[johnnygreco]

The NSpect report lists three vulnerable dependencies. Upgrade each to the report's short-term fixed version:

Project	Package	Before	After
Reachy Mini	multidict	6.7.1	6.9.1
OpenShell exporter	golang.org/x/net	v0.58.0	v0.60.0
OpenShell exporter	golang.org/x/crypto	v0.57.0	v0.58.0

Add a multidict security floor and regenerate uv.lock with uv 0.11.0 to preserve the existing format. No other Python versions change. The upgraded Go modules require x/sys v0.49.0, x/term v0.47.0, and x/text v0.43.0; go mod tidy refreshes their checksums and required x/sync/x/tools checksums. Add a version-specific Apache-2.0 clarification backed by multidict's upstream license, because PyPI reports the non-SPDX string Apache License 2.0. Five files change, with 39 additions and 28 deletions.

The multidict advisory identifies 6.9.1 as patched. OSV reports no advisories for multidict 6.9.1 or x/net v0.60.0. x/crypto v0.58.0 retains GO-2026-5932, covering unmaintained OpenPGP packages with no fixed release. The exporter README already records this exception. Rechecked build/test imports: no OpenPGP packages; govulncheck finds that advisory only at module level and no findings for x/net.

Validation:

• go mod verify, go mod tidy -diff, go vet ./..., go test -race ./..., and go build ./cmd/... pass with Go 1.26.8.
• Both documented exporter configurations validate. The README's synthetic local-process flow delivers a normalized record and returns HTTP 200 from its health endpoint.
• uv lock --check, ruff check ., compileall, and git diff --check pass.
• 42 selected Reachy REST transport, camera policy, configuration, package, and sandbox-control tests pass in an isolated Python 3.12 uv environment using locked package versions.
• MultiDict/CIMultiDict C-extension reflected union and subtraction checks show no leaked value references. All eight locked multidict artifacts match non-yanked PyPI URLs, hashes, and sizes.
• The dependency license audit passes against the trusted main-branch allowlist. All GitHub checks pass for head 1f1004d7df7c888d1e71a5c2d9cec8243a780335.

Validation limits and scope: full Reachy sync/test/type validation cannot complete on this Linux host because the committed lockfile targets Darwin and native runtime packages are unavailable. govulncheck also reports 11 existing standard-library vulnerabilities in unchanged Go 1.26.8; those are outside the supplied package report. Application code, platform support, and the Go toolchain are unchanged.

Independent subagent review: clean, no actionable findings, for base cb153d63c54ea095b69b0a5d8e21f65a8c1227f3 to head 1f1004d7df7c888d1e71a5c2d9cec8243a780335. The reviewer independently passed Go module verification/tidy/vet/race/build checks, uv lock validation, 15 Reachy REST/package tests, PyPI artifact integrity checks, and 10,000 C-extension union/subtraction reference-count cycles. No OpenPGP paths appear among 1,613 build/test dependencies. Additional Python collection remains limited by the temporary Linux environment's missing fastrtc/native packages, consistent with the validation limits above. No scope expansion or file changes were requested by the review.

[johnnygreco]

@codex review

Please review this PR's fixes for the NSpect report: multidict 6.7.1, golang.org/x/net v0.58.0, and golang.org/x/crypto v0.57.0. Check the patched versions, dependency compatibility, lockfile integrity, and the version-specific multidict license clarification. Keep findings tied to the changes in this PR; the request explicitly excludes scope creep. The PR description records the Darwin-only validation limit and unchanged Go toolchain advisories outside the supplied report.