Phantom v1.6.1: Dependency Security Updates

Phantom 1.6.1 updates four dependencies to address security vulnerabilities. No Phantom commands or audio analysis behavior have changed.

What changed

The fixes cover:

• AnyIO: TLS hostname validation.
• PyJWT: JWT verification, key handling, and parsing.
• urllib3: Proxy TLS validation and HTTP response handling.
• virtualenv: Virtual environment creation, including activation scripts and seed-wheel integrity.

The published package now requires patched versions, so fresh installations cannot select the affected releases. Those requirements also cover the relevant extras: urllib3 is part of the analysis extra, and virtualenv is part of the development extra.

The Phantom plugin and its marketplace version pin also move to 1.6.1.

Updating

For an existing installation managed by uv, run:

uv tool upgrade phantom-audio
phantom --version

The version check should report 1.6.1.

Phantom requires Python 3.10–3.13 on macOS or Linux. Windows installation remains unsupported because Essentia does not publish a Windows wheel. For a new installation, follow the getting-started guide.

The full release notes describe the dependency update and validation.