Skip to content

Fix reported Reachy dependency vulnerabilities #95

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
johnnygreco merged 2 commits into from
Oct 27, 2026
Merged

Fix reported Reachy dependency vulnerabilities #95

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f2dd927
Fix reported Reachy dependency vulnerabilities
johnnygreco Oct 27, 2026
4acc5cd
Clarify certifi floor comment
johnnygreco Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .github/dependency-license-policy.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,16 @@ source = '{"registry":"https://pypi.org/simple"}'
license = "Apache-2.0"
evidence = "https://github.com/huggingface/transformers/blob/v5.17.0/LICENSE"

[[exception]]
ecosystem = "pypi"
name = "certifi"
source = '{"registry":"https://pypi.org/simple"}'
reason = "Existing transitive CA bundle dependency pinned directly for a security-only version update."
evidence = "https://pypi.org/project/certifi/2026.10.23/"
reports = [
{ version = "2026.10.23", license = "MPL-2.0" },
]

[[exception]]
ecosystem = "pypi"
name = "gstreamer-bundle"
Expand Down
7 changes: 7 additions & 0 deletions projects/use-case-examples/reachy-mini-openshell/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -461,3 +461,10 @@ uv run reachy-mini-app-assistant check .

The checked-in uv resolution targets macOS/Darwin. For Linux deployment,
update `[tool.uv].environments` and regenerate `uv.lock`.

GStreamer 1.28.8 fixes [GStreamer-SA-2026-0078 and SA-2026-0083 through
SA-2026-0092](https://gstreamer.freedesktop.org/security/), but PyPI's
`gstreamer-plugins` 1.28.8 has no macOS wheels, so `gstreamer-bundle` 1.28.8
does not resolve for this lock. The lock keeps 1.28.7; the 1.29.2a0 prerelease
predates those fixes. Raise both `gstreamer-bundle` floors in `pyproject.toml`
to 1.28.8 once its macOS plugin wheels are published.
10 changes: 6 additions & 4 deletions projects/use-case-examples/reachy-mini-openshell/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,18 +9,20 @@ description = "Reachy Mini conversation demo for OpenShell."
readme = "README.md"
requires-python = ">=3.11,<3.13"
dependencies = [
"aiohttp>=3.14.3,<4", # 3.14.3 fixes aiohttp security advisories pulled in by reachy-mini.
"aiohttp>=3.14.5,<4", # 3.14.5 includes the 3.14.4 aiohttp security fixes pulled in by reachy-mini.
"aiortc>=1.13.0",
"anyio>=4.15.1,<5", # 4.15.1 fixes AnyIO security advisories pulled in by Gradio.
"certifi>=2026.10.23", # 2026.10.23 includes the 2026.10.19 emSign CA fix pulled in by requests and httpx.
"cryptography>=50.0.1,<51", # 50.0.1 fixes cryptography security advisories pulled in by aiortc.
"fastrtc>=0.0.34",
"filelock>=4.2.4,<5", # 4.2.4 includes the 4.2.1 filelock security fixes pulled in by torch and huggingface-hub.
"gradio==5.50.1.dev1",
"gstreamer-bundle>=1.28.7,<1.29; sys_platform != 'linux'", # 1.28.7 fixes GStreamer advisories and supports Python 3.11-3.12 on macOS.
"huggingface-hub>=1.5,<2",
"multidict>=6.9.1,<7", # 6.9.1 fixes the items-view reference leak pulled in by aiohttp.
"opencv-python>=4.12.0.88",
"pillow>=12.3,<13", # 12.3.0 fixes Pillow security advisories pulled in by Gradio.
"pip>=26.2.1,<27", # 26.2.1 fixes pip security advisories pulled in by reachy-mini.
"pillow>=13,<14", # 13.0.0 fixes Pillow security advisories pulled in by Gradio.
"pip>=26.2.2,<27", # 26.2.2 vendors certifi 2026.10.19, which fixes the emSign CA advisory.
"protobuf>=7.36,<8", # 7.36.0 fixes protobuf security advisories pulled in by ONNX Runtime.
"python-dotenv",
"openai>=2.1",
Expand Down Expand Up @@ -59,7 +61,7 @@ environments = [
override-dependencies = [
"gstreamer-bundle>=1.28.7,<1.29; sys_platform != 'linux'",
"huggingface-hub>=1.5,<2",
"pillow>=12.3,<13",
"pillow>=13,<14",
"pydantic>=2.12.5,<3", # Reachy Mini requires 2.12.5; Gradio's conservative cap excludes it.
"starlette>=1.6,<2",
]
Expand Down
Loading
Loading