Release 1.230.0

See release notes.

Author: cjdsellers

.cargo/audit.toml

@@ -20,7 +20,7 @@ ignore = [
   "RUSTSEC-2025-0090",
   "RUSTSEC-2025-0098",
   "RUSTSEC-2025-0100",
-  # bincode unmaintained, transitive via hypersync-client
+  # bincode unmaintained, dev-only via madsim
   "RUSTSEC-2025-0141",
   # capnp unsound APIs, transitive via hypersync-client, awaiting upstream fix
   "RUSTSEC-2025-0143",

.codespellrc

@@ -3,4 +3,4 @@
 
 [codespell]
 # Comma-separated list of words to ignore
-ignore-words-list = ACN,ALO,Alo,allTime,BadAloPx,CapTable,arange,crate,datas,deques,disjointness,HIGHTER,Implementors,intoto,ot,pre,ser,socio-economic,Superseed,SUPERSEED,te,ThirdParty,trough,usIn,zar
+ignore-words-list = ACN,ALO,Alo,allTime,BadAloPx,CapTable,arange,crate,datas,deques,disjointness,FO,HIGHTER,Implementors,intoto,ot,pre,ser,socio-economic,Superseed,SUPERSEED,te,ThirdParty,trough,usIn,zar

.docker/DockerfileUbuntu

@@ -50,7 +50,7 @@ ENV CARGO_HOME="/usr/local/cargo" \
 WORKDIR /workspace
 
 # Install uv
-COPY --from=ghcr.io/astral-sh/uv:0.11.23@sha256:d0a0a753ab981624b49c97abc98821c1c09f4ca69d1ef5cee69c501be3d88479 \
+COPY --from=ghcr.io/astral-sh/uv:0.11.25@sha256:1e3808aa9023d0980e7c15b1fa7c1ac16ff35925780cf5c459858b2d693f01a9 \
   /uv /uvx /root/.local/bin/
 ENV PATH="/root/.local/bin:${PATH}"
 

.docker/jupyterlab.dockerfile

@@ -29,7 +29,7 @@ RUN curl -fsSL --retry 3 \
     mv /tmp/eurusd_instrument.parquet /catalog/data/currency_pair/EURUSD.SIM/part-0.parquet
 
 # Install UV
-COPY --from=ghcr.io/astral-sh/uv:0.11.23@sha256:d0a0a753ab981624b49c97abc98821c1c09f4ca69d1ef5cee69c501be3d88479 \
+COPY --from=ghcr.io/astral-sh/uv:0.11.25@sha256:1e3808aa9023d0980e7c15b1fa7c1ac16ff35925780cf5c459858b2d693f01a9 \
   /uv /uvx /root/.local/bin/
 
 RUN uv pip install --system jupyterlab datafusion

.docker/nautilus_trader.dockerfile

@@ -31,7 +31,7 @@ COPY --from=rust-toolchain /usr/local/cargo /usr/local/cargo
 COPY --from=rust-toolchain /usr/local/rustup /usr/local/rustup
 
 # Install UV
-COPY --from=ghcr.io/astral-sh/uv:0.11.23@sha256:d0a0a753ab981624b49c97abc98821c1c09f4ca69d1ef5cee69c501be3d88479 \
+COPY --from=ghcr.io/astral-sh/uv:0.11.25@sha256:1e3808aa9023d0980e7c15b1fa7c1ac16ff35925780cf5c459858b2d693f01a9 \
   /uv /uvx /root/.local/bin/
 
 # Install package requirements

.github/OVERVIEW.md

@@ -24,10 +24,10 @@ CI/CD, testing, publishing, and automation within the NautilusTrader repository.
 
 - **build.yml**: main CI pipeline - plan, pre-commit, cargo-deny, Rust tests, Python tests,
   wheel builds, artifact uploads, release asset uploads, Trusted Publishing to PyPI and crates.io,
-  release attestations, registry verification, release checksum publication, and final GitHub
-  release publication and attestation verification. Uses Depot 8-core runners for Linux and Windows
-  builds. Includes a plan step that skips builds on docs-only changes and skips Rust tests on
-  Python-only changes.
+  release preflights, release attestations, registry verification, release checksum publication,
+  final release asset verification, and final GitHub release publication and attestation
+  verification. Uses Depot 8-core runners for Linux and Windows builds. Includes a plan step that
+  skips builds on docs-only changes and skips Rust tests on Python-only changes.
 - **build-v2.yml**: CI pipeline for the v2 Rust-native system. Runs Linux builds on the self-hosted `build-v2` pool.
 - **build-docs.yml**: dispatches documentation build on `master` and `nightly` pushes.
 - **cli-binaries.yml**: builds and publishes CLI binaries for multiple platforms.
@@ -108,17 +108,18 @@ CI/CD, testing, publishing, and automation within the NautilusTrader repository.
   OIDC trusted publishing. The trusted publisher on crates.io must be configured per crate for
   repo `nautechsystems/nautilus_trader`, workflow `build.yml`, and environment `release`; the
   job uses a short-lived token from `rust-lang/crates-io-auth-action` and no long-lived cargo token.
-- **Post-publish verification**: `publish-release-integrity` verifies PyPI files against
-  `dist-manifest.json`, verifies PyPI provenance publisher metadata, and verifies crates.io entries
-  were trusted-published by this repository. These verifier calls retry transient
-  Sigstore/Rekor/TUF lag, while provenance and identity mismatches fail fast. The job records
-  whether each crate matches the release commit, was already published, or matched an explicit
-  `CRATES_IO_MANUAL_PUBLISH_EXCEPTIONS` `crate@version` entry for emergency token-publish
-  recovery. Manual entries are recorded in `crates-manifest.json` with
+- **Post-publish verification**: `publish-release-integrity` generates the release manifest, then
+  verifies PyPI files against `dist-manifest.json`, verifies PyPI provenance publisher metadata, and
+  verifies crates.io entries were trusted-published by this repository before attaching checksum
+  assets to the draft release. These verifier calls retry transient Sigstore/Rekor/TUF lag, while
+  provenance and identity mismatches fail fast. The job records whether each crate matches the
+  release commit, was already published, or matched an explicit
+  `CRATES_IO_MANUAL_PUBLISH_EXCEPTIONS` `crate@version` entry for emergency token-publish recovery.
+  Manual entries are recorded in `crates-manifest.json` with
   `release_status: "manual_token_publish"`. Malformed or unused exception entries fail the job. The
   job uploads `crates-manifest.json`, attaches attestation siblings, and cleans up release workflow
-  artifacts. `publish-github-release` then publishes the draft release and verifies GitHub's
-  release attestation.
+  artifacts. `publish-github-release` verifies the final draft asset set, publishes the draft
+  release, and verifies GitHub's release attestation.
 - **Caching**: Rust target directory cache (`Swatinem/rust-cache`), prek hook environments, and test
   data caches speed up workflows while preserving hermetic builds. Rust cache saves are restricted
   to push events to prevent PR cache pollution.

.github/actions/cargo-tool-install/action.yml

@@ -31,7 +31,7 @@ runs:
 
     # https://github.com/actions-rust-lang/setup-rust-toolchain
     - name: Set up Rust toolchain
-      uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
+      uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
       with:
         toolchain: ${{ env.TOOLCHAIN }}
         override: true

.github/actions/common-setup/action.yml

@@ -78,6 +78,30 @@ runs:
         docker-images: true
         swap-storage: true
 
+    # Extra unused SDKs beyond jlumbroso; only GitHub-hosted runners are disk-bound
+    - name: Free additional disk space (Linux)
+      if: >-
+        inputs.free-disk-space == 'true'
+        && runner.os == 'Linux'
+        && runner.environment == 'github-hosted'
+      shell: bash
+      run: |
+        echo "=== Disk usage before extra cleanup ==="
+        df -h /
+        for path in \
+          /usr/share/swift \
+          /usr/local/lib/swift \
+          /usr/local/share/powershell \
+          /usr/local/share/boost \
+          /usr/local/share/chromium \
+          /opt/google/chrome \
+          /opt/microsoft \
+          /usr/local/julia*; do
+          sudo rm -rf $path || true
+        done
+        echo "=== Disk usage after extra cleanup ==="
+        df -h /
+
     - name: Free disk space (macOS)
       if: inputs.free-disk-space == 'true' && runner.os == 'macOS'
       shell: bash
@@ -155,7 +179,7 @@ runs:
 
     # https://github.com/actions-rust-lang/setup-rust-toolchain
     - name: Set up Rust toolchain
-      uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
+      uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
       with:
         toolchain: ${{ env.TOOLCHAIN }}
         components: clippy,rustfmt
@@ -186,7 +210,7 @@ runs:
     - name: Install cargo-nextest
       if: inputs.build-type != 'pre-commit' && runner.os != 'macOS'
       # https://github.com/taiki-e/install-action
-      uses: taiki-e/install-action@db5fb34fa772531a3ece57ca434f579eb334e0fb # v2.75.30
+      uses: taiki-e/install-action@7a79fe8c3a13344501c80d99cae481c1c9085912 # v2.81.10
       with:
         tool: cargo-nextest@${{ env.CARGO_NEXTEST_VERSION }}
 
@@ -249,7 +273,7 @@ runs:
 
     - name: Install uv
       # https://github.com/astral-sh/setup-uv
-      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
       with:
         version: ${{ env.UV_VERSION }}
         enable-cache: ${{ inputs.uv-cache-enabled }}

.github/actions/upload-artifact-wheel/action.yml

@@ -1,6 +1,12 @@
 name: Upload wheel artifact to GitHub Actions
 description: Upload wheel artifact to GitHub Actions
 
+inputs:
+  retention-days:
+    description: Number of days to retain the uploaded wheel artifact
+    required: false
+    default: "1"
+
 runs:
   using: "composite"
   steps:
@@ -40,4 +46,4 @@ runs:
         name: ${{ env.ASSET_NAME }}
         path: dist/nautilus_trader-*.whl
         if-no-files-found: error
-        retention-days: 1
+        retention-days: ${{ inputs.retention-days }}

.github/workflows/build-docs.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # https://github.com/step-security/harden-runner
-      - uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: ${{ vars.STEP_SECURITY_EGRESS_POLICY || 'block' }}
           allowed-endpoints: >-