fix(deps): pin msgpack exactly in requirements.txt

[itsmiso-ai]

Pin msgpack exactly in requirements.txt to align with CI's 'both files pin exact versions' audit claim.

Fixes #172

Opened by foreman on review GO (workload wl-misospace-foreman-dispatch-bridge-172).

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: dsv4f@https://litellm.jory.dev/v1 (openai) — primary route

Recommendation

Approve. This is a minimal, well-scoped dependency pin change that directly resolves the linked issue PR 172. The diff changes a single line in requirements.txt, converting the floating msgpack>=1.2.1 to an exact pin msgpack==1.2.1. CI (docker and test) passed on the head commit.

Change-by-Change Findings

requirements.txt — msgpack>=1.2.1 → msgpack==1.2.1

The change removes the only floating dependency line in requirements.txt, making every line an exact pin. This aligns the file with the CI pip-audit step's documented assumption (.github/workflows/ci.yaml:24-25: "Both files pin exact versions, so we can skip dependency resolution and audit exactly what is installed") and with the --no-deps audit mode. The pinned version 1.2.1 matches the fixed minimum introduced in PR 128 (commit 7a9a529), so no regression in the transitive CVE fix is introduced. msgpack is a transitive dependency (via CacheControl ← requests) and is not imported anywhere in bridge/, so the pin has no code impact.

Must-Check Items

• Check for breaking API changes in updated dependencies: Not applicable in the usual sense — this is not a version bump. The change pins an already-installed transitive dependency to the exact version that was already the effective minimum (1.2.1). No new version is introduced, so there is no API surface change. msgpack is not imported in bridge/, so no code path is affected.
• Run full test suite after upgrade: The CI test check passed on the head commit c701677. The docker check also passed. No test changes were needed since the pin has no code impact.

Linked Issue Fit

Issue PR 172 asks to pin msgpack exactly in requirements.txt so every dependency is reproducible and the CI pip-audit step audits exactly what is installed. The acceptance criteria are:

• ✅ requirements.txt pins msgpack==<exact> (the current fixed minimum 1.2.1 or newer) — satisfied: msgpack==1.2.1.
• ✅ No line in either requirements file uses a comparator (>=, <=, ~=, == wildcards) — the diff removes the only >= in requirements.txt; no other requirements file is touched.
• ✅ The CI comment about "both files pin exact versions" is now accurate for every line — satisfied by this change.
• ✅ CI passes unchanged — confirmed by the passing test and docker checks.

The issue also names .github/workflows/ci.yaml as an expected file, but the acceptance criteria do not require a CI change — the comment is already accurate once the pin is applied. The diff correctly touches only requirements.txt, which is the file that needed the change.

Standards Compliance

The repository's AGENTS.md requires issues to state the ask in one imperative sentence and name concrete file paths. Issue PR 172 does both ("Pin msgpack exactly in requirements.txt..." and names requirements.txt, .github/workflows/ci.yaml). The diff touches requirements.txt, one of the named files, so the scope-overlap rail is satisfied. No repository convention is violated by this change.

Unknowns or Needs Verification

None material. The change is a pure pin with no version change, so no compatibility-matrix verification is required (no host/peer platform version is coupled to this bump). The only minor note is that the linked issue also listed .github/workflows/ci.yaml as an expected file, but the acceptance criteria do not require a CI modification, and the existing CI comment is accurate after this pin.