Bump the ci-constraints group across 1 directory with 23 updates by dependabot[bot] · Pull Request #69 · microsoft/bocpy

dependabot · 2026-10-13T14:56:48Z

Bumps the ci-constraints group with 23 updates in the /ci directory:

Package	From	To
tomli	`2.4.1`	`2.5.0`
charset-normalizer	`3.4.9`	`3.5.2`
cyclonedx-python-lib	`11.11.0`	`11.12.0`
filelock	`3.32.2`	`4.1.0`
idna	`3.18`	`3.20`
msgpack	`1.2.1`	`1.2.3`
pip-api	`0.0.34`	`0.0.35`
platformdirs	`4.11.0`	`4.12.4`
pygments	`2.20.0`	`2.21.0`
pyparsing	`3.3.2`	`3.3.3`
urllib3	`2.7.0`	`2.8.0`
flake8	`7.3.0`	`7.4.1`
flake8-bugbear	`25.11.29`	`26.9.30`
pycodestyle	`2.14.0`	`2.15.0`
pyflakes	`3.4.0`	`4.0.3`
setuptools	`83.0.0`	`84.0.0`
imagesize	`2.0.0`	`2.0.1`
markupsafe	`3.0.3`	`3.0.4`
soupsieve	`2.9.2`	`2.10`
webencodings	`0.5.1`	`0.6.1`
coverage	`7.15.4`	`7.16.2`
iniconfig	`2.3.0`	`2.3.1`
wheel	`0.47.0`	`0.48.0`

Updates tomli from 2.4.1 to 2.5.0

Changelog

Sourced from tomli's changelog.

2.5.0

Added

Binary wheels for Python 3.15

Fixed

Set nested inline array/table limit to 400 to fix mypyc generated binaries crashing unrecoverably in constrained environments (e.g. worker thread in a python:3.13-alpine image)

2.3.1

Fixed

Backport: Limit number of parts of a TOML key to address quadratic time complexity

Commits

a2a5789 Bump version: 2.4.1 → 2.5.0
94a6081 Add 2.5.0 changelog
85f8748 Update README.md
70fd460 Allow flit_core v4
00d0610 Update pre-commit
eb93c12 Improve tomllib compatibility and sync docs (#299)
18d8d59 Bump cibuildwheel for Python 3.15 wheels (#317)
1e6e869 Set smaller MAX_INLINE_NESTING to avoid python:3.13-alpine worker thread crash
c329998 Use Trusted Publishing
ba611c5 Add zizmor security scanner to pre-commit (#301)
Additional commits viewable in compare view

Updates charset-normalizer from 3.4.9 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)

Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Version 3.5.1

3.5.1 (2026-08-15)

Changed

Raised upper bound of setuptools to v84 (#794)

Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

Version 3.5.0

3.5.0 (2026-08-12)

Added

Explicit support for Python 3.15

Fixed

Comparing a CharsetMatch to a non-alias encoding strings (#773)

Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)

A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.

iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.

Applied micro-optimization on several utils.

CharsetMatches no longer sort on each match insertion.

... (truncated)

Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)

Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

3.5.1 (2026-08-15)

Changed

Raised upper bound of setuptools to v84 (#794)

Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

3.5.0 (2026-08-12)

Added

Explicit support for Python 3.15

Fixed

Comparing a CharsetMatch to a non-alias encoding strings (#773)

Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)

A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.

iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.

Applied micro-optimization on several utils.

CharsetMatches no longer sort on each match insertion.

Misc

Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).

Commits

935c29a Release 3.5.2 (#805)
9d3238a test: disable traefik in downstream niquests
b4c0368 docs: write changelog entry for 3.5.2
717da31 chore: bump version to 3.5.2
264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
41e28b6 chore: raise Cython upper bound to 3.3
b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
e239bdc Merge pull request #795 from jawah/release-3.5.1
648ad77 docs: update faq
Additional commits viewable in compare view

Updates cyclonedx-python-lib from 11.11.0 to 11.12.0

Release notes

Sourced from cyclonedx-python-lib's releases.

v11.12.0 (2026-08-13)

Features

Add isExternal property to Component for CycloneDX v1.7 (#959, 6993dea)

What's Changed

tests: add Python 3.14 to tox tests by @jkowalleck in CycloneDX/cyclonedx-python-lib#1029

feat: add isExternal property to Component for CycloneDX v1.7 by @tonal in CycloneDX/cyclonedx-python-lib#959

New Contributors

@tonal made their first contribution in CycloneDX/cyclonedx-python-lib#959

Full Changelog: CycloneDX/cyclonedx-python-lib@v11.11.2...v11.12.0

v11.11.2 (2026-08-12)

Bug Fixes

Encode paths when loading XML schemas (#1028, 17a0136)

What's Changed

fix: encode paths when loading XML schemas by @CAOShurong in CycloneDX/cyclonedx-python-lib#1028

New Contributors

@CAOShurong made their first contribution in CycloneDX/cyclonedx-python-lib#1028

Full Changelog: CycloneDX/cyclonedx-python-lib@v11.11.1...v11.11.2

v11.11.1 (2026-08-10)

Bug Fixes

Comparablepackageurl includes name (#1022, d718ac2)

What's Changed

chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot[bot] in CycloneDX/cyclonedx-python-lib#1012

chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @dependabot[bot] in CycloneDX/cyclonedx-python-lib#1011

chore(deps): bump actions/checkout from 6.0.2 to 7.0.0 by @dependabot[bot] in CycloneDX/cyclonedx-python-lib#1008

chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 by @dependabot[bot] in CycloneDX/cyclonedx-python-lib#1020

chore(deps): bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 by @dependabot[bot] in CycloneDX/cyclonedx-python-lib#1025

chore(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in CycloneDX/cyclonedx-python-lib#1024

chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 by @dependabot[bot] in CycloneDX/cyclonedx-python-lib#1023

chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in CycloneDX/cyclonedx-python-lib#1019

... (truncated)

Changelog

Sourced from cyclonedx-python-lib's changelog.

v11.12.0 (2026-08-13)

Features

Add isExternal property to Component for CycloneDX v1.7 (#959, 6993dea)

v11.11.2 (2026-08-12)

Bug Fixes

Encode paths when loading XML schemas (#1028, 17a0136)

v11.11.1 (2026-08-10)

Bug Fixes

Comparablepackageurl includes name (#1022, d718ac2)

Commits

52cb3c9 chore(release): 11.12.0
6993dea feat: add isExternal property to Component for CycloneDX v1.7 (#959)
27b2d43 tests: add Python 3.14 to tox tests (#1029)
a092c49 chore(release): 11.11.2
17a0136 fix: encode paths when loading XML schemas (#1028)
8edee5c chore(release): 11.11.1
7b5350c chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (#1026)
72e4e4c chore(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#1027)
d718ac2 fix: ComparablePackageURL includes name (#1022)
cb1a4e2 chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#1019)
Additional commits viewable in compare view

Updates filelock from 3.32.2 to 4.1.0

Release notes

Sourced from filelock's releases.

4.1.0

What's Changed

ci: download coverage during tool setup by @gaborbernat in tox-dev/filelock#776

🐛 fix(api): validate timeout and poll_interval bounds by @gaborbernat in tox-dev/filelock#781

🐛 fix(read-write): accept inf and reject nan timeouts by @darrenhuai in tox-dev/filelock#779

🐛 fix(soft-rw): ignore non-ASCII generation names by @dxbjavid in tox-dev/filelock#778

🐛 fix(soft): check start token in is_lock_held_by_us by @lprnmns in tox-dev/filelock#774

🐛 fix(soft): clean up marker when rollback close fails by @harbinresearcher in tox-dev/filelock#775

🐛 fix(read-write): clamp waits to threading.TIMEOUT_MAX by @darrenhuai in tox-dev/filelock#780

🐛 fix(soft): treat truncated markers as malformed by @gaborbernat in tox-dev/filelock#782

🐛 fix(acquire): keep every acquire wait within the timeout by @feiiiiii5 in tox-dev/filelock#777

📝 docs: fix hanging example and platform claims by @gaborbernat in tox-dev/filelock#783

🐛 fix(unix): keep peer marker on ENOSYS fallback by @gaborbernat in tox-dev/filelock#785

🐛 fix(async): clear the task hold after a canceled release by @gaborbernat in tox-dev/filelock#789

✨ feat(api): export lease types and has_fcntl by @gaborbernat in tox-dev/filelock#790

🐛 fix(strict): age private records by the filesystem clock by @gaborbernat in tox-dev/filelock#792

🐛 fix(async): surface executor shutdown as an error by @gaborbernat in tox-dev/filelock#793

🐛 fix(soft): expire leases on the contender's clock by @gaborbernat in tox-dev/filelock#796

🐛 fix(soft-rw): stop an acquire that close() overtook by @gaborbernat in tox-dev/filelock#798

🐛 fix(strict): record claims before linking them by @gaborbernat in tox-dev/filelock#787

🐛 fix(soft): restore a live marker a stale break moved aside by @gaborbernat in tox-dev/filelock#786

🐛 fix(api): chain errors on 3.10 without exceptiongroup by @gaborbernat in tox-dev/filelock#788

🐛 fix(soft): release a dropped SoftFileLease by @gaborbernat in tox-dev/filelock#791

🐛 fix(read-write): keep probe fds until the last connection closes by @gaborbernat in tox-dev/filelock#794

📦 build(sdist): ship docs and update SECURITY.md by @gaborbernat in tox-dev/filelock#812

🐛 fix(soft-rw): survive a removed generation log by @gaborbernat in tox-dev/filelock#795

🐛 fix(soft): tell PID namespaces apart in the marker host by @gaborbernat in tox-dev/filelock#797

🐛 fix(async): release from the finalizer and keep I/O off the loop by @gaborbernat in tox-dev/filelock#800

🐛 fix(strict): name what blocks the lock path by @gaborbernat in tox-dev/filelock#804

🐛 fix(read-write): reject WAL databases and link beside the db by @gaborbernat in tox-dev/filelock#805

🐛 fix(read-write): track read depth per thread by @gaborbernat in tox-dev/filelock#806

🐛 fix(soft): honour mode and tighten marker grammar by @gaborbernat in tox-dev/filelock#807

🧪 test: drop timing races from two runner-load flakes by @gaborbernat in tox-dev/filelock#809

🐛 fix(descriptor): reject poll intervals above TIMEOUT_MAX by @sricharanreddycheruku in tox-dev/filelock#802

🐛 fix(api): validate lock options up front by @gaborbernat in tox-dev/filelock#803

🐛 fix(soft-rw): publish the head through gen/HEAD by @gaborbernat in tox-dev/filelock#799

🐛 fix(api): release thread holds, guard reentry by @gaborbernat in tox-dev/filelock#810

🧪 test(lease): give the age-out test a real-time margin by @gaborbernat in tox-dev/filelock#814

📝 docs: point canonical and og:url at versioned pages by @gaborbernat in tox-dev/filelock#813

🐛 fix(read-write): refuse a database moved mid-acquire by @gaborbernat in tox-dev/filelock#808

🐛 fix: close regressions since 4.0.12 by @gaborbernat in tox-dev/filelock#815

New Contributors

@darrenhuai made their first contribution in tox-dev/filelock#779

@harbinresearcher made their first contribution in tox-dev/filelock#775

@sricharanreddycheruku made their first contribution in tox-dev/filelock#802

Full Changelog: tox-dev/filelock@4.0.12...4.1.0

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.1.1 (2026-10-11)

Bound the shared-lock contention test by worker progress so slow CI machines can finish the workload. :pr:819

Avoid the macOS /dev/fd lookup implicated in a kernel panic by opening SQLite through a validated hard link. The database directory must be writable and support hard links; alias creation failure raises OSError. :pr:820

Ignore non-ASCII PID or start-time fields and out-of-range PIDs in ReadWriteLock hard-link directory names so forged owners cannot abort acquisition. :pr:821

Use Python 3.15 for development and automation. :pr:816

4.1.0 (2026-10-09)

Import :data:~filelock.OwnerMode, :data:~filelock.CompromiseReason and :data:~filelock.has_fcntl from filelock. :pr:790

:class:~filelock.AcquireReturnProxy is generic in the lock type, so with lock.acquire() as held: types held as the lock's own class. :pr:803

A :class:~filelock.Timeout from a soft lock names a holder on another host or in another PID namespace, which no contender ever reclaims. :pr:815

:attr:~filelock.SoftFileLock.is_lock_held_by_us and :attr:~filelock.MarkerSoftFileLock.is_lock_held_by_us return False for a marker an earlier process with the same PID left behind. :pr:774

:class:~filelock.SoftFileLock removes its marker when writing it fails and closing the descriptor fails too, so the lock path no longer stays blocked. :pr:775

:meth:~filelock.BaseFileLock.acquire and :meth:~filelock.BaseAsyncFileLock.acquire no longer wait past timeout when poll_interval is longer than the time left. :pr:777

:class:~filelock.SoftReadWriteLock ignores a generation-log entry whose name is not 20 ASCII digits, which used to stop its heartbeat thread or delete real generations. :pr:778

:class:~filelock.ReadWriteLock, :class:~filelock.SoftReadWriteLock and their async wrappers treat a :data:math.inf timeout like -1 and raise :class:ValueError for a blocking nan one. :pr:779

:class:~filelock.ReadWriteLock and :class:~filelock.SoftReadWriteLock accept a timeout above :data:threading.TIMEOUT_MAX instead of raising :class:OverflowError. :pr:780

:meth:~filelock.BaseFileLock.acquire raises :class:ValueError for a blocking nan timeout or a poll_interval above :data:threading.TIMEOUT_MAX, and treats a :data:math.inf timeout like -1. :pr:781

:class:~filelock.SoftFileLock and :class:~filelock.MarkerSoftFileLock treat a marker cut before its final newline as malformed, so a crash-truncated record self-heals and a read mid-write no longer breaks a live lock. :pr:782

:class:~filelock.UnixFileLock no longer deletes another process's live marker when it falls back to a soft lock on ENOSYS, and on macOS a lock path ending in a separator raises :class:FileNotFoundError instead of retrying. :pr:785

:class:~filelock.SoftFileLock and :class:~filelock.SoftFileLease put back a live successor's marker that a racing stale break moved aside, so a third contender no longer acquires beside the successor. :pr:786

:class:~filelock.StrictSoftFileLock removes every claim a failed acquire published, counts an EEXIST link that

... (truncated)

Commits

6c0ecc2 Release 4.1.0
df06bbd 🐛 fix: close regressions since 4.0.12 (#815)
0712045 🐛 fix(read-write): refuse a database moved mid-acquire (#808)
73fefc1 📝 docs: point canonical and og:url at versioned pages (#813)
181b36b 🧪 test(lease): give the age-out test a real-time margin (#814)
2c19af4 🐛 fix(api): release thread holds, guard reentry (#810)
367b111 🐛 fix(soft-rw): publish the head through gen/HEAD (#799)
61582c5 🐛 fix(api): validate lock options up front (#803)
20c4b5a 🐛 fix(descriptor): reject poll intervals above TIMEOUT_MAX (#802)
cf092c7 🧪 test: drop timing races from two runner-load flakes (#809)
Additional commits viewable in compare view

Updates idna from 3.18 to 3.20

Release notes

Sourced from idna's releases.

v3.20

Update to Unicode 18.0.0.

Better enforcement of the domain length limit in the incremental codec.

Add support for Python 3.15.

v3.19

Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.

Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.

Test on free-threaded CPython with the GIL disabled and document thread safety.

Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.

Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.

The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.

Reject A-labels that are not the canonical Punycode encoding of their U-label.

Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.

Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.

Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.

Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

Update to Unicode 18.0.0.

Better enforcement of the domain length limit in the incremental codec.

Add support for Python 3.15.

3.19 (2026-08-18)

Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.

Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.

Test on free-threaded CPython with the GIL disabled and document thread safety.

Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.

Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.

The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.

Reject A-labels that are not the canonical Punycode encoding of their U-label.

Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.

Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.

Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.

Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Commits

d55e65e Release 3.20
0c0824a Pre-release 3.20rc0
bd7c316 Note Python 3.15 support in the 3.20 changelog
b6cce85 Merge pull request #276 from kjd/unicode-18
9a4bc59 Update to Unicode 18.0.0
dfab5a0 Merge branch 'python-3.15'
417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
cd17392 Merge pull request #274 from kjd/fix-decode-length-check
c5796d7 Skip the decode round-trip check for domains past encode's length limit
d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
Additional commits viewable in compare view

Updates msgpack from 1.2.1 to 1.2.3

Release notes

Sourced from msgpack's releases.

v1.2.3

What's Changed

Fix memory leaks in the C extension when map key validation or container hooks fail. See GHSA-j586-36cw-2gc2.

wheels: also build for pyodide using emscripten. by @mr-c in msgpack/msgpack-python#732

Support packing Python 3.15 frozentdict (PEP 814) by @edgarrmondragon in msgpack/msgpack-python#738

Reject negative array and map header sizes by @jakezwang in msgpack/msgpack-python#742

Bump the all-dependencies group across 1 directory with 2 updates by @dependabot[bot] in msgpack/msgpack-python#741

New Contributors

@mr-c made their first contribution in msgpack/msgpack-python#732

@jakezwang made their first contribution in msgpack/msgpack-python#742

Full Changelog: msgpack/msgpack-python@v1.2.2...v1.2.3

v1.2.2

What's Changed

fix docstring for read_size by @methane in msgpack/msgpack-python#700

unpacker: fix silent datetime truncation with datetime=3 by @methane in msgpack/msgpack-python#701

run test with debug build by @methane in msgpack/msgpack-python#702

fix: add reentrant guard to Unpacker.feed() by @methane in msgpack/msgpack-python#704

Bump actions/checkout from 6.0.3 to 7.0.0 in the all-dependencies group by @dependabot[bot] in msgpack/msgpack-python#705

Improve error handling and reporting in unpacking functions by @methane in msgpack/msgpack-python#707

test_unpack.py: add tests for ExtraData by @methane in msgpack/msgpack-python#708

Bump the all-dependencies group with 2 updates by @dependabot[bot] in msgpack/msgpack-python#709

Fix Timestamp.from_datetime() precision for far-future datetimes by @gaoflow in msgpack/msgpack-python#710

Fix typos in test and docs by @maxtaran2010 in msgpack/msgpack-python#712

Bump the all-dependencies group across 1 directory with 5 updates by @dependabot[bot] in msgpack/msgpack-python#719

fix: use-after-free in unpackb() ExtraData path for non-contiguous input by @ThomasWaldmann in msgpack/msgpack-python#722

Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 in the all-dependencies group by @dependabot[bot] in msgpack/msgpack-python#721

Bump pypa/cibuildwheel from 4.1.1 to 4.2.0 in the all-dependencies group by @dependabot[bot] in msgpack/msgpack-python#724

Convert Packer's buf_size once by @hdimer in msgpack/msgpack-python#726

fix: translate RecursionError to StackError in fallback Unpacker.skip() by @hdimer in msgpack/msgpack-python#727

Validate nanoseconds range when unpacking timestamps in the C extension by @chuenchen309 in msgpack/msgpack-python#716

Avoid parallel execution of the recursion-limit nesting test on free-threaded builds by @methane with @Copilot in msgpack/msgpack-python#729

Raise OverflowError when use_single_float cannot represent a value by @dylanpulver in msgpack/msgpack-python#728

release v1.2.2 by @methane in msgpack/msgpack-python#730

New Contributors

@gaoflow made their first contribution in msgpack/msgpack-python#710

@maxtaran2010 made their first contribution in msgpack/msgpack-python#712

@hdimer made their first contribution in msgpack/msgpack-python#726

@chuenchen309 made their first contribution in msgpack/msgpack-python#716

@dylanpulver made their first contribution in msgpack/msgpack-python#728

Full Changelog: msgpack/msgpack-python@v1.2.1...v1.2.2

Changelog

Sourced from msgpack's changelog.

1.2.3

Release Date: 2026-09-29

Fix memory leaks in the C extension when map key validation or container hooks fail. See GHSA-j586-36cw-2gc2.

Fix use-after-free errors when cleaning up an incomplete or failed Unpacker.skip() after previously unpacking a nested object in the C extension.

Raise ValueError in the C extension when switching between unpacking, skipping, header readers, or read_bytes() while an object is incomplete. Resume with the same method after feeding more data; unpack() and iteration remain interchangeable.

Prevent reentrant unpacking, header reads, read_bytes(), and reinitialization of the same C Unpacker while unpacking is in progress.

Reject negative sizes in Packer.pack_array_header() and Packer.pack_map_header(). #742

Support packing Python 3.15 frozendict objects. #738

Update Cython from 3.2.5 to 3.3.0. #738

Build wheels for Pyodide using Emscripten. #732

Update cibuildwheel to 4.2.1 and the QEMU setup action to 4.4.0. #741

1.2.2

Release Date: 2026-08-27

Fix the read_size documentation. #700

Fix silent truncation when unpacking an out-of-range timestamp with timestamp=3. #701

Prevent reentrant calls to Unpacker.feed() while unpacking. #704

Improve error handling and reporting in unpacking functions. #707

Fix Timestamp.from_datetime() precision for far-future datetimes. #710

Fix typos in the documentation. #712

Validate the nanoseconds range when unpacking timestamps in the C extension. #716

Fix a use-after-free in the unpackb() ExtraData path for non-contiguous input. #722

Prevent a buffer overflow when converting Packer's buf_size. #726

Translate RecursionError to StackError in the fallback Unpacker.skip(). #727

Raise OverflowError when use_single_float=True cannot represent a value. #728

Commits

742cb6d release v1.2.3
620b0eb Merge commit from fork
475c1b7 Bump the all-dependencies group across 1 directory with 2 updates (#741)
0014ca9 Reject negative array and map header sizes (#742)
7a63920 Support packing Python 3.15 frozentdict (PEP 814) (#738)
9f4909c wheels: also build for pyodide using emscripten. (#732)
7381b31 release
ee1bd3c release v1.2.2 (#730)
57d28a2 Raise OverflowError when use_single_float cannot represent a value (#728)
d374a17 Avoid parallel execution of the recursion-limit nesting test on free-threaded...
Additional commits viewable in compare view

Updates pip-api from 0.0.34 to 0.0.35

Release notes

Sourced from pip-api's releases.

0.0.35

What's Changed

Test against pip 24.2, 24.3, 24.3.1 (#227, #234, #234)

Test against pip 25.0, 25.0.1, 25.1, 25.2, 25.3 (#237, #242, #244, #250, #255)

Test against pip 26.0, 26.0.1, 26.1, 26.1.1, 26.1.2, 26.2, 26.2.1 (#261, #265, #270, #282, #284, #289, #293)

Drop support for Python 3.8 (#245)

Drop support for Python 3.9 (#270)

Support Python 3.14 (#272)

Support Python 3.15 (#296)

Full Changelog: di/pip-api@0.0.34...0.0.35

Changelog

Sourced from pip-api's changelog.

0.0.35

Test against pip 24.2, 24.3, 24.3.1 (#227, #234, #234)

Test against pip 25.0, 25.0.1, 25.1, 25.2, 25.3 (#237, #242, #244, #250, #255)

Test against pip 26.0, 26.0.1, 26.1, 26.1.1, 26.1.2, 26.2, 26.2.1 (#261, #265, #270, #282, #284, #289, #293)

Drop support for Python 3.8 (#245)

Drop support for Python 3.9 (#270)

Support Python 3.14 (#272)

Support Python 3.15 (#296)

Commits

539f428 Update CHANGELOG (#299)
8582df7 Prepare 0.0.35 release metadata (#298)
51d317b Add Python 3.15 prerelease support (#296)

Bumps the ci-constraints group with 23 updates in the /ci directory: | Package | From | To | | --- | --- | --- | | [tomli](https://github.com/hukkin/tomli) | `2.4.1` | `2.5.0` | | [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.9` | `3.5.2` | | [cyclonedx-python-lib](https://github.com/CycloneDX/cyclonedx-python-lib) | `11.11.0` | `11.12.0` | | [filelock](https://github.com/tox-dev/py-filelock) | `3.32.2` | `4.1.0` | | [idna](https://github.com/kjd/idna) | `3.18` | `3.20` | | [msgpack](https://github.com/msgpack/msgpack-python) | `1.2.1` | `1.2.3` | | [pip-api](https://github.com/di/pip-api) | `0.0.34` | `0.0.35` | | [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.0` | `4.12.4` | | [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` | | [pyparsing](https://github.com/pyparsing/pyparsing) | `3.3.2` | `3.3.3` | | [urllib3](https://github.com/urllib3/urllib3) | `2.7.0` | `2.8.0` | | [flake8](https://github.com/pycqa/flake8) | `7.3.0` | `7.4.1` | | [flake8-bugbear](https://github.com/PyCQA/flake8-bugbear) | `25.11.29` | `26.9.30` | | [pycodestyle](https://github.com/PyCQA/pycodestyle) | `2.14.0` | `2.15.0` | | [pyflakes](https://github.com/PyCQA/pyflakes) | `3.4.0` | `4.0.3` | | [setuptools](https://github.com/pypa/setuptools) | `83.0.0` | `84.0.0` | | [imagesize](https://github.com/shibukawa/imagesize_py) | `2.0.0` | `2.0.1` | | [markupsafe](https://github.com/pallets/markupsafe) | `3.0.3` | `3.0.4` | | [soupsieve](https://github.com/facelessuser/soupsieve) | `2.9.2` | `2.10` | | [webencodings](https://github.com/CourtBouillon/webencodings) | `0.5.1` | `0.6.1` | | [coverage](https://github.com/coveragepy/coveragepy) | `7.15.4` | `7.16.2` | | [iniconfig](https://github.com/pytest-dev/iniconfig) | `2.3.0` | `2.3.1` | | [wheel](https://github.com/pypa/wheel) | `0.47.0` | `0.48.0` | Updates `tomli` from 2.4.1 to 2.5.0 - [Changelog](https://github.com/hukkin/tomli/blob/master/CHANGELOG.md) - [Commits](hukkin/tomli@2.4.1...2.5.0) Updates `charset-normalizer` from 3.4.9 to 3.5.2 - [Release notes](https://github.com/jawah/charset_normalizer/releases) - [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md) - [Commits](jawah/charset_normalizer@3.4.9...3.5.2) Updates `cyclonedx-python-lib` from 11.11.0 to 11.12.0 - [Release notes](https://github.com/CycloneDX/cyclonedx-python-lib/releases) - [Changelog](https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md) - [Commits](CycloneDX/cyclonedx-python-lib@v11.11.0...v11.12.0) Updates `filelock` from 3.32.2 to 4.1.0 - [Release notes](https://github.com/tox-dev/py-filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](tox-dev/filelock@3.32.2...4.1.0) Updates `idna` from 3.18 to 3.20 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.18...v3.20) Updates `msgpack` from 1.2.1 to 1.2.3 - [Release notes](https://github.com/msgpack/msgpack-python/releases) - [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md) - [Commits](msgpack/msgpack-python@v1.2.1...v1.2.3) Updates `pip-api` from 0.0.34 to 0.0.35 - [Release notes](https://github.com/di/pip-api/releases) - [Changelog](https://github.com/di/pip-api/blob/master/CHANGELOG) - [Commits](di/pip-api@0.0.34...0.0.35) Updates `platformdirs` from 4.11.0 to 4.12.4 - [Release notes](https://github.com/tox-dev/platformdirs/releases) - [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst) - [Commits](tox-dev/platformdirs@4.11.0...4.12.4) Updates `pygments` from 2.20.0 to 2.21.0 - [Release notes](https://github.com/pygments/pygments/releases) - [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES) - [Commits](pygments/pygments@2.20.0...2.21.0) Updates `pyparsing` from 3.3.2 to 3.3.3 - [Release notes](https://github.com/pyparsing/pyparsing/releases) - [Changelog](https://github.com/pyparsing/pyparsing/blob/master/CHANGES) - [Commits](pyparsing/pyparsing@3.3.2...3.3.3) Updates `urllib3` from 2.7.0 to 2.8.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.7.0...2.8.0) Updates `flake8` from 7.3.0 to 7.4.1 - [Commits](PyCQA/flake8@7.3.0...7.4.1) Updates `flake8-bugbear` from 25.11.29 to 26.9.30 - [Release notes](https://github.com/PyCQA/flake8-bugbear/releases) - [Commits](PyCQA/flake8-bugbear@25.11.29...26.9.30) Updates `pycodestyle` from 2.14.0 to 2.15.0 - [Release notes](https://github.com/PyCQA/pycodestyle/releases) - [Changelog](https://github.com/PyCQA/pycodestyle/blob/main/CHANGES.txt) - [Commits](PyCQA/pycodestyle@2.14.0...2.15.0) Updates `pyflakes` from 3.4.0 to 4.0.3 - [Changelog](https://github.com/PyCQA/pyflakes/blob/main/NEWS.rst) - [Commits](PyCQA/pyflakes@3.4.0...4.0.3) Updates `setuptools` from 83.0.0 to 84.0.0 - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](pypa/setuptools@v83.0.0...v84.0.0) Updates `imagesize` from 2.0.0 to 2.0.1 - [Release notes](https://github.com/shibukawa/imagesize_py/releases) - [Commits](shibukawa/imagesize_py@2.0.0...2.0.1) Updates `markupsafe` from 3.0.3 to 3.0.4 - [Release notes](https://github.com/pallets/markupsafe/releases) - [Changelog](https://github.com/pallets/markupsafe/blob/main/CHANGES.rst) - [Commits](pallets/markupsafe@3.0.3...3.0.4) Updates `soupsieve` from 2.9.2 to 2.10 - [Release notes](https://github.com/facelessuser/soupsieve/releases) - [Commits](facelessuser/soupsieve@2.9.2...2.10) Updates `webencodings` from 0.5.1 to 0.6.1 - [Release notes](https://github.com/CourtBouillon/webencodings/releases) - [Changelog](https://github.com/CourtBouillon/webencodings/blob/main/docs/changelog.rst) - [Commits](CourtBouillon/webencodings@v0.5.1...v0.6.1) Updates `coverage` from 7.15.4 to 7.16.2 - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.15.4...7.16.2) Updates `iniconfig` from 2.3.0 to 2.3.1 - [Release notes](https://github.com/pytest-dev/iniconfig/releases) - [Changelog](https://github.com/pytest-dev/iniconfig/blob/main/CHANGELOG) - [Commits](pytest-dev/iniconfig@v2.3.0...v2.3.1) Updates `wheel` from 0.47.0 to 0.48.0 - [Release notes](https://github.com/pypa/wheel/releases) - [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst) - [Commits](pypa/wheel@0.47.0...0.48.0) --- updated-dependencies: - dependency-name: tomli dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints - dependency-name: charset-normalizer dependency-version: 3.5.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints - dependency-name: cyclonedx-python-lib dependency-version: 11.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints - dependency-name: filelock dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: ci-constraints - dependency-name: idna dependency-version: '3.20' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints - dependency-name: msgpack dependency-version: 1.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci-constraints - dependency-name: pip-api dependency-version: 0.0.35 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci-constraints - dependency-name: platformdirs dependency-version: 4.12.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints - dependency-name: pygments dependency-version: 2.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints - dependency-name: pyparsing dependency-version: 3.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci-constraints - dependency-name: urllib3 dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints - dependency-name: flake8 dependency-version: 7.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints - dependency-name: flake8-bugbear dependency-version: 26.9.30 dependency-type: direct:production update-type: version-update:semver-major dependency-group: ci-constraints - dependency-name: pycodestyle dependency-version: 2.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints - dependency-name: pyflakes dependency-version: 4.0.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: ci-constraints - dependency-name: setuptools dependency-version: 84.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: ci-constraints - dependency-name: imagesize dependency-version: 2.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci-constraints - dependency-name: markupsafe dependency-version: 3.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci-constraints - dependency-name: soupsieve dependency-version: '2.10' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints - dependency-name: webencodings dependency-version: 0.6.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints - dependency-name: coverage dependency-version: 7.16.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints - dependency-name: iniconfig dependency-version: 2.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci-constraints - dependency-name: wheel dependency-version: 0.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci-constraints ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-19T13:46:54Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added ci dependencies labels Oct 13, 2026

dependabot Bot closed this Oct 19, 2026

dependabot Bot deleted the dependabot/pip/ci/ci-constraints-74823c00af branch October 19, 2026 13:47

Navigation Menu

Repository navigation

Bump the ci-constraints group across 1 directory with 23 updates - #69

Bump the ci-constraints group across 1 directory with 23 updates#69
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/ci/ci-constraints-74823c00af

dependabot Bot commented on behalf of github Oct 13, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2.5.0

2.3.1

Version 3.5.2

3.5.2 (2026-09-29)

Changed

Fixed

Version 3.5.1

3.5.1 (2026-08-15)

Changed

Fixed

Version 3.5.0

3.5.0 (2026-08-12)

Added

Fixed

Changed

3.5.2 (2026-09-29)

Changed

Fixed

3.5.1 (2026-08-15)

Changed

Fixed

3.5.0 (2026-08-12)

Added

Fixed

Changed

Misc

v11.12.0 (2026-08-13)

Features

What's Changed

New Contributors

v11.11.2 (2026-08-12)

Bug Fixes

What's Changed

New Contributors

v11.11.1 (2026-08-10)

Bug Fixes

What's Changed

v11.12.0 (2026-08-13)

Features

v11.11.2 (2026-08-12)

Bug Fixes

v11.11.1 (2026-08-10)

Bug Fixes

4.1.0

What's Changed

New Contributors

v3.20

v3.19

3.20 (2026-09-17)

3.19 (2026-08-18)

v1.2.3

What's Changed

New Contributors

v1.2.2

What's Changed

New Contributors

1.2.3

1.2.2

0.0.35

What's Changed

0.0.35

Uh oh!

dependabot Bot commented on behalf of github Oct 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 13, 2026 •

edited

Loading