mirror of https://github.com/OpenBB-finance/OpenBB.git synced 2026-11-07 18:01:10 +00:00

Files

dlee-bq 53d4dcc46d [Feature] Drop Python 3.10 and Resolve Open Dependabot Alerts (#7804 )

* Drop Python 3.10 support

Python 3.10 reached end of life on 2026-10-01, and the patched releases of
Pillow (13.0.0) and filelock (>=4.2.1) require Python >=3.11, so the 3.10
resolution fork kept vulnerable versions in every lockfile.

- requires-python = ">=3.11,<4" in all pyproject.toml files, the
  cookiecutter template, and the CLI codegen project template
- CI: drop the ubuntu 3.10 matrix rows, move the macOS/Windows minimum
  rows and the lint jobs to 3.11, drop 3.10 from the nox sessions
- READMEs: state 3.11 as the minimum supported version

* Relock with patched certifi, filelock, virtualenv, Pillow, and fastmcp

Regenerate all 38 uv.lock files against requires-python >=3.11 and upgrade
only the packages with open Dependabot advisories:

- certifi 2026.7.22 -> 2026.10.23 (GHSA-6q48-6c7w-9gw2, compromised emSign CAs)
- virtualenv 21.14.7 -> 21.14.13
- filelock 4.1.0/4.2.0 -> 4.2.4
- Pillow 12.3.0 -> 13.0.0
- fastmcp / fastmcp-slim 4.1.0 -> 4.1.3

All other changes are removed Python 3.10-only resolution forks; no other
package changes version for Python 3.11+.

* desktop: bump zod, @hookform/resolvers, and vitest

- zod ^3.25.76 -> ^4.6.7 (GHSA-mrhx-c7xc-m3w5; no patched 3.x exists)
- @hookform/resolvers ^3.10.0 -> ^5.9.2 for zod 4 support
- vitest ^4.1.11 -> ^4.1.12 (@vitest/mocker GHSA-qxg6-89mg-rqv8,
  GHSA-xp26-3454-mjgp)
- override zod to the root version so @openbb/ui-pro, which declares
  zod ^3 but never imports it, does not pull in a second, vulnerable copy

* desktop: remove Python 3.10 from environment pickers

- version pickers in InstallComponents and AddExtensionSelector start at 3.11
- create_environment_from_requirements accepts 3.11 through 3.14 and falls
  back to 3.12 otherwise (previously 3.10 through 3.13)
- component tests select 3.11 instead of 3.10

* Remove Python 3.10 tomli fallbacks

With requires-python >=3.11, tomllib is always available, so the
version-conditional tomli imports are dead code.

- import tomllib directly in the cli and core config loaders, the
  mcp_server and platform_api config validators, dev_install.py, and
  the cli and cookiecutter tests; dev_install.py no longer pip-installs
  tomli on the fly
- drop the tomli>=2.0; python_version<'3.11' dependency from cli, core,
  mcp_server, and platform_api, plus platform_api's backport comment
- raise the fake-extension fixtures in cli/conftest.py,
  core/integration/conftest.py, and the charting test metadata to
  >=3.11
- relock cli, core, mcp_server, and platform_api; only the tomli
  requires-dist entry is removed and resolution markers are reordered,
  no package versions change

* Target Python 3.11 in ruff and ty for cli, core, mcp_server, platform_api, cookiecutter

With ruff target-version py310 and ty python-version 3.10, both tools
reject an unconditional `import tomllib`: ty reports it as unresolved
(exit 1) and ruff's isort classifies it as third-party. Raise the targets
in the projects that now import tomllib directly, and in the root
ruff.toml that governs dev_install.py.

- ruff target-version = "py311" and ty python-version = "3.11" in cli,
  core, mcp_server, platform_api, and cookiecutter; root ruff.toml
  target-version = "py311"
- UP042: OutputMode, ChartLifecycle, MCPType, and HTTPMethod become
  StrEnum; every consumer uses .value or == comparisons, so only str()
  and format() output change
- UP017: datetime.timezone.utc -> datetime.UTC (ruff autofix) in the cli
  dispatchers, the cli test generator, and a core test

* Fix ruff and ty failures in packages this PR touches

CI installs unpinned dependencies, so the lint jobs ran against
pandas 3.1.0, ruff 0.17.2, and ty 0.0.91.

- cli/conftest.py: guard the find_spec("openbb") lookup so ty no longer
  reports an Optional ModuleSpec/origin (failing Lint openbb-cli)
- quantitative: pandas 3.1 types Index.max() as object; cast max_date to
  Timestamp before period_start in attribution, factors, and
  risk_decomposition (failing ty)
- federal_reserve: use Series(...).dt.date instead of
  DatetimeIndex.date so neither pandas 3.0 nor 3.1 needs a ty: ignore
  (pandas 3.1 made the existing ignores unused, failing ty)
- core tests: type the filter_by_dates doubles as Data subclasses and
  cast the deliberate bad arguments in test_helpers.py; apply ruff format
  to test_docstring_generator_helpers.py
- platform_api README: apply ruff format to the Python code blocks

* Fix pandas 3.1 deprecations failing fred, sec, and eia tests

These suites turn warnings into errors, and pandas 3.1.0 adds
Pandas4Warning deprecations for several patterns they use. Every change
also passes with the locked pandas 3.0.6.

- fred, sec: replace inplace=True sort_values/reset_index/rename/
  set_index/drop with reassignment
- fred balance_of_payments, sec as_filed_widget: replace fillna with a
  string on float columns by astype(object).where(notna, ...)
- sec: build quarter start dates from ISO strings instead of parsing
  "2024Q2"-style strings; use the DataFrame constructor instead of
  DataFrame.from_records for column dicts; pad CIK lookup rows to two
  fields instead of constructing a ragged DataFrame
- eia: read EIA workbooks with the calamine engine (xlrd is deprecated);
  replace the xlrd dependency with python-calamine and relock; calamine
  workbooks are not safe for concurrent reads, so the petroleum status
  report serializes its sheet reads with a lock

* imf: fall back to the published catalog when the IMF API is unreachable

imf_cache.json.xz is generated at build time and is not committed, so
every CI build of openbb-imf needed a live api.imf.org. The only fallback
was actions/cache, and caches saved by pull_request runs are scoped to
that PR, so a new PR never had one. With api.imf.org returning
"503 no healthy upstream" during IMF's data portal maintenance window,
the build failed.

When live generation fails on a non-forced build, the hook now copies
imf_cache.json.xz from the latest openbb-imf wheel on PyPI, after
checking the wheel's sha256 against the digest PyPI publishes. Builds
with OPENBB_IMF_FORCE_CACHE_REBUILD=1, which the publish workflow sets,
still fail hard, so a release never ships a stale catalog.

---------

Co-authored-by: dlee-bq <325002271+dlee-bq@users.noreply.github.com>

2026-11-01 18:16:45 +00:00

integration

V5 (#7489 )

2026-09-29 14:45:53 +00:00

openbb_ecb

V5 (#7489 )

2026-09-29 14:45:53 +00:00

tests

V5 (#7489 )

2026-09-29 14:45:53 +00:00

__init__.py

[Feature] Remove Python 3.9 (#7235 )

2025-10-10 23:16:16 +00:00

.gitignore

V5 (#7489 )

2026-09-29 14:45:53 +00:00

hatch_build.py

V5 (#7489 )

2026-09-29 14:45:53 +00:00

pyproject.toml

[Feature] Drop Python 3.10 and Resolve Open Dependabot Alerts (#7804 )

2026-11-01 18:16:45 +00:00

README.md

V5 (#7489 )

2026-09-29 14:45:53 +00:00

uv.lock

[Feature] Drop Python 3.10 and Resolve Open Dependabot Alerts (#7804 )

2026-11-01 18:16:45 +00:00

README.md

OpenBB ECB Provider

This extension integrates the European Central Bank (ECB) Data Portal into the OpenBB Platform. It is a self-registering extension: when the economy, currency, and fixedincome extensions are absent, every model is exposed under its own obb.ecb.* router; when they are installed, the ECB fetchers plug into their canonical commands (e.g. obb.economy.balance_of_payments(provider="ecb")).

Installation

pip install openbb-ecb

Coverage

Full SDMX 2.1 catalogue sweep

available_indicators — the series builder: enumerate the individual series (indicators) within a dataflow (SDMX serieskeysonly), narrowed by frequency and reference_area dependent dropdowns (their options adapt to the selected dataflow), a dimension_values text field for the dataflow's other dimensions (DIM:VALUE), and a text query; each row is a ready FLOW::KEY symbol (e.g. the ~60k HICP series under ICP). In the Workspace you click a row's symbol (cellOnClick) to load it in the indicators widget. A dataflow is the table; a series is the indicator (with its transformation — index, rate, …).
indicators — fetch any ECB series by a FLOW::KEY symbol, e.g. EXR::D.USD.EUR.SP00.A.
list_dataflows, search_dataflows, list_topics, topic_dataflows, get_dataflow_dimensions, dimension_choices — dataflow discovery & progressive key building.

Concepts & dataset metadata

list_concepts — the ECB data-portal concepts (the portal's curated topics, e.g. Bank interest rates, Monetary aggregates, HICP), each grouping the datasets it covers.
dataflow_information — an HTML widget serving a dataset's full ECB reference metadata — Scope, Methodological information, Statistical processing, Administrative information, Quality, Dissemination, Legal and institutional environment, Technical information (with the downloadable series catalogue) and Miscellaneous. Pick a concept, then a dataset. This rich metadata for every dataflow is materialised into the shipped cache at build time.

Presentation tables

list_tables — the ECB data-portal presentation ("release") tables (e.g. the monetary aggregates or the HICP), the full curated set enumerated from the portal's publications tree and grouped by its categories.
presentation_table — every series a table publishes as a wide row: its concise title, the full series definition on hover, its unit, and the most recent periods pivoted into columns as real, unit-scaled numbers (each value expanded by the series' UNIT_MULT from the SDMX schema). Labels, values and units are resolved at request time from each series' TITLE / TITLE_COMPL / UNIT / UNIT_MULT; the cache stores only each table's title, portal placement and full series list.

Standardized timeseries

exchange_rates — euro reference exchange rates (EXR), EUR pairs and derived cross rates.
reference_rates — the latest euro foreign-exchange reference rates.
key_interest_rates — the key ECB rates (deposit, lending, refinancing) from FM.
euro_short_term_rate — the €STR and its full detail (EST).
mfi_interest_rates — MFI/bank interest rates on euro-area loans & deposits (MIR).
yield_curve — euro area government bond yield curves.
balance_of_payments — euro area balance of payments.

Releases, documents & calendar

release_choices / release_document — ECB press releases, publications, and blog posts (RSS). release_choices lists a feed's posts (newest first) and feeds the HTML widget's release dropdown; release_document is the ECB Release Viewer (type: "html"), which serves the chosen article as a full page — its own CSS, charts, tables and images intact, URLs resolved to absolute with an injected <base> so it renders exactly as ECB published it.
calendar — the ECB statistical release calendar. In the Workspace it is the app's entry point: each row's Dataset cell (cellOnClick) sets the shared dataflow, so picking a release drives the dataflow-dimensions and series-builder widgets to explore that release's data.
eligible_assets — the Eurosystem list of eligible marketable (collateral) assets.

Caching

Two independent caches:

A shipped, read-only SDMX metadata cache (assets/ecb_cache.json.xz), materialized at build time by generate-ecb-cache.
A parsed-data disk cache (diskcache) for fetched results, with per-dataset TTLs matched to ECB release cadence. The directory is OPENBB_ECB_CACHE_DIR, or <cache_directory>/ecb/data from the OpenBB layered config. Set OPENBB_ECB_NO_CACHE=1 to disable it; most data commands also accept use_cache=False.

Documentation available here.