chore(deps): bump the python-runtime group across 1 directory with 18 updates

backend_api_python/requirements-dev.txt

@@ -3,4 +3,4 @@ pip-audit>=2.10.1,<3
 pytest>=9.1.1,<10
 pytest-cov>=7.1.0,<8
 pytest-timeout>=2.4.0,<3
-ruff>=0.16.0,<0.17
+ruff>=0.16.9,<0.17

backend_api_python/requirements.txt

@@ -1,55 +1,55 @@
 # Flask 3.1.3+ / Werkzeug 3.1.6+: GHSA-68rp-wp8r-4726 (session/Vary: Cookie), GHSA-29vq-49wr-vm6x (safe_join)
 Flask==3.1.3
-Werkzeug>=3.1.8
+Werkzeug>=3.1.9
 flask-cors==6.0.5
 finnhub-python>=2.4.29
-yfinance>=1.5.2
+yfinance>=1.7.0
 # GHSA-cq5v-8q36-5273 (C parser OOB read), GHSA-mfx4-hv73-q22v and
 # GHSA-mq44-7p77-q5h7 (WebSocket parsing); 3.14.3+
 aiohttp>=3.14.3,<3.15
-pandas>=3.0.5
+pandas>=3.0.6
 # Strategy API V2 technical indicator runtime. The 0.6.x wheels bundle the C library.
-TA-Lib==0.7.1
+TA-Lib==0.8.1
 exchange-calendars>=4.13.2,<5
 requests>=2.34.2
 # CVE-2026-97687 and related redirect/decompression advisories; 2.8.0+
 urllib3>=2.8.0,<3
-websocket-client>=1.9.0,<2
+websocket-client>=1.9.2,<2
 # CVE-2026-84377; 1.93.2+
-litellm>=1.93.2,<1.94
-certifi>=2026.6.17
+litellm>=1.103.0,<1.104
+certifi>=2026.7.22
 PySocks>=1.7.1
-akshare>=1.18.80
+akshare>=1.18.97
 # GHSA-752w-5fwx-jx9f and 2026 JWT validation advisories; 2.15.0+
-PyJWT>=2.15.0,<3
-python-dotenv>=1.2.2
+PyJWT>=2.15.1,<3
+python-dotenv>=1.2.3
 # GHSA-g6cj-pr64-35w5 (PKCS#7 Bleichenbacher oracle); 50.0.0+
-cryptography>=50.0.0,<51
+cryptography>=50.0.1,<51
 # TOTP MFA and QR code generation
 pyotp>=2.10.0
 qrcode[pil]>=8.2
 # PostgreSQL support (multi-user mode)
-psycopg2-binary>=2.9.12
+psycopg2-binary>=2.9.13
 # Runtime metrics
 prometheus-client>=0.26.0,<1
 # Kafka event backbone
 confluent-kafka>=2.15.1,<3
 # Redis cache (optional but recommended for multi-worker setups).
 # Celery 5.6 / Kombu 5.6 currently require redis-py <6.5. This client remains
 # compatible with the Redis 8 server used by the production stack.
-redis>=6.4.0,<6.5
+redis>=8.1.0,<8.2
 # Durable background jobs and periodic maintenance
 celery[redis]>=5.6.3,<6
 # Production WSGI server
-gunicorn>=26.0.0
+gunicorn>=26.2.0
 # OpenAPI generation (flask-smorest)
 flask-smorest>=0.47.0,<0.48
-marshmallow>=4.3.0,<5
+marshmallow>=4.3.1,<5
 PyYAML>=6.0.3
 # Server-side PDF export for AI analysis reports
 # PDF parser security advisories; 6.19.0+
 pypdf>=6.19.0,<7
-reportlab>=5.0.0
+reportlab>=5.0.1
 # Password hashing
 bcrypt>=5.0.0
 # Interactive Brokers trading (optional, for US stock trading via TWS/IB Gateway)
@@ -59,4 +59,4 @@ ib_insync>=0.9.86
 # tavily-python>=0.3.0
 # SerpAPI - Google/Bing search scraper (free 100 requests/month)
 # google-search-results>=2.4.0
-alpaca-py>=0.43.5
+alpaca-py>=0.44.0