[Lucas1479]

Problem and change

The Python dependency audit now rejects the main branch's locked msgpack 1.2.2 for CVE-2026-114613 / GHSA-j586-36cw-2gc2, blocking the otherwise reviewed dependency updates #266 and #265.

Raise the Host's msgpack minimum to 1.2.3, lock that patched release, and update the Fish Audio example pin and its documentation. The existing audit policy and exceptions are unchanged.

This is the four-file dependency commit dc237e3de7412d2a825d350a7591c36dc6c260e0 from #271, applied separately to current main so the shared security repair can be reviewed independently. It also covers the example dependency update in #272.

Validation

Fresh CPython 3.12.10 environment on Windows:

• uv sync --locked --extra dev: passed; installed msgpack 1.2.3.
• Exact CI audit command, uv run --locked --no-sync python -m pip_audit --local --progress-spinner off --ignore-vuln PYSEC-2026-1845: passed, no known vulnerabilities and 2 existing ignores.
• python -X utf8 -m pytest tests/test_tts_fish_audio_backend.py tests/test_extension_fish_audio.py -q: 62 passed with real local WebSocket peers.
• uv lock --check --offline, python -m ruff check ., and python tools/verify_python_environment.py --profile ci: passed.
• Fish Audio example wheel build and tools/extension_package.py check-wheel: passed.
• Structural comparison of the lockfile with main confirms msgpack is the only changed third-party package entry; git diff --check passed.

Full hosted CI is pending. No live provider requests were made. Draft pending CI and maintainer approval of this prerequisite repair.