This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
ReleasePort's take
Moderate signalVersion v0.2.5 of TradingAgents fixes a ticker path‑traversal vulnerability and adds several bugfixes and feature enhancements.
Why it matters: Patch to v0.2.5 immediately because the release resolves a critical path‑traversal security flaw (Ticker validation added).
Summary
AI summaryFixed a ticker path-traversal vulnerability.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Grounded Sentiment Analyst reads real Yahoo News, StockTwits, Reddit data. Grounded Sentiment Analyst reads real Yahoo News, StockTwits, Reddit data. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Qwen/GLM/MiniMax dual-region support with separate API keys. Qwen/GLM/MiniMax dual-region support with separate API keys. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Remote Ollama support via OLLAMA_BASE_URL. Remote Ollama support via OLLAMA_BASE_URL. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Configurable alpha benchmarks for non-US tickers (e.g., .NS, .T). Configurable alpha benchmarks for non-US tickers (e.g., .NS, .T). Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
News-fetch parameters exposed via DEFAULT_CONFIG. News-fetch parameters exposed via DEFAULT_CONFIG. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
TRADINGAGENTS_* env vars configure agent with auto-detect API keys. TRADINGAGENTS_* env vars configure agent with auto-detect API keys. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
output_language propagates to all user-facing agents. output_language propagates to all user-facing agents. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
TRADINGAGENTS_* environment variables override config settings with type-aware coercion and auto-detect missing API keys. TRADINGAGENTS_* environment variables override config settings with type-aware coercion and auto-detect missing API keys. Source: granite4.1:30b@2026-05-24-audit Confidence: low |
— |
| Bugfix | Medium |
pip install . now picks up project .env for CLI as console script. pip install . now picks up project .env for CLI as console script. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Ticker prompt preserves exchange suffixes (.SH, .SZ, etc.). Ticker prompt preserves exchange suffixes (.SH, .SZ, etc.). Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Config state no longer leaks between runs when sub-dicts are mutated. Config state no longer leaks between runs when sub-dicts are mutated. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Missing-API-key error specifies exact env var to set. Missing-API-key error specifies exact env var to set. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Ticker path-traversal validation added at every filesystem-path site. Ticker path-traversal validation added at every filesystem-path site. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Reports now save end-to-end without dropped streamed chunks. Reports now save end-to-end without dropped streamed chunks. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Docker permission errors no longer block first-run write to ~/.tradingagents/ Docker permission errors no longer block first-run write to ~/.tradingagents/ Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
"max_recur_limit" config now applies to the propagator. "max_recur_limit" config now applies to the propagator. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Missing API‑key errors specify the exact environment variable that must be set. Missing API‑key errors specify the exact environment variable that must be set. Source: granite4.1:30b@2026-05-24-audit Confidence: low |
— |
| Refactor | Medium |
Quieter startup — suppressed upstream langgraph-checkpoint deprecation warning. Quieter startup — suppressed upstream langgraph-checkpoint deprecation warning. Source: llm_adapter@2026-05-21 Confidence: low |
— |
Full changelog
Summary
TradingAgents v0.2.5 ships the grounded Sentiment Analyst, Qwen/GLM/MiniMax dual-region support, `TRADINGAGENTS_*` env-var configurability with API-key auto-detection, remote Ollama support, configurable alpha benchmarks for non-US tickers, and a ticker path-traversal fix.
Sentiment Analyst
The renamed Sentiment Analyst now reads real Yahoo News, StockTwits, and Reddit data before generating its report, replacing the prior flow that could fabricate social posts under prompt pressure. The new name flows through the CLI dropdown, status panel, and final reports; `AnalystType.SOCIAL = "social"` is kept for saved-config back-compat.
Provider Coverage
- MiniMax with the full M2.x catalog (204K context), plus dual-region Global (`MINIMAX_API_KEY`) and China (`MINIMAX_CN_API_KEY`).
- Dual-region Qwen and GLM with separate keys per region (`DASHSCOPE_`, `ZHIPU_`), chosen via a secondary region prompt so the main provider dropdown stays clean.
- Catalog refresh across every provider: GPT-5.5 frontier, Claude Opus 4.7, Gemini 3.1 Flash-Lite GA, Grok 4.20, Qwen 3.6 line. Versioned IDs only; auto-shifting aliases moved to a "Custom model ID" option.
- Structured output now works on DeepSeek V4 / reasoner and MiniMax M2.x — those providers reject `tool_choice`; the binding flow now skips it automatically.
Configuration via Environment
`TRADINGAGENTS_*` env vars override `DEFAULT_CONFIG` keys with type-aware coercion (string / int / bool) — `llm_provider`, deep/quick model IDs, `backend_url`, `output_language`, debate-round counts, the checkpoint flag, and the benchmark ticker. When a selected provider's API key is missing, the CLI prompts for it and persists the value to `.env` so the run continues without restart.
Ollama
`OLLAMA_BASE_URL` makes remote `ollama-serve` first-class for both the CLI and programmatic users. The CLI prints the resolved endpoint after selecting Ollama and warns on common malformed inputs. A new "Custom model ID" option lets users pick any model they have pulled via `ollama pull`.
Reflection
Alpha is now computed against a regional benchmark for non-US tickers — `.NS` (^NSEI), `.T` (^N225), `.HK` (^HSI), `.L` (^FTSE), `.TO` (^GSPTSE), `.AX` (^AXJO), `.BO` (^BSESN), SPY for US listings. Eliminates FX drift dominating the alpha figure for non-USD listings. `benchmark_ticker` overrides the suffix map when set explicitly.
News-fetch parameters (per-ticker article limit, macro headline limit, lookback window, macro search queries) are now exposed via `DEFAULT_CONFIG` for strategy-specific tuning.
Multi-language
`output_language` now propagates to every user-facing agent — researchers, risk debators, research manager, and trader — ending the previous partial-localization reports where only analysts and the portfolio manager respected the setting.
Fixes
- Security: ticker path-traversal validation at every filesystem-path site.
- `pip install .` installations now pick up the project `.env` when running the CLI as a console script.
- Reports save end-to-end — streamed chunks were previously dropped from `complete_report.md`.
- Ticker prompt preserves exchange suffixes (`.SH`, `.SZ`, `.SS`, `.HK`, `.T`, etc.).
- Docker permission errors no longer block first-run write to `~/.tradingagents/`.
- Config state no longer leaks between runs when sub-dicts are mutated.
- `max_recur_limit` config actually applies to the propagator.
- Missing-API-key error names the exact env var to set.
- Quieter startup — suppressed the noisy upstream langgraph-checkpoint deprecation warning.
See CHANGELOG.md for the full per-item list with PR / issue references.
Security Fixes
- Ticker path-traversal validation fixed at every filesystem-path site
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About TradingAgents
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]