Skip to content

TradingAgents

v0.2.5 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

agent finance llm multiagent trading

ReleasePort's take

Moderate signal
editorial:auto 13d

Version v0.2.5 of TradingAgents fixes a ticker path‑traversal vulnerability and adds several bugfixes and feature enhancements.

Why it matters: Patch to v0.2.5 immediately because the release resolves a critical path‑traversal security flaw (Ticker validation added).

Summary

AI summary

Fixed a ticker path-traversal vulnerability.

Changes in this release

Feature Medium

Grounded Sentiment Analyst reads real Yahoo News, StockTwits, Reddit data.

Grounded Sentiment Analyst reads real Yahoo News, StockTwits, Reddit data.

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Qwen/GLM/MiniMax dual-region support with separate API keys.

Qwen/GLM/MiniMax dual-region support with separate API keys.

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Remote Ollama support via OLLAMA_BASE_URL.

Remote Ollama support via OLLAMA_BASE_URL.

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

Configurable alpha benchmarks for non-US tickers (e.g., .NS, .T).

Configurable alpha benchmarks for non-US tickers (e.g., .NS, .T).

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

News-fetch parameters exposed via DEFAULT_CONFIG.

News-fetch parameters exposed via DEFAULT_CONFIG.

Source: llm_adapter@2026-05-21

Confidence: high

Feature Medium

TRADINGAGENTS_* env vars configure agent with auto-detect API keys.

TRADINGAGENTS_* env vars configure agent with auto-detect API keys.

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

output_language propagates to all user-facing agents.

output_language propagates to all user-facing agents.

Source: llm_adapter@2026-05-21

Confidence: low

Feature Medium

TRADINGAGENTS_* environment variables override config settings with type-aware coercion and auto-detect missing API keys.

TRADINGAGENTS_* environment variables override config settings with type-aware coercion and auto-detect missing API keys.

Source: granite4.1:30b@2026-05-24-audit

Confidence: low

Bugfix Medium

pip install . now picks up project .env for CLI as console script.

pip install . now picks up project .env for CLI as console script.

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Ticker prompt preserves exchange suffixes (.SH, .SZ, etc.).

Ticker prompt preserves exchange suffixes (.SH, .SZ, etc.).

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Config state no longer leaks between runs when sub-dicts are mutated.

Config state no longer leaks between runs when sub-dicts are mutated.

Source: llm_adapter@2026-05-21

Confidence: high

Bugfix Medium

Missing-API-key error specifies exact env var to set.

Missing-API-key error specifies exact env var to set.

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Ticker path-traversal validation added at every filesystem-path site.

Ticker path-traversal validation added at every filesystem-path site.

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Reports now save end-to-end without dropped streamed chunks.

Reports now save end-to-end without dropped streamed chunks.

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Docker permission errors no longer block first-run write to ~/.tradingagents/

Docker permission errors no longer block first-run write to ~/.tradingagents/

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

"max_recur_limit" config now applies to the propagator.

"max_recur_limit" config now applies to the propagator.

Source: llm_adapter@2026-05-21

Confidence: low

Bugfix Medium

Missing API‑key errors specify the exact environment variable that must be set.

Missing API‑key errors specify the exact environment variable that must be set.

Source: granite4.1:30b@2026-05-24-audit

Confidence: low

Refactor Medium

Quieter startup — suppressed upstream langgraph-checkpoint deprecation warning.

Quieter startup — suppressed upstream langgraph-checkpoint deprecation warning.

Source: llm_adapter@2026-05-21

Confidence: low

Full changelog

Summary

TradingAgents v0.2.5 ships the grounded Sentiment Analyst, Qwen/GLM/MiniMax dual-region support, `TRADINGAGENTS_*` env-var configurability with API-key auto-detection, remote Ollama support, configurable alpha benchmarks for non-US tickers, and a ticker path-traversal fix.

Sentiment Analyst

The renamed Sentiment Analyst now reads real Yahoo News, StockTwits, and Reddit data before generating its report, replacing the prior flow that could fabricate social posts under prompt pressure. The new name flows through the CLI dropdown, status panel, and final reports; `AnalystType.SOCIAL = "social"` is kept for saved-config back-compat.

Provider Coverage

  • MiniMax with the full M2.x catalog (204K context), plus dual-region Global (`MINIMAX_API_KEY`) and China (`MINIMAX_CN_API_KEY`).
  • Dual-region Qwen and GLM with separate keys per region (`DASHSCOPE_`, `ZHIPU_`), chosen via a secondary region prompt so the main provider dropdown stays clean.
  • Catalog refresh across every provider: GPT-5.5 frontier, Claude Opus 4.7, Gemini 3.1 Flash-Lite GA, Grok 4.20, Qwen 3.6 line. Versioned IDs only; auto-shifting aliases moved to a "Custom model ID" option.
  • Structured output now works on DeepSeek V4 / reasoner and MiniMax M2.x — those providers reject `tool_choice`; the binding flow now skips it automatically.

Configuration via Environment

`TRADINGAGENTS_*` env vars override `DEFAULT_CONFIG` keys with type-aware coercion (string / int / bool) — `llm_provider`, deep/quick model IDs, `backend_url`, `output_language`, debate-round counts, the checkpoint flag, and the benchmark ticker. When a selected provider's API key is missing, the CLI prompts for it and persists the value to `.env` so the run continues without restart.

Ollama

`OLLAMA_BASE_URL` makes remote `ollama-serve` first-class for both the CLI and programmatic users. The CLI prints the resolved endpoint after selecting Ollama and warns on common malformed inputs. A new "Custom model ID" option lets users pick any model they have pulled via `ollama pull`.

Reflection

Alpha is now computed against a regional benchmark for non-US tickers — `.NS` (^NSEI), `.T` (^N225), `.HK` (^HSI), `.L` (^FTSE), `.TO` (^GSPTSE), `.AX` (^AXJO), `.BO` (^BSESN), SPY for US listings. Eliminates FX drift dominating the alpha figure for non-USD listings. `benchmark_ticker` overrides the suffix map when set explicitly.

News-fetch parameters (per-ticker article limit, macro headline limit, lookback window, macro search queries) are now exposed via `DEFAULT_CONFIG` for strategy-specific tuning.

Multi-language

`output_language` now propagates to every user-facing agent — researchers, risk debators, research manager, and trader — ending the previous partial-localization reports where only analysts and the portfolio manager respected the setting.

Fixes

  • Security: ticker path-traversal validation at every filesystem-path site.
  • `pip install .` installations now pick up the project `.env` when running the CLI as a console script.
  • Reports save end-to-end — streamed chunks were previously dropped from `complete_report.md`.
  • Ticker prompt preserves exchange suffixes (`.SH`, `.SZ`, `.SS`, `.HK`, `.T`, etc.).
  • Docker permission errors no longer block first-run write to `~/.tradingagents/`.
  • Config state no longer leaks between runs when sub-dicts are mutated.
  • `max_recur_limit` config actually applies to the propagator.
  • Missing-API-key error names the exact env var to set.
  • Quieter startup — suppressed the noisy upstream langgraph-checkpoint deprecation warning.

See CHANGELOG.md for the full per-item list with PR / issue references.

Security Fixes

  • Ticker path-traversal validation fixed at every filesystem-path site

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track TradingAgents

Get notified when new releases ship.

Sign up free

About TradingAgents

All releases →

Beta — feedback welcome: [email protected]