pyup.io safety check fails after pinning msgpack version ( thinc v6.12.1)

[00willo]

safety check -r requirements.txt --full-report
╒══════════════════════════════════════════════════════════════════════════════╕
│                                                                              │
│                               /$$$$$$            /$$                         │
│                              /$$__  $$          | $$                         │
│           /$$$$$$$  /$$$$$$ | $$  \__//$$$$$$  /$$$$$$   /$$   /$$           │
│          /$$_____/ |____  $$| $$$$   /$$__  $$|_  $$_/  | $$  | $$           │
│         |  $$$$$$   /$$$$$$$| $$_/  | $$$$$$$$  | $$    | $$  | $$           │
│          \____  $$ /$$__  $$| $$    | $$_____/  | $$ /$$| $$  | $$           │
│          /$$$$$$$/|  $$$$$$$| $$    |  $$$$$$$  |  $$$$/|  $$$$$$$           │
│         |_______/  \_______/|__/     \_______/   \___/   \____  $$           │
│                                                          /$$  | $$           │
│                                                         |  $$$$$$/           │
│  by pyup.io                                              \______/            │
│                                                                              │
╞══════════════════════════════════════════════════════════════════════════════╡
│ REPORT                                                                       │
│ checked 120 packages, using default DB                                       │
╞════════════════════════════╤═══════════╤══════════════════════════╤══════════╡
│ package                    │ installed │ affected                 │ ID       │
╞════════════════════════════╧═══════════╧══════════════════════════╧══════════╡
│ msgpack                    │ 0.5.6     │ <0.6.0                   │ 36700    │
╞══════════════════════════════════════════════════════════════════════════════╡
│ msgpack 0.6.0 contains some backward incompatible changes for security reaso │
│ n (DoS).                                                                     │
╘══════════════════════════════════════════════════════════════════════════════╛

$ pipdeptree -rp msgpack
msgpack==0.5.6
  - msgpack-numpy==0.4.3.2 [requires: msgpack>=0.3.0]
    - thinc==6.12.1 [requires: msgpack-numpy<0.4.4]
      - spacy==2.0.18 [requires: thinc>=6.12.1,<6.13.0]
  - thinc==6.12.1 [requires: msgpack>=0.5.6,<0.6.0]
    - spacy==2.0.18 [requires: thinc>=6.12.1,<6.13.0]

[00willo]

Just raising an issue on this for visibility.

Ultimately is this an issue for the thinc or the package to resolve?

[honnibal]

@00willo This should be taken care of in v7.0. See here: https://github.com/explosion/srsly