Files
OpenBB/openbb_platform/core/integration/conftest.py
dlee-bq 53d4dcc46d [Feature] Drop Python 3.10 and Resolve Open Dependabot Alerts (#7804)
* Drop Python 3.10 support

Python 3.10 reached end of life on 2026-10-01, and the patched releases of
Pillow (13.0.0) and filelock (>=4.2.1) require Python >=3.11, so the 3.10
resolution fork kept vulnerable versions in every lockfile.

- requires-python = ">=3.11,<4" in all pyproject.toml files, the
  cookiecutter template, and the CLI codegen project template
- CI: drop the ubuntu 3.10 matrix rows, move the macOS/Windows minimum
  rows and the lint jobs to 3.11, drop 3.10 from the nox sessions
- READMEs: state 3.11 as the minimum supported version

* Relock with patched certifi, filelock, virtualenv, Pillow, and fastmcp

Regenerate all 38 uv.lock files against requires-python >=3.11 and upgrade
only the packages with open Dependabot advisories:

- certifi 2026.7.22 -> 2026.10.23 (GHSA-6q48-6c7w-9gw2, compromised emSign CAs)
- virtualenv 21.14.7 -> 21.14.13
- filelock 4.1.0/4.2.0 -> 4.2.4
- Pillow 12.3.0 -> 13.0.0
- fastmcp / fastmcp-slim 4.1.0 -> 4.1.3

All other changes are removed Python 3.10-only resolution forks; no other
package changes version for Python 3.11+.

* desktop: bump zod, @hookform/resolvers, and vitest

- zod ^3.25.76 -> ^4.6.7 (GHSA-mrhx-c7xc-m3w5; no patched 3.x exists)
- @hookform/resolvers ^3.10.0 -> ^5.9.2 for zod 4 support
- vitest ^4.1.11 -> ^4.1.12 (@vitest/mocker GHSA-qxg6-89mg-rqv8,
  GHSA-xp26-3454-mjgp)
- override zod to the root version so @openbb/ui-pro, which declares
  zod ^3 but never imports it, does not pull in a second, vulnerable copy

* desktop: remove Python 3.10 from environment pickers

- version pickers in InstallComponents and AddExtensionSelector start at 3.11
- create_environment_from_requirements accepts 3.11 through 3.14 and falls
  back to 3.12 otherwise (previously 3.10 through 3.13)
- component tests select 3.11 instead of 3.10

* Remove Python 3.10 tomli fallbacks

With requires-python >=3.11, tomllib is always available, so the
version-conditional tomli imports are dead code.

- import tomllib directly in the cli and core config loaders, the
  mcp_server and platform_api config validators, dev_install.py, and
  the cli and cookiecutter tests; dev_install.py no longer pip-installs
  tomli on the fly
- drop the tomli>=2.0; python_version<'3.11' dependency from cli, core,
  mcp_server, and platform_api, plus platform_api's backport comment
- raise the fake-extension fixtures in cli/conftest.py,
  core/integration/conftest.py, and the charting test metadata to
  >=3.11
- relock cli, core, mcp_server, and platform_api; only the tomli
  requires-dist entry is removed and resolution markers are reordered,
  no package versions change

* Target Python 3.11 in ruff and ty for cli, core, mcp_server, platform_api, cookiecutter

With ruff target-version py310 and ty python-version 3.10, both tools
reject an unconditional `import tomllib`: ty reports it as unresolved
(exit 1) and ruff's isort classifies it as third-party. Raise the targets
in the projects that now import tomllib directly, and in the root
ruff.toml that governs dev_install.py.

- ruff target-version = "py311" and ty python-version = "3.11" in cli,
  core, mcp_server, platform_api, and cookiecutter; root ruff.toml
  target-version = "py311"
- UP042: OutputMode, ChartLifecycle, MCPType, and HTTPMethod become
  StrEnum; every consumer uses .value or == comparisons, so only str()
  and format() output change
- UP017: datetime.timezone.utc -> datetime.UTC (ruff autofix) in the cli
  dispatchers, the cli test generator, and a core test

* Fix ruff and ty failures in packages this PR touches

CI installs unpinned dependencies, so the lint jobs ran against
pandas 3.1.0, ruff 0.17.2, and ty 0.0.91.

- cli/conftest.py: guard the find_spec("openbb") lookup so ty no longer
  reports an Optional ModuleSpec/origin (failing Lint openbb-cli)
- quantitative: pandas 3.1 types Index.max() as object; cast max_date to
  Timestamp before period_start in attribution, factors, and
  risk_decomposition (failing ty)
- federal_reserve: use Series(...).dt.date instead of
  DatetimeIndex.date so neither pandas 3.0 nor 3.1 needs a ty: ignore
  (pandas 3.1 made the existing ignores unused, failing ty)
- core tests: type the filter_by_dates doubles as Data subclasses and
  cast the deliberate bad arguments in test_helpers.py; apply ruff format
  to test_docstring_generator_helpers.py
- platform_api README: apply ruff format to the Python code blocks

* Fix pandas 3.1 deprecations failing fred, sec, and eia tests

These suites turn warnings into errors, and pandas 3.1.0 adds
Pandas4Warning deprecations for several patterns they use. Every change
also passes with the locked pandas 3.0.6.

- fred, sec: replace inplace=True sort_values/reset_index/rename/
  set_index/drop with reassignment
- fred balance_of_payments, sec as_filed_widget: replace fillna with a
  string on float columns by astype(object).where(notna, ...)
- sec: build quarter start dates from ISO strings instead of parsing
  "2024Q2"-style strings; use the DataFrame constructor instead of
  DataFrame.from_records for column dicts; pad CIK lookup rows to two
  fields instead of constructing a ragged DataFrame
- eia: read EIA workbooks with the calamine engine (xlrd is deprecated);
  replace the xlrd dependency with python-calamine and relock; calamine
  workbooks are not safe for concurrent reads, so the petroleum status
  report serializes its sheet reads with a lock

* imf: fall back to the published catalog when the IMF API is unreachable

imf_cache.json.xz is generated at build time and is not committed, so
every CI build of openbb-imf needed a live api.imf.org. The only fallback
was actions/cache, and caches saved by pull_request runs are scoped to
that PR, so a new PR never had one. With api.imf.org returning
"503 no healthy upstream" during IMF's data portal maintenance window,
the build failed.

When live generation fails on a non-forced build, the hook now copies
imf_cache.json.xz from the latest openbb-imf wheel on PyPI, after
checking the wheel's sha256 against the digest PyPI publishes. Builds
with OPENBB_IMF_FORCE_CACHE_REBUILD=1, which the publish workflow sets,
still fail hard, so a release never ships a stale catalog.

---------

Co-authored-by: dlee-bq <325002271+dlee-bq@users.noreply.github.com>
2026-11-01 18:16:45 +00:00

337 lines
11 KiB
Python

"""Session-scoped fixture that builds & installs a synthetic OpenBB extension.
This is the integration substrate for tests that need a *real* ``from
openbb import obb`` to expose a real command. Rather than depending on
the developer having any of the production extensions
(``openbb-fixedincome``, ``openbb-equity``, ``openbb-fmp``, …)
installed, the fixture writes a self-contained extension distribution
to disk, ``pip install``s it into the current interpreter, and runs
``openbb-build`` so the static package under ``openbb/package/`` is
regenerated with that extension's command(s) baked in.
Because the static package is wired via entry points discovered at
*interpreter start*, every test that imports ``openbb`` after the build
must do so in a fresh ``python`` subprocess. The fixture exposes a
helper, ``run_in_obb``, that runs an inline snippet of code in a child
interpreter with the freshly-built package on its path.
Cleanup: after the session, the synthetic distribution is uninstalled
and the generated ``openbb/package/`` and ``openbb/assets/`` directories
are restored to their pre-test state.
"""
import contextlib
import json
import os
import shutil
import subprocess
import sys
import textwrap
from pathlib import Path
import pytest
CORE_DIR = Path(__file__).resolve().parents[1]
OPENBB_DIR = CORE_DIR / "openbb"
PACKAGE_DIR = OPENBB_DIR / "package"
ASSETS_DIR = OPENBB_DIR / "assets"
EXT_NAME = "openbb-fake-integration"
EXT_PKG = "openbb_fake_integration"
PYPROJECT = """\
[project]
name = "{ext_name}"
version = "0.0.1"
requires-python = ">=3.11,<4"
dependencies = ["openbb-core"]
[project.entry-points."openbb_core_extension"]
fake_integration = "{pkg}.router:router"
[project.entry-points."openbb_provider_extension"]
fake_integration = "{pkg}:fake_integration_provider"
[project.entry-points."openbb_obbject_extension"]
fake_accessor = "{pkg}.accessor:ext"
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"
[tool.hatch.build.targets.wheel]
packages = ["{pkg}"]
"""
INIT_PY = '''\
"""Synthetic provider for OpenBB integration tests."""
from typing import Any
from openbb_core.provider.abstract.data import Data
from openbb_core.provider.abstract.fetcher import Fetcher
from openbb_core.provider.abstract.provider import Provider
from openbb_core.provider.standard_models.available_indicators import (
AvailableIndicatorsData,
AvailableIndicesQueryParams,
)
class _FakeIntegrationData(AvailableIndicatorsData):
"""Provider-specific data for the fake_integration provider."""
extra: str | None = None
class _FakeIntegrationFetcher(
Fetcher[AvailableIndicesQueryParams, list[_FakeIntegrationData]]
):
"""Deterministic fetcher: returns one row regardless of input."""
require_credentials = False
@staticmethod
def transform_query(params: dict[str, Any]) -> AvailableIndicesQueryParams:
return AvailableIndicesQueryParams(**params)
@staticmethod
def extract_data(
query: AvailableIndicesQueryParams,
credentials: dict[str, str] | None,
**kwargs: Any,
) -> list[dict[str, Any]]:
return [{"symbol": "FAKE", "extra": "ok"}]
@staticmethod
def transform_data(
query: AvailableIndicesQueryParams,
data: list[dict[str, Any]],
**kwargs,
) -> list[_FakeIntegrationData]:
return [_FakeIntegrationData(**row) for row in data]
fake_integration_provider = Provider(
name="fake_integration",
description="Synthetic provider used by the openbb-core integration suite.",
website="https://example.invalid",
credentials=None,
fetcher_dict={"AvailableIndicators": _FakeIntegrationFetcher},
)
'''
ROUTER_PY = '''\
"""Synthetic router for OpenBB integration tests."""
from openbb_core.app.model.command_context import CommandContext
from openbb_core.app.model.obbject import OBBject
from openbb_core.app.provider_interface import (
ExtraParams,
ProviderChoices,
StandardParams,
)
from openbb_core.app.query import Query
from openbb_core.app.router import Router
router = Router(prefix="", description="Fake integration extension.")
@router.command(model="AvailableIndicators")
async def list_indicators(
cc: CommandContext,
provider_choices: ProviderChoices,
standard_params: StandardParams,
extra_params: ExtraParams,
) -> OBBject:
"""Return synthetic indicator rows for integration testing."""
return await OBBject.from_query(Query(**locals()))
'''
ACCESSOR_PY = '''\
"""Synthetic OBBject accessor extension.
Demonstrates the ``openbb_obbject_extension`` entry-point group.
``Extension.obbject_accessor`` registers ``FakeAccessor`` as
``OBBject.fake_accessor``, so any ``OBBject`` instance can call
``result.fake_accessor.upper_symbols()`` (the typical pandas-style
accessor pattern).
"""
from openbb_core.app.model.extension import Extension
ext = Extension(name="fake_accessor", description="Fake accessor for integration tests.")
@ext.obbject_accessor
class FakeAccessor:
"""Custom accessor exposed as ``OBBject.fake_accessor``."""
def __init__(self, obbject):
"""Hold a reference to the wrapped OBBject (pandas-accessor pattern)."""
self._obbject = obbject
def upper_symbols(self) -> list[str]:
"""Return the symbol field of every row, uppercased."""
out = []
for row in self._obbject.results or []:
sym = (
row.symbol
if hasattr(row, "symbol")
else (row.get("symbol") if isinstance(row, dict) else None)
)
if sym is not None:
out.append(str(sym).upper())
return out
def row_count(self) -> int:
"""Return the number of result rows."""
return len(self._obbject.results or [])
'''
def _snapshot_dir(src: Path, dst: Path) -> None:
if src.exists():
shutil.copytree(src, dst, dirs_exist_ok=True)
def _restore_dir(src: Path, dst: Path) -> None:
shutil.rmtree(dst, ignore_errors=True)
if src.exists():
shutil.copytree(src, dst)
def _pip(*args: str) -> None:
subprocess.run( # noqa: S603
[sys.executable, "-m", "pip", *args],
check=True,
capture_output=True,
text=True,
)
def _subprocess_env(extra: dict[str, str] | None = None) -> dict[str, str]:
"""Build a subprocess env that opts into coverage.py auto-startup if a config exists.
Strips ``COV_CORE_*`` so the child does not also try to bootstrap via
``pytest_cov.embed.init()`` (which would race with ``coverage.process_startup``
and write into the parent's locked data file).
"""
env = {k: v for k, v in os.environ.items() if not k.startswith("COV_CORE_")}
rcfile = CORE_DIR / ".coveragerc"
if rcfile.exists():
env["COVERAGE_PROCESS_START"] = str(rcfile)
if extra:
env.update(extra)
return env
def _run_openbb_build() -> None:
"""Invoke ``openbb-build`` in a fresh subprocess.
A child process is required because ``ExtensionLoader``/``RouterLoader``
cache entry points at module load time; the parent process cannot
discover the freshly-installed distribution without a restart.
"""
env = _subprocess_env({"OPENBB_AUTO_BUILD": "true"})
subprocess.run(
[sys.executable, "-c", "import openbb"],
check=True,
capture_output=True,
text=True,
env=env,
)
@pytest.fixture(scope="session")
def fake_extension_installed(tmp_path_factory):
"""Build, install, openbb-build, yield, then uninstall and restore."""
work = tmp_path_factory.mktemp("fake_ext_dist")
pkg_dir = work / EXT_PKG
pkg_dir.mkdir()
(pkg_dir / "__init__.py").write_text(INIT_PY, encoding="utf-8")
(pkg_dir / "router.py").write_text(ROUTER_PY, encoding="utf-8")
(pkg_dir / "accessor.py").write_text(ACCESSOR_PY, encoding="utf-8")
(work / "pyproject.toml").write_text(
PYPROJECT.format(ext_name=EXT_NAME, pkg=EXT_PKG), encoding="utf-8"
)
snapshot_root = tmp_path_factory.mktemp("openbb_snapshot")
pkg_snapshot = snapshot_root / "package"
assets_snapshot = snapshot_root / "assets"
_snapshot_dir(PACKAGE_DIR, pkg_snapshot)
_snapshot_dir(ASSETS_DIR, assets_snapshot)
try:
_pip("install", "--no-deps", "-e", str(work))
# The parent pytest interpreter processed `.pth` files at startup, so
# the editable install isn't visible to `import` here even though
# `importlib.metadata.entry_points()` will return the new entry point.
# Add the source dir to sys.path so subsequent unit tests in this same
# process that instantiate `ExtensionLoader` can `ep.load()` it.
if str(work) not in sys.path:
sys.path.insert(0, str(work))
_run_openbb_build()
ext_pkg_module = PACKAGE_DIR / "fake_integration.py"
if not ext_pkg_module.exists():
pytest.fail(
"openbb-build did not emit fake_integration.py; "
f"contents of {PACKAGE_DIR}: "
f"{sorted(p.name for p in PACKAGE_DIR.glob('*.py'))}"
)
yield {
"ext_name": EXT_NAME,
"ext_pkg": EXT_PKG,
"package_dir": PACKAGE_DIR,
"assets_dir": ASSETS_DIR,
}
finally:
with contextlib.suppress(subprocess.CalledProcessError):
_pip("uninstall", "-y", EXT_NAME)
with contextlib.suppress(ValueError):
sys.path.remove(str(work))
# Drop any cached imports of the synthetic package so later tests
# that re-instantiate `ExtensionLoader` don't see a phantom module.
for mod_name in [m for m in sys.modules if m.startswith(EXT_PKG)]:
del sys.modules[mod_name]
_restore_dir(pkg_snapshot, PACKAGE_DIR)
_restore_dir(assets_snapshot, ASSETS_DIR)
@pytest.fixture(scope="session")
def run_in_obb(fake_extension_installed): # noqa: ARG001
"""Run an inline snippet under a fresh ``python`` subprocess that imports ``openbb``.
Returns a callable ``run(snippet: str) -> dict``. The snippet must
assign a JSON-serializable value to a variable called ``RESULT``;
the wrapper ``json.dumps`` it to stdout and the helper parses it
back into Python.
"""
def _run(snippet: str) -> dict:
wrapper = textwrap.dedent("""
import json, sys
from openbb import obb # noqa: F401
{snippet}
sys.stdout.write(json.dumps(RESULT))
""").format(snippet=textwrap.indent(snippet, ""))
proc = subprocess.run( # noqa: S603
[sys.executable, "-c", wrapper],
check=False,
capture_output=True,
text=True,
env=_subprocess_env({"OPENBB_AUTO_BUILD": "false"}),
)
if proc.returncode != 0:
raise AssertionError(
f"obb subprocess failed (rc={proc.returncode})\n"
f"--- stdout ---\n{proc.stdout}\n"
f"--- stderr ---\n{proc.stderr}"
)
return json.loads(proc.stdout)
return _run