msgpack==1.1.2 has published security advisories (clean as of 1.2.1)

[jiawenyao401]

Hi, and thanks for publishing H-EmbodVis/TurboVLA. While looking at how recently released Python projects pin their dependencies, I found that one of the exact pins in this repository resolves to releases that OSV reports as affected by published advisories.

These are advisories in upstream packages, not in your code, and I have not checked whether the affected code paths are reachable from this project. Please treat this as information rather than a confirmed exploit path.

What was found

Manifest	Pin	Advisories	Highest severity	Current release
pyproject.toml	msgpack==1.1.2	1	HIGH	1.2.1

Details

msgpack==1.1.2 in pyproject.toml

• GHSA-6v7p-g79w-8964 (HIGH): MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error (fixed in 1.2.1)

msgpack==1.2.1 is the current release on PyPI, and querying OSV for that exact version returns no advisories.

Suggested change

-msgpack==1.1.2
+msgpack==1.2.1

I have not verified that these upgrades are compatible with this project. If any of these pins are intentional, feel free to close this out.

---

Found with an automated scan of exact pins against the public OSV database. Each suggested version was rescanned before being proposed.