[johnnygreco]

The October 25 NSpect scan flagged 8 vulnerable packages. Five ship in the Reachy Mini demo's locked dependencies and now upgrade to fixed releases. The other three have no installable fix: GStreamer's fixed release cannot install on macOS yet, and the two Go modules are already at their latest releases.

Project	Package	Before	After	Fixes
Reachy Mini	aiohttp	3.14.3	3.14.5	8 advisories fixed in 3.14.4 (request smuggling, cookie scope, resource exhaustion)
Reachy Mini	certifi	2026.6.17	2026.10.23	GHSA-6q48-6c7w-9gw2: trusted emSign ECC Root CA - G3, whose intermediates have compromised keys
Reachy Mini	filelock	3.29.4	4.2.4	3 lock-file advisories fixed in 4.2.1; the scan's suggested 3.32.7 is still affected
Reachy Mini	Pillow	12.3.0	13.0.0	41 advisories listed in the 13.0.0 release notes
Reachy Mini	pip	26.2.1	26.2.2	Vendors certifi 2026.10.19 without the affected emSign root
Reachy Mini	gstreamer-bundle	1.28.7	1.28.7	Not installable yet; see below
OpenShell exporter	golang.org/x/crypto	v0.58.0	v0.58.0	Latest release; see below
OpenShell exporter	golang.org/x/text	v0.43.0	v0.43.0	Latest release; see below

What changed

• ⚙️ Raise or add Reachy security floors for aiohttp, certifi, filelock, Pillow, and pip, and regenerate uv.lock with uv 0.11.0 to keep the existing format. Pillow also moves in override-dependencies, because Gradio still caps it below 12. The new versions require yarl 1.25.1, virtualenv 21.14.13, python-discovery 1.6.4, and packaging 26.3; no other versions change.
• ⚙️ Add a version-specific license exception for certifi 2026.10.23. It is MPL-2.0, outside the approved allowlist, and the new security floor makes it a direct dependency that the license check enforces. The entry mirrors the existing gstreamer-bundle exception.
• 📝 Document in the Reachy README why GStreamer stays at 1.28.7. GStreamer 1.28.8 fixes SA-2026-0078 and SA-2026-0083 through SA-2026-0092, but PyPI's gstreamer-plugins 1.28.8 has only free-threaded Windows wheels, so uv lock fails for macOS with "gstreamer-plugins==1.28.8 has no wheels with a matching Python version tag". The scan's suggested 1.29.2a0 is a July prerelease that predates those fixes and lacks Python 3.11/3.12 macOS gstreamer-python wheels.

Go findings (no change): x/crypto v0.58.0 carries GO-2026-5932, the unmaintained OpenPGP packages with no fixed release; the exporter README already records it, and go list -deps -test ./... still contains no OpenPGP paths. For x/text v0.43.0, the Go vulnerability database, OSV, and GitHub advisories list nothing affecting this version, and govulncheck reports no x/text finding. Upstream has unreleased x/text fixes after v0.43.0 (an IDNA Punycode work cap in internal/export/idna, which the exporter does not compile, and an Accept-Language guard the Go security team judged non-security). Pick up the next tagged x/text release when it ships.

Verification

Proof: a vulnerability audit of the locked packages shows the reported findings before and none after, and the same test suite gives identical results on main and this branch.

• pip-audit (OSV) on environments built from each lock: main has aiohttp 8, certifi 2, filelock 3, Pillow 41, and virtualenv 23 findings; this branch has none for those packages.
• Reachy tests in isolated Linux Python 3.12 environments built from each lock (macOS-only GStreamer, PyObjC, and Zenoh omitted, CPU torch): 255 passed on both main and this branch. The same 2 modules fail to import gi, which is macOS-only. ty check reports the same 36 pre-existing diagnostics on both.
• Runtime smoke on this branch: Gradio image postprocess and cache save, plus transformers and torchvision to_pil_image, on Pillow 13; huggingface-hub WeakFileLock, FileLock, SoftFileLock, and virtualenv creation on filelock 4.2.4; aiohttp HTTP, WebSocket, and TLS round trips; requests and httpx TLS with the new certifi; emSign ECC Root CA - G3 absent from both certifi and pip's vendored bundle.
• uv lock --check (uv 0.11.0 and 0.13.4), ruff check ., compileall, and git diff --check pass.
• Dependency license audit against the main-branch allowlist: 9 of 9 enforced dependencies pass. tests/test_dependency_licenses.py: 52 passed.
• Not run: full macOS uv sync, tests, and type checks, because the committed lock targets Darwin and this host is Linux.

Outside this report: govulncheck reports Go 1.26.8 standard-library advisories fixed in 1.26.9/1.26.10. pip-audit also flags gradio 5.50.1.dev1, setuptools 84.0.0, brotli 1.2.0, and dev-only gitpython 3.1.50. OAR's dev-only lock has filelock 3.32.3, and native-controller/pyproject.toml keeps unlocked floors, including pillow<13. None of these appear in the scan; they are left for follow-up.

Panel review (one round on f2dd927): integration and correctness with Claude Opus 5.5 at high effort was clean; intent, verification, and security with Claude Fable 5.1 at high effort found one low-severity issue, a certifi floor comment naming 2026.10.23 rather than 2026.10.19 as the fixing release, fixed in 4acc5cd (comment only; uv lock --check still passes). Declined as follow-ups: using a uv constraint-dependencies floor instead of a direct certifi dependency to avoid the MPL-2.0 exception (no repo precedent; prior fixes use direct floors), and an exporter README note for x/text (no advisory exists to document).

Reviewed with sol-loop: 1 round with gpt-6.1-sol on high. Sol verdict: approved