Latest PyPI release (4.5.13) still ships CVE-affected deepdiff==8.2.0 / python-socketio<5.12 — a release would pick up master's already-relaxed pins

[tmilnthorp]

Thanks for AppDaemon! Flagging a dependency/security gap that a fresh release would resolve — the fix is already on master, it just hasn't shipped.

The gap

The latest release on PyPI is 4.5.13 (published 2026-01-19), and its metadata pins:

• deepdiff==8.2.0 (exact)
• python-socketio<5.12,>=5.5

Both hold versions with known advisories:

Package	Pinned by 4.5.13	Advisory	Fixed in
deepdiff	==8.2.0	Class Pollution DoS (PYSEC-2026-327)	8.6.1
deepdiff	==8.2.0	Memory Exhaustion DoS (PYSEC-2026-2445)	8.6.2
python-socketio	<5.12	binary-attachment DoS (PYSEC-2026-1854 / PYSEC-2026-3042)	5.16.2

Because the pins are exact / upper-capped, downstreams can't resolve to the fixed versions without an override-dependencies-style workaround.

It's already fixed on master

master's pyproject.toml has relaxed both, so this looks purely like release lag:

• deepdiff>=8.2.0 (allows 9.x — CVE-clear; Bump deepdiff from 8.6.2 to 9.0.0 #2583 bumped the lock to 9.0.0)
• python-socketio>=5.5 (the <5.12 cap is gone — allows 5.16.x)

Would it be possible to cut a release so these reach PyPI? That's the whole ask.

Minor bonus: deepdiff appears unused

While tracking this down I couldn't find a single import deepdiff / DeepDiff reference anywhere in the shipped appdaemon package (4.5.13). If that's right, it may be worth dropping deepdiff as a runtime dependency entirely rather than carrying periodic dependabot bumps (and the occasional advisory) for a package that isn't imported. (python-socketio, by contrast, is genuinely used by appdaemon/stream/, so its floor is fine.)

Happy to open a PR for the deepdiff removal if that'd help. Thanks again!

[tmilnthorp]

Opened #2674 for the deepdiff removal.