Release 1.224.0

See release notes.

Author: cjdsellers

.config/nextest.toml

@@ -15,10 +15,10 @@ slow-timeout = { period = "300s" }
 
 # Tests that download large data files share the same target paths across binaries
 [[profile.default.overrides]]
-filter = 'binary(grid_mm_itch) | binary(orderbook_integration)'
+filter = 'binary(grid_mm_itch) | binary(backtest_node_itch) | binary(orderbook_integration)'
 test-group = 'large-data-tests'
 
-# Websocket tests can be flaky due to timing on low-spec runners, give them extra retries
+# Websocket and data client tests can be flaky due to timing on low-spec runners
 [[profile.default.overrides]]
-filter = 'binary(websocket)'
+filter = 'binary(websocket) | binary(data_client)'
 retries = 3

.github/OVERVIEW.md

@@ -12,6 +12,7 @@ CI/CD, testing, publishing, and automation within the NautilusTrader repository.
 - **common-setup**: prepares the environment (OS packages, Rust toolchain, Python, sccache, pre-commit).
 - **common-test-data**: caches large test data under `tests/test_data/large`.
 - **common-wheel-build**: builds and installs Python wheels across Linux, macOS, and Windows for multiple Python versions.
+- **install-capnp**: installs the Cap'n Proto compiler with caching across Linux, macOS, and Windows.
 - **publish-wheels**: publishes built wheels to Cloudflare R2, manages old wheel cleanup and index generation.
 - **upload-artifact-wheel**: uploads the latest wheel artifact to GitHub Actions.
 
@@ -24,9 +25,12 @@ CI/CD, testing, publishing, and automation within the NautilusTrader repository.
 - **codeql-analysis.yml**: CodeQL security scans for Python and Rust on PRs and via cron.
 - **copilot-setup-steps.yml**: environment setup for GitHub Copilot coding agent.
 - **coverage.yml**: coverage report generation for the `nightly` branch.
-- **docker.yml**: builds and pushes Docker images (`nautilus_trader`, `jupyterlab`) using Buildx and QEMU.
+- **docker.yml**: builds and pushes multi-platform Docker images (`nautilus_trader`, `jupyterlab`) using Buildx and native ARM runners.
+- **nightly-docs-features-check.yml**: nightly docs.rs build checks and crate feature compatibility verification.
 - **nightly-merge.yml**: auto-merges `develop` into `nightly` when CI succeeds.
+- **nightly-tests.yml**: extended test suites (turmoil network tests) that are too slow for PR builds.
 - **performance.yml**: Rust/Python benchmarks on `nightly`, reporting to CodSpeed.
+- **security-audit.yml**: nightly supply chain security checks (cargo-audit, cargo-deny, cargo-vet, osv-scanner).
 - **trigger-reindexing.yml**: triggers documentation reindexing for search.
 
 ## Security

.github/actions/cargo-tool-install/action.yml

@@ -38,7 +38,7 @@ runs:
 
     # https://github.com/actions/cache
     - name: Cache tool binary
-      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: ${{ runner.tool_cache }}/${{ inputs.tool-name }}
         key: ${{ inputs.tool-name }}-bin-${{ env.TOOL_VERSION }}-${{ runner.os }}-${{ env.TOOLCHAIN }}

.github/actions/common-setup/action.yml

@@ -32,13 +32,32 @@ runs:
         docker-images: true
         swap-storage: ${{ inputs.build-type != 'pre-commit' }}
 
+    - name: Free disk space (macOS)
+      if: inputs.free-disk-space == 'true' && runner.os == 'macOS'
+      shell: bash
+      run: |
+        echo "=== Disk usage before cleanup ==="
+        df -h /
+        sudo rm -rf /Library/Developer/CoreSimulator || true
+        sudo rm -rf ~/Library/Android || true
+        sudo rm -rf /usr/local/share/dotnet || true
+        sudo rm -rf /usr/local/share/powershell || true
+        sudo rm -rf /usr/local/.ghcup || true
+        echo "=== Disk usage after cleanup ==="
+        df -h /
+
     - name: Free disk space (Windows)
       if: inputs.free-disk-space == 'true' && runner.os == 'Windows'
       shell: bash
       env:
         BUILD_TYPE: ${{ inputs.build-type }}
       run: |
         rm -rf "/c/Program Files/dotnet"
+        rm -rf "/c/Android"
+        rm -rf /c/hostedtoolcache/windows/Java_*
+        rm -rf "/c/hostedtoolcache/windows/CodeQL"
+        rm -rf "/c/Miniconda"
+        rm -rf "/c/Strawberry"
         if [ "$BUILD_TYPE" != "pre-commit" ]; then
           rm -rf "/c/Program Files (x86)/Microsoft Visual Studio/2019"
         fi
@@ -82,7 +101,7 @@ runs:
     - name: Install cargo-nextest
       if: inputs.build-type != 'pre-commit'
       # https://github.com/taiki-e/install-action # v2.53.2
-      uses: taiki-e/install-action@59679e24ffb0dbbbc136684eda7fcd21fe9eddea # v2.63.0
+      uses: taiki-e/install-action@f176c07a0a40cbfdd08ee9aa8bf1655701d11e69 # v2.67.25
       with:
         tool: nextest
 
@@ -128,7 +147,7 @@ runs:
     # > Python
     - name: Set up Python environment
       # https://github.com/actions/setup-python
-      uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: ${{ inputs.python-version }}
 
@@ -150,7 +169,7 @@ runs:
     - name: Cache Python site-packages
       id: cached-site-packages
       # https://github.com/actions/cache
-      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: ~/.local/lib/python${{ inputs.python-version }}/site-packages
         key: ${{ runner.os }}-${{ inputs.python-version }}-site-packages
@@ -170,7 +189,7 @@ runs:
 
     - name: Install uv
       # https://github.com/astral-sh/setup-uv
-      uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
+      uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
       with:
         version: ${{ env.UV_VERSION }}
 
@@ -185,7 +204,7 @@ runs:
       if: runner.os != 'macOS'
       id: cached-uv
       # https://github.com/actions/cache
-      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: ${{ env.UV_CACHE_DIR }}
         key: ${{ runner.os }}-${{ env.PYTHON_VERSION }}-uv-${{ hashFiles('**/uv.lock') }}
@@ -198,7 +217,7 @@ runs:
       if: runner.os != 'macOS'
       id: cached-pre-commit
       # https://github.com/actions/cache
-      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: ~/.cache/pre-commit
         key: ${{ runner.os }}-${{ env.PYTHON_VERSION }}-pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}

.github/actions/common-test-data/action.yml

@@ -10,7 +10,7 @@ runs:
       if: runner.os != 'macOS'
       id: cached-testdata-large
       # https://github.com/actions/cache/tree/main/restore
-      uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+      uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: tests/test_data/large
         key: large-files-${{ hashFiles('tests/test_data/large/checksums.json') }}
@@ -22,7 +22,7 @@ runs:
       # See: https://github.com/actions/runner/issues/3765
       if: ${{ runner.os != 'macOS' && always() && steps.cached-testdata-large.outputs.cache-hit != 'true' }}
       # https://github.com/actions/cache/tree/main/save
-      uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+      uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: tests/test_data/large
         key: large-files-${{ hashFiles('tests/test_data/large/checksums.json') }}

.github/actions/install-capnp/action.yml

@@ -33,7 +33,7 @@ runs:
     - name: Cache Cap'n Proto (Linux)
       if: runner.os == 'Linux'
       id: cache-capnp
-      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: ${{ github.workspace }}/.cache/capnp
         key: capnp-linux-${{ steps.linux-version.outputs.release }}-${{ env.CAPNP_VERSION }}-${{ runner.arch }}

.github/workflows/build-docs.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # https://github.com/step-security/harden-runner
-      - uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+      - uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
         with:
           egress-policy: audit
 

.github/workflows/build-v2.yml

@@ -23,12 +23,12 @@ jobs:
   pre-commit:
     runs-on: ubuntu-22.04  # glibc 2.35 – larger runtime range
     steps:
-      - uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+      - uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -87,12 +87,12 @@ jobs:
     # yamllint enable rule:line-length
 
     steps:
-      - uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+      - uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -162,15 +162,15 @@ jobs:
       CLOUDFLARE_R2_BUCKET_NAME: "packages"
       CLOUDFLARE_R2_PREFIX: "v2/simple/nautilus-trader"
     steps:
-      - uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+      - uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
         with:
           egress-policy: audit
           allowed-endpoints: |
             ${{ vars.COMMON_ALLOWED_ENDPOINTS }}
             ${{ secrets.CLOUDFLARE_R2_ALLOWED_HOST }}:443
 
       - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -183,7 +183,7 @@ jobs:
 
       # https://github.com/actions/attest-build-provenance
       - name: Attest wheel provenance
-        uses: actions/attest-build-provenance@46a583fd92dfbf46b772907a9740f888f4324bb9 # v3.1.0
+        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
         with:
           subject-path: 'dist/*.whl'