v1.3.8

1.3.8 (2026-04-30)

Bug Fixes

• deps: relax aiohttp constraint to >=3.13.4 for litellm compatibility (34ab192)
• qlib: correct indentation in except blocks in quant_proposal and factor_runner (8143451)
• security: replace eval() with ast.literal_eval in finetune validator (B307) (0508caf)
• security: replace shell=True subprocess calls with list args in env.py (B602) (2012d5a)
• security: resolve path-injection and add nosec for safe temp paths (B108, py/path-injection) (6727480)