Summary

• raise the bot extra floor to python-socketio>=5.16.2
• add an explicit python-engineio>=4.13.2 floor for the same bot runtime path
• refresh uv.lock so frozen installs resolve python-socketio==5.16.3 and python-engineio==4.13.3

Why

The bot extra imports Socket.IO for the Mochat channel path. The previous lock resolved:

• python-socketio==5.16.1, which is in range for GHSA-5w7q-77mv-v69f
• python-engineio==4.13.1, which is in range for GHSA-cgwc-pv48-fhj5 and GHSA-m9gh-vj53-gvh9

All three advisories are denial-of-service issues in the Socket.IO/Engine.IO stack, so this affects a network-facing optional runtime extra rather than a dev-only dependency.

Lockfile note

Running uv lock also synchronized existing main-branch manifest/lock drift: pyproject.toml already declares feedparser>=6.0.0, defusedxml>=0.7.1, litellm>=1.83.7,<1.89.3, and python-multipart>=0.0.31, while parts of uv.lock still reflected older generated metadata. The only manifest changes in this PR are the two bot Socket.IO floors; the additional lock hunks are resolver output needed for uv lock --check against the current manifest.

Checks

• uv lock --check
• parsed pyproject.toml / uv.lock to assert the bot extra floors and locked versions are above the patched floors
• git diff --check

I also attempted uv sync --python /Users/admin/.local/bin/python3.12 --frozen --extra bot; dependency installation resolved and started but was stopped locally after hanging during the large bot-extra install. The lock consistency checks above passed.