Skip to content

daniel3303/Equibles](https:

v1.2.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 8d Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

congressional-trading .net financial-data finra insider-trading institutional-holdings
+6 more
mcp postgresql sec sec-filings self-hosted short-data

Summary

AI summary

Session-scoped OTP cooldowns close an abuse vector and usage alerts warn owners before billing caps hit.

Changes in this release

Feature Low

Adds confidential treatment flag parsing and warning banner on institution profile.

Adds confidential treatment flag parsing and warning banner on institution profile.

Source: llm_adapter@2026-05-26

Confidence: high

Feature Low

Adds rules-based fund classification badge on institution profiles and filterable index.

Adds rules-based fund classification badge on institution profiles and filterable index.

Source: llm_adapter@2026-05-26

Confidence: high

Feature Low

Adds 13F conviction heat map visualization at `/Holdings/HeatMap`.

Adds 13F conviction heat map visualization at `/Holdings/HeatMap`.

Source: llm_adapter@2026-05-26

Confidence: high

Feature Low

Adds 13F aggregate stats dashboard at `/Holdings/Stats`.

Adds 13F aggregate stats dashboard at `/Holdings/Stats`.

Source: llm_adapter@2026-05-26

Confidence: high

Feature Low

Adds 13F trend charts (AUM, filer count, sector allocation) at `/Holdings/Trends`.

Adds 13F trend charts (AUM, filer count, sector allocation) at `/Holdings/Trends`.

Source: llm_adapter@2026-05-26

Confidence: high

Feature Low

Adds Double‑down report with threshold filter at `/Holdings/DoubleDown`.

Adds Double‑down report with threshold filter at `/Holdings/DoubleDown`.

Source: llm_adapter@2026-05-26

Confidence: high

Feature Low

Adds institution overlap matrix at `/Institutions/Overlap`.

Adds institution overlap matrix at `/Institutions/Overlap`.

Source: llm_adapter@2026-05-26

Confidence: high

Feature Low

Adds latest 13F filings page with new‑filer and amendment badges at `/Holdings/LatestFilings`.

Adds latest 13F filings page with new‑filer and amendment badges at `/Holdings/LatestFilings`.

Source: llm_adapter@2026-05-26

Confidence: high

Feature Low

Adds insider trading dashboard showing recent market‑wide transactions at `/InsiderActivity/Dashboard`.

Adds insider trading dashboard showing recent market‑wide transactions at `/InsiderActivity/Dashboard`.

Source: llm_adapter@2026-05-26

Confidence: high

Feature Low

Adds daily filing activity badge on stock detail page and position‑type filter toggles on Holdings tab.

Adds daily filing activity badge on stock detail page and position‑type filter toggles on Holdings tab.

Source: llm_adapter@2026-05-26

Confidence: high

Feature Low

Enriches holders table with ownership %, change %, and quarter first owned fields.

Enriches holders table with ownership %, change %, and quarter first owned fields.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Feature Low

Enriches holders CSV export to include ownership %, change %, and position type columns.

Enriches holders CSV export to include ownership %, change %, and position type columns.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Feature Low

Shows inline key metrics (market cap, P/E, EPS, etc.) on stock detail page.

Shows inline key metrics (market cap, P/E, EPS, etc.) on stock detail page.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Feature Low

Adds compact number toggle for large values in holdings tables.

Adds compact number toggle for large values in holdings tables.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Feature Low

Scrapes and persists company website URL from SEC EDGAR submissions on CommonStock records.

Scrapes and persists company website URL from SEC EDGAR submissions on CommonStock records.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Feature Low

Adds "Current + Combined" date selector in Holdings tab to merge latest quarterly data with realtime filings.

Adds "Current + Combined" date selector in Holdings tab to merge latest quarterly data with realtime filings.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Feature Low

Parses and stores 13F filing type (COVER PAGE, HOLDINGS, AMENDMENT) on InstitutionalHolding records.

Parses and stores 13F filing type (COVER PAGE, HOLDINGS, AMENDMENT) on InstitutionalHolding records.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Performance Low

Wraps Vite bundles in IIFE to avoid global scope collisions; loads bundle.js as ES module.

Wraps Vite bundles in IIFE to avoid global scope collisions; loads bundle.js as ES module.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Performance Low

Splits Chart.js into a separate lazy‑loaded bundle loaded only on chart pages.

Splits Chart.js into a separate lazy‑loaded bundle loaded only on chart pages.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Performance Low

Enables response compression using Brotli and Gzip algorithms.

Enables response compression using Brotli and Gzip algorithms.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Performance Low

Adds Cache-Control headers for static asset delivery.

Adds Cache-Control headers for static asset delivery.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Bugfix Medium

Fixes cold‑start race on fresh DB volume by forcing TCP healthcheck probe and retrying Database.MigrateAsync on transient failures.

Fixes cold‑start race on fresh DB volume by forcing TCP healthcheck probe and retrying Database.MigrateAsync on transient failures.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Bugfix Low

Guards FiscalPeriodResolver methods against year underflow/overflow edge cases.

Guards FiscalPeriodResolver methods against year underflow/overflow edge cases.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Bugfix Low

Clamps date‑related calculations (SyncDateResolver, ParseDataSetEndDate, HoldingsBacktestCalculator) to DateOnly.MaxValue to prevent overflow exceptions.

Clamps date‑related calculations (SyncDateResolver, ParseDataSetEndDate, HoldingsBacktestCalculator) to DateOnly.MaxValue to prevent overflow exceptions.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Refactor Low

Extracts duplicated MCP date‑parsing logic into McpToolExecutor.ParseDateOr helper method.

Extracts duplicated MCP date‑parsing logic into McpToolExecutor.ParseDateOr helper method.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Refactor Low

Extracts repeated "stock not found" MCP responses into McpToolExecutor.StockNotFound utility.

Extracts repeated "stock not found" MCP responses into McpToolExecutor.StockNotFound utility.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Refactor Low

Migrates SEC MCP DocumentTextTools to McpToolRunner, aligning with Execute/ReportError pattern used by other tool groups.

Migrates SEC MCP DocumentTextTools to McpToolRunner, aligning with Execute/ReportError pattern used by other tool groups.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Refactor Low

Extracts LIKE metacharacter escaping into shared LikePattern helper utility.

Extracts LIKE metacharacter escaping into shared LikePattern helper utility.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Refactor Low

Extracts repeated empty‑table‑row markup into EmptyTableRowTagHelper component.

Extracts repeated empty‑table‑row markup into EmptyTableRowTagHelper component.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Refactor Low

Migrates Screener CSV export to shared CsvExportService instead of hand‑rolled writer implementation.

Migrates Screener CSV export to shared CsvExportService instead of hand‑rolled writer implementation.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

Full changelog

Added

  • Confidential treatment flag — 13F cover pages' confidentialTreatmentRequestedFlag
    is now parsed and stored on InstitutionalHolder. The institution profile page
    shows a warning banner when the flag is set, and GetInstitutionSummary MCP tool
    appends a note. Helps users understand that a fund's 13F may be incomplete.
  • Fund classification — rules-based classifier labels each 13F filer (Bank, Insurance,
    Hedge Fund, Pension, etc.) from the filing manager name. Classification badge shown
    on institution profiles and filterable in the institutions index.
  • 13F conviction heat map visualization at /Holdings/HeatMap.
  • 13F aggregate stats dashboard at /Holdings/Stats.
  • 13F trend charts (AUM, filer count, sector allocation) at /Holdings/Trends.
  • Double-down report at /Holdings/DoubleDown with threshold filter.
  • Institution overlap matrix at /Institutions/Overlap.
  • Latest 13F filings page at /Holdings/LatestFilings with new-filer and amendment badges.
  • Insider trading dashboard at /InsiderActivity/Dashboard with market-wide
    recent transactions.
  • Daily filing activity badge on stock detail page.
  • Position-type filter toggles on stock Holdings tab.
  • Enriched holders table with ownership %, change %, and quarter first owned.
  • Enriched holders CSV export with ownership %, change %, and position type.
  • Stock detail page inline key metrics (market cap, P/E, EPS, etc.).
  • Compact number toggle for large values in holdings tables.
  • Company website URL scraped from SEC EDGAR submissions and persisted on
    CommonStock.
  • "Current + Combined" date selector in the Holdings tab, showing a merged
    view of the latest quarterly data set and any realtime filings since.
  • 13F filing type (COVER PAGE, HOLDINGS, AMENDMENT) parsed and stored
    on InstitutionalHolding.
  • Many new end-user guide pages (docs/guide/): tutorials, how-tos, and FAQ entries.

Changed

  • Institution name matching prefers the shortest match to avoid subsidiary
    collisions (e.g. "BlackRock" now resolves to "BlackRock, Inc." instead of
    "BlackRock Advisors LLC").
  • Insider search tokenizes queries so "First Last" order matches "Last First"
    names in the database.
  • GetShortInterestSnapshot excludes stocks with zero average daily volume
    (previously dominated results with capped days-to-cover of 1000).
  • 13F holdings import runs incrementally instead of batching.
  • <cn> tag helper renamed to <compactable-number> for clarity.
  • Company name normalization handles common abbreviations (Inc → Inc.,
    Corp → Corp., Ltd → Ltd., etc.), higher roman numerals (IV–X), and
    parenthesized abbreviations.
  • Duplicated MCP date-parsing logic extracted into McpToolExecutor.ParseDateOr.
  • Repeated "stock not found" MCP responses extracted into
    McpToolExecutor.StockNotFound.
  • SEC MCP DocumentTextTools migrated to McpToolRunner, matching the
    Execute / ReportError pattern used by the other MCP tool groups.
  • LIKE metacharacter escaping extracted into shared LikePattern helper.
  • Repeated empty-table-row markup extracted into a shared
    EmptyTableRowTagHelper.
  • Screener CSV export migrated to the shared CsvExportService instead of
    hand-rolling its own writer.
  • Vite bundles wrapped in IIFE to prevent global scope collision; bundle.js
    loaded as ES module.
  • Chart.js split into a separate bundle loaded only on chart pages.
  • Response compression (Brotli + Gzip) enabled.
  • Cache-Control headers added for static assets.
  • Unused Inter font weight 300 dropped.

Fixed

  • Cold-start race on a fresh DB volume — the compose healthcheck now forces a
    TCP probe instead of a Unix-socket probe, so it only flips healthy after
    ParadeDB's init phase finishes and the real TCP listener is up. The web
    host also retries Database.MigrateAsync on transient connection failures.
  • FiscalPeriodResolver.Resolve guarded against year-underflow on AddYears(-1).
  • FiscalPeriodResolver.CreateSafe guarded against year overflow past 9999.
  • FiscalCalendar.GetPeriod guarded against fiscal year overflow past 9999.
  • FiscalCalendar.GetQuarterEndDate guarded against calendar year underflow.
  • SyncDateResolver.Resolve clamped to DateOnly.MaxValue on overflow.
  • ParseDataSetEndDate validates year range before DaysInMonth call.
  • TryParseDatePart validates day-of-month before DateOnly construction.
  • HoldingsBacktestCalculator clamps backtest horizon to DateOnly.MaxValue.
  • HoldingsBacktestCalculator rebalance date overflow past DateOnly.MaxValue clamped.
  • Truncate guards against IndexOutOfRangeException when maxLength is 0 or negative.
  • Truncate no longer splits surrogate pairs.
  • ErrorManager.Truncate uses surrogate-pair-safe boundary handling.
  • Holdings position grouper classifies 0-shares-both-quarters as Unchanged, not New.
  • Bank fund classifier matches BANK as the last word (not just mid-string).
  • InsiderTradingTools.GetRole handles empty and whitespace-only OfficerTitle.
  • FinancialConceptAliases.Normalize collapses spaced ampersands (&amp;&).
  • VIX put/call CSV column mapping corrected.
  • FINRA API date formatting uses InvariantCulture.
  • SEC GetDailyIndex URL date formatting uses InvariantCulture.
  • Realtime13FArchiveBuilder date formatting uses InvariantCulture.
  • HoldingsDataSetClient.FormatDatePart uses InvariantCulture for year.
  • CIK leading zeros normalized in the 13F TSV import path.
  • Realtime 13F lookback computed dynamically from last quarterly data set.
  • ProcessedDataSetRepository registered in DoWork integration test.
  • Holdings integration test CIKs aligned with TrimStart('0') normalization.
  • Congress Truncate handles negative maxLength.
  • Empty-state message added when no economic indicators are imported.
  • 13F import respects NEW HOLDINGS amendment type (was silently treated
    as a regular filing).
  • FiscalYearEndMonth inferred from 10-K filing date when SEC EDGAR
    metadata is null.
  • FiscalYearEndMonth inferred from 20-F / 40-F for foreign filers
    (previously only 10-K was checked).
  • Fiscal year-end day validated against its month (e.g., day 31 rejected
    for months with fewer days).
  • Filer-universe query narrowed to only gap holders.
  • ParseTransactionCode trims input so whitespace-padded SEC transaction
    codes resolve to the correct TransactionCode enum value.
  • ParseBool trims input so whitespace-padded SEC boolean strings
    ("true ", " false") are interpreted correctly.
  • SafeRound guards against the decimal.MaxValue boundary instead of
    throwing on rounding overflow.
  • House PTR PDF parser joins multi-line transaction entries so the asset
    name, ticker/dates, and amount land on a single transaction instead of
    three partial rows.
  • 13F-HR import aggregates same-key rows across the whole filing instead
    of flushing every 1000 unique keys. When a filer split a position
    across otherManager codes the matching rows could fall in different
    batches; the upsert's WhenMatched clause REPLACED the persisted row,
    so only the last batch's slice survived (Vanguard's Q4 2025 AAPL came
    out as 39M shares instead of 1.43B). The import now flushes at the
    accession boundary, which SEC guarantees is contiguous in both the
    bulk INFOTABLE and the realtime archive.
  • StocksController.ParsePositionTypes gates parsed values with
    Enum.IsDefined so numeric query input with no matching
    PositionChangeType member (e.g. ?types=999) is rejected the same
    as an unrecognised name, preventing a polluted filter set from
    round-tripping into rendered toggle URLs on the holdings tab.
  • CompanySyncService.NormalizeCompanyName no longer treats the short English
    words MIX, DIV, LIV, and CIV as Roman numerals — they decompose as 1009,
    504, 54, and 104 respectively but aren't numerals in a company-name context.
    An explicit deny-list rejects exactly those four tokens, so other short
    numerals that use L/C/D/M (XL=40, XC=90, CD=400, CM=900, XLI=41, XLV=45,
    MII=1002) keep working alongside the pure-I/V/X cases.

Security Fixes

  • Authflow cooldowns now session-scoped — closes abuse vector where users changed phone/email mid-flow to reset OTP cooldowns

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track daniel3303/Equibles](https:

Get notified when new releases ship.

Sign up free

About daniel3303/Equibles](https:

All releases →

Related context

Beta — feedback welcome: [email protected]