[dependabot]

Bumps the uv group with 1 update in the / directory: msgpack.

Updates msgpack from 1.2.1 to 1.2.3

Release notes

Sourced from msgpack's releases.

v1.2.3

What's Changed

• Fix memory leaks in the C extension when map key validation or container hooks fail. See GHSA-j586-36cw-2gc2.
• wheels: also build for pyodide using emscripten. by @​mr-c in msgpack/msgpack-python#732
• Support packing Python 3.15 frozentdict (PEP 814) by @​edgarrmondragon in msgpack/msgpack-python#738
• Reject negative array and map header sizes by @​jakezwang in msgpack/msgpack-python#742
• Bump the all-dependencies group across 1 directory with 2 updates by @​dependabot[bot] in msgpack/msgpack-python#741

New Contributors

• @​mr-c made their first contribution in msgpack/msgpack-python#732
• @​jakezwang made their first contribution in msgpack/msgpack-python#742

Full Changelog: msgpack/msgpack-python@v1.2.2...v1.2.3

v1.2.2

What's Changed

• fix docstring for read_size by @​methane in msgpack/msgpack-python#700
• unpacker: fix silent datetime truncation with datetime=3 by @​methane in msgpack/msgpack-python#701
• run test with debug build by @​methane in msgpack/msgpack-python#702
• fix: add reentrant guard to Unpacker.feed() by @​methane in msgpack/msgpack-python#704
• Bump actions/checkout from 6.0.3 to 7.0.0 in the all-dependencies group by @​dependabot[bot] in msgpack/msgpack-python#705
• Improve error handling and reporting in unpacking functions by @​methane in msgpack/msgpack-python#707
• test_unpack.py: add tests for ExtraData by @​methane in msgpack/msgpack-python#708
• Bump the all-dependencies group with 2 updates by @​dependabot[bot] in msgpack/msgpack-python#709
• Fix Timestamp.from_datetime() precision for far-future datetimes by @​gaoflow in msgpack/msgpack-python#710
• Fix typos in test and docs by @​maxtaran2010 in msgpack/msgpack-python#712
• Bump the all-dependencies group across 1 directory with 5 updates by @​dependabot[bot] in msgpack/msgpack-python#719
• fix: use-after-free in unpackb() ExtraData path for non-contiguous input by @​ThomasWaldmann in msgpack/msgpack-python#722
• Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 in the all-dependencies group by @​dependabot[bot] in msgpack/msgpack-python#721
• Bump pypa/cibuildwheel from 4.1.1 to 4.2.0 in the all-dependencies group by @​dependabot[bot] in msgpack/msgpack-python#724
• Convert Packer's buf_size once by @​hdimer in msgpack/msgpack-python#726
• fix: translate RecursionError to StackError in fallback Unpacker.skip() by @​hdimer in msgpack/msgpack-python#727
• Validate nanoseconds range when unpacking timestamps in the C extension by @​chuenchen309 in msgpack/msgpack-python#716
• Avoid parallel execution of the recursion-limit nesting test on free-threaded builds by @​methane with @​Copilot in msgpack/msgpack-python#729
• Raise OverflowError when use_single_float cannot represent a value by @​dylanpulver in msgpack/msgpack-python#728
• release v1.2.2 by @​methane in msgpack/msgpack-python#730

New Contributors

• @​gaoflow made their first contribution in msgpack/msgpack-python#710
• @​maxtaran2010 made their first contribution in msgpack/msgpack-python#712
• @​hdimer made their first contribution in msgpack/msgpack-python#726
• @​chuenchen309 made their first contribution in msgpack/msgpack-python#716
• @​dylanpulver made their first contribution in msgpack/msgpack-python#728

Full Changelog: msgpack/msgpack-python@v1.2.1...v1.2.2

Changelog

Sourced from msgpack's changelog.

1.2.3

Release Date: 2026-09-29

• Fix memory leaks in the C extension when map key validation or container hooks fail. See GHSA-j586-36cw-2gc2.
• Fix use-after-free errors when cleaning up an incomplete or failed Unpacker.skip() after previously unpacking a nested object in the C extension.
• Raise ValueError in the C extension when switching between unpacking, skipping, header readers, or read_bytes() while an object is incomplete. Resume with the same method after feeding more data; unpack() and iteration remain interchangeable.
• Prevent reentrant unpacking, header reads, read_bytes(), and reinitialization of the same C Unpacker while unpacking is in progress.
• Reject negative sizes in Packer.pack_array_header() and Packer.pack_map_header(). #742
• Support packing Python 3.15 frozendict objects. #738
• Update Cython from 3.2.5 to 3.3.0. #738
• Build wheels for Pyodide using Emscripten. #732
• Update cibuildwheel to 4.2.1 and the QEMU setup action to 4.4.0. #741

1.2.2

Release Date: 2026-08-27

• Fix the read_size documentation. #700
• Fix silent truncation when unpacking an out-of-range timestamp with timestamp=3. #701
• Prevent reentrant calls to Unpacker.feed() while unpacking. #704
• Improve error handling and reporting in unpacking functions. #707
• Fix Timestamp.from_datetime() precision for far-future datetimes. #710
• Fix typos in the documentation. #712
• Validate the nanoseconds range when unpacking timestamps in the C extension. #716
• Fix a use-after-free in the unpackb() ExtraData path for non-contiguous input. #722
• Prevent a buffer overflow when converting Packer's buf_size. #726
• Translate RecursionError to StackError in the fallback Unpacker.skip(). #727
• Raise OverflowError when use_single_float=True cannot represent a value. #728

Commits

• 742cb6d release v1.2.3
• 620b0eb Merge commit from fork
• 475c1b7 Bump the all-dependencies group across 1 directory with 2 updates (#741)
• 0014ca9 Reject negative array and map header sizes (#742)
• 7a63920 Support packing Python 3.15 frozentdict (PEP 814) (#738)
• 9f4909c wheels: also build for pyodide using emscripten. (#732)
• 7381b31 release
• ee1bd3c release v1.2.2 (#730)
• 57d28a2 Raise OverflowError when use_single_float cannot represent a value (#728)
• d374a17 Avoid parallel execution of the recursion-limit nesting test on free-threaded...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.