Dependency integrity and review

Release 0.4.0 pins every runtime and test dependency to an exact version and approved wheel SHA-256. Installers use pip's hash-checking mode and accept wheels only, avoiding arbitrary source-build hooks. The lock fixes reviewed package versions; it does not claim a complete source-code audit or guarantee that no undisclosed vulnerabilities exist.

requirements-bootstrap.txt: pip 26.2.1, installed before other packages.
requirements.txt: 29 runtime packages; developer/test packages are excluded.
requirements-dev.txt: six additional test dependencies and the runtime lock.
requirements-audit.txt: 27 maintainer-only security scanner packages;

this file and the scanner are not distributed to app users.

On 2026-09-17, pip-audit 2.10.1 queried the Python Packaging Advisory Database through PyPI and reported zero known vulnerabilities in all four locks. A fresh Windows Python 3.14 environment accepted all runtime/test hashes and pip check reported no broken requirements. The bundled pip 25.3 had published advisories, which is why setup explicitly upgrades to the hashed pip 26.2.1 wheel.

Maintainers prepare a separate environment; never audit by upgrading a user's running trading environment:

python -m venv .venv-audit
.venv-audit\Scripts\python.exe -m pip --isolated --disable-pip-version-check install --require-hashes --only-binary=:all: -r requirements-bootstrap.txt
.venv-audit\Scripts\python.exe -m pip --isolated --disable-pip-version-check install --require-hashes --only-binary=:all: -r requirements-audit.txt
python tools/audit_dependencies.py --python .venv-audit\Scripts\python.exe

The audit report is data/dependency-audit.json: UTC timestamp, exact lock-file digests, scanner identity, counts, findings and any skipped packages. A failed query, skipped package or advisory causes audit failure. Release packaging checks that this successful evidence matches the current locks and is less than 24 hours old. Run the complete test suite from a fresh environment installed from the bootstrap and development locks before packaging.

To change dependencies, deliberately edit the direct .in pins, install and test the proposed versions in an isolated environment, then run tools/lock_dependencies.py from that environment. Review all transitive and hash changes, rerun the audit, and test before release. The app never selects new dependency versions at launch.

References: pip repeatable installs and pip-audit.