Files
wickra/CHANGELOG.md
T
kingchenc c99cf54a1f fix(security): upgrade pyo3 and numpy to 0.28, fix RUSTSEC-2025-0020
Bumps the Python binding from pyo3 0.22 / numpy 0.22 to 0.28 / 0.28,
which resolves RUSTSEC-2025-0020 — a buffer overflow in
`PyString::from_object` that affected every published Python wheel.

Migration:

- `into_pyarray_bound(py)` → `into_pyarray(py)` (numpy 0.23 dropped the
  `_bound` transitional suffix; the method now returns `Bound<'py, _>`
  directly).
- `downcast::<PyDict>` → `cast::<PyDict>` (pyo3 renamed the method on
  `PyAnyMethods`).
- Every `#[pyclass]` declares `skip_from_py_object` to opt out of the
  now-deprecated automatic `FromPyObject` derive for `Clone` types.
  Indicators are stateful — silently extracting them by value-clone is
  never the intended FFI semantics.
- Workspace clippy gains `unused_self = "allow"` on the python crate
  only: Python's `__repr__` protocol forces `&self` even for parameter-
  less indicators where the body does not read state.
- `map_err` arms collapsed into a single `PyValueError` arm
  (clippy::match_same_arms).

`deny.toml` no longer suppresses RUSTSEC-2025-0020; `cargo deny check`
is green on advisories, bans, licenses and sources without exceptions.
2026-05-23 01:26:55 +02:00

7.9 KiB

Changelog

All notable changes to Wickra are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

Security

  • Upgrade pyo3 (0.22 → 0.28) and numpy (0.22 → 0.28) in the Python binding. Fixes RUSTSEC-2025-0020 — a buffer overflow in PyString::from_object that affected the published Python wheels. The cargo-deny ignore entry that previously suppressed the advisory has been removed; cargo deny check is now clean without suppression. Migrated into_pyarray_bound to into_pyarray, downcast::<PyDict> to cast::<PyDict>, and opted every #[pyclass] out of the deprecated automatic FromPyObject derive via skip_from_py_object.

Added

  • 46 new technical indicators, taking the library from 25 to 71 and reorganising the catalogue into eight families, each with at least five members. Every indicator is implemented once in the Rust core and wired through the Python, Node and WASM bindings, with reference-value tests and a dedicated wiki page:
    • Moving Averages: Smma, Trima, Zlema, T3, Vwma.
    • Momentum Oscillators: Mom, Cmo, Tsi, Pmo, StochRsi, UltimateOscillator.
    • Trend & Directional: AroonOscillator, Vortex, MassIndex, ChoppinessIndex, VerticalHorizontalFilter.
    • Price Oscillators: Ppo, Dpo, Coppock, AcceleratorOscillator, BalanceOfPower.
    • Volatility & Bands: Natr, StdDev, UlcerIndex, HistoricalVolatility, BollingerBandwidth, PercentB, TrueRange, ChaikinVolatility.
    • Trailing Stops: SuperTrend, ChandelierExit, ChandeKrollStop, AtrTrailingStop.
    • Volume: Adl, VolumePriceTrend, ChaikinMoneyFlow, ChaikinOscillator, ForceIndex, EaseOfMovement.
    • Price Statistics: TypicalPrice, MedianPrice, WeightedClose, LinearRegression, LinRegSlope, ZScore, LinRegAngle.
  • TickAggregator::with_gap_fill — opt-in mode that emits a flat placeholder candle for every empty bucket between two ticks, keeping the candle series evenly spaced for downstream indicators.
  • CSV reader: a leading UTF-8 byte-order mark is stripped, fields are trimmed, and the header is validated against the required OHLCV columns.
  • CI: an msrv job that builds and tests the workspace on Rust 1.75 and the node binding on Rust 1.77.
  • Community health files: CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, issue / pull-request templates, CODEOWNERS, and a Dependabot configuration.
  • Seven example OHLCV datasets under examples/data/, one per timeframe (1m / 5m / 15m / 1h / 12h / 1d / 1month), holding real BTCUSDT spot klines, alongside the fetch_btcusdt example that regenerates them from the Binance REST API.
  • Timeframe::minutes, Timeframe::hours and Timeframe::days convenience constructors, each building on seconds with a checked-multiplication overflow guard.

Changed

  • The indicator wiki is reorganised into eight family folders under docs/wiki/indicators/ (moving-averages/, momentum-oscillators/, trend-directional/, price-oscillators/, volatility-bands/, trailing-stops/, volume/, price-statistics/); Indicators-Overview.md, Home.md and the README indicator table follow the same eight families.
  • TickAggregator::push returns Result<Vec<Candle>> (was Result<Option<Candle>>) so a single tick can yield a closed bar plus gap fillers.
  • Resampler::push returns Result<Option<Candle>>: a candle in a bucket earlier than the open bar is now rejected as out of order.
  • Aggregated candles are finalised through the validating Candle::new, so a volume that overflows to a non-finite value is surfaced as an error instead of producing a poisoned candle.
  • All GitHub Actions are pinned to commit SHAs; the four publish jobs run in a protected release environment.
  • The indicator benchmarks (crates/wickra/benches/indicators.rs) now run against the checked-in real BTCUSDT 1-minute dataset instead of a synthetic price series.
  • Every language's examples now live under a uniform examples/<lang>/ tree: Rust moved into a new examples/rust/ workspace member crate (wickra-examples, run via cargo run -p wickra-examples --bin <name>), Node into examples/node/ with its own package.json linking wickra via file:../../bindings/node, and the WASM browser demos into examples/wasm/. The bundled BTCUSDT datasets move alongside them at examples/data/. Six new examples close the cross-language parity matrix: streaming demos for Python and Rust; multi-timeframe and parallel-assets demos for both Rust and Node.
  • Cross-language data-generator parity: examples/python/fetch_btcusdt.py (stdlib only: urllib + json + csv) and examples/node/fetch_btcusdt.js (Node 18+ built-in fetch) mirror the Rust fetch_btcusdt binary — byte-for-byte identical CSV output on the same Binance snapshot.
  • Four additional WebAssembly browser demos under examples/wasm/ alongside the original index.html: backtest.html (fetch + basket of indicators), live_trading.html (browser-native WebSocket to Binance), multi_timeframe.html (in-page resample) and parallel_assets.html + parallel_worker.js (module-Worker pool with serial-vs-parallel speedup). The cross-language matrix is now closed for every cell where the pattern makes sense.
  • Three new wiki pages: TA-Lib-Migration.md (full mapping table from talib.X(...) calls to Wickra), Cookbook.md (seven concrete strategy recipes — RSI mean reversion, MACD crossover, Bollinger breakout, ADX-gated trend, multi-timeframe confirmation, SuperTrend, chained indicators) and FAQ.md. All three linked from Home.md.

Fixed

  • Timeframe::floor no longer overflows for timestamps near i64::MIN.
  • The aggregator rejects same-bucket ticks that arrive out of order instead of silently overwriting the bar's close with a stale price.
  • The Binance live stream reconnects with exponential backoff, skips non-kline frames, applies a read timeout and message-size limits, and tracks a closed flag.
  • Example scripts: live_trading.py skips non-kline frames and validates the symbol/interval; backtest.py and multi_timeframe.py report clear errors for malformed CSV input.

0.1.4 - 2026-05-21

Added

  • GitHub Release runs now attach every built artefact (wheels, sdist, native Node binaries, npm-pack tarballs, cargo .crate files) to the tag's release page.

0.1.3 - 2026-05-21

Fixed

  • npm package ships the napi-generated loader and is built with --platform so the per-platform binary is resolved correctly.

0.1.2 - 2026-05-21

Fixed

  • Release pipeline: per-platform idempotent npm publishing with a spam-filter retry, and committed npm/<platform>/ package templates.

0.1.1 - 2026-05-21

Fixed

  • Node publish step and coordinated version bump across all bindings.

0.1.0 - 2026-05-21

Added

  • Initial release: a streaming-first technical-analysis library with 25 indicators (SMA, EMA, WMA, DEMA, TEMA, HMA, KAMA, RSI, MACD, ROC, Stochastic, CCI, Williams %R, ADX, MFI, TRIX, Aroon, Awesome Oscillator, Bollinger Bands, ATR, Keltner Channels, Donchian Channels, Parabolic SAR, OBV, VWAP).
  • Rust core (wickra-core), umbrella crate (wickra), and a data layer (wickra-data) with a CSV reader, tick aggregator, resampler, and an optional Binance live feed.
  • Bindings for Python, Node.js, and WebAssembly.