2.1.9

Version 2.1.9

• Corrected erroneous build configuration that broke version 2.1.8
• Fixed file path in load_plotly.py
• Added packaging tests

Summary for yanked version 2.1.8

• Replaces Poetry with uv for dependency management, locking, and CI sync
• Hardens GitHub Actions workflows for supply-chain and fork-PR security
• Adds supply-chain scanning, CodeQL, and zizmor auditing in CI and pre-commit
• Improves typing across the library and fixes an efficient-frontier plotting bug

Project management

• Replaced poetry.lock with uv.lock and updated pyproject.toml for uv/pep 621 workflow
• Updated Makefile, make.ps1, and source_me to use uv sync, uv lock, and uv build instead of Poetry
• Added make update for upgrading dependencies and make audit for local lockfile + pip-audit checks
• Updated installation and contributing docs for uv-based setup

CI/CD workflows

• Migrated all workflows from Poetry to uv (uv sync --locked, uv build, etc.)
• Pinned all third-party actions to immutable SHAs; added Dependabot config for GitHub Actions and pip (lockfile-only, 7-day cooldown)
• Added supply-chain.yml: lockfile verification, OSV-Scanner, and pip-audit on push/PR to master
• Added codeql.yml: Python CodeQL analysis on push/PR, schedule, and manual dispatch
• Added zizmor.yml: workflow security audit with SARIF upload to GitHub Security tab
• Split release pipeline into reusable workflows:
  • release-tag.yml: GPG-signed tag + GitHub release
  • release-publish.yml: build dist, TestPyPI → PyPI (OIDC), docs trigger
  • deploy.yml: manual entry point only; requires master branch before proceeding
• Added pull_request trigger to tests.yml so fork PRs get CI coverage
• Disabled uv caching in the publish workflow; guarded mypy cache restore and issue creation on fork PRs

Security

• Expanded SECURITY.md with documented CI controls and an org/repo admin settings checklist
• Added .github/zizmor.yml policies: hash-pin all actions, allowlisted action set, Dependabot cooldown enforcement
• zizmor runs with --strict-collection --pedantic in CI and pre-commit
• OIDC (id-token: write) scoped only to GitHub Pages and PyPI publish jobs
• No use of pull_request_target; explicit read-only default permissions on workflows

Code and tests

• Reduced # noqa / # type: ignore usage; tightened type annotations in frame.py, series.py, _common_model.py, portfoliotools.py, and report.py
• Fixed portfoliotools.py: repeat Plotly colorway to match column count so zip(..., strict=True) does not fail when there are more portfolio points than theme colors
• Added/updated tests for package metadata, common model internals, frame, series, types, and portfoliotools

Dev tooling

• Added zizmor pre-commit hook (strict + pedantic, matching CI)
• Updated pre-commit hooks (uv-lock, ruff, mypy) for the uv-based environment

2.1.7

• added the methods .autocorr .acf .partial_autocorr .pacf .ljung_box and an autocorr property
• added option to set an autocorrelation parameter in the random series generation
• added tzdata to dependencies to ensure safer conda publish
• miscellaneous updates to dev scripts including update of default Python to 3.14

What's Changed

• zizmor tuning by @karrmagadgeteer2 in #358
• dev deps and gha updated by @karrmagadgeteer2 in #359
• dev deps and gha updated by @karrmagadgeteer2 in #360
• dependencies checked vs new versions and fixed deprecation warning by @karrmagadgeteer2 in #361
• update and set py314 as dev default by @karrmagadgeteer2 in #362
• New version 2.1.7 by @karrmagadgeteer2 in #363

Full Changelog: 2.1.6...2.1.7

2.1.6

• New .ewma_var_func() on class OpenTimeSeries

2.1.5

• Fixed wrapped titles in report_html table
• Fixed mobile render responsiveness for plot methods
• Exposing html_utils.export_plotly_figure for use with other plotly figures needing a mobile responsive html wrapper.
• Miscellaneous linting cleanup

2.1.4

• New version of report_html function with improved responsiveness

2.1.3

• Fixed rendering size and reverted return value structure for report_html. *** Version 2.1.2 may cause issues ***

2.1.2

• Fixed narrow desktop and mobile rendering for report html

2.1.1

• report_html function responsiveness made to be default behaviour

2.1.0

• Closing #340
• Fixed example in docs/examples/portfolio_optimization
• Html report made browser window width aware
• Code efficiency improvements
• Code complexity improvements
• Test suite made more pytest native

2.0.3

• Removed upper limit on versions for project dependencies
• ord_least_squares_fit output now as native float instead of numpy float
• Dev scripts, docs and dependencies updates
• Used Cursor AI to reformat all doc strings to Google style and miscellaneous code cleanup
• Added deprecation warning on Python 3.10 support