-6.2.0 deps(actions): bump actions/setup-python from 5.6.0 to 6.2.0	2026-05-23 21:19:29 +02:00
kingchenc	bf4faddf0f	Merge pull request #6 from kingchenc/dependabot/github_actions/actions/setup-node-6.4.0 deps(actions): bump actions/setup-node from 4.4.0 to 6.4.0	2026-05-23 21:19:26 +02:00
dependabot[bot]	9b34c84d86	deps(actions): bump actions/setup-python from 5.6.0 to 6.2.0 Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.6.0 to 6.2.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/a26af69be951a213d495a4c3e4e4022e16d87065...a309ff8b426b58ec0e2a45f0f869d46889d02405) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-23 18:54:30 +00:00
dependabot[bot]	08928c5b17	deps(actions): bump actions/setup-node from 4.4.0 to 6.4.0 Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4.4.0 to 6.4.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/49933ea5288caeca8642d1e84afbd3f7d6820020...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-23 18:54:20 +00:00
dependabot[bot]	246d982e93	deps(actions): bump codecov/codecov-action from 5.5.4 to 6.0.1 Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.5.4 to 6.0.1. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/75cd11691c0faa626561e295848008c8a7dddffe...e79a6962e0d4c0c17b229090214935d2e33f8354) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-23 18:53:50 +00:00
dependabot[bot]	4d8c0ce1a5	deps(actions): bump taiki-e/install-action from 2.79.4 to 2.79.5 Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.79.4 to 2.79.5. - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/e0eafa9a0d485c37f97c0f7beb930a58a2facbac...6c1f7cf125e42770ff087ea443901b487cc5471a) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.79.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-05-23 18:49:22 +00:00
kingchenc	3f9429dd2c	build: lift workspace MSRV further to 1.85 for criterion's clap_lex The first MSRV bump to 1.80 fixed the rayon-core floor but ran into a second transitive-dep floor on the same CI run: error: failed to parse manifest at clap_lex-1.1.0/Cargo.toml Caused by: feature `edition2024` is required The package requires the Cargo feature called `edition2024`, but that feature is not stabilized in this version of Cargo (1.80.1). clap_lex 1.1.0 is pulled in by criterion (dev-dep on the wickra crate) via clap 4.6 -> clap_builder 4.6 -> clap_lex 1.1. edition2024 was stabilized in Rust 1.85, so lift the workspace MSRV one more step. The 1.85 floor subsumes the rayon-core 1.80 requirement; bindings/node stays at 1.88 (napi-build) which already covers everything below it. Also fix the fuzz job: cargo-fuzz defaulted to building for x86_64-unknown-linux-musl, which is not installed on the GitHub-hosted ubuntu runner. Pass --target x86_64-unknown-linux-gnu explicitly on every cargo fuzz run invocation so it builds for the actual host target.	2026-05-23 20:30:46 +02:00
kingchenc	30444ce296	build: lift MSRV to 1.80 workspace / 1.88 node binding The previous MSRV pins were below what current transitive dependencies need: - rayon-core 1.13.0 (pulled in by the optional `parallel` feature on wickra-core via rayon) requires rustc >= 1.80; under the old 1.75 workspace MSRV the CI MSRV job broke with "package `rayon-core v1.13.0` cannot be built because it requires rustc 1.80 or newer". - napi-build 2.3.2 (the build-script crate that napi-derive 2.x calls into) requires rustc >= 1.88; under the old 1.77 node-binding MSRV the CI MSRV-node job broke with "package `napi-build v2.3.2` cannot be built because it requires rustc 1.88 or newer". Pinning the deps backwards would have frozen us out of upstream security/fix releases for both crates. Lifting the MSRV is the cleaner path for a young 0.x library — downstream consumers on older toolchains can stay on the already-published 0.2.0. Updated: - Cargo.toml workspace rust-version 1.75 -> 1.80 - bindings/node/Cargo.toml rust-version 1.77 -> 1.88 - .github/workflows/ci.yml MSRV matrix names + toolchain values + comment - CHANGELOG.md [Unreleased] documents the bump	2026-05-23 20:22:35 +02:00
kingchenc	90d8a299c3	ci(fuzz): install cargo-fuzz from a prebuilt binary The previous `cargo install cargo-fuzz --locked` resolved against cargo-fuzz's own Cargo.lock which pins to rustix 0.36.5. That rustix version still annotates its source with internal #[rustc_*] attributes, and the current nightly compiler rejects those attributes from out-of-tree crates, so cargo-fuzz never finished compiling on CI: error: attributes starting with `rustc` are reserved for use by the `rustc` compiler --> rustix-0.36.5/src/backend/linux_raw/io/errno.rs:28 error: could not compile `rustix` (lib) due to 4 previous errors error: failed to compile `cargo-fuzz v0.13.1` Switch the install to taiki-e/install-action, the same prebuilt-binary provider we already use for cargo-llvm-cov. That skips the full transitive-dependency compile and lets the fuzz-smoke job actually run.	2026-05-23 20:21:03 +02:00
kingchenc	73f8da49bd	ci: build wickra-examples bins instead of removed cargo examples The Z5 reorganisation moved every runnable example out of the per-crate examples/ folders and into a dedicated wickra-examples crate at examples/rust/, with the binaries living under src/bin/<name>.rs. The old ci.yml Compile-examples step still pointed at the now-deleted cargo example targets backtest (wickra) and live_binance (wickra-data), which is why Rust windows-latest failed with 'no example target named backtest in wickra package' and 'no example target named live_binance in wickra-data package'. Replace both calls with a single cargo build -p wickra-examples --bins. That covers backtest, live_binance, fetch_btcusdt, multi_timeframe, parallel_assets and streaming in one shot, and the wickra-examples crate already enables the live-binance feature on its wickra-data dep so no extra --features flag is needed.	2026-05-23 20:19:14 +02:00
kingchenc	6786917cee	ci: move bench to scheduled workflow + add Python 3.13 (R10, R11) R10 — `cross-library-bench` previously ran on every push and every PR to `main`, adding 5–10 minutes of build + bench time per CI run with no automated consumer of the artefact. It moves to a dedicated workflow (`.github/workflows/bench.yml`) that fires nightly at 03:00 UTC and on-demand via `workflow_dispatch` (with optional `size` / `iterations` inputs). The job in `ci.yml` is removed and a pointer comment is left in its place so future readers find the new home. R11 — `pyproject.toml`'s `requires-python = ">=3.9"` already allowed Python 3.13 installs, but the classifier list stopped at 3.12 and CI tested only 3.9 / 3.11 / 3.12. The Python CI matrix gains `"3.13"` and the matching `Programming Language :: Python :: 3.13` classifier is added so PyPI listings and version-search tooling reflect the actually-tested range.	2026-05-23 10:52:20 +02:00
kingchenc	b003321562	test(fuzz): cover every indicator, scalar and candle inputs (R9) The fuzz suite previously covered only `Rsi(14)` and `Ema(20)` — 2 of 71 indicators, no OHLCV coverage at all. Audit finding R9 asked for ATR/ADX/Stochastic/PSAR as a minimum; this commit goes further and brings every indicator under fuzz. - `indicator_update` (rewritten): drives every scalar-input indicator through one streaming pass + one batch call per iteration. Covers SMA, EMA, WMA, RSI, DEMA, TEMA, HMA, ROC, TRIX, SMMA, TRIMA, ZLEMA, KAMA, T3, MOM, CMO, TSI, PMO, StochRSI, DPO, PPO, Coppock, StdDev, UlcerIndex, HistoricalVolatility, LinearRegression, LinRegSlope, LinRegAngle, VHF, ZScore, MACD, BollingerBands. A `drive` helper marked `#[inline(never)]` keeps each indicator on its own panic backtrace frame. - `indicator_update_candle` (new): chunks the fuzz `f64` stream into `[open, high, low, close, volume]` tuples, builds candles via `Candle::new` (skipping ones that fail OHLCV validation — that path is fuzz-tested separately), then drives every candle-input indicator through streaming + batch. Covers ATR, NATR, TrueRange, ChaikinVolatility, Keltner, Donchian, PSAR, SuperTrend, ChandelierExit, ChandeKrollStop, ATRTrailingStop, ADX, Aroon, AroonOscillator, Vortex, MassIndex, ChoppinessIndex, CCI, WilliamsR, AwesomeOscillator, AcceleratorOscillator, UltimateOscillator, BalanceOfPower, OBV, MFI, VWAP, RollingVWAP, VWMA, ADL, VPT, CMF, ChaikinOscillator, ForceIndex, EaseOfMovement, TypicalPrice, MedianPrice, WeightedClose, Stochastic. - `fuzz/Cargo.toml` registers the new target; `fuzz/README.md` describes both expanded targets. - A `fuzz-smoke` CI job runs each of the five targets for 30 s on every push and pull-request — enough to catch a regression in the harness without slowing CI to a crawl. Long fuzz campaigns belong on dedicated infrastructure with persistent corpora.	2026-05-23 10:33:05 +02:00

1 2

58 Commits