This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+6 more
Summary
AI summarySession-scoped OTP cooldowns close an abuse vector and usage alerts warn owners before billing caps hit.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Adds confidential treatment flag parsing and warning banner on institution profile. Adds confidential treatment flag parsing and warning banner on institution profile. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Adds rules-based fund classification badge on institution profiles and filterable index. Adds rules-based fund classification badge on institution profiles and filterable index. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Adds 13F conviction heat map visualization at `/Holdings/HeatMap`. Adds 13F conviction heat map visualization at `/Holdings/HeatMap`. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Adds 13F aggregate stats dashboard at `/Holdings/Stats`. Adds 13F aggregate stats dashboard at `/Holdings/Stats`. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Adds 13F trend charts (AUM, filer count, sector allocation) at `/Holdings/Trends`. Adds 13F trend charts (AUM, filer count, sector allocation) at `/Holdings/Trends`. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Adds Double‑down report with threshold filter at `/Holdings/DoubleDown`. Adds Double‑down report with threshold filter at `/Holdings/DoubleDown`. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Adds institution overlap matrix at `/Institutions/Overlap`. Adds institution overlap matrix at `/Institutions/Overlap`. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Adds latest 13F filings page with new‑filer and amendment badges at `/Holdings/LatestFilings`. Adds latest 13F filings page with new‑filer and amendment badges at `/Holdings/LatestFilings`. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Adds insider trading dashboard showing recent market‑wide transactions at `/InsiderActivity/Dashboard`. Adds insider trading dashboard showing recent market‑wide transactions at `/InsiderActivity/Dashboard`. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Adds daily filing activity badge on stock detail page and position‑type filter toggles on Holdings tab. Adds daily filing activity badge on stock detail page and position‑type filter toggles on Holdings tab. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Feature | Low |
Enriches holders table with ownership %, change %, and quarter first owned fields. Enriches holders table with ownership %, change %, and quarter first owned fields. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Feature | Low |
Enriches holders CSV export to include ownership %, change %, and position type columns. Enriches holders CSV export to include ownership %, change %, and position type columns. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Feature | Low |
Shows inline key metrics (market cap, P/E, EPS, etc.) on stock detail page. Shows inline key metrics (market cap, P/E, EPS, etc.) on stock detail page. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Feature | Low |
Adds compact number toggle for large values in holdings tables. Adds compact number toggle for large values in holdings tables. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Feature | Low |
Scrapes and persists company website URL from SEC EDGAR submissions on CommonStock records. Scrapes and persists company website URL from SEC EDGAR submissions on CommonStock records. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Feature | Low |
Adds "Current + Combined" date selector in Holdings tab to merge latest quarterly data with realtime filings. Adds "Current + Combined" date selector in Holdings tab to merge latest quarterly data with realtime filings. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Feature | Low |
Parses and stores 13F filing type (COVER PAGE, HOLDINGS, AMENDMENT) on InstitutionalHolding records. Parses and stores 13F filing type (COVER PAGE, HOLDINGS, AMENDMENT) on InstitutionalHolding records. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Performance | Low |
Wraps Vite bundles in IIFE to avoid global scope collisions; loads bundle.js as ES module. Wraps Vite bundles in IIFE to avoid global scope collisions; loads bundle.js as ES module. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Performance | Low |
Splits Chart.js into a separate lazy‑loaded bundle loaded only on chart pages. Splits Chart.js into a separate lazy‑loaded bundle loaded only on chart pages. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Performance | Low |
Enables response compression using Brotli and Gzip algorithms. Enables response compression using Brotli and Gzip algorithms. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Performance | Low |
Adds Cache-Control headers for static asset delivery. Adds Cache-Control headers for static asset delivery. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Bugfix | Medium |
Fixes cold‑start race on fresh DB volume by forcing TCP healthcheck probe and retrying Database.MigrateAsync on transient failures. Fixes cold‑start race on fresh DB volume by forcing TCP healthcheck probe and retrying Database.MigrateAsync on transient failures. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Bugfix | Low |
Guards FiscalPeriodResolver methods against year underflow/overflow edge cases. Guards FiscalPeriodResolver methods against year underflow/overflow edge cases. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Bugfix | Low |
Clamps date‑related calculations (SyncDateResolver, ParseDataSetEndDate, HoldingsBacktestCalculator) to DateOnly.MaxValue to prevent overflow exceptions. Clamps date‑related calculations (SyncDateResolver, ParseDataSetEndDate, HoldingsBacktestCalculator) to DateOnly.MaxValue to prevent overflow exceptions. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Refactor | Low |
Extracts duplicated MCP date‑parsing logic into McpToolExecutor.ParseDateOr helper method. Extracts duplicated MCP date‑parsing logic into McpToolExecutor.ParseDateOr helper method. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Refactor | Low |
Extracts repeated "stock not found" MCP responses into McpToolExecutor.StockNotFound utility. Extracts repeated "stock not found" MCP responses into McpToolExecutor.StockNotFound utility. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Refactor | Low |
Migrates SEC MCP DocumentTextTools to McpToolRunner, aligning with Execute/ReportError pattern used by other tool groups. Migrates SEC MCP DocumentTextTools to McpToolRunner, aligning with Execute/ReportError pattern used by other tool groups. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Refactor | Low |
Extracts LIKE metacharacter escaping into shared LikePattern helper utility. Extracts LIKE metacharacter escaping into shared LikePattern helper utility. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Refactor | Low |
Extracts repeated empty‑table‑row markup into EmptyTableRowTagHelper component. Extracts repeated empty‑table‑row markup into EmptyTableRowTagHelper component. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
| Refactor | Low |
Migrates Screener CSV export to shared CsvExportService instead of hand‑rolled writer implementation. Migrates Screener CSV export to shared CsvExportService instead of hand‑rolled writer implementation. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
— |
Full changelog
Added
- Confidential treatment flag — 13F cover pages'
confidentialTreatmentRequestedFlag
is now parsed and stored onInstitutionalHolder. The institution profile page
shows a warning banner when the flag is set, andGetInstitutionSummaryMCP tool
appends a note. Helps users understand that a fund's 13F may be incomplete. - Fund classification — rules-based classifier labels each 13F filer (Bank, Insurance,
Hedge Fund, Pension, etc.) from the filing manager name. Classification badge shown
on institution profiles and filterable in the institutions index. - 13F conviction heat map visualization at
/Holdings/HeatMap. - 13F aggregate stats dashboard at
/Holdings/Stats. - 13F trend charts (AUM, filer count, sector allocation) at
/Holdings/Trends. - Double-down report at
/Holdings/DoubleDownwith threshold filter. - Institution overlap matrix at
/Institutions/Overlap. - Latest 13F filings page at
/Holdings/LatestFilingswith new-filer and amendment badges. - Insider trading dashboard at
/InsiderActivity/Dashboardwith market-wide
recent transactions. - Daily filing activity badge on stock detail page.
- Position-type filter toggles on stock Holdings tab.
- Enriched holders table with ownership %, change %, and quarter first owned.
- Enriched holders CSV export with ownership %, change %, and position type.
- Stock detail page inline key metrics (market cap, P/E, EPS, etc.).
- Compact number toggle for large values in holdings tables.
- Company website URL scraped from SEC EDGAR submissions and persisted on
CommonStock. - "Current + Combined" date selector in the Holdings tab, showing a merged
view of the latest quarterly data set and any realtime filings since. - 13F filing type (
COVER PAGE,HOLDINGS,AMENDMENT) parsed and stored
onInstitutionalHolding. - Many new end-user guide pages (
docs/guide/): tutorials, how-tos, and FAQ entries.
Changed
- Institution name matching prefers the shortest match to avoid subsidiary
collisions (e.g. "BlackRock" now resolves to "BlackRock, Inc." instead of
"BlackRock Advisors LLC"). - Insider search tokenizes queries so "First Last" order matches "Last First"
names in the database. GetShortInterestSnapshotexcludes stocks with zero average daily volume
(previously dominated results with capped days-to-cover of 1000).- 13F holdings import runs incrementally instead of batching.
<cn>tag helper renamed to<compactable-number>for clarity.- Company name normalization handles common abbreviations (Inc → Inc.,
Corp → Corp., Ltd → Ltd., etc.), higher roman numerals (IV–X), and
parenthesized abbreviations. - Duplicated MCP date-parsing logic extracted into
McpToolExecutor.ParseDateOr. - Repeated "stock not found" MCP responses extracted into
McpToolExecutor.StockNotFound. - SEC MCP
DocumentTextToolsmigrated toMcpToolRunner, matching the
Execute / ReportError pattern used by the other MCP tool groups. - LIKE metacharacter escaping extracted into shared
LikePatternhelper. - Repeated empty-table-row markup extracted into a shared
EmptyTableRowTagHelper. - Screener CSV export migrated to the shared
CsvExportServiceinstead of
hand-rolling its own writer. - Vite bundles wrapped in IIFE to prevent global scope collision;
bundle.js
loaded as ES module. - Chart.js split into a separate bundle loaded only on chart pages.
- Response compression (Brotli + Gzip) enabled.
- Cache-Control headers added for static assets.
- Unused Inter font weight 300 dropped.
Fixed
- Cold-start race on a fresh DB volume — the compose healthcheck now forces a
TCP probe instead of a Unix-socket probe, so it only flips healthy after
ParadeDB's init phase finishes and the real TCP listener is up. The web
host also retriesDatabase.MigrateAsyncon transient connection failures. FiscalPeriodResolver.Resolveguarded against year-underflow onAddYears(-1).FiscalPeriodResolver.CreateSafeguarded against year overflow past 9999.FiscalCalendar.GetPeriodguarded against fiscal year overflow past 9999.FiscalCalendar.GetQuarterEndDateguarded against calendar year underflow.SyncDateResolver.Resolveclamped toDateOnly.MaxValueon overflow.ParseDataSetEndDatevalidates year range beforeDaysInMonthcall.TryParseDatePartvalidates day-of-month beforeDateOnlyconstruction.HoldingsBacktestCalculatorclamps backtest horizon toDateOnly.MaxValue.HoldingsBacktestCalculatorrebalance date overflow pastDateOnly.MaxValueclamped.Truncateguards againstIndexOutOfRangeExceptionwhenmaxLengthis 0 or negative.Truncateno longer splits surrogate pairs.ErrorManager.Truncateuses surrogate-pair-safe boundary handling.- Holdings position grouper classifies 0-shares-both-quarters as Unchanged, not New.
- Bank fund classifier matches
BANKas the last word (not just mid-string). InsiderTradingTools.GetRolehandles empty and whitespace-onlyOfficerTitle.FinancialConceptAliases.Normalizecollapses spaced ampersands (&→&).- VIX put/call CSV column mapping corrected.
- FINRA API date formatting uses
InvariantCulture. - SEC
GetDailyIndexURL date formatting usesInvariantCulture. Realtime13FArchiveBuilderdate formatting usesInvariantCulture.HoldingsDataSetClient.FormatDatePartusesInvariantCulturefor year.- CIK leading zeros normalized in the 13F TSV import path.
- Realtime 13F lookback computed dynamically from last quarterly data set.
ProcessedDataSetRepositoryregistered inDoWorkintegration test.- Holdings integration test CIKs aligned with
TrimStart('0')normalization. - Congress
Truncatehandles negativemaxLength. - Empty-state message added when no economic indicators are imported.
- 13F import respects
NEW HOLDINGSamendment type (was silently treated
as a regular filing). FiscalYearEndMonthinferred from 10-K filing date when SEC EDGAR
metadata is null.FiscalYearEndMonthinferred from 20-F / 40-F for foreign filers
(previously only 10-K was checked).- Fiscal year-end day validated against its month (e.g., day 31 rejected
for months with fewer days). - Filer-universe query narrowed to only gap holders.
ParseTransactionCodetrims input so whitespace-padded SEC transaction
codes resolve to the correctTransactionCodeenum value.ParseBooltrims input so whitespace-padded SEC boolean strings
("true ", " false") are interpreted correctly.SafeRoundguards against thedecimal.MaxValueboundary instead of
throwing on rounding overflow.- House PTR PDF parser joins multi-line transaction entries so the asset
name, ticker/dates, and amount land on a single transaction instead of
three partial rows. - 13F-HR import aggregates same-key rows across the whole filing instead
of flushing every 1000 unique keys. When a filer split a position
acrossotherManagercodes the matching rows could fall in different
batches; the upsert'sWhenMatchedclause REPLACED the persisted row,
so only the last batch's slice survived (Vanguard's Q4 2025 AAPL came
out as 39M shares instead of 1.43B). The import now flushes at the
accession boundary, which SEC guarantees is contiguous in both the
bulk INFOTABLE and the realtime archive. StocksController.ParsePositionTypesgates parsed values with
Enum.IsDefinedso numeric query input with no matching
PositionChangeTypemember (e.g.?types=999) is rejected the same
as an unrecognised name, preventing a polluted filter set from
round-tripping into rendered toggle URLs on the holdings tab.CompanySyncService.NormalizeCompanyNameno longer treats the short English
words MIX, DIV, LIV, and CIV as Roman numerals — they decompose as 1009,
504, 54, and 104 respectively but aren't numerals in a company-name context.
An explicit deny-list rejects exactly those four tokens, so other short
numerals that use L/C/D/M (XL=40, XC=90, CD=400, CM=900, XLI=41, XLV=45,
MII=1002) keep working alongside the pure-I/V/X cases.
Security Fixes
- Authflow cooldowns now session-scoped — closes abuse vector where users changed phone/email mid-flow to reset OTP cooldowns
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About daniel3303/Equibles](https:
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]