Skip to content

chore(deps): bump msgpack from 1.2.1 to 1.2.3 - #82

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/msgpack-1.2.3
Open

chore(deps): bump msgpack from 1.2.1 to 1.2.3#82
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/msgpack-1.2.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor

Bumps msgpack from 1.2.1 to 1.2.3.

Release notes

Sourced from msgpack's releases.

v1.2.3

What's Changed

New Contributors

Full Changelog: msgpack/msgpack-python@v1.2.2...v1.2.3

v1.2.2

What's Changed

New Contributors

Full Changelog: msgpack/msgpack-python@v1.2.1...v1.2.2

Changelog

Sourced from msgpack's changelog.

1.2.3

Release Date: 2026-09-29

  • Fix memory leaks in the C extension when map key validation or container hooks fail. See GHSA-j586-36cw-2gc2.
  • Fix use-after-free errors when cleaning up an incomplete or failed Unpacker.skip() after previously unpacking a nested object in the C extension.
  • Raise ValueError in the C extension when switching between unpacking, skipping, header readers, or read_bytes() while an object is incomplete. Resume with the same method after feeding more data; unpack() and iteration remain interchangeable.
  • Prevent reentrant unpacking, header reads, read_bytes(), and reinitialization of the same C Unpacker while unpacking is in progress.
  • Reject negative sizes in Packer.pack_array_header() and Packer.pack_map_header(). #742
  • Support packing Python 3.15 frozendict objects. #738
  • Update Cython from 3.2.5 to 3.3.0. #738
  • Build wheels for Pyodide using Emscripten. #732
  • Update cibuildwheel to 4.2.1 and the QEMU setup action to 4.4.0. #741

1.2.2

Release Date: 2026-08-27

  • Fix the read_size documentation. #700
  • Fix silent truncation when unpacking an out-of-range timestamp with timestamp=3. #701
  • Prevent reentrant calls to Unpacker.feed() while unpacking. #704
  • Improve error handling and reporting in unpacking functions. #707
  • Fix Timestamp.from_datetime() precision for far-future datetimes. #710
  • Fix typos in the documentation. #712
  • Validate the nanoseconds range when unpacking timestamps in the C extension. #716
  • Fix a use-after-free in the unpackb() ExtraData path for non-contiguous input. #722
  • Prevent a buffer overflow when converting Packer's buf_size. #726
  • Translate RecursionError to StackError in the fallback Unpacker.skip(). #727
  • Raise OverflowError when use_single_float=True cannot represent a value. #728
Commits
  • 742cb6d release v1.2.3
  • 620b0eb Merge commit from fork
  • 475c1b7 Bump the all-dependencies group across 1 directory with 2 updates (#741)
  • 0014ca9 Reject negative array and map header sizes (#742)
  • 7a63920 Support packing Python 3.15 frozentdict (PEP 814) (#738)
  • 9f4909c wheels: also build for pyodide using emscripten. (#732)
  • 7381b31 release
  • ee1bd3c release v1.2.2 (#730)
  • 57d28a2 Raise OverflowError when use_single_float cannot represent a value (#728)
  • d374a17 Avoid parallel execution of the recursion-limit nesting test on free-threaded...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump msgpack from 1.2.1 to 1.2.3
cd0407a 
Bumps [msgpack](https://github.com/msgpack/msgpack-python) from 1.2.1 to 1.2.3.
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md)
- [Commits](msgpack/msgpack-python@v1.2.1...v1.2.3)

---
updated-dependencies:
- dependency-name: msgpack
  dependency-version: 1.2.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 30, 2026
@labro-bot

labro-bot Bot commented Oct 31, 2026

Copy link
Copy Markdown
Contributor

Labro picking up. Assigning to claude-code:claude-sonnet-5.

@labro-bot

labro-bot Bot commented Oct 31, 2026

Copy link
Copy Markdown
Contributor

Maintainer review — dependency bump audit

Semver risk: patch (1.2.1 → 1.2.3). Low risk — no API changes expected, pyproject.toml only requires msgpack>=1.2.1 so this stays within the declared constraint.

Changes in this release:

  • v1.2.3: fixes a memory leak in the C extension when map-key validation or container hooks fail (GHSA-j586-36cw-2gc2); fixes a use-after-free in Unpacker.skip() cleanup; adds reentrancy guards around the C Unpacker; rejects negative array/map header sizes; adds Python 3.15 frozendict packing support.
  • v1.2.2 (included in the range): fixes silent datetime truncation with timestamp=3, a reentrancy bug in Unpacker.feed(), a use-after-free in the unpackb() ExtraData path, and a Packer.buf_size buffer overflow.
  • Net effect: this is a defensive security/correctness release for the C extension, not a feature or behavioral change relevant to how labro would use the library.

Lock file: clean. Compared uv.lock package-by-package between main and this branch (all 64 entries) — only msgpack changes version (1.2.1 → 1.2.3); every other package/version is identical. The large diff stat (+684/-661) is just wheel/hash metadata churn for msgpack's own release artifacts, not unexpected transitive upgrades.

Prior pins: msgpack>=1.2.1 was added in v0.16.3 (commit 9908c3e) specifically to resolve GHSA-6v7p-g79w-8964. That's a lower-bound security pin, not an upper bound — this PR is a continuation of that same security-driven trajectory (fixing a newer advisory), not a conflict with it. No blocker.

Note: msgpack isn't imported directly anywhere in src/labro or tests/ — it's a direct dependency per pyproject.toml but appears to only be needed transitively (e.g. by cachecontrol). Doesn't change the risk assessment, just worth knowing it's not exercised by labro's own code paths.

Conflict check: clean. CI's ci job already ran uv sync --extra dev on this branch and resolved/installed all 63 packages (including msgpack==1.2.3) without error, then passed ruff/mypy/bandit/pytest.

CI: ci job passing. dependency-audit (pip-audit) is failing, but not because of this PR — the failure is 33 known CVEs/PYSECs against certifi, filelock, urllib3, and virtualenv (all dev-tooling transitive deps, unrelated to msgpack). These are already being tracked and fixed independently in open PRs #79 (certifi), #80 (filelock), #73 (urllib3), and #77 (virtualenv). The last clean run of ci-python.yml on main predates the CVE disclosures that are now failing the audit — this is a pre-existing, repo-wide issue surfacing on every PR right now, not something introduced here.

Recommendation: ⏳ Safe to merge once CI passes — specifically, once one of #73/#77/#79/#80 lands to clear the unrelated dependency-audit failure (or that check is otherwise resolved). The msgpack bump itself is a clean, low-risk security/bugfix patch release with no lock file surprises and no pin conflicts.

@labro-bot

labro-bot Bot commented Oct 31, 2026

Copy link
Copy Markdown
Contributor

Labro's agent (claude-code) ran out of turns before completing this pr.

Reason: error_max_turns

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

ai-contributed ai-failed dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants