Files
OpenBB/openbb_platform
dlee-bq 53d4dcc46d [Feature] Drop Python 3.10 and Resolve Open Dependabot Alerts (#7804)
* Drop Python 3.10 support

Python 3.10 reached end of life on 2026-10-01, and the patched releases of
Pillow (13.0.0) and filelock (>=4.2.1) require Python >=3.11, so the 3.10
resolution fork kept vulnerable versions in every lockfile.

- requires-python = ">=3.11,<4" in all pyproject.toml files, the
  cookiecutter template, and the CLI codegen project template
- CI: drop the ubuntu 3.10 matrix rows, move the macOS/Windows minimum
  rows and the lint jobs to 3.11, drop 3.10 from the nox sessions
- READMEs: state 3.11 as the minimum supported version

* Relock with patched certifi, filelock, virtualenv, Pillow, and fastmcp

Regenerate all 38 uv.lock files against requires-python >=3.11 and upgrade
only the packages with open Dependabot advisories:

- certifi 2026.7.22 -> 2026.10.23 (GHSA-6q48-6c7w-9gw2, compromised emSign CAs)
- virtualenv 21.14.7 -> 21.14.13
- filelock 4.1.0/4.2.0 -> 4.2.4
- Pillow 12.3.0 -> 13.0.0
- fastmcp / fastmcp-slim 4.1.0 -> 4.1.3

All other changes are removed Python 3.10-only resolution forks; no other
package changes version for Python 3.11+.

* desktop: bump zod, @hookform/resolvers, and vitest

- zod ^3.25.76 -> ^4.6.7 (GHSA-mrhx-c7xc-m3w5; no patched 3.x exists)
- @hookform/resolvers ^3.10.0 -> ^5.9.2 for zod 4 support
- vitest ^4.1.11 -> ^4.1.12 (@vitest/mocker GHSA-qxg6-89mg-rqv8,
  GHSA-xp26-3454-mjgp)
- override zod to the root version so @openbb/ui-pro, which declares
  zod ^3 but never imports it, does not pull in a second, vulnerable copy

* desktop: remove Python 3.10 from environment pickers

- version pickers in InstallComponents and AddExtensionSelector start at 3.11
- create_environment_from_requirements accepts 3.11 through 3.14 and falls
  back to 3.12 otherwise (previously 3.10 through 3.13)
- component tests select 3.11 instead of 3.10

* Remove Python 3.10 tomli fallbacks

With requires-python >=3.11, tomllib is always available, so the
version-conditional tomli imports are dead code.

- import tomllib directly in the cli and core config loaders, the
  mcp_server and platform_api config validators, dev_install.py, and
  the cli and cookiecutter tests; dev_install.py no longer pip-installs
  tomli on the fly
- drop the tomli>=2.0; python_version<'3.11' dependency from cli, core,
  mcp_server, and platform_api, plus platform_api's backport comment
- raise the fake-extension fixtures in cli/conftest.py,
  core/integration/conftest.py, and the charting test metadata to
  >=3.11
- relock cli, core, mcp_server, and platform_api; only the tomli
  requires-dist entry is removed and resolution markers are reordered,
  no package versions change

* Target Python 3.11 in ruff and ty for cli, core, mcp_server, platform_api, cookiecutter

With ruff target-version py310 and ty python-version 3.10, both tools
reject an unconditional `import tomllib`: ty reports it as unresolved
(exit 1) and ruff's isort classifies it as third-party. Raise the targets
in the projects that now import tomllib directly, and in the root
ruff.toml that governs dev_install.py.

- ruff target-version = "py311" and ty python-version = "3.11" in cli,
  core, mcp_server, platform_api, and cookiecutter; root ruff.toml
  target-version = "py311"
- UP042: OutputMode, ChartLifecycle, MCPType, and HTTPMethod become
  StrEnum; every consumer uses .value or == comparisons, so only str()
  and format() output change
- UP017: datetime.timezone.utc -> datetime.UTC (ruff autofix) in the cli
  dispatchers, the cli test generator, and a core test

* Fix ruff and ty failures in packages this PR touches

CI installs unpinned dependencies, so the lint jobs ran against
pandas 3.1.0, ruff 0.17.2, and ty 0.0.91.

- cli/conftest.py: guard the find_spec("openbb") lookup so ty no longer
  reports an Optional ModuleSpec/origin (failing Lint openbb-cli)
- quantitative: pandas 3.1 types Index.max() as object; cast max_date to
  Timestamp before period_start in attribution, factors, and
  risk_decomposition (failing ty)
- federal_reserve: use Series(...).dt.date instead of
  DatetimeIndex.date so neither pandas 3.0 nor 3.1 needs a ty: ignore
  (pandas 3.1 made the existing ignores unused, failing ty)
- core tests: type the filter_by_dates doubles as Data subclasses and
  cast the deliberate bad arguments in test_helpers.py; apply ruff format
  to test_docstring_generator_helpers.py
- platform_api README: apply ruff format to the Python code blocks

* Fix pandas 3.1 deprecations failing fred, sec, and eia tests

These suites turn warnings into errors, and pandas 3.1.0 adds
Pandas4Warning deprecations for several patterns they use. Every change
also passes with the locked pandas 3.0.6.

- fred, sec: replace inplace=True sort_values/reset_index/rename/
  set_index/drop with reassignment
- fred balance_of_payments, sec as_filed_widget: replace fillna with a
  string on float columns by astype(object).where(notna, ...)
- sec: build quarter start dates from ISO strings instead of parsing
  "2024Q2"-style strings; use the DataFrame constructor instead of
  DataFrame.from_records for column dicts; pad CIK lookup rows to two
  fields instead of constructing a ragged DataFrame
- eia: read EIA workbooks with the calamine engine (xlrd is deprecated);
  replace the xlrd dependency with python-calamine and relock; calamine
  workbooks are not safe for concurrent reads, so the petroleum status
  report serializes its sheet reads with a lock

* imf: fall back to the published catalog when the IMF API is unreachable

imf_cache.json.xz is generated at build time and is not committed, so
every CI build of openbb-imf needed a live api.imf.org. The only fallback
was actions/cache, and caches saved by pull_request runs are scoped to
that PR, so a new PR never had one. With api.imf.org returning
"503 no healthy upstream" during IMF's data portal maintenance window,
the build failed.

When live generation fails on a non-forced build, the hook now copies
imf_cache.json.xz from the latest openbb-imf wheel on PyPI, after
checking the wheel's sha256 against the digest PyPI publishes. Builds
with OPENBB_IMF_FORCE_CACHE_REBUILD=1, which the publish workflow sets,
still fail hard, so a release never ships a stale catalog.

---------

Co-authored-by: dlee-bq <325002271+dlee-bq@users.noreply.github.com>
2026-11-01 18:16:45 +00:00
..
2026-09-29 14:45:53 +00:00
2026-09-29 14:45:53 +00:00
2026-09-29 14:45:53 +00:00
2026-09-29 14:45:53 +00:00
2026-09-29 14:45:53 +00:00
2026-09-29 14:45:53 +00:00

OpenBB Platform

The OpenBB Platform is a set of Python packages that turn financial and economic data sources into one typed Python client (from openbb import obb), a FastAPI REST API, and an MCP server.

openbb-core is the runtime. It ships no data and no commands; it discovers the extensions installed in the environment through entry points and assembles them. Everything else in this folder is an extension:

  • Routers add command namespaces such as obb.equity or obb.economy.
  • Providers implement those commands against a data source, and may add their own namespace such as obb.fred.
  • OBBject extensions add accessors to every result, such as result.charting.

Documentation lives at docs.openbb.co.

Repository layout

Path Contents
core/ openbb-core: the runtime, the generated openbb package, and the REST API app.
extensions/ Routers, plus the API launcher, the MCP server, and developer tooling.
providers/ Data provider extensions.
obbject_extensions/ Result accessors (openbb-charting).
dev_install.py Editable install of every package for local development.
../cli/ openbb-cli, the command-line interface.

Packages

Core and tooling

Package Path Description
openbb-core core Runtime, extension loader, static package builder (openbb-build), and REST API app.
openbb-platform-api extensions/platform_api openbb-api launcher for the REST API and the OpenBB Workspace custom-backend connector.
openbb-mcp-server extensions/mcp_server openbb-mcp: serves the installed commands as Model Context Protocol tools.
openbb-devtools extensions/devtools Linters, type checker, and test dependencies for development.
openbb-cli ../cli openbb: interactive command-line interface.

Routers

Package Namespace
openbb-commodity obb.commodity
openbb-crypto obb.crypto
openbb-currency obb.currency
openbb-derivatives obb.derivatives
openbb-econometrics obb.econometrics
openbb-economy obb.economy
openbb-equity obb.equity
openbb-etf obb.etf
openbb-fixedincome obb.fixedincome
openbb-index obb.index
openbb-news obb.news
openbb-quantitative obb.quantitative
openbb-technical obb.technical

Providers

Package Path Source Credential
openbb-bls providers/bls U.S. Bureau of Labor Statistics bls_api_key
openbb-cboe providers/cboe Cboe None
openbb-cftc providers/cftc CFTC and DTCC Public Price Dissemination cftc_app_token
openbb-deribit providers/deribit Deribit None
openbb-ecb providers/ecb European Central Bank None
openbb-famafrench providers/famafrench Ken French Data Library None
openbb-federal-reserve providers/federal_reserve Federal Reserve System, FOMC, and the twelve regional districts None
openbb-finra providers/finra FINRA None
openbb-fred providers/fred FRED fred_api_key
openbb-government-us providers/government_us U.S. Congress, U.S. Treasury, and USDA congress_gov_api_key
openbb-imf providers/imf International Monetary Fund None
openbb-jodi providers/jodi Joint Organisations Data Initiative None
openbb-nasdaq providers/nasdaq Nasdaq None
openbb-oecd providers/oecd OECD None
openbb-sec providers/sec SEC EDGAR None
openbb-tmx providers/tmx TMX (Canadian markets) None
openbb-us-eia providers/eia U.S. Energy Information Administration eia_api_key

OBBject extensions

Package Accessor
openbb-charting result.charting: Plotly charts, with native window rendering through the pywry extra.

Installation

Install openbb-core together with the routers and providers you need; openbb-core is pulled in by each of them.

pip install openbb-equity openbb-cboe

The openbb Python package is generated from whatever is installed. It rebuilds on import when the installed extensions change, and openbb-build rebuilds it explicitly after installing or removing an extension.

openbb-build

Python

from openbb import obb

output = obb.equity.price.historical("AAPL", provider="cboe")
df = output.to_dataframe()

Credentials

Providers that need a key read it as <provider>_<credential>, as listed in the provider table.

Set keys in ~/.openbb_platform/user_settings.json:

{
  "credentials": {
    "fred_api_key": "REPLACE_ME",
    "bls_api_key": "REPLACE_ME"
  }
}

Or as environment variables, which take precedence over the file. ~/.openbb_platform/.env is loaded automatically.

export FRED_API_KEY=REPLACE_ME

Or for the current session only:

from openbb import obb

obb.user.credentials.fred_api_key = "REPLACE_ME"

REST API

openbb-platform-api serves every installed command over FastAPI, with OpenAPI docs at /docs and a widgets.json for OpenBB Workspace.

pip install openbb-platform-api
openbb-api

The bare FastAPI app is openbb_core.api.rest_api:app and runs under any ASGI server.

uvicorn openbb_core.api.rest_api:app --host 127.0.0.1 --port 8000

MCP server

pip install openbb-mcp-server
openbb-mcp

See extensions/mcp_server/README.md for transports, tool discovery, and configuration.

Local development

Requirements:

  • Git
  • Python 3.11 or newer
  • uv

From an activated virtual environment at the repository root:

python openbb_platform/dev_install.py --routers

This installs every tracked package under core, extensions, obbject_extensions, providers, and ../cli in editable mode, with all optional extras and each package's dev dependency group, then runs openbb-build. A new extension is picked up once its pyproject.toml is committed in one of those folders.

Router extensions (openbb-equity, openbb-economy, openbb-fixedincome, and the rest of the router table except openbb-news) are installed only with --routers. Without it, you get core, the tooling, openbb-news, the providers, openbb-charting, and the CLI.

Install the git hooks, which run the same ruff, ty, codespell, and markdownlint checks as CI:

pre-commit install

Each package is linted and tested from its own directory, matching its CI workflow:

cd openbb_platform/providers/fred
ruff format --check .
ruff check .
ty check openbb_fred
pytest tests

See CONTRIBUTING.md for extension guidelines.

License

Apache-2.0. See LICENSE.